
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@shipi18n/mcp
Advanced tools
MCP server for i18n translation — bring your own LLM. Translate locale files from any MCP client (Claude Desktop, Cursor, ...).
A Model Context Protocol server for i18n translation — translate your locale files straight from any MCP client (Claude Desktop, Cursor, …). Bring your own LLM, or use no key at all and let the client's own model do the work.
ANTHROPIC_API_KEY or OPENAI_API_KEY in the server env; translation calls your model.sampling/createMessage. No API key needed; uses whatever model your client runs. (Requires a client
that supports MCP sampling.)Add it to your MCP client config. For Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"shipi18n": {
"command": "npx",
"args": ["-y", "@shipi18n/mcp"],
"env": { "ANTHROPIC_API_KEY": "sk-ant-..." }
}
}
}
Omit the env block to use the zero-key sampling mode. For the OpenAI provider, set OPENAI_API_KEY
instead. You'll also need the matching SDK available (@anthropic-ai/sdk or openai) when using BYO key.
Then just ask: "Translate locales/en.json into French, German, and Japanese."
| Tool | Description |
|---|---|
translate_json | Translate a locale JSON string to one or more languages (returns the translated JSON). |
translate_file | Read a .json locale file, translate it, and write <lang>.json files. Supports incremental. |
list_languages | List the language codes/names with friendly names (any BCP-47 code works). |
check_placeholders | Verify a translation preserves a source string's placeholders (no LLM call). |
All translation tools accept optional provider (anthropic/openai) and model arguments to override
auto-detection.
Built on @shipi18n/core: structure-preserving JSON
translation with placeholder preservation/validation, batching, and incremental (only-changed) mode.
Open-source, no Shipi18n account, no hosted API.
Apache-2.0
FAQs
MCP server for i18n quality assurance — check, diff and review locale files from any MCP client. Validation needs no API key.
The npm package @shipi18n/mcp receives a total of 32 weekly downloads. As such, @shipi18n/mcp popularity was classified as not popular.
We found that @shipi18n/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.