# LPM CLI developer resources

> LPM CLI is a package manager and developer toolkit. Use these files to discover its public documentation and the cli.lpm.dev search API.

## Machine-readable resources

- [LPM CLI OpenAPI specification](https://cli.lpm.dev/openapi.json): OpenAPI 3.1 description of the public documentation search API.
- [LPM CLI API catalog](https://cli.lpm.dev/.well-known/api-catalog): RFC 9727 catalog of public APIs and their descriptions.
- [LPM CLI developer resources](https://cli.lpm.dev/docs/developer-resources): Human-readable API, authentication, MCP, skill, and webhook links.
- [LPM CLI Agent Skills index](https://cli.lpm.dev/.well-known/agent-skills/index.json): Installable instructions for agents that use LPM CLI.
- [Complete LPM CLI documentation](https://cli.lpm.dev/llms-full.txt): All documentation pages in one markdown response.

## LPM CLI documentation

- [LPM CLI](/docs): A fast, all-in-one package manager and dev toolkit. Drop-in compatible with npm — works with any registry.
- [Installation](/docs/installation): Install LPM CLI via npm, Homebrew, curl, or cargo.
- [Your first install](/docs/first-install): A two-minute walkthrough — install a package, look around, run a script.
- [Registries](/docs/registries): LPM CLI works with npm, private registries, and LPM.dev Registry. Here is how it routes.
- [Project setup](/docs/project-setup): What goes in package.json, lpm.json, and lpm.toml — and which file owns each kind of setting.
- [Migrating to LPM CLI](/docs/migrating): Convert an existing npm, pnpm, yarn, or bun project to LPM CLI with one command.
- [Compared to npm, pnpm, bun](/docs/comparison): Side-by-side defaults across the four JavaScript package managers — security, resolution, developer orchestration, publishing, and platform.
- [LPM.dev Registry and Pro](/docs/lpm-dev-and-pro): What LPM.dev Registry adds to LPM CLI: private packages, Pool and Marketplace distribution, Free vs Pro limits, and hosted platform features.

- **Developers**
- [LPM CLI developer resources](/docs/developer-resources): Find LPM CLI OpenAPI, search API, auth, MCP, agent skill, webhook, and machine-readable documentation.

- **Commands**
- [Commands](/docs/commands): Every LPM CLI command on one page, grouped by category.

- **Separator**
- Packages
  - [Packages](/docs/packages): Install, publish, audit, and manage dependencies — plus the resolver, lockfile, store, and security model behind them.

  - **Install + dependency management**
  - [lpm install](/docs/packages/install): Install dependencies from package.json, or add new ones.
  - [lpm uninstall](/docs/packages/uninstall): Remove a dependency from package.json and node_modules.
  - [lpm add](/docs/packages/add): Copy source files from a package into your project (shadcn-style).
  - [lpm remove](/docs/packages/remove): Remove source files that lpm add previously copied into your project.
  - [lpm global](/docs/packages/global): Manage globally-installed CLI packages under ~/.lpm/global/.
  - [lpm cache](/docs/packages/cache): Manage ephemeral caches and prune the global package store.
  - [lpm upgrade](/docs/packages/upgrade): Bump dependencies to their latest matching version, with optional major upgrades.
  - [lpm outdated](/docs/packages/outdated): List dependencies with newer versions available.
  - [lpm patch / patch-commit / patch-remove](/docs/packages/patch): Create, finalize, and remove local dependency patches with integrity binding.

  - **Publish, search, discover**
  - [lpm init](/docs/packages/init): Create a new package manifest for LPM.dev Registry or npm-compatible publishing.
  - [lpm version](/docs/packages/version): Bump package.json version with npm-compatible increments, JSON plans, and optional git commit/tag.
  - [lpm release](/docs/packages/release): Plan, apply, and publish workspace releases in dependency order.
  - [lpm publish](/docs/packages/publish): Publish a package to LPM.dev Registry, npm, GitHub Packages, or a custom registry.
  - [lpm stage](/docs/packages/stage): Stage npm publishes, inspect staged versions, and approve or reject them.
  - [lpm search](/docs/packages/search): Search the registry for packages by name and description.
  - [lpm info](/docs/packages/info): Show metadata for a package — versions, dependencies, integrity, ecosystem.

