add

What add does on Npm

AI agents invoke add to trigger actions in Npm. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call: builds kicked off, notifications sent, workflows started.

Why add is rated High

In npm/pnpm, 'add' executes a package installation operation, which runs external commands, modifies node_modules, and updates package.json/lock files. This spans Write and Execute; Execute is more severe as it triggers external operations (downloading and running install scripts from the registry). The description is nearly empty ('Runs' with no further text), which lowers confidence slightly.

From the tool's definition Tool name 'add' on a server described as handling 'npm/pnpm operations (install, audit, outdated, list)' — 'add' in npm/pnpm context runs package installation commands

The rule that runs add safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Npm, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For add, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "add": {
      "limits": [
        {
          "counter": "add_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about add