
Security News
pnpm 12’s Rust Rewrite Cuts Install Times by Up to 90%
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.
@slickfast/mcp
Advanced tools
SlickFast — render 47 chart & info-design types (bar, line, pie, KPI, cards, funnel, matrix, gauge, calendar…) plus multi-chart dashboards tiled into one image, as SVG/PNG via MCP. Local and deterministic; nothing leaves your machine.
⚡ Live — SlickFast’s own project pulse, updating on a cron. Same trick works in your README:
JSON in → chart or whole Page out. No browser, no Puppeteer. Same spec, same picture, every time. Runs as an MCP tool — 100% local, nothing leaves your machine until you ask to share or publish.
47 types (bar, line, pie, KPI, funnel, gauge, heatmap, calendar…) plus multi-chart dashboards in one call. Also: Pages (designed docs), News, and Get started — all as live Pages, not baked copy.
render_chart({ type: "bar", data: { labels: ["Q1","Q2","Q3"], series: [{ values: [12,19,8] }] } })
→ retina PNG (or SVG) on your machine
More pictures: slickfast.com · start here: slickfast.com/start · what’s shipping: slickfast.com/news
Renders locally and privately for free. Public URLs / live embeds need a free API key at slickfast.com (no card).
Or add to your MCP config and restart:
{ "mcpServers": { "slickfast": { "command": "npx", "args": ["-y", "@slickfast/mcp"] } } }
claude_desktop_config.json (Settings → Developer → Edit Config)claude mcp add slickfast -- npx -y @slickfast/mcp~/.cursor/mcp.jsonhttps://mcp.slickfast.com (free key or demo)First clicks (prompts in clients that show them): Get started → Try SlickFast → Build a dashboard. Also: SlickFast News, Update / refresh SlickFast, Make a Page, Share / publish, Report a SlickFast issue.
Or say: "Show me what SlickFast can do" · "what's new" · "get me started".
Stuck? Restart the client · Node 18+ · one stray comma breaks JSON · open an issue.
render_chart(spec) → PNG (default) or SVG. Dashboards: type: "dashboard" with
tiles: [{ chart, span }] — one image, one call.describe_type(type) → data shape, minimal spec, gotchas. Call when unsure.gallery() → curated demos (images + specs). board:"comparison" / board:"all" for boards.list_palettes() → every valid palette name and colors, plus one swatch-board PNG
(flat + nested; dark themes on a dark strip). Keyless.share_chart(spec, name?) → public / live embed URL via the hosted API (free key).
Rendering stays local; offer only when asked to share.read_chart(url) → spec twin of any SlickFast chart URL.push_to_trmnl(spec, webhook_url) → e-ink PNG to a TRMNL display.describe_pagespec() → Pages contract (hero, prose, charts, themes, drill-downs).render_page(pagespec) → self-contained HTML, local. Optional outputPath.publish_page(pagespec) → public Page URL + .json twin (free = short TTL + watermark;
paid = permanent).news() → live twin behind slickfast.com/news. Keyless.get_started() → live onboarding Page behind slickfast.com/start.
Keyless. Best first tool after install.mcp_status() → this package version + how to refresh (facts only, no nag).report_issue(summary, spec?) → draft GitHub / email links. SlickFast sends nothing.format:"svg" when the chat supports artifacts (claude.ai / Claude Desktop) —
most reliable inline path.format:"png" needs a client that paints MCP image blocks (inconsistent).outputPath. Hosted/sandbox MCP often can’t show that file — use SVG
or share_chart / publish_page for a URL.If values came back but no picture, it rendered — display surface gap, not a broken engine. Re-ask for SVG into an artifact, or open a Share URL.
Ask to share or publish. Needs SLICKFAST_API_KEY in the MCP config (free at
slickfast.com). The live board at the top of this README is that
pattern: one public URL, push new data, every embed updates.
AGPL-3.0-only. Local / self-host / embed under AGPL is fine. Closed-source product or hosted service → open the AGPL’d source, or a commercial license: slickfast.com/license.html · licensing@slickfast.com.
report_issue drafts the links (nothing auto-sent).cd apps/mcp
npm install
node test-client.mjs
Point a client at a checkout: "command": "node", "args": ["…/apps/mcp/server.mjs"].
FAQs
SlickFast MCP — JSON → charts, dashboards, and Pages. Twin at .json, fingerprint on the Page. News and Get started in chat. Local by default; share/publish with a free key.
The npm package @slickfast/mcp receives a total of 1,305 weekly downloads. As such, @slickfast/mcp popularity was classified as popular.
We found that @slickfast/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.

Research
/Security News
Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.