
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@devframes/plugin-inspect
Advanced tools
Devframe plugin that inspects the RPC registry, shared state, and agent surface of a connection.
[!WARNING] Experimental This plugin is experimental and may change without a major version bump until it stabilizes.
A devframe plugin that inspects its own connection (and, when mounted in a
host, the host's): browse every registered RPC function with its metadata,
invoke read-only query/static functions and inspect the results, watch
shared-state keys update live, explore the agent-exposed surface, and — while
running against a live backend — list the other devframe dev servers running
alongside it.
Ported in spirit from the RPC & State panels of
vitejs/devtools; rebuilt on devframe's
framework-neutral client (connectDevframe, rpc.sharedState) with a Vue + Vite SPA.
pnpx @devframes/plugin-inspect
Opens the inspector against a fresh standalone devframe connection — useful as a reference and for poking at the introspection RPCs themselves.
// vite.config.ts
import createInspectDevframe from '@devframes/plugin-inspect'
import { devframeVite } from '@devframes/vite/single'
import { defineConfig } from 'vite'
export default defineConfig({
plugins: [
devframeVite(createInspectDevframe()),
],
})
import { createInspectDevframe } from '@devframes/plugin-inspect'
const devframe = createInspectDevframe({ port: 9100 })
All functions are namespaced devframes:plugin:inspect:*:
| Function | Type | What it returns |
|---|---|---|
list-functions | query (snapshot) | Every registered RPC function with metadata (type, JSON-serializable/snapshot flags, args/return JSON Schema, agent exposure). |
invoke | action | Invokes a read-only query/static function by name and returns a result envelope. Refuses action/event functions. |
list-state-keys | query (snapshot) | The keys of every shared-state entry on the connection. |
describe-agent | query (snapshot) | The agent manifest — tools and readable resources. |
list-instances | query (live) | Every devframe dev server currently running on the machine, discovered through the shared instance registry. Powers the read-only Instances tab. |
The three snapshot query functions are agent-exposed (read-only) and bake into
the static dump, so the inspector still lists functions, state keys, and the
agent surface when deployed as a static SPA. list-instances is live rather
than baked (the set of running processes is meaningless in a static dump), so
the Instances tab appears only against a live backend.
FAQs
Devframe plugin that inspects the RPC registry, shared state, and agent surface of a connection.
The npm package @devframes/plugin-inspect receives a total of 59,113 weekly downloads. As such, @devframes/plugin-inspect popularity was classified as popular.
We found that @devframes/plugin-inspect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.