
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@smartmemory/compose-mcp
Advanced tools
MCP stdio server for @smartmemory/compose: typed feature management tools (roadmap, changelog, artifact linking, and more). Requires a compose-initialized project.
Slim MCP stdio launcher for @smartmemory/compose. Installing this package transitively pulls the full compose runtime; the compose-mcp binary spawns the embedded MCP server.
Compose is a structured AI dev pipeline that takes a goal to shipped code. Your agent writes the code, Compose makes it prove it: design decisions are gated before any code, every step has to clear its postconditions, and review runs on a different model than the one that wrote the work.
npm install -g @smartmemory/compose-mcp
This installs both @smartmemory/compose-mcp and its peer @smartmemory/compose.
npx -y @smartmemory/compose-mcp
The launcher resolves the embedded MCP server (@smartmemory/compose/mcp) and spawns it with stdio inheritance — suitable for direct Claude Code / MCP client wiring.
Add an entry to .claude/mcp.json:
{
"mcpServers": {
"compose": {
"command": "npx",
"args": ["-y", "@smartmemory/compose-mcp"]
}
}
}
Restart Claude Code; the typed compose tools (roadmap, changelog, artifact linking, journal, completion) become available.
The MCP tools mutate canonical compose artifacts (ROADMAP.md, CHANGELOG.md, docs/features/<code>/, docs/journal/). Run compose-mcp from inside a compose-initialized project — see the compose README for compose init.
Discovery: published as io.github.smartmemory/compose-mcp on the official MCP registry. Installing the slim package keeps npx startup fast while the full runtime is fetched transitively.
Business Source License 1.1, same as the compose root, licensed by Regression Analytics LLC. Free for non-production use, and for production use by organizations with USD 250,000 or less in annual revenue. Larger organizations need a commercial license: help@smartmemory.ai. Each version converts to Apache 2.0 four years after its release.
FAQs
MCP stdio server for @smartmemory/compose: typed feature management tools (roadmap, changelog, artifact linking, and more). Requires a compose-initialized project.
The npm package @smartmemory/compose-mcp receives a total of 232 weekly downloads. As such, @smartmemory/compose-mcp popularity was classified as not popular.
We found that @smartmemory/compose-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.