
Product
Socket MCP Adds Org Alerts, Threat Feed Review, and Package Inspection
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.
@engramresearch/srun
Advanced tools
srun is a Universal Smart Project Runner. It translates a developer intent into the concrete command for the current project.
srun dev
srun build
srun installer
srun test
srun check
srun preview
srun clean
srun setup
srun lint
srun format
srun info
srun list
The goal is to reduce cognitive load when switching between projects, package managers, frameworks, and custom script names.
With Cargo:
cargo install --path .
With npm from the project directory:
npm install -g .
After publishing:
npm install -g @engramresearch/srun
The npm package includes prebuilt binaries for supported platforms. Rust/Cargo is only required when building from source.
Or run during development:
cargo run -- info
cargo run -- dev --dry-run
Package managers:
pnpm-lock.yaml -> pnpmbun.lockb or bun.lock -> bunyarn.lock -> yarnpackage-lock.json -> npmpackage.json without lockfile -> npm with warningIf multiple lockfiles exist, priority is:
pnpm > bun > yarn > npm
Project markers:
electron, electron-builder, electron-vite, electron/, electron.vite.config.*src-tauri/, tauri.conf.json, tauri scripts/dependenciesnext.config.* or nextvite.config.* or viteturbo.jsonnx.jsonapps/, packages/, TurboRepo or NX markersCargo.toml without package.jsonCore commands:
srun dev — run the project in development mode.srun build — build the project.srun installer — create installer/package/release artifacts when a matching script exists.srun test — run tests.srun check — run validation/typecheck. Alias: srun typecheck.srun preview — run preview/serve production build when available.srun clean — clean build output/cache.srun setup — run setup/bootstrap/dependency scripts. Aliases: srun install, srun bootstrap.srun lint — run linting.srun format — run formatting.srun info — show detected project type, package manager, warnings, and resolved commands.srun list — show resolved intents plus all package scripts.Safe flags for executable commands:
--dry-run prints the resolved command without executing it.--verbose prints detection and resolution details.Next.js:
{
"scripts": {
"dev": "next dev"
}
}
srun dev --dry-run
# pnpm run dev
Electron:
{
"scripts": {
"dev": "vite",
"dev:electron": "electron-vite dev"
}
}
srun dev --dry-run
# pnpm run dev:electron
Tauri:
{
"scripts": {
"tauri:dev": "tauri dev"
}
}
srun dev --dry-run
# pnpm run tauri:dev
Cargo-only:
srun dev --dry-run
# cargo run
srun check --dry-run
# cargo check
srun clean --dry-run
# cargo clean
TypeScript validation:
{
"scripts": {
"check": "tsc --noEmit"
}
}
srun check --dry-run
# pnpm run check
Discovery:
srun list
Shows resolved intents and all package scripts.
srun info
Prints project type, package manager, warnings, and resolved commands.
srun dev --verbose --dry-run
Shows detection and resolution phases before printing the command.
Releases are published by GitHub Actions from version tags.
package.json and Cargo.toml.npm run release:check
cargo fmt -- --check
cargo check
cargo test
git tag v0.1.5
git push origin main v0.1.5
The workflow builds platform binaries, packages them into the single root npm package, publishes @engramresearch/srun to npmjs, then publishes the same package as a GitHub Packages mirror.
Required GitHub secret:
NPM_TOKEN
Use an npm automation/granular token that can publish under @engramresearch and bypass 2FA for CI.
GitHub Packages uses the workflow GITHUB_TOKEN; no extra secret is required.
srun dev web are detected as a future extension but not fully implemented yet.srun reports candidates instead of guessing.FAQs
Universal Smart Project Runner
We found that @engramresearch/srun demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket MCP now lets AI assistants review org alerts, investigate threats using the Socket threat feed, and inspect package files in addition to dependency scoring.

Product
Socket Firewall blocks malicious VS Code and Open VSX extensions before install, protecting developers from compromised editor marketplaces.

Research
More than 140 Mastra npm packages were compromised in a supply chain attack that used a typosquatted dependency to deliver a cross-platform infostealer during installation.