How does connecting my agent stay secure?

With the npm server, asking your agent to connect opens an approval page in your browser. You sign in there, click Authorize, and the client receives a scoped API token. Your password never touches the client.

With the remote server you create a token yourself in Settings and put it in the Authorization header. Either way the agent only ever holds a scoped, revocable token, never your credentials.