
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@pulsemcp/air-core
Advanced tools
AIR core — config resolution, validation, schemas, and extension interfaces
Core package for the AIR framework. Provides config resolution, validation, JSON schemas, and extension interfaces.
npm install @pulsemcp/air-core
import {
resolveArtifacts,
validateJson,
mergeArtifacts,
emptyArtifacts,
} from "@pulsemcp/air-core";
// Resolve all artifacts from an air.json file
const artifacts = await resolveArtifacts("~/.air/air.json");
// Validate a JSON file against its AIR schema
const result = validateJson(data, "skills");
// Merge two artifact sets (additive union — duplicate qualified IDs throw)
const merged = mergeArtifacts(base, overlay);
import { resolveArtifacts } from "@pulsemcp/air-core";
import { GitHubCatalogProvider } from "@pulsemcp/air-provider-github";
const artifacts = await resolveArtifacts("./air.json", {
providers: [new GitHubCatalogProvider()],
});
resolveArtifacts(), loadAirConfig(), mergeArtifacts(), emptyArtifacts()validateJson() using AJV against AIR JSON SchemasloadSchema(), detectSchemaType(), detectSchemaFromValue()SkillEntry, McpServerEntry, RootEntry, ReferenceEntry, PluginEntry, HookEntryAgentAdapter, CatalogProvider, PrepareTransform, AirExtensionAgentSessionConfig, StartCommand, PrepareSessionOptions, PreparedSessionCore defines four extension points that other packages implement:
| Interface | Purpose | Example |
|---|---|---|
AgentAdapter | Translate AIR config for a specific agent | @pulsemcp/air-adapter-claude |
CatalogProvider | Resolve remote URIs in air.json | @pulsemcp/air-provider-github |
PrepareTransform | Post-prepare transforms on .mcp.json | @pulsemcp/air-secrets-env, @pulsemcp/air-secrets-file |
AirExtension | Extension metadata for CLI discovery | All extension packages |
FAQs
AIR core — config resolution, validation, schemas, and extension interfaces
We found that @pulsemcp/air-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.