Seu agent tá limitado? Private npm packages unlock proprietary tools.

Seu agent tá limitado? Private npm packages unlock proprietary tools.

Você é founder de SaaS.

Seu SaaS tem agent de IA (WhatsApp, atendimento ao cliente, automação de vendas).

Current agent limitation:

Your agent's tool access (today): │ ├─ What your agent CAN access: │ ├─ Public npm packages: ✅ (axios, lodash, moment, etc) │ ├─ Open-source libraries: ✅ (anyone can download) │ ├─ Public APIs: ✅ (weather, news, exchange rates) │ ├─ Code from GitHub public repos: ✅ (available to all) │ └─ Generic tools: ✅ (JSON parsing, date manipulation) │ ├─ What your agent CANNOT access: │ ├─ Private npm packages: ❌ (company-proprietary code) │ ├─ Custom libraries: ❌ (your internal code) │ ├─ Proprietary integrations: ❌ (your company APIs) │ ├─ Internal authentication: ❌ (API keys for internal systems) │ ├─ Company-specific tools: ❌ (your custom business logic) │ └─ Proprietary algorithms: ❌ (your competitive advantage) │ ├─ Why this matters: │ ├─ Your agent: Limited to generic tasks │ ├─ Example: Agent can parse JSON, can't call your internal API │ ├─ Example: Agent can search web, can't query your proprietary database │ ├─ Example: Agent can format dates, can't run your custom billing logic │ ├─ Result: Agent is useful but NOT differentiated │ └─ Problem: Any competitor can build similar agent │ ├─ Competitive impact: │ ├─ Your agent: Generic (uses public tools only) │ ├─ Competitor's agent: Proprietary (uses their custom code) │ ├─ Your limitation: Stuck at baseline (public tools) │ ├─ Competitor advantage: Uses their secret sauce (custom code) │ ├─ Your moat: None (agent is easily replicated) │ └─ Competitor moat: Strong (agent uses their unique code) │ └─ Bottom line: ├─ Agent without private code access: Generic (replicable) ├─ Agent with private code access: Proprietary (defensible) ├─ Your current state: Generic ├─ Your needed state: Proprietary ├─ Blocker: Can't give agent access to private packages └─ Solution: Vercel Agent now supports private npm packages

Then Vercel added private npm support.

The Problem: Agents Are Limited to Public Tools

Agents can only access public npm packages and open APIs. Your proprietary code? Off-limits. Agent stays generic, loses competitive advantage.

Why agent isolation from proprietary code kills differentiation

AGENT TOOL ACCESS PROBLEM (Why it matters):

Generic agent (public tools only): ├─ Tools available: │ ├─ JSON parsing (lodash, JSON5) │ ├─ HTTP requests (axios, node-fetch) │ ├─ Data formatting (moment, date-fns) │ ├─ Math operations (decimal.js, big-number) │ ├─ Text processing (string-similarity, natural) │ └─ Generic business logic (chance, faker) │ ├─ What it can do: │ ├─ Parse customer message (generic) │ ├─ Format response (generic) │ ├─ Search public web (generic) │ ├─ Call public APIs (generic) │ └─ Perform basic calculations (generic) │ ├─ What it CANNOT do: │ ├─ Call your internal API (proprietary) │ ├─ Query your database (proprietary) │ ├─ Run your pricing algorithm (proprietary) │ ├─ Execute your fulfillment logic (proprietary) │ ├─ Check your inventory system (proprietary) │ └─ Apply your custom rules (proprietary) │ └─ Result: Agent is limited to generic tasks (anyone can replicate)

---

REAL EXAMPLE (E-commerce SaaS agent):

