--- title: "npm Registry Integration" description: "Read the public npm registry to fetch package metadata and versions, resolve dist-tags, search packages, and pull download statistics. Public reads need no token; an optional token reads private packages." url: https://flowrunner.ai/integrations/npm date_modified: 2026-08-07T17:20:23-07:00 --- # npm Registry [Utilities & Personal](https://flowrunner.ai/integrations/category/utilities-personal) Read the public npm registry to fetch package metadata and versions, resolve dist-tags, search packages, and pull download statistics. Public reads need no token; an optional token reads private packages. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 7 actions · API key · available [npm Registry website](https://npmjs.com/) · [Platform Documentation](https://docs.npmjs.com/) · Capability data verified 2026-08-12 1. A scheduled check runs against a watched dependency 2. Agent calls Get Package Dist-Tags to read the current latest version 3. Agent compares latest against the version the project pins 4. Agent checks whether the change is a patch, minor, or major bump 5. Agent drafts a bump summary with the version delta and release notes link 6. A person decides whether to open the dependency update or hold it ## What This Integration Enables The npm Registry connector lets agents read the public registry without touching a shell. Agents fetch the full metadata document for a package, read a single version manifest, and resolve dist-tags such as latest and next. They search the registry with quality, popularity, and maintenance scoring and qualifiers like author, scope, and keywords. They pull total download counts and per-day download ranges for a package or for the registry as a whole, and read the registry information document as a health check. Public reads need no token; an optional token reads private packages. Every action reads; nothing writes, so the connector is a monitoring surface, not a publishing one. ### Without FlowRunner **Version drift goes unnoticed**: Nobody watches upstream, so updates land only when something breaks **Checks run by hand**: An engineer runs npm commands to see what moved on each dependency **Download trends untracked**: Adoption numbers for a maintained package get pulled ad hoc, if at all ### With FlowRunner **Version changes surfaced**: The agent reads dist-tags on a schedule and flags every new latest **Checks run in the flow**: Metadata, versions, and dist-tags are read automatically for watched packages **Download trends charted**: Daily download ranges feed a trend view without manual pulls ## Use Case Scenarios ### Dependency Version Watch On a schedule, the agent calls Get Package Dist-Tags for each watched dependency and compares the current latest against the version the project pins. When a new latest appears, it reads the version manifest with Get Package Version, assembles the delta and a link to the release, and posts a bump summary to the engineering channel. Routine reads flow through; the decision to update waits for a person. ### Download Trend Tracking For a package the team maintains, the agent calls Get Download Range on a schedule to pull per-day download counts, then appends them to a trend view. Over time the view shows adoption without anyone exporting numbers from the registry by hand. ### Registry Discovery To evaluate a new library, the agent runs Search Packages against a keyword or scope, reads the quality, popularity, and maintenance scores on the top results, and posts a shortlist to the channel for review. The search narrows the field; the choice of what to adopt stays with the team. ## Human-in-Loop Highlight Reading the registry is safe and read-only. Acting on what it reports is where judgment enters, because a dependency bump can ripple through a build and a security signal can demand an urgent response. This is [human-in-the-loop](https://flowrunner.ai/concepts/human-in-the-loop) at the boundary between detecting a change and responding to it: the agent watches dist-tags and download data and pauses when something crosses a threshold worth a decision, then routes the signal to a person through their preferred channel. The message is specific: "lodash moved its latest tag from 4.17.20 to 4.17.21, a patch release with a security note. Open a bump ticket, or hold?" The connector never writes to the registry and never updates a project on its own. It reads, it flags, and a person owns the response to a dependency or security signal. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via preferred channel Human decides Agent resumes with decision ## Agent Capabilities 7 actions ### Packages 3 - **Get Package** Retrieve the full metadata document for a package, including every published version, dist-tags, maintainers, license, and repository links. Scoped names are URL-encoded automatically. - **Get Package Version** Retrieve the metadata for a single package version, given an exact version or a dist-tag such as latest or next. Returns the manifest including dependencies and dist information. - **Get Package Dist-Tags** Retrieve the distribution tags for a package as a map of tag name to version. Dist-tags are friendly aliases that point to specific versions. ### Search 1 - **Search Packages** Run a full-text search of the registry and return matching packages with quality, popularity, and maintenance scores. Supports pagination and qualifiers such as author, scope, and keywords. ### Downloads 2 - **Get Download Count** Return the total downloads for a package over a period, given a friendly preset or a custom date range. Omit the package name for registry-wide totals. - **Get Download Range** Return a per-day breakdown of downloads for a package over a period, useful for charting download trends. Omit the package name for registry-wide daily totals. ### Registry 1 - **Get Registry Info** Retrieve the top-level information document from the registry root, useful as a connection and health check. ## Frequently Asked Questions ### What can FlowRunner do with npm Registry? FlowRunner agents can run Get Package, Get Package Version, and Get Package Dist-Tags in npm Registry, plus 4 more actions. ### Does connecting npm Registry to FlowRunner require OAuth? No. npm Registry connects to FlowRunner with an API key, no OAuth flow required. ### Can npm Registry trigger a FlowRunner workflow automatically? npm Registry doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at npm Registry?** This integration exposes npm Registry to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/npm. Site index: https://flowrunner.ai/llms.txt