
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@gently/mcp-server
Advanced tools
MCP server for gently. Agents query the knowledge graph over stdio; authorization uses gently's device flow (approve in the console — no tokens in your MCP config).
npx -y @gently/mcp-server
On the first tool call without credentials, the server returns a console URL and a short
code. Approve there, then retry the same tool call so gently can finish signing in.
Credentials stay on the machine (owner-only) and refresh automatically. A pending device
code is kept across process restarts so a short-lived npx probe does not mint a new code
after you already approved.
For CI, set GENTLY_TOKEN to a bearer token instead of using the device flow.
Point the server at your gently deployment:
| Variable | Required | Purpose |
|---|---|---|
GENTLY_API_URL | yes | Graph API base URL (include /v1) |
GENTLY_IDENTITY_URL | yes | Identity base URL used for device auth |
GENTLY_GRAPH | no | Graph id (defaults to the deployment default) |
GENTLY_CLIENT_NAME | no | Label shown on the approval screen |
GENTLY_TOKEN | no | Bearer token; skips device flow (CI) |
Example MCP client entry:
{
"mcpServers": {
"gently": {
"command": "npx",
"args": ["-y", "@gently/mcp-server"],
"env": {
"GENTLY_API_URL": "<your-graph-api>/v1",
"GENTLY_IDENTITY_URL": "<your-identity-url>"
}
}
}
}
Writes gently agent guidance into the current repo:
npx -y -p @gently/mcp-server gently-mcp-init
Enrich the graph with a simplified SCIP JSON index (not full protobuf).
Requires a token with graph:write (device-flow approver or GENTLY_TOKEN).
When to upload — on CI after scip-typescript / scip-python (or when an
operator explicitly asks). Not on every agent query: read tools
(gently_query / gently_path / gently_impact) never upload.
MCP tool — gently_upload_scip with path to a JSON file or inline index
(opt-in; agents must not call it unless asked).
CLI (preferred for CI):
npx -y -p @gently/mcp-server gently-mcp-scip-upload \
--file ./index.scip.json \
--source github:org/repo
Typical CI: scip-typescript index → convert to the ADR-0024 JSON shape → upload.
Bodies over 1 MiB are rejected by the edge.
MIT
FAQs
gently MCP server — repo-first graph tools for agents
The npm package @gently/mcp-server receives a total of 29 weekly downloads. As such, @gently/mcp-server popularity was classified as not popular.
We found that @gently/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.