Scenario: Customer asks "What's my personalized price?" ├─ Your company: Has proprietary pricing algorithm │ ├─ Algorithm: Based on customer lifetime value + purchase history + segment │ ├─ Logic: €100 base - (5% if VIP) - (10% if bulk buyer) + (20% if new) │ ├─ Implementation: Private npm package (@company/pricing) │ ├─ Why proprietary: Competitive advantage (pricing optimization) │ └─ Security: Can't expose pricing logic publicly │ ├─ Generic agent (without private package access): │ ├─ Agent: "Let me search for your price online" │ ├─ Reality: Can't access internal pricing logic │ ├─ Fallback: "Price is €100 (public price, not personalized)" │ ├─ Customer: "That's not the price you quoted me last time" │ ├─ Problem: Agent can't give personalized price │ └─ Result: Agent is useless for personalized pricing │ ├─ Proprietary agent (with private package access): │ ├─ Agent: "Let me calculate your personalized price" │ ├─ Action: Imports @company/pricing (private package) │ ├─ Logic: calculatePrice(customerId, purchaseHistory, segment) │ ├─ Calculation: €100 - 5% (VIP) - 10% (bulk) + 0% (not new) = €80.50 │ ├─ Answer: "Your personalized price is €80.50 (you're a VIP + bulk buyer)" │ ├─ Customer: "Exactly right, this agent understands me" │ └─ Result: Agent gives personalized, valuable answer │ ├─ Impact: │ ├─ Generic agent: Customer satisfaction LOW (wrong price) │ ├─ Proprietary agent: Customer satisfaction HIGH (personalized price) │ ├─ Generic agent: Competitor can replicate (no moat) │ ├─ Proprietary agent: Competitor can't replicate (uses YOUR algorithm) │ ├─ Generic agent: Switching cost LOW (customer goes to competitor) │ └─ Proprietary agent: Switching cost HIGH (customer loses personalization) │ └─ Competitive advantage: ├─ Your agent: Can't do proprietary pricing (generic) ├─ Competitor's agent: Uses THEIR proprietary pricing (proprietary) ├─ Winner: Competitor (better customer experience) └─ Loser: You (agents are commoditized)

---

THE ROOT CAUSE (Agent isolation from proprietary code):

Technical limitation: ├─ Agent runtime: Isolated environment (security) ├─ Isolation reason: Agents shouldn't access arbitrary code ├─ Side effect: Agents can only access public npm packages ├─ Public packages: Anyone can download (no authentication) ├─ Private packages: Require credentials (authentication) ├─ Problem: Agent runtime had no way to authenticate ├─ Result: Agent couldn't install private packages └─ Impact: Agent stuck with generic tools only

Business impact: ├─ Your agent: Limited (can't use your code) ├─ Competitor's agent: Limited too (same problem) ├─ Both agents: Equally generic ├─ Differentiation: Impossible (no proprietary code access) ├─ Market: Agents become commodities ├─ Pricing: Downward pressure (agents are interchangeable) └─ Your moat: Eroded (can't differentiate via agent)

---

WHY THIS BLOCKED REAL-TIME AGENT DEPLOYMENT:

What founders want: ├─ Agent that uses company proprietary code ├─ Agent that calls internal APIs (with authentication) ├─ Agent that runs custom business logic ├─ Agent that gives personalized answers ├─ Agent that's defensible (can't be easily copied) └─ Agent that's valuable (uses company's unique capabilities)

What they got instead: ├─ Agent that uses public code only ├─ Agent that calls public APIs only ├─ Agent that runs generic logic ├─ Agent that gives commodity answers ├─ Agent that's easily replicated (competitor can build same agent) └─ Agent that's not defensible (no unique moat)

Result: ├─ Founder frustration: "My agent is generic, any competitor can build this" ├─ Agent stuck in: "Public tools only" state ├─ Differentiation: Impossible (need private code access) ├─ Business case: Weak (agent doesn't add competitive value) ├─ ROI: Low (agents are commodities) └─ Deployment: Delayed (waiting for private package support)

The Solution: Private npm Packages for Agents

Vercel Agent now supports private npm packages. Agents can access proprietary code. Differentiation is finally possible.

How private npm package support changes agents

PRIVATE NPM PACKAGE SUPPORT (How it works):

Traditional agent (public packages only): ├─ Agent deployment: npm install (public packages only) ├─ Agent runtime: Has no credentials ├─ Agent access: Public npm packages ├─ Agent limitation: Can't install @company/pricing ├─ Agent capability: Generic tools only └─ Result: Agent is generic (replicable)

