
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@mcoda/codali
Advanced tools
Standalone tool-runner adapter for mcoda. codali runs a tool loop that can edit the repo directly via built-in tools, with optional streaming output and pre-flight cost estimates.
Run with a task file:
codali run --workspace-root . --provider openai-compatible --model gpt-4o-mini --task tasks/work.txt
Or pass the task on stdin:
echo "Fix the failing test" | codali run --workspace-root . --provider ollama-remote --model llama3
Enable the multi-phase pipeline with --smart (librarian/architect/builder/critic):
codali run --smart --workspace-root . --provider openai-compatible --model gpt-4o-mini --task tasks/work.txt
You can also set CODALI_SMART=1 in the environment.
openai-compatible (default base URL: https://api.openai.com/v1)ollama-remote (default base URL: http://127.0.0.1:11434)stub (test-only provider)codali merges config in this order:
codali.config.json or .codalircCommon environment variables:
CODALI_WORKSPACE_ROOTCODALI_PROVIDERCODALI_MODELCODALI_API_KEYCODALI_BASE_URLCODALI_STREAMING_ENABLEDCODALI_STREAMING_FLUSH_MSCODALI_COST_MAX_PER_RUNCODALI_COST_CHAR_PER_TOKENCODALI_COST_PRICING_OVERRIDESCODALI_TOOLS_ENABLEDCODALI_ALLOW_SHELLCODALI_SHELL_ALLOWLISTDOCDEX_HTTP_BASE_URLCODALI_DOCDEX_REPO_IDRouting config (per phase, optional) lives in codali.config.json:
{
"routing": {
"librarian": { "agent": "<librarian-agent-slug>", "temperature": 0.1 },
"architect": { "agent": "<architect-agent-slug>", "temperature": 0.4 },
"builder": { "agent": "<builder-agent-slug>", "temperature": 0.2, "format": "json" },
"critic": { "agent": "<critic-agent-slug>", "temperature": 0.1 },
"interpreter": { "agent": "<interpreter-agent-slug>", "temperature": 0.1 }
},
"limits": {
"maxRetries": 3
}
}
To enforce a GBNF grammar with Ollama:
{
"routing": {
"builder": { "format": "gbnf", "grammar": "root ::= \"ok\"" }
}
}
Routing env overrides:
CODALI_PROVIDER_LIBRARIANCODALI_PROVIDER_ARCHITECTCODALI_PROVIDER_BUILDERCODALI_PROVIDER_CRITICCODALI_PROVIDER_INTERPRETERCODALI_MODEL_LIBRARIANCODALI_MODEL_ARCHITECTCODALI_MODEL_BUILDERCODALI_MODEL_CRITICCODALI_MODEL_INTERPRETERCODALI_FORMAT_LIBRARIANCODALI_FORMAT_ARCHITECTCODALI_FORMAT_BUILDERCODALI_FORMAT_CRITICCODALI_FORMAT_INTERPRETERCODALI_GRAMMAR_LIBRARIANCODALI_GRAMMAR_ARCHITECTCODALI_GRAMMAR_BUILDERCODALI_GRAMMAR_CRITICCODALI_GRAMMAR_INTERPRETERCODALI_LIMIT_MAX_RETRIEScodali writes JSONL logs under logs/codali/<runId>.jsonl, rooted in the global workspace folder
(~/.mcoda/workspaces/<workspace>/).
codali calls docdex over HTTP for search/snippets/graphs and uses MCP for symbols/AST/memory. Ensure docdexd is running and DOCDEX_HTTP_BASE_URL is set if needed.
FAQs
Standalone tool-runner adapter for mcoda.
The npm package @mcoda/codali receives a total of 538 weekly downloads. As such, @mcoda/codali popularity was classified as not popular.
We found that @mcoda/codali demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.