Lab: is the SDK you're about to install real?

Nothing so far has asked you to trust this course's word for what a package is. This lab checks the one claim every SDK lesson rests on: that @1claw/sdk is a real thing you can safely add to a project.

1. 1

   Ask the registry directly, the same one npm install itself queries.

   code Copy

   curl -s https://registry.npmjs.org/@1claw/sdk/latest | python3 -c '
   import json, sys
   d = json.load(sys.stdin)
   print("name:      ", d["name"])
   print("version:   ", d["version"])
   print("deps:      ", d.get("dependencies", {}))
   print("unpacked:  ", d["dist"]["unpackedSize"], "bytes")
   '

2. 2

   A real, versioned package, published by an account, with zero runtime dependencies and a size you can inspect before you pull it in.

   text Copy

   name:       @1claw/sdk
   version:    0.60.0
   deps:       {}
   unpacked:   2529522 bytes

3. 3

   Check the two packages this course tells you to trust with far more, the CLI and the MCP server, and note something they have in common.

   code Copy

   for pkg in @1claw/cli @1claw/mcp; do
     curl -s "https://registry.npmjs.org/$pkg/latest" | python3 -c '
   import json, sys
   d = json.load(sys.stdin)
   print(d["name"], d["version"], len(d.get("dependencies", {})), "deps")
   '
   done

4. 4

   All three release together.

   text Copy

   @1claw/cli 0.60.0 7 deps
   @1claw/mcp 0.60.0 7 deps

Every 1Claw package this course has told you to install version-locks to the same release. That is worth noticing on its own: an SDK, a CLI, and an MCP server that all ship 0.60.0 together are a single product surface, not three independently maintained tools that happen to share a name.

• A registry lookup costs one HTTP request and answers a question worth asking before any install: is this maintained, and by whom.
• @1claw/sdk has zero runtime dependencies. That is a deliberate, checkable property, and a smaller dependency tree is a smaller supply chain to inherit trust in.
• The version match across packages is what makes 'pin an exact version' meaningful advice from the ecosystem lessons. If the packages did not release in lockstep, pinning one and not the others could put you on an incompatible combination.