New agent (with private package support): ├─ Setup: Add NPM_TOKEN to Vercel environment │ ├─ NPM_TOKEN: Your npm authentication token │ ├─ Storage: Vercel environment (shared across agent) │ ├─ Security: Only team members can access │ └─ Scope: Works for all agent sessions │ ├─ Agent deployment: npm install (public + private packages) │ ├─ Public: axios (installs immediately) │ ├─ Private: @company/pricing (authenticates with NPM_TOKEN) │ ├─ Custom registry: @internal/utilities (uses NPM_RC config) │ └─ Result: All packages installed (public + proprietary) │ ├─ Agent runtime: Has authentication credentials │ ├─ ENV: NPM_TOKEN available in runtime │ ├─ ENV: NPM_RC available in runtime │ ├─ Access: Can authenticate to private registries │ └─ Capability: Can import proprietary code │ ├─ Agent access: Public + private packages │ ├─ Public: lodash, axios, moment (generic) │ ├─ Private: @company/pricing (proprietary) │ ├─ Custom: @company/inventory (proprietary) │ ├─ Internal: @company/auth (proprietary) │ └─ Result: All tools available (generic + proprietary) │ ├─ Agent capability: Proprietary logic now available │ ├─ Can import @company/pricing │ ├─ Can call internal pricing algorithm │ ├─ Can run custom business logic │ ├─ Can give personalized answers │ └─ Can differentiate (uses proprietary code) │ └─ Result: Agent is proprietary (not easily replicable)

---

IMPACT (What changes with private package support):

Before (Generic agent): ├─ Agent tools: Public npm packages only ├─ Agent capability: Generic tasks only ├─ Agent differentiation: None (anyone can replicate) ├─ Competitive moat: None (agent is commodity) ├─ Switching cost: Low (customer can use competitor's agent) ├─ Business value: Low (agent doesn't add competitive advantage) └─ ROI on agent: Medium (just automation, not differentiation)

After (Proprietary agent): ├─ Agent tools: Public + private npm packages ├─ Agent capability: Generic + proprietary tasks ├─ Agent differentiation: High (uses YOUR code) ├─ Competitive moat: Strong (can't easily replicate) ├─ Switching cost: High (customer loses proprietary features) ├─ Business value: High (agent uses your unique capabilities) └─ ROI on agent: Very High (automation + differentiation + competitive moat)

---

REAL EXAMPLE (E-commerce SaaS agent with proprietary pricing):

Setup (one-time): ├─ Step 1: Create private npm package │ ├─ @company/pricing (npm private package) │ ├─ Code: Proprietary pricing algorithm │ ├─ Export: calculatePrice(customerId, segment, history) │ └─ Publish: To npm (as private package) │ ├─ Step 2: Add Vercel environment variable │ ├─ NPM_TOKEN: Your npm authentication token │ ├─ Storage: Vercel team environment (shared) │ ├─ Security: Only team members can access │ └─ Done: Agent can now authenticate to npm │ └─ Step 3: Update agent code ├─ Import: import { calculatePrice } from '@company/pricing' ├─ Use: const price = calculatePrice(customerId, segment, history) └─ Deploy: Agent now has pricing logic

Runtime (when customer asks): ├─ Customer: "What's my personalized price?" │ ├─ Agent step 1: Receive customer ID │ └─ ID: customer_12345 │ ├─ Agent step 2: Get customer data │ ├─ Query: Find customer in database │ ├─ Data: { segment: 'VIP', purchaseHistory: [...], lifetime: €50k } │ └─ Ready: Have customer context │ ├─ Agent step 3: Calculate personalized price │ ├─ Import: @company/pricing (uses private package) │ ├─ Call: calculatePrice(12345, 'VIP', history) │ ├─ Algo: €100 - 5% (VIP) - 10% (bulk) + 0% (not new) = €80.50 │ └─ Result: Personalized price calculated │ ├─ Agent step 4: Answer customer │ ├─ Response: "Your personalized price is €80.50" │ ├─ Explanation: "You get 5% VIP discount + 10% bulk discount" │ ├─ Offer: "Lock in this price for the next 24 hours?" │ └─ CTA: Customer can accept offer │ └─ Outcome: ├─ Customer: Personalized pricing (feels special) ├─ Trust: "This agent understands my value" ├─ Conversion: More likely to buy (feels like VIP) ├─ Retention: Hard to switch (competitor's agent wouldn't know VIP status) └─ Revenue: Higher (personalized pricing + better retention)

---

COMPETITIVE ADVANTAGE (Proprietary agent):

Your agent (with private packages): ├─ Capability: Personalized pricing (your algorithm) ├─ Differentiation: HIGH (uses your secret sauce) ├─ Customer experience: Premium (feels personalized) ├─ Defensibility: HIGH (competitor can't replicate) ├─ Switching cost: HIGH (customer loses personalization) ├─ Market position: Strong (unique agent capability) └─ Revenue impact: Positive (better retention + pricing)

Competitor's agent (limited to public packages): ├─ Capability: Generic pricing (no personalization) ├─ Differentiation: LOW (same as everyone else) ├─ Customer experience: Generic (feels transactional) ├─ Defensibility: LOW (easy to replicate) ├─ Switching cost: LOW (customer can switch anytime) ├─ Market position: Weak (commodity agent) └─ Revenue impact: Neutral (automation only, no moat)

Competitive gap: 3-5x better customer retention

Implementation: Adding Private npm Packages to Your Agent

Setup is simple: add NPM_TOKEN to Vercel environment, update agent code. Instant access to proprietary tools.

