
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@heznpc/anvil
Advanced tools
Atomic workflow recipes for Claude Code. One MCP tool call runs the whole commit → push → PR → CI-wait → merge pipeline.
Atomic workflow recipes for Claude Code. One MCP tool call runs the whole commit → push → PR → CI-wait → merge pipeline. Either all of it happens, or it errors cleanly. No more half-finished agent loops.
Claude Code memory rules (CLAUDE.md) are advisory. The model routinely ignores procedural instructions like "commit → push → open a PR → wait for CI → merge — no confirmation at each step." anthropics/claude-code#8059 is the canonical bug that every duplicate gets merged into.
Hooks can gate a single tool call but can't force a sequence across calls. The actual fix is to move atomicity down a layer — from the agent loop (where enforcement is impossible) to the tool call (where atomicity is native).
anvil exposes a single MCP tool (ship) that runs the entire pipeline inside one tool call. The model either invokes it end-to-end or errors. No partial state, no skipped steps, no approval fatigue.
npm install -g @heznpc/anvil
Then in your repo:
anvil init
This wires up .claude/settings.json to register anvil's MCP server for that project.
In a Claude Code session:
> ship this as "fix auth redirect bug"
Claude calls the ship tool. Internally it runs:
git add -Agit commit -m "<message>"git push -u origin HEAD (creates a branch if you're on main)gh pr create --base main --title "<message>"gh pr checks --watch (blocks until CI passes)gh pr merge --squash --delete-branchAny step failing aborts the whole pipeline. No half-shipped state.
| Arg | Required | Default | Description |
|---|---|---|---|
message | yes | — | Commit message and PR title |
branch | no | ship/<timestamp> | Branch name, used when starting from the base branch |
strategy | no | squash | Merge strategy: squash / merge / rebase |
base | no | main | Base branch for the PR |
git with an authenticated remotegh CLI (run gh auth status to confirm)Stop hook): blocks session end if a ship started but didn't completeship| anvil | Claude hooks only | Slash commands | Spine-lite | |
|---|---|---|---|---|
| Atomic multi-step workflows | ✅ tool-call level | ❌ per-call gate only | ⚠️ manual chain | ❌ single-call policy |
| Works without user remembering to type a command | ✅ | ⚠️ | ❌ | ⚠️ |
| CI wait + merge built in | ✅ | ❌ | ⚠️ DIY | ❌ |
| Cross-repo portable | ✅ | ⚠️ | ⚠️ | ⚠️ |
MIT © heznpc
FAQs
Atomic workflow recipes for Claude Code. One MCP tool call runs the whole commit → push → PR → CI-wait → merge pipeline.
The npm package @heznpc/anvil receives a total of 2 weekly downloads. As such, @heznpc/anvil popularity was classified as not popular.
We found that @heznpc/anvil demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.