
Security News
6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.
@devframes/plugin-inspect
Advanced tools
Devframe plugin — a self-inspector for the RPC registry, shared state, and agent surface of a devframe connection.
[!WARNING] Experimental This plugin is experimental and may change without a major version bump until it stabilizes.
A devframe plugin that inspects its own connection (and, when mounted in a
host, the host's): browse every registered RPC function with its metadata,
invoke read-only query/static functions and inspect the results, watch
shared-state keys update live, and explore the agent-exposed surface.
Ported in spirit from the RPC & State panels of
vitejs/devtools; rebuilt on devframe's
framework-neutral client (connectDevframe, rpc.sharedState) with a Vue + Vite SPA.
pnpx @devframes/plugin-inspect
Opens the inspector against a fresh standalone devframe connection — useful as a reference and for poking at the introspection RPCs themselves.
// vite.config.ts
import { inspectVitePlugin } from '@devframes/plugin-inspect/vite'
import { defineConfig } from 'vite'
export default defineConfig({
plugins: [
inspectVitePlugin(),
],
})
import { createInspectDevframe } from '@devframes/plugin-inspect'
const devframe = createInspectDevframe({ port: 9100 })
All functions are namespaced devframes:plugin:inspect:*:
| Function | Type | What it returns |
|---|---|---|
list-functions | query (snapshot) | Every registered RPC function with metadata (type, JSON-serializable/snapshot flags, args/return JSON Schema, agent exposure). |
invoke | action | Invokes a read-only query/static function by name and returns a result envelope. Refuses action/event functions. |
list-state-keys | query (snapshot) | The keys of every shared-state entry on the connection. |
describe-agent | query (snapshot) | The agent manifest — tools and readable resources. |
The three query functions are agent-exposed (read-only) and bake into the
static dump, so the inspector still lists functions, state keys, and the agent
surface when deployed as a static SPA.
FAQs
Devframe plugin that inspects the RPC registry, shared state, and agent surface of a connection.
The npm package @devframes/plugin-inspect receives a total of 70,962 weekly downloads. As such, @devframes/plugin-inspect popularity was classified as popular.
We found that @devframes/plugin-inspect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.

Research
/Security News
Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.