
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@thunderphone/mcp
Advanced tools
npx -y @thunderphone/mcp
npx -y @thunderphone/mcp setup --client cursor --api-key-env THUNDERPHONE_API_KEY
npx -y @thunderphone/mcp setup --client claude-desktop --scope user
Node 18.18+. Starts a stdio bridge to https://api.thunderphone.com/v1/mcp.
THUNDERPHONE_API_KEY wins; otherwise it uses the current thunderphone login
profile and refreshes expiring tokens, or delegates OAuth to mcp-remote.
Set THUNDERPHONE_PROFILE or --profile to choose a profile.
THUNDERPHONE_MCP_URL overrides the remote endpoint. Stored tokens require a
matching API origin. HTTP overrides are restricted to localhost.
Setup supports Claude Code, Codex, Cursor, VS Code, Gemini, Claude Desktop and
Windsurf, preserving unrelated servers. Desktop and Windsurf require user scope. Desktop uses stdio; the other clients
use direct HTTP. Without --api-key-env, direct
HTTP configs rely on the client's OAuth support. Direct HTTP does not read CLI
credentials; choose stdio to reuse device login. Desktop inherits environment
variables from its launcher; CLI credentials avoid storing keys in its config.
No telemetry. Do not put key values on the command line. JSON-RPC owns stdout when serving; diagnostics go to stderr.
FAQs
ThunderPhone thunderphone-mcp command line tools
We found that @thunderphone/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.