
Security News
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
@pulsemcp/air-core
Advanced tools
AIR core — config resolution, validation, schemas, and extension interfaces
Core package for the AIR framework. Provides config resolution, validation, JSON schemas, and extension interfaces.
npm install @pulsemcp/air-core
import {
resolveArtifacts,
validateJson,
mergeArtifacts,
emptyArtifacts,
} from "@pulsemcp/air-core";
// Resolve all artifacts from an air.json file
const artifacts = await resolveArtifacts("~/.air/air.json");
// Validate a JSON file against its AIR schema
const result = validateJson(data, "skills");
// Merge two artifact sets (additive union — duplicate qualified IDs throw)
const merged = mergeArtifacts(base, overlay);
import { resolveArtifacts } from "@pulsemcp/air-core";
import { GitHubCatalogProvider } from "@pulsemcp/air-provider-github";
const artifacts = await resolveArtifacts("./air.json", {
providers: [new GitHubCatalogProvider()],
});
resolveArtifacts(), loadAirConfig(), mergeArtifacts(), emptyArtifacts()validateJson() using AJV against AIR JSON SchemasloadSchema(), detectSchemaType(), detectSchemaFromValue()SkillEntry, McpServerEntry, RootEntry, ReferenceEntry, PluginEntry, HookEntryAgentAdapter, CatalogProvider, PrepareTransform, AirExtensionAgentSessionConfig, StartCommand, PrepareSessionOptions, PreparedSessionCore defines four extension points that other packages implement:
| Interface | Purpose | Example |
|---|---|---|
AgentAdapter | Translate AIR config for a specific agent | @pulsemcp/air-adapter-claude |
CatalogProvider | Resolve remote URIs in air.json | @pulsemcp/air-provider-github |
PrepareTransform | Post-prepare transforms on .mcp.json | @pulsemcp/air-secrets-env, @pulsemcp/air-secrets-file |
AirExtension | Extension metadata for CLI discovery | All extension packages |
FAQs
AIR core — config resolution, validation, schemas, and extension interfaces
The npm package @pulsemcp/air-core receives a total of 15 weekly downloads. As such, @pulsemcp/air-core popularity was classified as not popular.
We found that @pulsemcp/air-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.