A developer built a 26-line shell script, check-script-refs.sh, that cross-checks every `pnpm`, `npm run` and `yarn` command referenced in Markdown rules files against the scripts defined in package.j…
LemonBeam launched as a source-backed onboarding guide generator that scans public JavaScript and TypeScript GitHub repositories and produces a fixed-format contributor guide with inline citations bac…
Akto published a September 29, 2026 analysis of AI supply-chain trust, citing the September 2025 case of the npm-distributed MCP server `postmark-mcp`, which operated normally through its first 15 ver…
The Vibe Coding Production Kit (VCP), a model-agnostic CLI and workflow for AI coding agents, has been published as an npm package requiring Node.js 22+ with no runtime dependencies, installable via `…
MemTensor's AI memory tooling suffered a security breach affecting the MemoryOS library and associated plugins, including MemoryOS==2.0.34 on PyPI and certain npm plugin versions, according to the Slo…
Mcp-audit version 0.18.0 adds a lockfile for MCP servers, addressing unpinned npx dependencies that fetch whatever version the npm registry calls latest on every tool start, according to the tool's au…
A developer building Infrawise, an MCP server that gives coding agents context about live infrastructure, disclosed that a name-matching linker shipped with a green test suite for 82 days while carryi…
MindForge v12.0.0, an npm package (mindforge-cc) that layers governance and orchestration on top of Claude Code, has shipped as its first release "deliberately cut for real external users." The projec…
Maskbreak v0.1.6, an MCP server providing public IP signals such as cloud hosting and Tor exit data for fraud checks, was published to the official MCP registry on 2026-09-24 and is distributed as @se…
Music Studio (io.github.linxule/mcp-music-studio) version 0.5.8 was published to the official MCP registry on 2026-09-24, distributed as mcp-music-studio on npm and as a hosted remote over streamable-…
VirWave Breathe version 1.2.0, an MCP server that runs animated breathing sessions locally and collects no data, was published to the official MCP registry on 2026-09-24 and is distributed as virwave-…
Cycode announced Workstation Protection, a capability that intercepts package installs in real time on developer workstations and blocks malicious packages before they install, enforcing release-age c…
MCP registry index mcpindex.ai published a screening record for CRA AGENT (io.github.giupy997/cra-agent@0.0.9), an MCP server that lets an agent pay for x402 APIs in USDC on Arc under a spending polic…
Cambrian API MCP version 1.7.0 was published to the official MCP registry on 2026-09-23, distributed as cambrian-api-mcp on npm and as a hosted remote over streamable-http, according to the mcpindex r…
CloudSEK disclosed on September 20 that a malware loader called GHAPPIER was distributed through the npm package @dforge-core/dforge-mcp after an attacker spent 105 minutes in the maintainer's account…
Developer Chris Coyier built `<show-keystrokes>`, a web-native custom element that displays keyboard shortcuts and navigational keys on screen during demos, after a corporate security policy blocked h…
Pirol-ai released Company as Code, an open standard and validator tool called charta that lets organizations describe goals, roles, processes and policies as plain markdown files in git so AI agents c…
The MCP server io.github.Aureliolo/gdharness v1.0.16 was published to the official MCP registry on 2026-09-23, distributed as gdharness on npm, according to the mcpindex index. The index reports a sem…
The NOAA marine MCP server io.github.cyanheads/noaa-marine-mcp-server reached version 0.6.0, published to the official MCP registry on 2026-09-23 and distributed as @cyanheads/noaa-marine-mcp-server o…
Nofax v0.2.18, a local stdio MCP server providing human-in-the-loop approvals and notifications for AI coding agents, was published to the official MCP registry on 2026-09-23 and is distributed as nof…