
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@blackwell-systems/knowing
Advanced tools
Self-adapting code intelligence engine. Gives AI agents ranked, graph-aware context instead of grep results. Gets smarter with scale, not dumber.
npm install -g @blackwell-systems/knowing
knowing version # should print the version
Add to your agent's MCP config (.mcp.json for Claude Code, .cursor/mcp.json for Cursor, .vscode/mcp.json for VS Code, see all):
{
"mcpServers": {
"knowing": {
"command": "knowing",
"args": ["mcp", "--watch"],
"transport": "stdio"
}
}
}
The MCP server auto-indexes your repo on first launch (10-30 seconds). No model downloads, no API keys required.
Ask your agent:
"Use the context_for_task tool to find symbols related to [something you know exists in your code]."
You should see ranked symbols with scores and file paths. If results are empty, the repo is still indexing. If results seem unrelated, use specific symbol names in your task description.
knowing indexes code across 23 extractors (Go, TypeScript, Python, Rust, Java, C#, and more) into a content-addressed knowledge graph. 38 edge types, 28 MCP tools, 277 equivalence classes bridging task vocabulary to code symbols.
P@10 = 0.330 across 302 tasks, 17 repos, 8 languages. 13 self-adapting mechanisms. 3.79x codegraph, 6.00x GitNexus.
knowing add . # index a repo
knowing context -task "refactor auth" -format gcf # ranked context
knowing test-scope -files internal/auth/handler.go # affected tests
knowing why -task "refactor auth" -symbol "SessionHandler" # explain ranking
knowing enrich lsp # LSP enrichment for higher-quality edges
Full docs at https://blackwell-systems.github.io/knowing
FAQs
Content-addressed knowledge graph for software systems
We found that @blackwell-systems/knowing demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.