Report what this server can and cannot do: whether a token is configured and where it came from, which npm account it belongs to, whether two-factor authentication is on, whether writes are enabled, and whether a one-time password is currently cached. Call this first when a tool you expected is missing — an absent tool means missing configuration rather than a bug. trusted_publishing_available is true, false, or "unknown" when a probe npm refused left the answer undetermined — read blockers and undetermined for which. It is an ACCOUNT-level answer: npm also refuses the trust endpoints per package, which this cannot see, so a true here is not a promise that any particular package will work.

Re-read the npm token from ~/.npmrc, NPM_TOKEN and the config file, and report whether it changed. Use this after npm login in a terminal: this server captures the token when it starts, so a login that visibly worked leaves it sending the OLD credential and failing 401 on everything while npm whoami in your shell succeeds. Cheap and safe — it reads three files, sends nothing to npm, and never reports the token itself. It re-reads ONLY the token: the registry, the write gate and the OTP settings stay as they were at startup, so a reload can never quietly widen what this server may do. One limit worth knowing: if the server started with NO token at all, the credentialled tools were never registered, and a reload cannot add them — that case still needs a restart.

Check a set of package versions against npm's security advisories — the same data npm audit uses, queried directly. Takes a flat map of package name to the versions you have installed, and returns only the packages with advisories against them. Needs no npm token, so it works on an otherwise unconfigured server. The references field is stripped from each advisory: it is about 1.5 KB of markdown links apiece, and url already points at the write-up.