
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@mcoda/codali
Advanced tools
Standalone tool-runner adapter for mcoda. codali runs a tool loop that can edit the repo directly via built-in tools, with optional streaming output and pre-flight cost estimates.
Run with a task file:
codali run --workspace-root . --provider openai-compatible --model gpt-4o-mini --task tasks/work.txt
Or pass the task on stdin:
echo "Fix the failing test" | codali run --workspace-root . --provider ollama-remote --model llama3
Enable the multi-phase pipeline with --smart (librarian/architect/builder/critic):
codali run --smart --workspace-root . --provider openai-compatible --model gpt-4o-mini --task tasks/work.txt
You can also set CODALI_SMART=1 in the environment.
openai-compatible (default base URL: https://api.openai.com/v1)ollama-remote (default base URL: http://127.0.0.1:11434)stub (test-only provider)codali merges config in this order:
codali.config.json or .codalircCommon environment variables:
CODALI_WORKSPACE_ROOTCODALI_PROVIDERCODALI_MODELCODALI_API_KEYCODALI_BASE_URLCODALI_STREAMING_ENABLEDCODALI_STREAMING_FLUSH_MSCODALI_COST_MAX_PER_RUNCODALI_COST_CHAR_PER_TOKENCODALI_COST_PRICING_OVERRIDESCODALI_TOOLS_ENABLEDCODALI_ALLOW_SHELLCODALI_SHELL_ALLOWLISTDOCDEX_HTTP_BASE_URLCODALI_DOCDEX_REPO_IDRouting config (per phase, optional) lives in codali.config.json:
{
"routing": {
"librarian": { "agent": "<librarian-agent-slug>", "temperature": 0.1 },
"architect": { "agent": "<architect-agent-slug>", "temperature": 0.4 },
"builder": { "agent": "<builder-agent-slug>", "temperature": 0.2, "format": "json" },
"critic": { "agent": "<critic-agent-slug>", "temperature": 0.1 },
"interpreter": { "agent": "<interpreter-agent-slug>", "temperature": 0.1 }
},
"limits": {
"maxRetries": 3
}
}
To enforce a GBNF grammar with Ollama:
{
"routing": {
"builder": { "format": "gbnf", "grammar": "root ::= \"ok\"" }
}
}
Routing env overrides:
CODALI_PROVIDER_LIBRARIANCODALI_PROVIDER_ARCHITECTCODALI_PROVIDER_BUILDERCODALI_PROVIDER_CRITICCODALI_PROVIDER_INTERPRETERCODALI_MODEL_LIBRARIANCODALI_MODEL_ARCHITECTCODALI_MODEL_BUILDERCODALI_MODEL_CRITICCODALI_MODEL_INTERPRETERCODALI_FORMAT_LIBRARIANCODALI_FORMAT_ARCHITECTCODALI_FORMAT_BUILDERCODALI_FORMAT_CRITICCODALI_FORMAT_INTERPRETERCODALI_GRAMMAR_LIBRARIANCODALI_GRAMMAR_ARCHITECTCODALI_GRAMMAR_BUILDERCODALI_GRAMMAR_CRITICCODALI_GRAMMAR_INTERPRETERCODALI_LIMIT_MAX_RETRIEScodali writes JSONL logs under logs/codali/<runId>.jsonl, rooted in the global workspace folder
(~/.mcoda/workspaces/<workspace>/).
codali calls docdex over HTTP for search/snippets/graphs and uses MCP for symbols/AST/memory. Ensure docdexd is running and DOCDEX_HTTP_BASE_URL is set if needed.
FAQs
Standalone tool-runner adapter for mcoda.
The npm package @mcoda/codali receives a total of 131 weekly downloads. As such, @mcoda/codali popularity was classified as not popular.
We found that @mcoda/codali demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.