Step-by-step implementation guide

IMPLEMENTATION (Adding private npm packages to your agent):

Prerequisites: ├─ Vercel account (where your agent runs) ├─ npm account (where private packages are hosted) ├─ Private npm package (@company/pricing or similar) ├─ npm authentication token (for private package access) └─ Time: 15 minutes setup

Step 1: Create/prepare private npm package ├─ Option A: Publish existing package as private │ ├─ npm publish --access=restricted (@company/pricing) │ ├─ Package: Now private on npm registry │ ├─ Access: Only authenticated users can download │ └─ Ready: For agent to import │ ├─ Option B: Use custom registry │ ├─ Custom: Artifactory, Nexus, GitHub Packages │ ├─ Benefit: Self-hosted (full control) │ ├─ Setup: Configure .npmrc with registry URL │ └─ Ready: For agent to install │ └─ Verify: npm whoami (should show authenticated user)

Step 2: Get npm authentication token ├─ Method 1: npm login (creates ~/.npmrc) │ ├─ npm login │ ├─ Enter: username, password, email │ ├─ Result: ~/.npmrc has auth token │ ├─ Token: Copy from ~/.npmrc (auth line) │ └─ Secure: Keep token secret (don't commit to git) │ ├─ Method 2: npm token create (programmatic) │ ├─ npm token create --read-only │ ├─ Scope: Read-only (safer for agent) │ ├─ Token: New token created │ └─ Secure: Can be revoked if exposed │ └─ Store: Copy token (you'll use it next)

Step 3: Add token to Vercel environment ├─ Go to: Vercel dashboard → Settings → Environment Variables ├─ Create: New environment variable │ ├─ Name: NPM_TOKEN │ ├─ Value: [Your npm authentication token] │ ├─ Environments: Development, Preview, Production │ ├─ Scope: Shared (team can access) │ └─ Save: Environment variable added │ ├─ Or if using custom registry: │ ├─ Name: NPM_RC │ ├─ Value: [Your .npmrc content with custom registry] │ ├─ Example: │ │ @company:registry=https://artifactory.company.com/npm/ │ │ //artifactory.company.com/npm/:_authToken=[TOKEN] │ └─ Save: Environment variable added │ └─ Verify: Agent can now authenticate to npm

Step 4: Update agent code ├─ Install: npm install @company/pricing (locally first) │ ├─ Local: Verify package installs correctly │ ├─ Import: Test importing in your code │ ├─ Function: Test function calls │ └─ Ready: Package works locally │ ├─ Update: Agent code to import private package │ ├─ Before: (agent doesn't use proprietary code) │ ├─ After: │ │ import { calculatePrice } from '@company/pricing' │ │ const price = calculatePrice(customerId, segment, history) │ └─ Deploy: Agent now uses proprietary logic │ └─ Test: Deploy to Vercel ├─ Agent: Pulls code with private package reference ├─ Build: npm install (uses NPM_TOKEN to authenticate) ├─ Runtime: Agent imports @company/pricing ├─ Execution: Agent calls proprietary functions └─ Result: Agent successfully uses private code

Step 5: Test end-to-end ├─ Test 1: Agent can import private package ✅ ├─ Test 2: Agent can call proprietary functions ✅ ├─ Test 3: Agent returns correct proprietary results ✅ ├─ Test 4: Agent uses proprietary logic in responses ✅ └─ Launch: Enable for all customers

---

SECURITY CONSIDERATIONS (Private packages + agents):

Token security: ├─ NPM_TOKEN: Treat like password (keep secret) ├─ Storage: In Vercel environment (encrypted at rest) ├─ Access: Only team members can read (Vercel RBAC) ├─ Rotation: Create new token, update Vercel, revoke old ├─ Rotation frequency: Every 6 months (best practice) └─ If compromised: Immediately revoke token, create new one

Package security: ├─ Access: Only authenticated users can download ├─ Scope: @company/pricing is private (not public) ├─ Versioning: Pin versions in package.json (no auto-update) ├─ Code review: All changes to @company/pricing reviewed ├─ Audit: Track who deployed new package versions └─ Testing: Test all package versions before using in agent

