publish

Instructions

Implementation Reference

• src/index.ts:62-77 (handler)

  The handler function for the 'publish' tool. It builds npm publish CLI args (tag, access, dryRun, otp), executes the npm publish command via the run() helper, and returns stdout/stderr or an error.

  async ({ path, tag, access, dryRun, otp }) => {
    const args = ["publish"];
    if (tag) args.push("--tag", tag);
    if (access) args.push("--access", access);
    if (dryRun) args.push("--dry-run");
    if (otp) args.push("--otp", otp);
    try {
      const { stdout, stderr } = await run(args, path);
      return { content: [{ type: "text", text: stdout + stderr }] };
    } catch (e: any) {
      return {
        content: [{ type: "text", text: `Error: ${e.stderr || e.message}` }],
        isError: true,
      };
    }
  },

• src/index.ts:46-78 (registration)

  Registration of the 'publish' tool on the MCP server via server.tool('publish', ...). Defines the tool name, description, and Zod schema for input parameters.

  server.tool(
    "publish",
    "Publish a package to the npm registry",
    {
      path: z.string().describe("Absolute path to the package directory"),
      tag: z.string().optional().describe("Dist-tag (default: latest)"),
      access: z
        .enum(["public", "restricted"])
        .optional()
        .describe("Access level for scoped packages"),
      dryRun: z
        .boolean()
        .optional()
        .describe("Run publish without actually publishing"),
      otp: z.string().optional().describe("One-time password for 2FA"),
    },
    async ({ path, tag, access, dryRun, otp }) => {
      const args = ["publish"];
      if (tag) args.push("--tag", tag);
      if (access) args.push("--access", access);
      if (dryRun) args.push("--dry-run");
      if (otp) args.push("--otp", otp);
      try {
        const { stdout, stderr } = await run(args, path);
        return { content: [{ type: "text", text: stdout + stderr }] };
      } catch (e: any) {
        return {
          content: [{ type: "text", text: `Error: ${e.stderr || e.message}` }],
          isError: true,
        };
      }
    },
  );

• src/index.ts:49-60 (schema)

  Input schema for the 'publish' tool: path (required string), tag (optional string), access (optional enum public/restricted), dryRun (optional boolean), otp (optional string).

  {
    path: z.string().describe("Absolute path to the package directory"),
    tag: z.string().optional().describe("Dist-tag (default: latest)"),
    access: z
      .enum(["public", "restricted"])
      .optional()
      .describe("Access level for scoped packages"),
    dryRun: z
      .boolean()
      .optional()
      .describe("Run publish without actually publishing"),
    otp: z.string().optional().describe("One-time password for 2FA"),

• src/index.ts:26-38 (helper)

  The run() helper function used by the publish handler. Executes npm with the given args using execFile, with a 120s timeout and 10MB buffer. Injects NPM_TOKEN via --userconfig if configured.

  async function run(
    args: string[],
    cwd?: string,
  ): Promise<{ stdout: string; stderr: string }> {
    const fullArgs = [...args, ...npmrcArgs];
    const opts: { cwd?: string; timeout: number; env: NodeJS.ProcessEnv; maxBuffer: number } = {
      timeout: 120_000,
      maxBuffer: 10 * 1024 * 1024, // 10MB buffer for large outputs
      env: { ...process.env, NO_COLOR: "1" },
    };
    if (cwd) opts.cwd = cwd;
    return exec(NPM, fullArgs, opts);
  }

• src/index.ts:1202-1208 (registration)

  Registration of the 'publish' tool in the sandbox server (createSandboxServer export). Uses a noop handler that always returns 'sandbox'.

  sandbox.tool("publish", "Publish a package to the npm registry", {
    path: z.string().describe("Absolute path to the package directory"),
    tag: z.string().optional().describe("Dist-tag (default: latest)"),
    access: z.enum(["public", "restricted"]).optional().describe("Access level for scoped packages"),
    dryRun: z.boolean().optional().describe("Run publish without actually publishing"),
    otp: z.string().optional().describe("One-time password for 2FA"),
  }, noop);