r/npm

I've been experimenting with Iroh. As a dev one thing that I always find annoying is having to spend time working out how to either host a service on a cloud instance, use a third party like Ngrok or Cloudflare for reverse tunnelling etc. I'd like the process of showing anyone whatever is on my PC easier.

So I made this utility. I used npx because while I don't personally use it, it is by far the easiest way to get it in front of lots of devs so I can get feedback and improve it.

Build and run from source:

cargo run -- share 3000

Run with npx (no global install):

npx p2p-tunnel share 3000

On another machine (or another terminal), connect using the ticket printed by share:

cargo run -- connect <TICKET>

Or with npx:

npx p2p-tunnel connect <TICKET>

https://github.com/drmikesamy/p2p-tunnel

https://www.npmjs.com/package/p2p-tunnel

Hey everyone!

I've been building a frontend library focused on UI behaviors called Nagare (流れ), and I'd really appreciate some honest feedback from other developers.

The idea is simple: instead of splitting a single interaction across CSS, Tailwind classes, event handlers, animation libraries, and state management, everything for that interaction lives in one place.

Example:

soul("button") .hover({ onStart: { tw: "scale-105 shadow-xl", css: `border-radius: 20px`, js: function () { console.log("hovered") } }, onEnd: { tw: "scale-100 shadow-none", css: `border-radius: 12px` } })

Each behavior (hover, click, tap, longpress, swipe, drag, scroll, onVisible, onIdle, networkChanged, etc.) can contain:

• "tw" for Tailwind classes
• "css" with inline "@if/@else"
• "js" for custom logic
• shared state, templates, presets, delays, and more

I'm not trying to replace React or Tailwind—Nagare is focused on giving interactions a single home.

I'd really love feedback on:

• Does the API feel intuitive?
• Is this something you'd actually use?
• What feels unnecessary or confusing?
• What would you change before a stable release?

Repository: https://github.com/Mizumi25/nagare

Showcase: https://nagare-nu.vercel.app/

npm: https://www.npmjs.com/package/@nagarejs/react

I'm mainly looking for honest criticism, not compliments. Thanks!

I’ve been working with MCP servers lately, and one thing I wanted was a clean way to put policies around tool handlers before exposing them to agents.

So I built ToolGate, a TypeScript npm package for MCP server authors.

It lets you wrap existing tools with policies like:

• risk level: read / write / external / destructive
• approval required
• allowed / denied file paths
• allowed / denied network domains
• allowed / denied command strings
• timeout
• rate limit
• secret redaction
• JSONL audit logs
• structured policy failure results

Example:

server.tool(
  "delete_file",
  schema,
  gate({
    risk: "destructive",
    requireApproval: true,
    allowedPaths: ["src/**", "docs/**"],
    deniedPaths: [".env", "secrets/**"],
    audit: true,
    redact: true,
    timeoutMs: 10_000
  }, async (input) => {
    // actual tool logic
  })
);

The goal is not to replace the MCP SDK. ToolGate is a policy layer for MCP tool handlers.

I’d like feedback from people building MCP servers:

• Would this fit your current tool structure?
• Would you prefer middleware, proxy/gateway, or both?
• What policy types would you expect?

Repo: https://github.com/Wezylnia/toolgate
npm: toolgate-mcp

Free access to dependencies, licenses, advisories and other critical health and security signals for open source package versions.

GitHub repo: https://github.com/edoardottt/depsdev

https://deps.dev/ (a Google project) repeatedly examines sites such as github.com, npmjs.com, pkg.go.dev and other package managers to find up-to-date information about open source software packages. Using that information it builds for each package the full dependency graph from scratch connecting it to the packages it depends on and to those that depend on it. And then does it all again to keep the information fresh. This transitive dependency graph allows problems in any package to be made visible to the owners and users of any software they affect.

If you're playing with/building OSS/dependency security let me know your thoughts! If you encounter an error or want so suggest an improvement just open an issue :) I'll be happy to discuss about that!