
Research
/Security News
GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.
@kepler-project/almanac
Advanced tools
MCP server exposing Kepler Almanac tools (customers, communications, briefs, product gaps, Confluence/Jira search) for Claude Code, Cursor, OpenAI Codex CLI, and other stdio MCP clients.
Distribution:
@kepler-project/almanac: pure JavaScript MCP stdio server used directly via npx -y -p @kepler-project/almanac@latest -c almanac.npx -y -p @kepler-project/almanac@latest -c almanac
The npx package runs as a JavaScript MCP server, connects to the hosted Kepler gRPC services, and mints its auth token internally from KEPLER_CLIENT_ID and KEPLER_CLIENT_SECRET.
Tool execution in this package is gRPC-only. The only HTTP request is the auth token mint to /v1/auth/service-token, which has no gRPC equivalent.
The npm distribution targets hosted Kepler production services only. There is no local-dev mode in the npx package.
/v1/auth/service-token.KEPLER_CLIENT_ID.| Client | Where to merge |
|---|---|
| Cursor | ~/.cursor/mcp.json (or project .cursor/mcp.json) under mcpServers |
| Claude Code | mcpServers in ~/.claude.json or project config per Anthropic docs |
| Codex CLI | ~/.codex/config.toml – [mcp_servers.kepler-almanac] (see Codex MCP) |
Use the portal Kepler MCP tab to download ready-made fragments.
Example shape (Cursor / Claude Code JSON):
{
"mcpServers": {
"kepler-almanac": {
"command": "npx",
"args": ["-y", "-p", "@kepler-project/almanac@latest", "-c", "almanac"],
"env": {
"KEPLER_CLIENT_ID": "your-client-id",
"KEPLER_CLIENT_SECRET": "your-client-secret"
}
}
}
}
KEPLER_CLIENT_ID=... KEPLER_CLIENT_SECRET=... npx -y -p @kepler-project/almanac@latest -c almanacKEPLER_CLIENT_ID or KEPLER_CLIENT_SECRET should fail fast.tools/list should advertise the Almanac, briefs, Salesforce, Confluence, Jira, and team tool families.KEPLER_GRPC_ENDPOINT is intended for advanced hosted-endpoint overrides, not local development.KEPLER_PORTAL_URL is not used by the npm package. Portal access is only for humans obtaining service credentials and downloading config fragments.FAQs
Kepler Almanac MCP server.
We found that @kepler-project/almanac demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.

Security News
Anthropic says the directive cited national security concerns over a narrow jailbreak, but offered no specific technical details.

Security News
A network of 152 Chrome live wallpaper extensions hid ad tracking and made extension-driven traffic look like Google search clicks.