  - **Security + tools**
  - [lpm audit](/docs/packages/audit): Scan installed packages for vulnerabilities, behavioral risks, and (optionally) hardcoded secrets.
  - [lpm tidy](/docs/packages/tidy): Find unused dependency declarations and undeclared imports.
  - [lpm query](/docs/packages/query): CSS-like selector queries against installed packages and behavioral tags.
  - [lpm graph](/docs/packages/graph): Visualize the dependency graph as tree, DOT, Mermaid, JSON, stats, or HTML.
  - [lpm sbom](/docs/packages/sbom): Export a CycloneDX or SPDX Software Bill of Materials from lpm.lock.
  - [lpm licenses](/docs/packages/licenses): Inventory installed dependency licenses and fail CI on compliance policy.
  - [lpm trust](/docs/packages/trust): Manage project lifecycle trust and release-age exclusions.
  - [lpm rebuild](/docs/packages/rebuild): Run or rerun lifecycle scripts for installed packages.
  - [lpm approve-scripts](/docs/packages/approve-scripts): Review and approve packages whose lifecycle scripts were blocked by the default-deny policy.

  - **Migration + inspection**
  - [lpm migrate](/docs/packages/migrate): Convert a project from npm, pnpm, yarn, or bun to LPM CLI.
  - [lpm catalog](/docs/packages/catalog): Inspect workspace catalog usage and resolved catalog provenance.
  - [lpm fetch](/docs/packages/fetch): Populate the package store from lpm.lock without installing.
  - [lpm download](/docs/packages/download): Download and extract a package tarball — no install side-effects.
  - [lpm resolve](/docs/packages/resolve): Print the resolved dependency tree for one or more package specs — without installing.

  - **Specialized integrations**
  - [lpm pool](/docs/packages/pool): Show your Pool revenue stats with per-package weighted downloads.
  - [lpm quality](/docs/packages/quality): Show the quality report for a package — score, tier, and per-check breakdown.
  - [lpm swift-registry](/docs/packages/swift-registry): Configure Swift Package Manager to use LPM.dev Registry as a SE-0292 package registry.
  - [lpm skills](/docs/packages/skills): Publish, install, inspect, and manage package and standalone agent skills.

  - **Features**
  - [Resolver](/docs/packages/resolver): How LPM CLI picks versions — greedy-fusion by default, with PubGrub as the documented fallback.
  - [Lockfile](/docs/packages/lockfile): How LPM CLI pins standalone and workspace graphs, importer projections, and warm-install state.
  - [Dependency graph](/docs/packages/dependency-graph): Understand package relationships, duplicate versions, graph filters, statistics, and exported graph data.
  - [Content-addressable store](/docs/packages/content-addressable-store): How LPM CLI deduplicates package content while keeping project-writable dependency files isolated from canonical store bytes.
  - [Save policy](/docs/packages/save-policy): How LPM CLI writes version ranges to package.json — caret default, explicit preservation, prerelease safety.
  - [Security & audit](/docs/packages/security-audit): Defense in depth — script policy, behavioral analysis, OSV, provenance, typosquatting, the triage gate.
  - [Workspaces](/docs/packages/workspaces): Monorepo support — workspace declaration, filter grammar, workspace:* protocol, catalogs, deploy.
  - [npm compatibility](/docs/packages/npm-compatibility): What works the same as npm, what's different, and what LPM CLI adds on top.
  - [Swift Package Registry (SE-0292)](/docs/packages/swift-package-registry): How LPM.dev Registry implements the SE-0292 Swift Package Registry spec — identity mapping, signing, certificates.
- Dev
  - [Dev](/docs/dev): Zero-config dev server, task runner, built-in dev tools, and managed runtimes.

  - **Run scripts + tasks**
  - [lpm dev](/docs/dev/dev): Zero-config dev server with HTTPS, tunnel, env loading, and multi-service orchestration.
  - [lpm run](/docs/dev/run): Run package.json scripts — parallel, cached, watchable, workspace-aware.
  - [lpm <file> and lpm exec](/docs/dev/exec): Run JS/TS source files directly, or run project-local binaries from node_modules/.bin.
  - [lpx / lpm dlx](/docs/dev/dlx): Run a package binary without installing it into the project.

  - **Test + bench**
  - [lpm test](/docs/dev/test): Auto-detect and run the project's test runner — vitest, jest, or mocha.
  - [lpm bench](/docs/dev/bench): Auto-detect and run the project's benchmark runner.

