
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@planu/cli
Advanced tools
Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).
The high-performance SDD stack for AI coding agents.
Documentation · Docs in Spanish · Docs in Portuguese
Planu is the complete Spec Driven Development stack for AI coding agents — an MCP server that enforces a structured workflow from brainstorm to validation. Powered by a native Rust core, Planu provides the performance and reliability needed for large-scale AI development.
Spec first, always. No approved spec means no code. This eliminates vibe-coding debt at scale.
spec.md.Add to your MCP client config (Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"planu": {
"command": "npx",
"args": ["-y", "@planu/cli@latest"]
}
}
}
Requirements: Node.js >= 22. The native Rust core is bundled and auto-detected for macOS (Intel/M1), Linux, and Windows.
init_project → create_spec → challenge_spec → check_readiness → implement → validate → done
Every transition is gated by Definition of Ready (DoR) and Definition of Done (DoD) checks. Specs are the single source of truth — implementation is validated against them.
Planu runs follow-up actions automatically after each step:
create_spec automatically runs challenge_spec + check_readiness.update_status(done) automatically runs validate + scans crash risks + freezes the spec.update_status(approved) automatically snapshots the spec version.Specs are context-efficient: 1 single file per spec containing both functional requirements and technical implementation details.
planu/specs/SPEC-001-auth/
└── spec.md # Requirements + Technical + Criteria + Status
Criteria use zero-ambiguity GIVEN/WHEN/THEN format — ensuring your AI never misinterprets the goal.
Planu v3.0 introduces The Rust Revolution:
| Feature | Node.js (Legacy) | Planu-RS (v3.0) | Benefit |
|---|---|---|---|
| Project Scanning | Sequential (Slow) | Parallel (Rayon) | 10x Speedup |
| File Watching | Polling/Event Loop | OS-level (Notify) | 0% CPU Idle |
| Spec Hashing | JS Crypto | Native SHA-256 | Instant Sync |
| Drift Monitor | Memory Heavy | Streaming Scan | Monorepo Ready |
src/
├── engine/ # Hybrid Core: TS Business Logic + Rust Native Engine
│ └── planu-core.node # High-performance native module
├── tools/ # Canonical SDD MCP tools + internal workflow handlers
├── storage/ # Atomic persistence layer
└── types/ # Strict TypeScript contracts
data/ # Local storage (gitignored)
├── projects/{hash}/ # Per-project: specs, metrics, patterns, knowledge
└── global/ # Shared: templates, pricing
pnpm install # Install dependencies
pnpm build # Compile TS + Build Rust bridge
pnpm dev # Watch mode
pnpm test # Run 31,000+ tests
FAQs
Planu — MCP Server for Spec Driven Development with native Rust acceleration for hot paths. Cross-platform (Linux/macOS/Windows, x64/arm64, glibc/musl).
The npm package @planu/cli receives a total of 6,002 weekly downloads. As such, @planu/cli popularity was classified as popular.
We found that @planu/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.