
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@commonninja/cli
Advanced tools
Common Ninja CLI + MCP server — create and manage website widgets from the command line or any AI assistant.
A Model Context Protocol (MCP) server implementation for Common Ninja Widgets+, allowing AI assistants to interact with the Common Ninja API.
npm install
The server runs in one of two transports:
command/args. The token comes from COMMONNINJA_ACCOUNT_ACCESS_TOKEN./mcp/<TOKEN>) or a CN-API-Token header.# stdio (local)
npm start
# HTTP (hosted) — any of these enable HTTP mode:
MCP_TRANSPORT=http npm start # or: node build/index.js --http (PORT defaults to 3000)
Once the server is deployed (anything that sets PORT, e.g. Render/Railway/Fly, runs HTTP mode automatically), connecting is one line. Grab your Account Access Token from the dashboard, then:
# Claude Code
claude mcp add --transport http commonninja https://mcp.commoninja.com/mcp/YOUR_API_TOKEN
Or point any MCP-compatible client at https://mcp.commoninja.com/mcp/YOUR_API_TOKEN. The token can also be sent as a CN-API-Token header instead of in the path. GET /healthz returns server status. (Stateless mode: only POST is served; GET/DELETE return 405.)
See DEPLOY.md for deploying the hosted server to Heroku at mcp.commoninja.com.
When OAUTH_ENABLED=true, users connect with just the URL — no token to paste. The client
discovers Common Ninja's authorization server and opens a browser login:
claude mcp add --transport http commonninja https://mcp.commoninja.com/mcp
# Claude opens a Common Ninja login + consent screen, then connects.
OAuth is opt-in and depends on a few authorization-server pieces (dynamic client registration, PKCE)
landing in widgets-api. Until then, use the token methods above. Full design + turn-on checklist:
OAUTH.md.
{
"globalShortcut": "",
"mcpServers": {
"commonninja": {
"command": "node",
"args": ["/path/to/commonninja-mcp-server/build/index.js"],
"env": {
"COMMONNINJA_ACCOUNT_ACCESS_TOKEN": "your_access_token_here"
}
}
}
}
Get current path with process.cwd(), and use it as the path to the MCP server.
The MCP server is a Node.js application that listens for MCP connections from the Common Ninja desktop app.
commonninja)A token-cheap CLI for agents and automation — every command outputs structured JSON. Install from npm:
npm install -g @commonninja/cli
export COMMONNINJA_ACCOUNT_ACCESS_TOKEN="your_access_token_here"
commonninja help # list all commands
commonninja widget-types
commonninja widgets:list --limit 5
commonninja widget:create --type faq --name "My FAQ" --data @faq.json
commonninja widget:update <widgetId> --name "New name" --description "New description"
commonninja widget:embed <widgetId>
Or run without installing: npx @commonninja/cli widget-types. The MCP server bin is commonninja-mcp. Full reference: docs.commoninja.com/docs/reference/cli.
This project is licensed under the MIT License. See the LICENSE file for details.
FAQs
Common Ninja CLI + MCP server — create and manage website widgets from the command line or any AI assistant.
The npm package @commonninja/cli receives a total of 0 weekly downloads. As such, @commonninja/cli popularity was classified as not popular.
We found that @commonninja/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.