
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@slickfast/mcp
Advanced tools
SlickFast — render 47 chart & info-design types (bar, line, pie, KPI, cards, funnel, matrix, gauge, calendar…) plus multi-chart dashboards tiled into one image, as SVG/PNG via MCP. Local and deterministic; nothing leaves your machine.
⚡ Live — SlickFast’s own project pulse, updating on a cron. Same trick works in your README:
JSON in → chart or whole Page out. No browser, no Puppeteer. Same spec, same picture, every time. Runs as an MCP tool — 100% local, nothing leaves your machine until you ask to share or publish.
47 types (bar, line, pie, KPI, funnel, gauge, heatmap, calendar…) plus multi-chart dashboards in one call. Also: Pages (designed docs), News, and Get started — all as live Pages, not baked copy.
render_chart({ type: "bar", data: { labels: ["Q1","Q2","Q3"], series: [{ values: [12,19,8] }] } })
→ retina PNG (or SVG) on your machine
More pictures: slickfast.com · start here: slickfast.com/start · what’s shipping: slickfast.com/news
Renders locally and privately for free. Public URLs / live embeds need a free API key at slickfast.com (no card).
Or add to your MCP config and restart:
{ "mcpServers": { "slickfast": { "command": "npx", "args": ["-y", "@slickfast/mcp"] } } }
claude_desktop_config.json (Settings → Developer → Edit Config)claude mcp add slickfast -- npx -y @slickfast/mcp~/.cursor/mcp.jsonhttps://mcp.slickfast.com (free key or demo)First clicks (prompts in clients that show them): Get started → Try SlickFast → Build a dashboard. Also: SlickFast News, Update / refresh SlickFast, Make a Page, Share / publish, Report a SlickFast issue.
Or say: "Show me what SlickFast can do" · "what's new" · "get me started".
Stuck? Restart the client · Node 18+ · one stray comma breaks JSON · open an issue.
render_chart(spec) → PNG (default) or SVG. Dashboards: type: "dashboard" with
tiles: [{ chart, span }] — one image, one call.describe_type(type) → data shape, minimal spec, gotchas. Call when unsure.gallery() → curated demos (images + specs). board:"comparison" / board:"all" for boards.list_palettes() → every valid palette name and colors.share_chart(spec, name?) → public / live embed URL via the hosted API (free key).
Rendering stays local; offer only when asked to share.read_chart(url) → spec twin of any SlickFast chart URL.push_to_trmnl(spec, webhook_url) → e-ink PNG to a TRMNL display.describe_pagespec() → Pages contract (hero, prose, charts, themes, drill-downs).render_page(pagespec) → self-contained HTML, local. Optional outputPath.publish_page(pagespec) → public Page URL + .json twin (free = short TTL + watermark;
paid = permanent).news() → live twin behind slickfast.com/news. Keyless.get_started() → live onboarding Page behind slickfast.com/start.
Keyless. Best first tool after install.mcp_status() → this package version + how to refresh (facts only, no nag).report_issue(summary, spec?) → draft GitHub / email links. SlickFast sends nothing.format:"svg" when the chat supports artifacts (claude.ai / Claude Desktop) —
most reliable inline path.format:"png" needs a client that paints MCP image blocks (inconsistent).outputPath. Hosted/sandbox MCP often can’t show that file — use SVG
or share_chart / publish_page for a URL.If values came back but no picture, it rendered — display surface gap, not a broken engine. Re-ask for SVG into an artifact, or open a Share URL.
Ask to share or publish. Needs SLICKFAST_API_KEY in the MCP config (free at
slickfast.com). The live board at the top of this README is that
pattern: one public URL, push new data, every embed updates.
AGPL-3.0-only. Local / self-host / embed under AGPL is fine. Closed-source product or hosted service → open the AGPL’d source, or a commercial license: slickfast.com/license.html · licensing@slickfast.com.
report_issue drafts the links (nothing auto-sent).cd apps/mcp
npm install
node test-client.mjs
Point a client at a checkout: "command": "node", "args": ["…/apps/mcp/server.mjs"].
FAQs
SlickFast MCP — JSON → charts, dashboards, and Pages. Twin at .json, fingerprint on the Page. News and Get started in chat. Local by default; share/publish with a free key.
The npm package @slickfast/mcp receives a total of 598 weekly downloads. As such, @slickfast/mcp popularity was classified as not popular.
We found that @slickfast/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.