tobiasstrebitzer/keybridge

keybridge is a macOS command line tool that lets you publish npm packages using only a Touch ID tap, even when the publish is triggered by an AI coding agent such as Claude Code rather than a human typing commands directly. Npm requires a web based identity verification step for accounts protected by two factor authentication, and that step normally needs a real browser window and a person clicking through it. When an automated agent tries to run npm publish without a person present, that verification fails and the publish simply errors out. keybridge solves this by intercepting npm's own machine readable handoff for that verification step and completing it inside an invisible, windowless browser view on your Mac. Instead of using a password or a browser prompt, it answers the verification using a security key stored in your Mac's Secure Enclave, a hardware chip built for storing sensitive keys safely, and that key only produces a signature after you physically touch Touch ID. Because of this, a human approval step remains required even though everything else is automated. There is no visible browser window at any point except a small login sheet the first time you sign in, or the Touch ID prompt itself, and it clearly states what package and account it is about to publish under. The tool ships as both a standalone command line utility and as a Claude Code plugin, which adds a setup command, blocks agents from running raw npm publish commands directly, and lets you simply ask Claude to publish a package. It also supports multiple npm accounts, each with its own separate browser profile and stored login token, and a five minute window where several packages can be published in a row after a single Touch ID tap. This tool works only on macOS, since it depends on Apple's Secure Enclave and native browser components. On other operating systems the verification step falls back to opening your regular browser. It is aimed at developers who publish npm packages, especially those using AI coding agents, and who want a safe way to keep a human in the loop without typing a password every time.