nowyourlink-agent-kitCAUTION
Official public SDKs (JS, Python, Go), CLI and agent skills for nowyourlink Spotlights
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://skills.sh/arneffm/nowyourlink-agent-kit)
Read the current nowyourlink advertising Spotlight and browse published, settled days. This standalone kit contains an official product skill, portable agent plugin, Codex compatibility manifest, and dependency-free JavaScript SDK and CLI, plus a Python standard-library SDK. Public Spotlight reads need no account or API key. Advertiser actions (bids, creatives, invoices) are delegated: they need an OAuth 2.1 grant that a human advertiser approves, with the spend mandate set on the consent page.
Distribution status: SDKs and CLI published. The public source repository is ArneFfm/nowyourlink-agent-kit. Python SDK and CLI 0.2.0 are published on PyPI. JavaScript SDK and CLI 0.3.0 are published on npm. Install with npm install nowyourlink-agent-kit, or run npx nowyourlink-agent-kit list --limit 5.
MCP registry
The public remote server is published as io.github.ArneFfm/nowyourlink version 1.1.0 in the official MCP Registry. Connect to https://nowyourlink.com/mcp using Streamable HTTP without credentials. server.json retains the published metadata; the registry version describes the remote server, independently of SDK package versions.
Documentation
- nowyourlink API documentation — endpoints, limits, examples
- nowyourlink OpenAPI specification
- nowyourlink agent guide — MCP tools, usage rules
- nowyourlink authentication — anonymous public reads, delegated OAuth 2.1 for advertisers
- [nowyour
b10422435e56OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add nowyourlink-agent-kit -- npx -y [email protected]
{
"mcpServers": {
"nowyourlink-agent-kit": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Trust audit
CAUTIONgrade B · trust 87/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (6)
const query = new URL(url, "http://127.0.0.1").searchParams;
const target = new URL(request.url, "http://127.0.0.1");
const redirectUri = `http://127.0.0.1:${server.address().port}/callback`;streamable-http
`login` runs the authorization-code flow with PKCE (S256) and an RFC 8252 loopback redirect: it starts a listener on `http://127.0.0.1:<random port>/callback`, opens your browser and prints the URL as
Gates applied: no_behavioural_pass.
b10422435e56full audit observations/trust-audit/mcp-server/arneffm__nowyourlink-agent-kit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | b10422435e56 | CAUTION | B | 87 | first audit |
Questions
What is the nowyourlink-agent-kit MCP server?
Official public SDKs (JS, Python, Go), CLI and agent skills for nowyourlink Spotlights
Is nowyourlink-agent-kit safe to connect to an agent?
With care. The audit graded it B (87/100) and found 6 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does nowyourlink-agent-kit need?
No credential environment variables were found in its source, so it appears to need none.
How does nowyourlink-agent-kit run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as nowyourlink-agent-kit at 0.3.2.
How current is this page?
The grade is for one exact copy of the source (b10422435e56), read on 2026-10-12. The repository is watched and re-audited when it changes.