  - **Lint, format, type-check, bundle, pack**
  - [lpm lint](/docs/dev/lint): Lint the project with Oxlint — lazy-downloaded, no npx round-trip.
  - [lpm fmt](/docs/dev/fmt): Format the project with Biome — lazy-downloaded, with --check mode for CI.
  - [lpm bundle](/docs/dev/bundle): Bundle the project with Rolldown through an LPM CLI-managed plugin.
  - [lpm pack](/docs/dev/pack): Build library-oriented package output through project-local tsdown.
  - [lpm check](/docs/dev/check): Type-check the project with tsc by default, or tsgo when you opt in.
  - [lpm plugin](/docs/dev/plugin): Manage built-in tool plugins — list, check, update, and remove lazy-downloaded tools.
  - [lpm completions](/docs/dev/completions): Generate a shell completion script for bash, zsh, fish, PowerShell, or elvish.

  - **Runtime + environment**
  - [lpm use](/docs/dev/use): Install, pin, list, and remove managed Node.js and Bun runtimes.
  - [lpm env](/docs/dev/env): Manage project environment variables and secrets — local-file storage, cloud sync, platform integrations, and OIDC policies.

  - **Features**
  - [Task runner](/docs/dev/task-runner): Parallel, cached, watchable, workspace-aware execution for package.json scripts.
  - [Test & bench auto-detection](/docs/dev/test-bench-runners): How lpm test and lpm bench pick the right runner — vitest, jest, or mocha.
  - [Built-in tools](/docs/dev/builtin-tools): How LPM CLI ships Oxlint, Biome, and Rolldown, plus how `lpm check` and `lpm pack` pick their backends.
  - [Managed runtimes](/docs/dev/node-version-pinning): How LPM CLI detects, installs, and exposes managed Node.js and Bun runtimes.
- Infra
  - [Infra](/docs/infra): Account auth, CLI settings, security approvals, tunnels, local HTTPS, secrets, port management, health checks, and store maintenance.

  - **CLI**
  - [lpm tunnel](/docs/infra/tunnel): Expose a local HTTP service through a public HTTPS URL, with request capture and replay.
  - [lpm cert](/docs/infra/cert): Manage certificates for trusted local HTTPS with LPM CLI.
  - [lpm proxy](/docs/infra/proxy): Run and inspect the local proxy for friendly HTTPS development hostnames.
  - [lpm hosts](/docs/infra/hosts): Manage local hostnames with lpm.json and remove stale LPM CLI hosts-file entries.
  - [lpm ports](/docs/infra/ports): Inspect local TCP ports, stop listening processes, and clear saved dev-port overrides.

  - **Account + auth**
  - [lpm login, logout, and whoami](/docs/infra/login): Sign in to package registries, check your account, and clear or revoke credentials.
  - [lpm setup](/docs/infra/setup): Configure .npmrc authentication or print GitHub Actions and GitLab CI workflows.
  - [lpm token-rotate](/docs/infra/token-rotate): Rotate an LPM-compatible registry token and save the replacement in local secure storage.

  - **Settings + security**
  - [lpm config](/docs/infra/config): Manage user-level defaults for installs, security controls, package scripts, and LPM.dev Registry features.
  - [lpm security](/docs/infra/security): Inspect the security floor, approve temporary exceptions, protect local policy, and repair security state.
  - [lpm policy](/docs/infra/policy): Inspect, diagnose, and test local programs that allow, warn about, or block packages during install.

  - **CLI maintenance**
  - [lpm doctor / lpm health](/docs/infra/doctor): Find project, runtime, registry, and environment problems, and apply supported fixes.
  - [lpm store](/docs/infra/store): Find, verify, or reset the shared package store.
  - [lpm self-update](/docs/infra/self-update): Update LPM CLI on the stable or nightly release channel.

