npm-mcp

The server uses environment variables for configuration, including `NPM_PASSWORD`. The automated installer writes these to a `.env` file with `chmod 600`, which is a good practice for restricting file access to the owner. The `NPMApiClient` handles authentication by acquiring and managing a bearer token in memory, with proper expiry logic. The server itself acts as a proxy to the Nginx Proxy Manager API; thus, the overall security largely depends on the robustness of the underlying NPM API and the security of the NPM instance. No 'eval' or arbitrary command execution patterns were found in the core server logic (`src/index.ts`, `src/api-client.ts`). The `install.sh` script utilizes `sudo` for `jq` installation, which is a common practice for shell installers.