Northveil TypeScript SDK & CLI

Official lightweight TypeScript SDK and Developer CLI for the Northveil Non-Custodial Agent Wallet & MCP Protocol.

The AI never holds keys. The server never holds a full key. The agent proposes an operation via MCP. A grant + policy engine decides if it can run. If approval is required, the user signs with a passkey on https://wallet.northveil.xyz.

📦 Installation

npm install northveil-sdk

Or install globally for the northveil CLI:

npm install -g northveil-sdk

💻 Developer CLI (northveil)

The northveil CLI provides instant terminal access to non-custodial agent deployments, mints, and request inspection.

Setup

export NORTHVEIL_API_KEY="nv_live_..."
export NORTHVEIL_API_URL="https://mcp.northveil.xyz" # optional, defaults to live control plane

Commands

All commands default to the Sepolia testnet (--network sepolia).

# 1. Deploy an ERC-20 Token
northveil deploy-token --name "Agent Token" --symbol "AGT" --supply 1000000 --wait

# 2. Deploy an ERC-721 NFT Collection
northveil deploy-nft --name "Agent Pass" --symbol "PASS" --base-uri "https://metadata.example.com/" --wait

# 3. Mint Tokens
northveil mint-token --contract 0x... --to 0x... --amount 100 --wait

# 4. Mint an NFT
northveil mint-nft --contract 0x... --to 0x... --token-id 1 --wait

# 5. Inspect Request Status
northveil request <requestId> --wait

Outputs formatted JSON to stdout and a single-line human summary to stderr.

Security Guardrail: The CLI strictly rejects --private-key, --mnemonic, or --seed flags (exit code 2 CUSTODY_REFUSED).

🚀 TypeScript SDK Quickstart

import { NorthveilClient } from 'northveil-sdk';

const client = new NorthveilClient({
  apiUrl: process.env.NORTHVEIL_API_URL || 'https://mcp.northveil.xyz',
  clientKey: process.env.NORTHVEIL_API_KEY, // Or pass apiKey
});

async function main() {
  // 1. Deploy ERC-20 Token on Sepolia
  const deploy = await client.deployToken({
    name: 'Northveil Token',
    symbol: 'NVT',
    supply: 1000000,
    network: 'sepolia',
  });
  console.log(`Deployment staged: ${deploy.requestId}`);

  // 2. Wait for Confirmation and Contract Address
  const confirmed = await client.waitForRequest(deploy.requestId, { requireContract: true });
  console.log(`Contract deployed at: ${confirmed.contractAddress}`);
  console.log(`Explorer: ${confirmed.explorerContract}`);

  // 3. Mint Tokens
  const mint = await client.mintToken({
    contractAddress: confirmed.contractAddress!,
    to: '0x1234567890123456789012345678901234567890',
    amount: '500',
    network: 'sepolia',
  });

  const mintConfirmed = await client.waitForRequest(mint.requestId);
  console.log(`Mint confirmed! Tx: ${mintConfirmed.txHash}`);
}

main().catch(console.error);

🔒 Security Invariants

• Non-Custodial: The SDK and CLI never store, process, or transmit private keys, mnemonics, or seeds.
• Capability-Based: Authenticates via user-granted API keys (nv_live_...).
• Passkey Step-Up: Unapproved transactions or transactions outside limits route to wallet.northveil.xyz for human WebAuthn signing.

📄 License

MIT License © 2026 Northveil Protocol.