  - **Features**
  - [Authentication](/docs/infra/authentication): How LPM CLI selects, stores, refreshes, and clears credentials for each package registry.
  - [Tunneling](/docs/infra/tunneling): How public tunnel URLs, stable domains, request limits, access protection, and local capture work.
  - [Local HTTPS](/docs/infra/local-https): Use trusted HTTPS for local development without adding TLS to your application.
  - [Secrets vault](/docs/infra/secrets-vault): Store environment secrets locally, sync encrypted copies, and share them with your organization.
  - [Port management](/docs/infra/port-management): Understand how LPM CLI assigns ports, handles conflicts, and connects development services.
  - [Project health](/docs/infra/project-health): Understand what LPM CLI examines, how health results affect automation, and which automatic fixes change a project.
- Guides
  - [Guides](/docs/guides): Task-oriented walkthroughs for common LPM CLI workflows.
  - [Publishing your first package](/docs/guides/publishing-a-package): From lpm init to lpm publish, with quality checks and provenance.
  - [Zero-config dev server](/docs/guides/zero-config-dev-server): Configure lpm.json once, then run lpm dev — HTTPS, tunnel, and multi-service orchestration.
  - [Firewall for npm](/docs/guides/firewall): Configure firewall.lpm.dev verdict checks, monitor mode, enforcement, and policy-group controls.
  - [Using LPM CLI with Swift](/docs/guides/using-with-swift): SPM integration via SE-0292 — login, install, publish.
  - [Monorepo setup](/docs/guides/monorepo-setup): Workspaces, --filter grammar, --affected, lpm deploy.
  - [Managing secrets across environments](/docs/guides/managing-secrets): Store, share, and validate per-environment secrets with lpm env.
  - [CI/CD setup](/docs/guides/ci-cd-setup): Configure LPM CLI for GitHub Actions, GitLab CI, and other CI systems.
  - [Docker Deploys](/docs/guides/docker-deploys): Build Docker images with lpm fetch, offline installs, and lpm deploy.
  - [Migrating from npm](/docs/guides/migrating-from-npm): Convert a package-lock.json project to LPM CLI with rollback safety.
  - [Migrating from pnpm](/docs/guides/migrating-from-pnpm): Convert a pnpm-lock.yaml project to LPM CLI, isolated layout preserved.
  - [Migrating from Yarn](/docs/guides/migrating-from-yarn): Convert a Yarn Classic or Berry yarn.lock project to LPM CLI with rollback safety.
  - [Migrating from Bun](/docs/guides/migrating-from-bun): Convert a Bun bun.lock or bun.lockb project to LPM CLI with rollback safety.
- Reference
  - [Reference](/docs/reference): Configuration files, environment variables, editor integrations, file formats, terminal output, exit codes, and glossary entries.

  - **Configuration**
  - [package.json — "lpm" key](/docs/reference/package-json-lpm): Reference for the LPM CLI-specific configuration block inside package.json.
  - [lpm.json](/docs/reference/lpm-json): Canonical schema reference for the lpm.json project file.
  - [lpm.config.json](/docs/reference/lpm-config-json): Schema reference for the lpm.config.json file shipped at a tarball root to control `lpm add`.
  - [JSON Schemas](/docs/reference/schemas): Published and locally emitted JSON Schemas for lpm.json and lpm.config.json.
  - [lpm.toml](/docs/reference/lpm-toml): Project-level CLI defaults and sandbox posture committed to the repo.
  - [~/.lpm/config.toml](/docs/reference/config-toml): User-level CLI defaults — applies to every project on this machine.
  - [Environment variables](/docs/reference/env-vars): Environment variables LPM CLI reads for auth, routing, publishing, diagnostics, and CI.

  - **Editor integrations**
  - [MCP servers](/docs/reference/mcp-servers): Wire Claude Code, Cursor, Windsurf, VS Code, and Claude Desktop to the LPM.dev Registry MCP server.
  - [AI agent skills](/docs/reference/ai-agent-skills): Understand LPM.dev package skills and standalone GitHub or local agent skills.

  - **File formats**
  - [lpm.lock format](/docs/reference/lockfile-format): TOML lockfile schema — what every field means and why it's there.
  - [lpm.lockb format](/docs/reference/lockb-format): Generated binary lockfile companion to lpm.lock.

  - **Other**
  - [Terminal output security](/docs/reference/terminal-output): How the LPM CLI separates trusted UI, external text, structured JSON, and raw child-process output.
  - [Exit codes](/docs/reference/exit-codes): What each LPM CLI exit code means and how to handle them in CI.
  - [Glossary](/docs/reference/glossary): LPM CLI, LPM.dev Registry, and LPM Firewall terminology in one place.