npm_whoami

What npm_whoami does on UnClick

AI agents call npm_whoami to retrieve information from UnClick without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Parameters from the server's own tool schema.

Why npm_whoami is rated Low

This tool performs an identity verification check (whoami pattern) that queries the npm registry to return account information associated with a token. It has no side effects—it neither modifies data, executes code, deletes resources, nor moves funds. The blast radius is minimal: an attacker could only learn which npm account is configured locally, which is low-sensitivity metadata.

From the tool's definition Tool name 'npm_whoami' and description 'Verify the saved npm access token and return the account it belongs to' indicate a read-only query operation that retrieves identity information without modifying or executing anything.

Risk signalsHandles credentials or secrets (token)

The rule that runs npm_whoami safely

PolicyLayer is an MCP gateway: it sits between your AI agents and UnClick, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For npm_whoami, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "npm_whoami": {}
  }
}

Questions about npm_whoami