
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
@reticlehq/server
Advanced tools
Reticle CLI, bridge and MCP server: a coding agent drives your running web app from the inside and gets a verdict with evidence, for change verification, access control, accessibility, performance and SEO checks.
The Reticle bridge + MCP server. It hosts a localhost WebSocket endpoint your app's @reticlehq/browser SDK connects to, and exposes MCP tools your coding agent uses to look at, act on, observe, and assert against the live app.
npx @reticlehq/server init # wire the project: SDK + build plugin + MCP registration
npx @reticlehq/server mcp # MCP over stdio; auto-starts the bridge on ws://localhost:4400
The package installs a reticle bin, so inside a project reticle mcp and npx @reticlehq/server mcp are the same command. reticle is not a package name on npm.
Point your agent at it. On Claude Code, register it at user scope:
claude mcp add reticle -s user -- npx @reticlehq/server mcp
Default tools (10):
reticle_navigate, reticle_look, reticle_act, reticle_act_and_wait, reticle_observe, reticle_assert, reticle_session, reticle_tools, reticle_run, reticle_verify.
Only reticle_act_and_wait and reticle_assert return a verdict; everything else moves or reads the app.
More tools ship but are not advertised, to keep the per-turn tool payload small: screenshots and visual diff, saved flows, recording, baselines, clock control, viewport, crawl, coverage, network mocking, leases and more. Reach any of them by name with reticle_run, list them with reticle_tools, or advertise the whole surface with RETICLE_ADVERTISE_ALL_TOOLS=1 (this roughly doubles the per-turn tool payload).
See the main README.
FSL-1.1-ALv2 (source-available: free for any use except reselling Reticle itself; converts to Apache-2.0 after two years). Files under dist/ee/ are enterprise features covered by the Reticle Enterprise License — free for development, testing, and evaluation; a license key activates them in production.
FAQs
Reticle CLI, bridge and MCP server: a coding agent drives your running web app from the inside and gets a verdict with evidence, for change verification, access control, accessibility, performance and SEO checks.
The npm package @reticlehq/server receives a total of 3,188 weekly downloads. As such, @reticlehq/server popularity was classified as popular.
We found that @reticlehq/server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.