
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@mysocial.io/intelligence
Advanced tools
Social media MCP server for creators: your real Instagram, TikTok, YouTube, LinkedIn and Threads history — posts, transcripts, comments and audience — readable by Claude, ChatGPT and Codex. Reads what you already published; it does not post for you.
A social media MCP server for creators. It gives Claude, Claude Code, ChatGPT and Codex your real Instagram, TikTok, YouTube, LinkedIn and Threads history — posts, transcripts, comments and audience — as tools they can call. It reads what you already published; it does not post for you.
Full connector docs (endpoint URL, per-client setup, tool list): mysocial.io/mcp.
npx -y @mysocial.io/intelligence@latest setup
That is the whole command. There is no code to fetch first and nothing expires.
The installer detects Claude Code and Codex, installs for the current user by default, opens the client's OAuth flow, and prints the first prompt to run. If both clients are available, select one interactively or pass --client claude / --client codex.
Signing in happens in your AI client, not here: it opens the browser, and if you are already signed in to Mysocial it returns straight away. If you are not — or have no account yet — you sign in or sign up there and land back in the same place. So this command is also a perfectly good way to start from scratch.
--sessionMysocial's onboarding page shows the same command with a --session <code> on the end. That code buys one thing: the installer reports progress back, so the page you started on can show the install happening live. It is never required, and outside that page it only gives you a value that expires.
mysocial-intelligence status
mysocial-intelligence repair
mysocial-intelligence uninstall
Useful options:
--scope project installs the agent and skills in the current project instead of user directories.--base-url https://example.mysocial.io overrides the current https://app.mysocial.io service. It takes precedence over MYSOCIAL_SETUP_API_URL.--no-telemetry is accepted for automation and policy compliance. This release sends no optional telemetry.| Client | User scope | Project scope |
|---|---|---|
| Claude agent | ~/.claude/agents/mysocial-intelligence.md | .claude/agents/mysocial-intelligence.md |
| Claude skills | ~/.claude/skills/{skill}/ | .claude/skills/{skill}/ |
| Codex agent | ~/.codex/agents/mysocial-intelligence.toml | .codex/agents/mysocial-intelligence.toml |
| Codex skills | ~/.agents/skills/{skill}/ | .agents/skills/{skill}/ |
Claude MCP registration uses its native scoped commands. User-scoped Codex registration uses codex mcp add. Because the Codex CLI has no project-scope flag, project setup atomically adds a marker-delimited [mcp_servers.mysocial] block to .codex/config.toml; it never changes the user's global Codex MCP configuration.
Codex exposes codex mcp login mysocial for OAuth. Current Claude Code completes remote MCP OAuth inside its interactive /mcp panel, so the installer offers to open Claude Code and explains the two choices to make there. If a future Claude release exposes a native mcp login command, the installer detects and uses it automatically. For the interactive Claude path, the CLI deliberately does not report OAuth success; Mysocial advances only when it observes real authenticated MCP traffic.
An ownership manifest is stored at ~/.mysocial/intelligence/manifest.json or .mysocial/intelligence/manifest.json. Every managed file has a SHA-256 checksum. Repair only replaces a file when its checksum proves Mysocial owns the current bytes. Uninstall preserves pre-existing and user-modified files and only removes an MCP registration that the manifest says Mysocial created and that still points to the installed URL.
When --session is present, the CLI calls:
GET <base-url>/api/intelligence/setup/v1/session
PATCH <base-url>/api/intelligence/setup/v1/session
Authorization: Setup <one-time-secret>
The GET response may use either a flat shape or a session envelope and supplies the expiry, selected/permitted clients, and MCP URL:
{
"session": {
"expiresAt": "2026-07-22T12:00:00.000Z",
"selectedClient": "codex",
"allowedClients": ["claude-code", "codex"]
},
"mcp": { "url": "https://app.mysocial.io/mcp" }
}
Progress PATCHes contain only phase, client, installerVersion, and, on failure, a safe errorCode. Allowed phases are client_selected, assets_installed, oauth_started, oauth_connected, awaiting_test, and failed. The CLI cannot report onboarding completion or MCP verification. Only the server's successful authenticated list_channels observation can verify an MCP connection; the browser may separately skip the optional AI step after the required social channel is connected.
The setup secret is used only in the HTTP authorization header. It is never written to disk, passed to a child process, included in output, or sent as telemetry. Functional setup progress is sent only when a setup session is explicitly supplied.
The canonical workflow skills live under services/connect-api/ssr/features/feature-mcp/skills. (services/webapp holds the pre-split copy and no longer receives changes.) Keep the package copies current with:
npm run sync:assets
npm test
npm pack --dry-run
The package is configured for public npm access and provenance. Publishing still requires an authorized @mysocial npm scope and a provenance-capable CI environment.
FAQs

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.