npm

npm Provenance

npm Provenance provides supply chain security for JavaScript packages by establishing a verifiable link between a published package and its source code repository and build environment. When a package is published with provenance, it is signed using Sigstore public good servers and the attestation is logged in a public transparency ledger. This allows developers to verify where and how a package was built before downloading it, helping to protect against supply chain attacks and ensuring the integrity of the npm ecosystem.

GitHub

Documentation

📖
Documentation
https://docs.npmjs.com/generating-provenance-statements
📖
Documentation
https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/provenance"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

API entry from apis.yml

apis.yml Raw ↑ 
aid: npm:provenance
name: npm Provenance
description: npm Provenance provides supply chain security for JavaScript packages by establishing a verifiable
  link between a published package and its source code repository and build environment. When a package
  is published with provenance, it is signed using Sigstore public good servers and the attestation is
  logged in a public transparency ledger. This allows developers to verify where and how a package was
  built before downloading it, helping to protect against supply chain attacks and ensuring the integrity
  of the npm ecosystem.
humanURL: https://docs.npmjs.com/generating-provenance-statements
tags:
- Security
- Supply Chain
- Verification
- Sigstore
- Transparency
- CI/CD
properties:
- type: Documentation
  url: https://docs.npmjs.com/generating-provenance-statements
- type: Documentation
  url: https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/