pm-ls

What pm-ls does on Npm

AI agents call pm-ls to retrieve information from Npm without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why pm-ls is rated Low

This tool appears to be a package manager list command (equivalent to 'npm ls' or 'pnpm ls'), which retrieves and displays dependency trees or package information without modifying, executing, or deleting anything. The incomplete description lowers confidence slightly, but the naming convention and server context strongly suggest a read-only operation.

From the tool's definition Tool name 'pm-ls' and context of npm/pnpm operations suggest it lists package information. Description is incomplete ('Runs') but the tool name and server description ('list' operations as typed JSON) indicate a read-only query operation.

The rule that runs pm-ls safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Npm, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For pm-ls, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "pm-ls": {}
  }
}

Questions about pm-ls