
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@aspicio/mcp
Advanced tools
MCP server exposing DXF and PDF drawings to AI agents: facts, renders, in-chat viewer.
An MCP server that lets AI agents open, inspect, and render DXF/CAD drawings and vector PDFs — built on the Aspicio viewer's headless pipeline. Local stdio server, no hosted dependency. A hosted endpoint and docs live at aspicio.frontsail.app/mcp; the interactive viewer at aspicio.frontsail.app.
Three pairs: one per format, plus one that detects the format from the
bytes. Every describe_* returns structured JSON — units, bounds/size,
entity and segment counts, layers with the color actually drawn, per-type
counts, and what was skipped. Every render_* returns a PNG (width
64–4000, default 1200).
| Tool | Reads |
|---|---|
describe_dxf / render_dxf | DXF only |
describe_pdf / render_pdf | PDF only |
describe_doc / render_doc | Either, detected from the bytes |
Use a describe_* for structural questions (layers, counts, dimensions,
units) and a render_* for visual ones. Handing a typed tool the wrong
format tells you which tool to use instead.
A PDF render shows vector line work and text, not a page facsimile: images, shadings, and transparency are reported as skipped rather than drawn. PDF measurements are in points, because a PDF carries no drawing scale.
All six accept source as an http(s) URL or a local file path;
DXF may also be passed as inline text. A PDF is binary, so it needs a
path or a URL.
Claude Code / Claude Desktop:
claude mcp add aspicio -- npx -y @aspicio/mcp
Codex:
codex mcp add aspicio -- npx -y @aspicio/mcp
Any other MCP client: register the stdio command npx -y @aspicio/mcp.
Prefer a one-step install with bundled skills? The aspicio plugin wires this server plus usage skills into Claude Code and Codex.
URL sources are fetched with a private-host guard (loopback, RFC1918, IPv6 local ranges — revalidated on every redirect hop) and an 8 MB cap, so a model acting on untrusted input can't turn the server into a LAN/localhost probe.
@resvg/resvg-js (native prebuilds; Node ≥ 18).FAQs
MCP server exposing DXF and PDF drawings to AI agents: facts, renders, in-chat viewer.
The npm package @aspicio/mcp receives a total of 201 weekly downloads. As such, @aspicio/mcp popularity was classified as not popular.
We found that @aspicio/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.