
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@slickfast/mcp
Advanced tools
SlickFast MCP — JSON → charts, dashboards, and Pages. Twin at .json, fingerprint on the Page. News and Get started in chat. Local by default; share/publish with a free key.
⚡ Live — SlickFast’s own project pulse, updating on a cron. Same trick works in your README:
JSON in → chart, dashboard, or a whole Page out. No browser. No Puppeteer. Same spec, same bytes, forever. Runs as an MCP tool — local by default; nothing leaves your machine until you ask to share or publish.
Most tools draw a picture and throw the recipe away. SlickFast keeps the recipe.
The spec is the chart. A pagespec is a public Page. Add .json — that’s
the twin. The fingerprint (sha256) is on the Page. People open the URL.
Agents fetch the twin. News lands in chat via the
news tool — same drop, two doors.
render_chart({ type: "bar", data: { labels: ["Q1","Q2","Q3"], series: [{ values: [12,19,8] }] } })
→ retina PNG (or SVG) on your machine
describe_pagespec() → render_page({ page: { … } })
→ self-contained HTML on your machine (local twin: save the pagespec JSON)
publish_page({ page: { … } })
→ https://api.slickfast.com/s/{slug} + .json twin + fingerprint
47 chart types + multi-chart dashboards in one call. Plus Pages, News, and Get started — live Pages, not baked README paste.
Site: slickfast.com · first minute: slickfast.com/start · what’s shipping: slickfast.com/news
A Page is a designed web document from one JSON pagespec — hero, prose, charts, layout. Publish once:
| Door | Who | What |
|---|---|---|
| Page URL | Humans | The document |
URL + .json | Agents | The twin — exact recipe |
sha256: in the chrome | Both | Fingerprint — prove HTML ↔ twin |
Local: describe_pagespec → render_page (optional pagespecPath / outputPath).
No key. Open the HTML in a browser. Save the pagespec beside it as your local twin.
Public: publish_page needs a free or paid SF- key.
Free: up to 5 Pages alive, 7-day TTL, watermark. Paid: more slots, permanent.
DELETE /pages/{slug} frees a slot. Hosted URLs are unlisted, not private — anyone with
the link can open the Page and fetch the twin (Privacy).
In chat: call news or get_started — current drops are Pages behind
slickfast.com/news and slickfast.com/start.
Renders locally and privately for free. Public URLs / live embeds / published Pages need a free API key at slickfast.com (no card).
Or add to your MCP config and restart:
{ "mcpServers": { "slickfast": { "command": "npx", "args": ["-y", "@slickfast/mcp"] } } }
claude_desktop_config.json (Settings → Developer → Edit Config)claude mcp add slickfast -- npx -y @slickfast/mcp~/.cursor/mcp.jsonhttps://mcp.slickfast.com (free key or demo)First clicks (prompts in clients that show them): Get started → Try SlickFast → Build a dashboard. Also: SlickFast News, Make a Page, My Pages, Share / publish, Update / refresh SlickFast, Report a SlickFast issue.
Or say: "get me started" · "what's new" · "make a Page" · "Show me what SlickFast can do".
Stuck? Restart the client · Node 18+ · one stray comma breaks JSON · open an issue.
get_started() → live onboarding Page (slickfast.com/start). Keyless. Best first call.news(archive?) → live News Page (slickfast.com/news). archive:true lists every drop from the live index. Keyless.describe_pagespec() → Pages contract (hero, prose, charts, themes, twin, slots).render_page(pagespec) → self-contained HTML, local. Optional pagespecPath / outputPath.publish_page(pagespec) → public URL + .json twin + fingerprint (free = 5 concurrent · 7d + watermark; paid = permanent). Unguessable ≠ private.my_pages() → this key’s Page history as a Page (needs key). Default publishes; publish:false = local HTML.render_chart(spec) → PNG (default) or SVG. Dashboards: type: "dashboard" with
tiles: [{ chart, span }]. Tiles fill the cell by default. Local: specPath + layout: sidecar.describe_type(type) → data shape, minimal spec, gotchas.gallery() → curated demos. board:"comparison" / board:"all".list_palettes() → palette names + hex + one swatch-board PNG. Keyless.share_chart(spec, name?) → public / live chart URL (free key). Offer when asked to share.read_chart(url) → spec twin of a SlickFast chart URL.push_to_trmnl(spec, webhook_url) → e-ink PNG to a TRMNL display.mcp_status() → this package version + how to refresh (facts only, no nag).report_issue(summary, spec?) → draft GitHub / email links. SlickFast sends nothing.format:"svg" when the chat supports artifacts (claude.ai / Claude Desktop).format:"png" needs a client that paints MCP image blocks (inconsistent).outputPath. Hosted/sandbox often can’t show that file — use SVG
or share_chart / publish_page for a URL.If values came back but no picture, it rendered — display surface gap, not a broken engine.
Ask to share a chart or publish a Page. Needs SLICKFAST_API_KEY in the MCP config
(free at slickfast.com). The live board at the top of this README
is that pattern: one public URL, push new data, every embed updates.
AGPL-3.0-only. Local / self-host / embed under AGPL is fine. Closed-source product → open the AGPL’d source, or a commercial license: slickfast.com/license.html · licensing@slickfast.com. Hosted API / hosted MCP stay on API pricing — service, not that license.
report_issue drafts the links (nothing auto-sent).cd apps/mcp
npm install
node test-client.mjs
Point a client at a checkout: "command": "node", "args": ["…/apps/mcp/server.mjs"].
FAQs
SlickFast MCP — JSON → charts, dashboards, and Pages. Twin at .json, fingerprint on the Page. News and Get started in chat. Local by default; share/publish with a free key.
The npm package @slickfast/mcp receives a total of 1,305 weekly downloads. As such, @slickfast/mcp popularity was classified as popular.
We found that @slickfast/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.