Least privilege: ├─ Token type: Use read-only token (agent doesn't need write) ├─ Scope: Token only accesses @company/* packages (not all packages) ├─ Env var: Only shared with team (not exposed to customers) ├─ Network: Agent runs in Vercel (trusted infrastructure) └─ Result: Minimal attack surface

---

COST ANALYSIS (Private npm packages + agent):

npm private packages: ├─ Free tier: None (npm doesn't have free private) ├─ Paid: $7/month (1 private package) ├─ Scaled: $7 per private package (up to 10) ├─ Your usage: ~3 private packages (@pricing, @inventory, @auth) ├─ Monthly cost: ~€21/month └─ ROI: Enables agent differentiation (massive value)

Vercel environment variables: ├─ Cost: Free (included with Vercel Pro/Business) ├─ Limit: Up to 100 environment variables per team ├─ Shared: Visible to all team members └─ No additional cost

Agent execution: ├─ No change: Agent execution cost same (with or without private packages) ├─ Slight increase: Private package imports = ~1% more execution time ├─ Cost increase: Negligible (<€1/month) └─ Total: No material cost increase

Total monthly cost: ├─ npm private packages: ~€21 ├─ Vercel environment: €0 (included) ├─ Agent execution: €0 (no change) ├─ Total: ~€21/month └─ ROI: Enables €100K+ revenue (through differentiation + retention)

Break-even: ├─ Monthly cost: €21 ├─ Revenue impact: €500+ (per customer, via retention/upsell) ├─ Payback: Immediate (first customer) ├─ 12-month ROI: 200x+ return on investment └─ Verdict: Extremely profitable

Next Steps: Proprietary Agent Strategy

At OpenClaw, we help SaaS founders add proprietary code to agents (private npm package setup, agent integration architecture, security best practices), differentiate agents through proprietary logic (identify unique code to expose, design agent-friendly APIs, create defensible moat), and maximize agent ROI (measure impact on retention/revenue, optimize proprietary feature usage, scale agent adoption):

• Agent audit (which proprietary code should agent access?)
• Private package setup (npm configuration, Vercel integration)
• Proprietary feature design (agent-friendly API design)
• Security review (token management, least privilege)
• ROI measurement (track proprietary feature usage + revenue impact)

Get a free proprietary agent assessment: Schedule 30 minutes with our agent architect. We'll evaluate your current agent (using public packages only?), identify proprietary code to expose (which features make agent unique?), design private npm integration (security + architecture?), calculate differentiation potential (how much better will your agent be?), and create implementation roadmap (step-by-step deployment?).

[Book your free assessment] → [Button: Schedule 30-Minute Call]

Your agent is generic (uses public packages only). Competitors can replicate it easily. Private npm packages unlock proprietary code. Add your secret sauce to your agent today—differentiation, defensibility, and revenue go up immediately.

---

FAQ

Q: Mas isso não vai deixar meu agent mais lento? (Performance Impact)

A: Não significativamente:

• Npm installation: ~2-5 segundos (one-time during build)
• Package import: <1ms (cached at runtime)
• Function calls: Same speed (no performance penalty)
• Network calls: No change (proprietary code = local execution)
• Total impact: Negligible (<1% performance change)

Recommendação: Performance trade-off é imperceptível (worth it for differentiation).

Q: E se expor meu código em agent compromete segurança? (Code Security)

A: Três camadas de proteção:

• Layer 1: Private npm package (encrypted, authenticated access)
• Layer 2: Vercel environment (encrypted at rest, team access)
• Layer 3: Agent isolation (runs in sandboxed environment)
• Safeguard: Don't expose secrets (passwords, API keys) in proprietary code
• Pattern: Proprietary code calls SECRET APIs (secrets stay hidden)

Recommendação: Proprietary code ≠ secrets (separate them).

Q: Qual é o custo de configurar private npm packages? (Setup Cost)

A: Muito baixo:

• npm private packages: €7-21/mês (dependendo quantidade)
• Vercel environment: €0 (included)
• Setup time: 15 minutos (você mesmo)
• Engineering time: 0 (if DIY) ou 1-2 horas (if consulting)
• Total cost: €7-21/mês + one-time setup
• ROI: 200x+ (first customer retention alone pays for it)

Recommendação: Cost is negligible, returns are massive.