
Security News
pnpm 11.5 Adds Support for Recognizing npm Staged Publishes
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.
@aigentic/cli-core
Advanced tools
Lightweight core CLI surface for Claude Flow — memory + hooks commands only. Designed to load fast on cold npx cache (<5s) so plugin skills don't race the 30s MCP-startup timeout. The full @claude-flow/cli metapackage lazy-loads everything else on top of
Status: alpha (pre-release). Tracking ADR-100. Don't depend on this in production yet.
Lightweight core CLI surface for Claude Flow — memory + hooks commands only. Designed to load fast on a cold npx cache so plugin skills don't race Claude Code's 30 second MCP-startup timeout.
Issue #1748 #3 documented a silent failure mode for new users: npx claude-flow@latest mcp start from a cold npx cache regularly exceeds 30 seconds (1.8 MB / 999 files), Claude Code's MCP startup timeout fires, zero tools register, and the user observes "Ruflo is broken — no MCP tools available."
@claude-flow/cli-core is a ≤250 KB packed subset containing only what plugin skills actually call: memory store/list/retrieve/search/delete/init and the hooks family (route, model-outcome, post-edit, pre-task, etc.). On a cold cache, npx @claude-flow/cli-core@alpha memory store ... should complete in under 5 seconds — well under the timeout.
# Pre-release alpha
npm install @claude-flow/cli-core@alpha
# Or just npx-invoke directly from a plugin Bash block
npx @claude-flow/cli-core@alpha memory store --key x --value 1 --namespace patterns
| Category | Commands |
|---|---|
memory | store, list, retrieve, search, delete, init, migrate, stats, configure, cleanup, compress, export, import |
hooks | route, pre-task, post-task, pre-edit, post-edit, pre-command, post-command, model-outcome, model-route, model-stats, worker-*, intelligence_*, plus 12 background-worker dispatchers |
@claude-flow/cli for these)swarm, hive-mind, agent, task, coordination — multi-agent orchestrationneural, embeddings, intelligence — full ML surfacefederation, claims, aidefence — cross-installation featuresbrowser, wasm, rvf — sandbox + browser automationinit, migrate, doctor, daemon, deployment — lifecycle managementperformance, security, providers, plugins, config — admin surfaceFor any of these, install @claude-flow/cli@alpha (the metapackage that re-exports cli-core and lazy-loads everything else).
@claude-flow/cli-core@3.7.0-alpha.x ships in lockstep with @claude-flow/cli@3.7.0-alpha.x. Once promoted from alpha → latest, the two packages will continue to share the major.minor line.
# Cold cache test — clear npx cache first
rm -rf ~/.npm/_npx
time npx @claude-flow/cli-core@alpha memory store --key smoke --value test --namespace test
# Expected: <5 seconds wall-time on typical broadband
@claude-flow/cli README — full feature listMIT
FAQs
Lightweight core CLI surface for Claude Flow — memory + hooks commands only. Designed to load fast on cold npx cache (<5s) so plugin skills don't race the 30s MCP-startup timeout. The full @claude-flow/cli metapackage lazy-loads everything else on top of
We found that @aigentic/cli-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.