GasPackᵐ
The missing package manager for Apps Script
The package manager Apps Script has been missing.
Install, version, and ship reusable code the way every modern ecosystem does.
The Infrastructure
Write once.
Available everywhere.
How do you share libraries today? A cryptic script ID in a Slack message? A Stack Overflow answer from 2017? Every other ecosystem solved this a decade ago.
Your scripts are code.
It's time to treat them like it.
Why GasPackᵐ
Trust is the product.
Why should you use packages? Why not just copy-paste code from a website article or let Gemini handle it? AI is good, but far from perfect when building complex systems and workflows from a prompt. You're left with hundreds or thousands of lines of unique code that could solve your problem — or delete all the files on your Google Drive, don't worry, Gemini will apologize for deleting your files and offer to help get them back…
Instead, you can use hundreds or thousands of lines of code that's been scanned, scored, and has a community of thousands of developer eyes looking over it and providing seals of approval.
Verified identity
Publishers prove domain ownership before they can publish under that scope. @acme.com/utils actually came from acme.com. No look-alikes, no impersonation.
Continuous scanning
Every publish runs through static analysis. Scope creep, prompt injection patterns, and known CVEs are surfaced before install. Each rule fires with what leaked, why it matters, and the one-line fix.
Supply-chain attestation
Packages published from CI carry npm-style provenance attestation — a cryptographic tie between the artifact and the commit it came from. Trust is verifiable, not asserted.
The ecosystem we're seeding
What gets built when sharing is easy.
Every modern ecosystem has its compounding packages — the unglamorous primitives, the workspace utilities, the AI building blocks. Here's the shape of an Apps Script catalog when creators have somewhere to ship them.
AI building blocks
What developers will build for agentic Workspace.
@workspace-tools/a2a-serverTurn any Apps Script into a discoverable A2A agent.@datateam.dev/mcp-serverStand up an MCP server in ten lines. Test locally before deploy.@yourcompany.com/sheets-aiGemini in your Sheet. Cell formulas that classify, summarize, and structure.@hr-tools.io/rag-driveRAG over a Drive folder. Chunking, embedding, vector store included.
Workspace utilities
The libraries every team rewrites. Imagine them written once.
@workspace-tools/batch-emailHigh-volume Gmail with batching, retries, and progress tracking.@datateam.dev/sheets-utilsDedupe, pivot, fuzzy match, range chunking, A1 helpers.@labs.example/drive-crawlerParallel folder walks viaUrlFetchApp.fetchAll— tree traversal that scales.@procurement.io/docs-templateTemplate-driven Docs with merge fields, tables, and conditional sections.
Production plumbing
The unglamorous primitives every production script needs.
@gaspackm.org/continuatorCheckpoint past the 6-minute execution limit. Resumes from last cursor.@yourcompany.com/token-meterTrack Gemini, Claude, and OpenAI token usage per user and per agent.@labs.example/semantic-cacheLLM response cache keyed on embedding similarity. Cut repeat-query cost.@gaspackm.org/audit-logTamper-evident audit chain for agent actions. Queryable, retention-aware.
The shape of a flourishing catalog. Be one of the creators who ships here — start free.
What compounds
Someone already solved this. You just have to install it.
The fix isn't a Stack Overflow rabbit hole. It's a one-line install.
Pricing
Simple, honest plans.
Free for public packages. Pro for private. Teams and Enterprise are next.
Free
For open-source authors and personal projects.
- Unlimited public packages
- Verified domain identity
- Continuous security scanning
- Supply-chain attestation
- Community support
Pro
For developers shipping production work.
- Everything in Free
- Unlimited private packages
- Advanced security scanning
- Priority support
- Pro badge on profile
Teams
For organizations sharing internal libraries.
- Everything in Pro
- Multi-seat billing
- Tenant-scoped packages
- Role-based publish
- Centralized audit log
Or email hello@gaspackm.org
Enterprise
For IT-governed teams with compliance needs.
- Everything in Teams
- SSO (SAML/OIDC)
- SLA + dedicated support
- Self-hosted registry option
- Custom compliance review
Or email hello@gaspackm.org
All plans include verified identity, continuous scanning, and provenance attestation. Pro adds private packages, AI-assisted features, and priority support.
Trust signals for the code you ship
AI writes the code. Who reads it?
AI will generate a thousand lines of unique code without breaking a sweat. None of it has been reviewed — including by you. None of it has been stress-tested by real users in real production. Six months from now when something breaks, you'll be scrolling through code you accepted but never read, looking for a bug no one else has ever seen.
A community package gives you what AI can't: evidence. A verified publisher with a Pro or Expert badge. An install count showing how many developers are already running it in production. A security score with the static analysis findings laid out. Comments from developers who've shipped it. You're not trusting blindly — you're reading the receipts.
Verifiable supply chain. The trust signals other ecosystems take for granted.
Coming soon — Teams and Enterprise plans with centralized billing, SSO, org-wide package governance, and private self-hosted registry support.
Stop pasting or generating code you can't verify.
Verified publishers. Code that's been scanned, scored, and reviewed by people. Cryptographic provenance back to the commit it came from. Free for public packages.