
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@shipi18n/mcp
Advanced tools
MCP server for i18n quality assurance — check, diff and review locale files from any MCP client. Validation needs no API key.
mcp-name: io.github.Shipi18n/shipi18n
A Model Context Protocol server for i18n quality assurance — check, diff and review your locale files straight from any MCP client (Claude Desktop, Cursor, …).
The validation tools need no API key and make no model call. Translation is also available, with your own provider key.
Add it to your MCP client config. For Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"shipi18n": {
"command": "npx",
"args": ["-y", "@shipi18n/mcp"]
}
}
}
That is the whole setup for validation — no env block, no key. Then ask:
"Check
./localesagainst English and tell me what's broken in Spanish."
To translate as well, add your provider key:
"env": { "ANTHROPIC_API_KEY": "sk-ant-..." }
You will also need the matching SDK available (@anthropic-ai/sdk or openai) for translation.
review_locales does not call a model. It runs the structural checks, then returns the surviving
source/translation pairs plus the review criteria — and your agent judges them with the model it
is already running. Nothing is sent to us, and nothing extra is billed.
A note on MCP sampling. Earlier versions of this README advertised a "zero-key" translation mode built on
sampling/createMessage. Sampling was deprecated in MCP spec 2026-07-28 (SEP-2577: "New implementations SHOULD NOT adopt it") and Claude Desktop never supported it, so that claim was wrong for the client most people use. The sampling path still exists as a silent fallback for clients that do implement it, but it is not the documented way to translate — a provider key is.
No API key required:
| Tool | Description |
|---|---|
check_locales | Structural QA over a locale tree: missing/orphan keys, dropped placeholders, collapsed plurals, empty values, untranslated copy. |
check_glossary | Enforce do-not-translate terms and locked per-language translations. |
diff_locales | What still needs translating, per language. |
review_locales | Returns translation pairs + criteria so your agent judges meaning with its own model. |
check_placeholders | Compare two strings for placeholder drift. |
list_languages | Known language codes. |
Requires your own provider key:
| Tool | Description |
|---|---|
translate_json | Translate a locale JSON string to one or more languages (returns the translated JSON). |
translate_file | Read a .json locale file, translate it, and write <lang>.json files. Supports incremental. |
list_languages | List the language codes/names with friendly names (any BCP-47 code works). |
check_placeholders | Verify a translation preserves a source string's placeholders (no LLM call). |
All translation tools accept optional provider (anthropic/openai) and model arguments to override
auto-detection.
Built on @shipi18n/core: structure-preserving JSON
translation with placeholder preservation/validation, batching, and incremental (only-changed) mode.
Open-source, no Shipi18n account, no hosted API.
Apache-2.0
FAQs
MCP server for i18n quality assurance — check, diff and review locale files from any MCP client. Validation needs no API key.
The npm package @shipi18n/mcp receives a total of 36 weekly downloads. As such, @shipi18n/mcp popularity was classified as not popular.
We found that @shipi18n/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.