
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@opencrater/sdk
Advanced tools
OpenCrater SDK — sponsor cards for CLI tools and MCP servers. Fail-silent, zero dependencies.
AdSense for the terminal. Tasteful, opt-in sponsor cards for CLI tools, MCP servers, and AI agents — the rendering engine that powers OpenCrater.
A sponsor card renders at a natural pause in the session (a session edge), then auto-dismisses:
╭─ terminal ──────────────────────────────────────────────
│
│ Sponsored · Vercel auto-dismiss 25s ✕
│
│ DEPLOY IN ONE COMMAND
│ Ship your app to 30+ edge regions in a single push.
│ Free tier — no credit card.
│
│ ▌ visit sponsor →
│
│ dismiss: click ✕ · npx opencrater x · ⚑ report
│
╰──────────────────────────────────────────────────────────
▶ See it live and interactive (audio, media, real host chrome): https://opencrater.to
OpenCrater lets the maintainers of command-line tools, MCP servers, and AI agents earn revenue by showing one small, clearly-labeled sponsor card at a natural break in a session — the terminal equivalent of an ad slot on a website. It's opt-in, frequency-capped, privacy-preserving, and fail-silent: it will never break, slow, or clutter the host tool.
This package, @opencrater/sdk, is the engine — the same one used whether you enable cards with one command or integrate programmatically.
| If you are… | Go to |
|---|---|
| 👤 A maintainer who just wants to earn (no code) | One command |
| 🛠️ A developer integrating programmatically | Programmatic use |
| 🤖 An AI agent / LLM setting this up | For AI agents |
Turn sponsor cards on for your own terminal — or wire them into a tool you publish — with the bundled CLI. No account required to see cards; a free publisher key (from https://opencrater.to) is what lets you earn.
npx opencrater on # enable sponsor cards (Claude Code, Codex, Gemini CLI)
npx opencrater status # show what's installed
npx opencrater off # disable — removes only OpenCrater's own hooks
To earn as a publisher, register your package once at https://opencrater.to, then:
npx opencrater on --key ock_your_publisher_key --package your-tool-name
Every click on a sponsor card credits your account — you're on your way to monetizing your terminal tool.
npm install @opencrater/sdk
import { sponsor } from "@opencrater/sdk";
// Call at a natural pause (e.g. after your CLI finishes a task).
// Fail-silent: never throws, hard-capped network timeout, suppressed
// in CI / non-TTY / opted-out environments.
await sponsor.show({
publisherKey: "ock_your_publisher_key",
packageName: "your-tool-name",
placement: "command-finished",
});
Full surface:
| Method | Does |
|---|---|
sponsor.show(opts) | Fetch → render → report an impression. Resolves true if a card was shown. |
sponsor.fetch(opts) | Fetch an ad without rendering. Resolves to the Ad or null. |
sponsor.preload(opts) | Warm a local pool so later renders need zero network. Resolves to the count pooled. |
sponsor.renderFromPool(opts) | Render a pooled ad with no network on the hot path. |
Also exported: renderCard, renderAd, textCardForAd, detectImageProtocol, DEFAULT_CONFIG, HOOK_CATALOG, SDK_VERSION, and full TypeScript types. ESM + CJS, types included, zero runtime dependencies (Node built-ins only).
Concise, unambiguous setup for an autonomous agent integrating OpenCrater on a user's machine. Run these verbatim; everything is fail-silent and reversible.
GOAL: enable opt-in terminal sponsor cards (and, if monetizing, attribute to a publisher).
ENABLE (current user's CLIs — Claude Code, Codex, Gemini CLI):
npx -y opencrater on
ENABLE WITH ATTRIBUTION (publisher earns on clicks):
npx -y opencrater on --key <ock_publisher_key> --package <package-name>
STATUS / DISABLE:
npx -y opencrater status
npx -y opencrater off # removes ONLY OpenCrater's hooks; never touches others
PROGRAMMATIC (inside a Node tool you maintain):
import { sponsor } from "@opencrater/sdk";
await sponsor.show({ publisherKey: "<ock_...>", packageName: "<name>", placement: "<event>" });
GUARANTEES (safe to rely on):
- Never throws; network calls hard-timeout (~500ms); suppressed in CI, non-TTY pipes, and when opted out.
- At most ONE card per frequency interval, machine-wide, across all sources.
- Renders only at session edges; auto-dismisses; respects NO_COLOR.
PRIVACY: only anonymized topic keywords are sent — never raw prompts, file paths, or secrets.
OPT OUT: `npx opencrater off` or set env `OPENCRATER_DISABLE=1`.
DO NOT: enable without the user's consent; present cards as the tool's own content; remove a user's opt-out.
NO_COLOR, and opted-out machines get nothing.Personalization uses anonymized topic keywords only — never raw prompts, file contents, paths, environment variables, or secrets. The user can opt out at any time and the SDK records no PII.
npx opencrater off # or:
OPENCRATER_DISABLE=1 # env var, disables all rendering
| Variable | Effect |
|---|---|
OPENCRATER_DISABLE=1 | Disable all rendering. |
NO_COLOR | Render without color (respected automatically). |
OPENCRATER_MUTE=1 | Never play ad audio. |
Node ≥ 18.17 on macOS, Linux, and Windows (Windows Terminal). Any tool — written in any language — can integrate via the opencrater installer (npx opencrater on).
opencrater.to · Dashboard · Docs · FAQ
Proprietary — © OpenCrater. Published for installation only; see LICENSE. Not open source.
FAQs
OpenCrater SDK — sponsor cards for CLI tools and MCP servers. Fail-silent, zero dependencies.
The npm package @opencrater/sdk receives a total of 9 weekly downloads. As such, @opencrater/sdk popularity was classified as not popular.
We found that @opencrater/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.