
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@pandanpc/mcp-server
Advanced tools
PandaNpc MCP Server — PandaNote and Agent connection management for Codex, Claude Code, and other MCP clients
PandaNpc MCP Server — expose PandaNote, workspaces, AI models, scheduled tasks, and Agent connection management to Codex, Claude Code, Cursor, Windsurf, and other MCP clients.
npm install -g @pandanpc/mcp-server
The postinstall script downloads the matching Rust binary for your platform from https://cos.pandanpc.com/mcp-server/.
Edit ~/.config/claude-code/config.json (or the platform equivalent):
{
"mcpServers": {
"pandanpc": {
"command": "pandanpc-mcp"
}
}
}
# stdio mode (default for MCP clients)
pandanpc-mcp
# HTTP/SSE mode
pandanpc-mcp --http --port 3100
Add this to ~/.codex/config.toml:
[mcp_servers.pandanpc]
command = "pandanpc-mcp"
get_guide — load only the workflow needed: notes, layouts, schedules, mail, memory or ASCnote_layout_guide — choose and write native image galleries (also available as get_guide topic layouts)note_login — log in to your PandaNpc accountlist_workspaces / create_workspace / update_workspace / delete_workspacelist_notes / create_note / read_note / update_note / delete_note / move_note_to_workspacesearch_notes — title + full-text + semantic searchgenerate_note_title — AI-generated title and iconlist_providers / create_provider / update_provider / delete_providerlist_models / list_model_types / create_model / update_model / delete_modellist_agent_connections — inspect Claude Code / Codex / PandaCode connections without exposing relay tokenscreate_agent_connection — idempotently create a connection; current-machine PandaPaw credentials are auto-detectedlist_scheduled_tasks / create_scheduled_task / update_scheduled_task / toggle_scheduled_task / delete_scheduled_tasksync_rules — sync .claude/rules/ and .claude/skills/ Markdown files to PandaNoteAccount operations require note_login when not already authenticated. Reading guides does not require a note login.
The npm launcher starts the last verified runtime immediately and checks for a newer stable release in a separate background process (at most once every six hours; failed checks back off for 15 minutes). It downloads the platform binary into the user's cache, verifies SHA-256, and runs a bounded startup check before atomically selecting it for the next launch. Current MCP sessions are never restarted or replaced. Offline or failed updates keep the existing runtime usable.
The cache defaults to ~/.pandanpc-mcp/runtime/<platform>-<arch> and does not require write access to a global npm installation. Each version uses its own file, including on Windows. Older cached executables are retained because another session may still use them; remove the cache only after closing those sessions if you want to reclaim disk space.
pandanpc-mcp --version shows the selected runtime and npm launcher versions.pandanpc-mcp --update checks/downloads now; reconnect afterwards to use the result. Status messages go to stderr, never the MCP protocol stream.PANDANPC_MCP_AUTO_UPDATE=0 in the MCP client's environment to disable checks and pin the runtime bundled with the installed npm version.PANDANPC_MCP_CACHE_DIR optionally selects a different user-writable cache directory.Existing users must first upgrade to a launcher containing this feature with npm install -g @pandanpc/mcp-server@latest, then reconnect. Automatic updates cover the executable and its embedded guides, not the npm launcher code or separately copied Skill files. A future release requiring a different updater protocol must be installed through npm; --update reports that condition. Directly launching a downloaded Rust binary bypasses the npm updater.
The package includes skills/pandanpc/SKILL.md and its references. These are the same guide files embedded in the MCP binary, so examples stay aligned with the installed version. MCP-only clients can call get_guide; they do not need filesystem or Skill support.
For a client that supports Agent Skills, explicitly install/copy the package's skills/pandanpc directory to that client's supported skill location. For a global npm installation, the package is under npm root -g plus @pandanpc/mcp-server. Consult your client's skill discovery settings, and refresh this optional copy when updating the MCP. The npm installer does not modify user/project skill directories automatically.
The bundled skill covers public PandaNpc workflows only; it does not contain project-specific machine settings or credentials.
MIT © PandaNpc
FAQs
PandaNpc MCP Server — PandaNote and Agent connection management for Codex, Claude Code, and other MCP clients
We found that @pandanpc/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.