Helping humans and AI agents discover, verify, and use software safely.

Nipmod is the software search and trust layer for packages, code, models and developer tools. It helps humans and AI agents search public software sources, inspect trust signals, and generate reviewable install plans before anything writes to a workspace.

Nipmod does not replace package registries. It makes existing software ecosystems easier to search, compare and use safely.

API beta access requires a free beta key.

curl -s -X POST 'https://nipmod.com/api/keys/beta'
curl 'https://nipmod.com/api/search?q=http%20client&limit=3' -H 'x-nipmod-api-key: <key>'
curl 'https://nipmod.com/api/inspect?source=npm&name=undici' -H 'x-nipmod-api-key: <key>'
curl 'https://nipmod.com/api/install-plan?source=npm&name=undici' -H 'x-nipmod-api-key: <key>'

Tell an agent:

Use Nipmod before choosing a package.
Search sources, inspect the selected record and show the install plan.
Do not install or edit files until I approve.

Copyable HTTP client examples:

node --experimental-strip-types examples/http-api/agent-flow.ts "http client"
python3 examples/http-api/agent_flow.py "http client"

Humans and agents both need a safer way to choose outside software before code enters a real workflow. Agents can choose dependencies, write code, run commands and modify real workspaces, while humans still need clear evidence before approving that action.

Nipmod gives both humans and agents one preflight surface:

1. Search supported sources.
2. Inspect exact package records.
3. Generate an install plan.
4. Wait for user or host-policy approval.
5. Optionally confirm useful discovery into the package intelligence archive.

Search ranking is never install permission. A popular package can still be compromised, stale, risky or blocked by policy.

Nipmod does not bulk mirror these sources. Source owners keep ownership.

curl 'https://nipmod.com/api/search?q=http%20client&sources=npm,pypi,github,huggingface-model,mcp&limit=5' \
  -H 'x-nipmod-api-key: <key>'

Search returns candidates, source reports, partial failure state and agent-readable ranking data. Search records are ephemeral by default.

curl 'https://nipmod.com/api/inspect?source=npm&name=undici' \
  -H 'x-nipmod-api-key: <key>'

Inspect refreshes one exact source-owned record and returns source URL, license, metrics, warnings, trust factors and policy output.

curl 'https://nipmod.com/api/install-plan?source=npm&name=undici' \
  -H 'x-nipmod-api-key: <key>'

Install plans describe commands, risk, warnings and approval boundaries. The hosted API never executes commands and never writes to the caller workspace.

nipmod deep-scan . --json
nipmod sandbox-audit . --json
nipmod sandbox-runtime . --dry-run -- node --version
nipmod sandbox-runtime . --confirm-runtime -- node --version

Deep scan is a local static pass over files already present on disk, including supported local package artifacts such as .tgz, .tar.gz, .zip and .whl. It is for the second stage after hosted search, inspect, install-plan and the decision artifactScanPlan. It does not download packages, clone repositories, extract files to disk, install dependencies, execute code or write to the workspace.

sandbox-audit wraps the local scan with a SHA-256 content-tree cache, an execution gate and an audit receipt. Run it once per local artifact, bundle or source snapshot content hash; reuse the result only while the bytes and sandbox policy stay unchanged.

sandbox-runtime is the next layer when you need to observe behavior, not just signatures or static files. It runs cached sandbox-audit first, then executes an approved command in an isolated Vercel Sandbox microVM with deny-all network by default and returns a runtime receipt bound to the audit receipt, command hash and runtime policy. It is local or host-controlled only; the hosted Nipmod API still does not run arbitrary package code.

curl 'https://nipmod.com/api/archive/prepare?source=npm&name=undici' \
  -H 'x-nipmod-api-key: <key>'

Archive prepare is preview-only. Durable archive writes require explicit confirmation through an authorized writer path. Confirmed records are deduplicated by source, name, version and source evidence.

External trust scores use the public external-v2 policy.

Popularity can affect ranking, but it never upgrades security confidence. See trust scoring.

Nipmod uses explicit lifecycle language:

Current API wire statuses are documented in archive records. The public product language should use the lifecycle states above.

pnpm install
pnpm verify

Useful focused checks:

pnpm --dir site test -- package-intelligence.test.ts external-packages.test.ts
pnpm api:contract -- --base-url https://nipmod.com
pnpm source:canary -- --base-url https://nipmod.com
pnpm install-plan:canary -- --base-url https://nipmod.com
pnpm decision:canary -- --base-url https://nipmod.com
pnpm archive:canary -- --base-url https://nipmod.com --require-durable
pnpm launch:verify -- --skip-local --require-distributed-rate-limit

Local smoke runs without a GitHub token can pass --sources npm,jsr,pypi,cratesio,go,dockerhub,huggingface-model,huggingface-dataset,mcp to source:canary, install-plan:canary and decision:canary.

The CLI is optional for hosted API use. Install it only when a local workflow needs controlled workspace actions, audits, SBOM output or local MCP.

curl https://nipmod.com/i|bash

Manual checksum verification:

curl -fLO https://nipmod.com/install.sh
curl -fLO https://nipmod.com/install.sh.sha256
shasum -a 256 -c install.sh.sha256
bash install.sh

• Architecture
• Product positioning
• API: search, inspect, install plan
• Trust scoring
• Package intelligence lifecycle
• Package intelligence seed v1
• Threat model
• Data retention
• Package metadata is untrusted
• Public API spec
• Source resolver spec
• Source crawling spec
• Trust signals spec
• API beta launch kit
• API beta post
• Agent workflow examples

Release sidecars are published under site/public/releases/:

• .sha256 checksums
• .sig signatures
• .sbom.json SBOM metadata
• .provenance.json provenance metadata

See release process for the verification flow.

• Governance: GOVERNANCE.md
• Maintainer: Hazar Kemal Okur
• Maintainer policy: MAINTAINERS.md
• Roadmap: ROADMAP.md
• Contributing: CONTRIBUTING.md
• Security: SECURITY.md

License: MIT. Trademark and affiliation notice: TRADEMARKS.md.