Quickstart

Get OPM up and running in minutes.

Quickstart

1. Install

npm

npm i -g opmsec

2. Configure (optional)

Read-only commands (install, audit, info, view, check) work with zero configuration.

For publishing (opm push) or agent registration, create a .env:

OPM_SIGNING_KEY=0x...           # Ethereum key for package signing
AGENT_PRIVATE_KEY=0x...         # Agent wallet for on-chain score submission
OPENROUTER_API_KEY=sk-or-...    # Multi-model AI scanning (Claude, Gemini, DeepSeek)
FILEVERSE_API_KEY=...           # Audit report uploads to IPFS

See Configuration for the full list.

3. Use It

Install with security verification

opm install lodash

Checks CVEs, verifies on-chain risk scores, validates signatures — then installs.

Scan your dependencies

opm check

Finds typosquats, CVEs, and AI-detected threats across all your deps.

Auto-fix vulnerabilities

opm fix

Patches typosquats and upgrades vulnerable versions in package.json.

Publish securely

opm push

Signs your package, scans with 3 AI agents, registers on-chain, writes ENS records, publishes to npm.

View package security

opm info lodash

Shows on-chain risk score, agent assessments, checksums, audit report link.

Look up an author

opm view djpai.eth

ENS profile, published packages, reputation score.

Register your own agent

opm register-agent --name sentinel --model anthropic/claude-sonnet-4-20250514

Runs 10 benchmark cases, generates ZK proof, registers on-chain if 100% accurate.

All standard npm commands (init, run, test, build, start) pass through transparently.