# apm docs

> Documentation for apm, a registry in front of npm with a security score on every version, yank and revoke, and approved publishing.

## Docs

- [apm documentation](https://docs.apmjs.dev/): apm is a package registry in front of npm. It scores every version, can pull a bad version at any time, and waits for a person to approve each publish.
- [Quick start](https://docs.apmjs.dev/quickstart): Point bun, npm or pnpm at apm, then add a package with the apm CLI.

## Guides

- [Publish a package](https://docs.apmjs.dev/guides/publishing): Sign in with GitHub, run apm publish, and approve the upload with a passkey or authenticator code. Agents publish the same way and hand you the link.
- [Yank, revoke and incident response](https://docs.apmjs.dev/guides/pull-a-version): Hide a version from new installs, pull a malicious one for everyone, or revoke every token and recent version after an account compromise.
- [CI and trusted publishing](https://docs.apmjs.dev/guides/ci): What works in CI today (checked installs, audits, staged publishes) and what does not exist yet (OIDC trusted publishing and provenance).
- [The ~safe registry view](https://docs.apmjs.dev/guides/safe-view): A registry URL that hides versions under 24 hours old, versions scoring under 40, and pulled versions, for any client with no extra tools.
- [Bun scanner](https://docs.apmjs.dev/guides/bun-scanner): Make stock bun install and bun add ask apm about every package, and cancel the install on revoked or low-scoring versions. Strict mode for CI.
- [Names and scopes](https://docs.apmjs.dev/guides/names): Your scope is your GitHub login. The rules for new package names, and how to check a name before you publish.
- [Appeal a score or report a package](https://docs.apmjs.dev/guides/appeals-and-reports): Ask a person to dismiss a wrong piece of score evidence, report a malicious package, or report a vulnerability in apm itself.

## Concepts

- [How the score works](https://docs.apmjs.dev/concepts/score): What apm's 0 to 100 score reads, what costs points, how evidence is cited, and what the score cannot catch.
- [Capabilities](https://docs.apmjs.dev/concepts/capabilities): Declaring what your package needs (network, shell, file system) in package.json. This page is a placeholder until the feature ships.
- [AI release review](https://docs.apmjs.dev/concepts/ai-review): A language model reads each new release in scope and reports cited findings next to the score. What it reads, how a flag is handled, and its measured limits.
- [Security model](https://docs.apmjs.dev/concepts/security-model): What apm protects against, how accounts, tokens and second factors work, and how apm makes your package manager install exactly what it checked.

## Reference

- [CLI reference](https://docs.apmjs.dev/reference/cli): Every apm command, its flags, its output with --json, and its exit codes.
- [Registry HTTP API](https://docs.apmjs.dev/reference/http-api): The npm-compatible routes and the /-/apm/v1/* API of registry.apmjs.dev, with methods, parameters, auth and errors.
- [Configuration](https://docs.apmjs.dev/reference/configuration): Every setting that points a client at apm, configures the CLI and the Bun scanner, and runs a self-hosted registry.

## Agent skills

- [apm-docs](https://docs.apmjs.dev/.well-known/agent-skills/apm-docs/SKILL.md): Read the apm docs instead of answering from memory. Documentation for apm, a registry in front of npm with a security score on every version, yank and revoke, and approved publishing. Use when a task involves apm docs: how it works, how to set it up or configure it, or its API.

## Agent resources

- [llms-full.txt](https://docs.apmjs.dev/llms-full.txt): The full Markdown of every page in one file.
- [Page Markdown](https://docs.apmjs.dev/index.md): Append `.md` to any page URL to fetch that page as raw Markdown.
- [JSON API](https://docs.apmjs.dev/api/docs/pages.json): Page index of the JSON docs API; each entry links the page's JSON and Markdown forms. Described by the OpenAPI document at https://docs.apmjs.dev/openapi.json.
- [Agent skills](https://docs.apmjs.dev/.well-known/agent-skills/index.json): Agent Skills discovery index of the skills this site publishes.
- [API catalog](https://docs.apmjs.dev/.well-known/api-catalog): RFC 9727 linkset of the APIs documented here.
- [AI catalog](https://docs.apmjs.dev/.well-known/ai-catalog.json): ARD manifest of the agent-facing resources on this site (MCP server, skills, APIs).
- [agent-readability.json](https://docs.apmjs.dev/agent-readability.json): Manifest of every agent-facing artifact on this site.
- [Sitemap](https://docs.apmjs.dev/sitemap.xml): Every indexable page URL with its last-modified date.