
Product
Socket Now Protects the Firefox Extension Ecosystem
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.
@heznpc/anvil
Advanced tools
Atomic workflow recipes for Claude Code. One MCP tool call runs the whole commit → push → PR → CI-wait → merge pipeline.
Atomic workflow recipes for Claude Code. One MCP tool call runs the whole commit → push → PR → CI-wait → merge pipeline. Either all of it happens, or it errors cleanly. No more half-finished agent loops.
Claude Code memory rules (CLAUDE.md) are advisory. The model routinely ignores procedural instructions like "commit → push → open a PR → wait for CI → merge — no confirmation at each step." anthropics/claude-code#8059 is the canonical bug that every duplicate gets merged into.
Hooks can gate a single tool call but can't force a sequence across calls. The actual fix is to move atomicity down a layer — from the agent loop (where enforcement is impossible) to the tool call (where atomicity is native).
anvil exposes a single MCP tool (ship) that runs the entire pipeline inside one tool call. The model either invokes it end-to-end or errors. No partial state, no skipped steps, no approval fatigue.
npm install -g @heznpc/anvil
Then in your repo:
anvil init
This wires up .claude/settings.json to register anvil's MCP server for that project.
In a Claude Code session:
> ship this as "fix auth redirect bug"
Claude calls the ship tool. Internally it runs:
git add -Agit commit -m "<message>"git push -u origin HEAD (creates a branch if you're on main)gh pr create --base main --title "<message>"gh pr checks --watch (blocks until CI passes)gh pr merge --squash --delete-branchAny step failing aborts the whole pipeline. No half-shipped state.
| Arg | Required | Default | Description |
|---|---|---|---|
message | yes | — | Commit message and PR title |
branch | no | ship/<timestamp> | Branch name, used when starting from the base branch |
strategy | no | squash | Merge strategy: squash / merge / rebase |
base | no | main | Base branch for the PR |
git with an authenticated remotegh CLI (run gh auth status to confirm)Stop hook): blocks session end if a ship started but didn't completeship| anvil | Claude hooks only | Slash commands | Spine-lite | |
|---|---|---|---|---|
| Atomic multi-step workflows | ✅ tool-call level | ❌ per-call gate only | ⚠️ manual chain | ❌ single-call policy |
| Works without user remembering to type a command | ✅ | ⚠️ | ❌ | ⚠️ |
| CI wait + merge built in | ✅ | ❌ | ⚠️ DIY | ❌ |
| Cross-repo portable | ✅ | ⚠️ | ⚠️ | ⚠️ |
MIT © heznpc
FAQs
Atomic workflow recipes for Claude Code. One MCP tool call runs the whole commit → push → PR → CI-wait → merge pipeline.
We found that @heznpc/anvil demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.