
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@archstone/cli
Advanced tools
Archstone CLI — compile a business capability definition (CDL) into tools an AI agent can call: apply, build, serve over MCP, and verify against the live backend.
The archstone command — compiles a Capability Definition Language (CDL) manifest to a
target-agnostic IR and serves it as MCP tools an AI agent can call.
Part of Archstone, an open-source Capability Platform: a company describes what it can do in CDL (business only, no integration code); Archstone compiles that to IR; an emitter turns the IR into tools an agent can discover and call.
npm install -g @archstone/cli
# Compile a manifest: parse -> validate -> lower to IR, print a human report
archstone apply path/to/manifest
# Serve the compiled tools to an AI agent as MCP over stdio
archstone serve path/to/manifest
# Replay a binding's golden fixture against the live backend; detect provider drift
archstone verify path/to/manifest
# Compile a manifest to a standalone IR artifact (archstone.ir.json by default)
archstone build path/to/manifest [--out path]
A manifest directory contains capabilities.yaml, *.capability.yaml, *.resource.yaml,
and bindings/*.binding.yaml — see the
main repository README and
examples/manifests/ for the full format and worked examples.
Apache-2.0
FAQs
Archstone CLI — compile a business capability definition (CDL) into tools an AI agent can call: apply, build, serve over MCP, and verify against the live backend.
The npm package @archstone/cli receives a total of 1,476 weekly downloads. As such, @archstone/cli popularity was classified as popular.
We found that @archstone/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.