
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@sylphx/architecture-reader-mcp
Advanced tools
Spine — local architecture engine for agents (SDK · CLI · MCP). Transitional package name architecture-reader-mcp.
Local architecture engine for agents — SDK · CLI · MCP.
Product repository (SSOT): https://github.com/SylphxAI/architecture-reader-mcp
npm i -g @sylphx/architecture-reader-mcp
# or from git SSOT
git clone https://github.com/SylphxAI/architecture-reader-mcp.git
cd architecture-reader-mcp && bun install && bun run build:rust
| Surface | Entry |
|---|---|
| CLI | spine / architecture-reader-mcp |
| MCP | stdio via package bin (Rust rmcp when built) |
| SDK | @sylphx/architecture-reader-mcp/sdk |
The MCP/CLI engines are Rust. After install from npm, set:
ARCHITECTURE_READER_MCP_RUST_BIN — path to architecture-reader-mcp-serverARCHITECTURE_READER_CLI_BIN — path to architecture-reader-cliOr install from git and run bun run build:rust so bin/native/* is populated.
Doctor: spine doctor (when CLI bin available) or use package doctor helper.
This package is one product. No multi-product monorepo; no central Instruments hub.
FAQs
Spine — local architecture engine for agents (SDK · CLI · MCP). Transitional package name architecture-reader-mcp.
We found that @sylphx/architecture-reader-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.