
Security News
arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.
@unravel-tech/thing
Advanced tools
Artifacts for any coding agent. Publish what Claude Code, Codex, Cursor or Gemini CLI builds to a durable link, with versions and comments on the page.
CLI for thing: push, version, and share artifacts (HTML pages, Markdown docs, standalone images and PDFs) from coding agents.
npx -y @unravel-tech/thing push report.html
That first push opens browser approval, waits for sign-in, then resumes and
prints the durable URL. Markdown, images, and PDFs work the same way. Install
globally if you use it often: npm i -g @unravel-tech/thing.
| Command | What it does |
|---|---|
thing login [--server url] [--no-browser] | Explicit device-code login; opens browser approval and stores a token |
thing logout / thing whoami | Clear / show the current identity and where pushes land |
thing default [team] [--clear] | Show or set your server-side default push target (used when no --team is given, from any machine) |
thing use <team> [project] | Set a local active team/project override for this machine |
thing push <file.html|.md|.pdf|.png|.jpg|.gif|.webp> [--name x] [--team t] [--project p] [--visibility v] | Authenticate if needed, then push a new immutable version and print the served URL |
thing list | List artifacts you can see |
thing versions <name> | Version history for an artifact |
thing rollback <name> <n> | Point latest back to version n |
thing open <name> | Open the artifact in a browser |
thing mcp | Run a Model Context Protocol server over stdio (tools: push_artifact, list_artifacts, whoami) |
Every command accepts --json for machine-readable output.
An unauthenticated push --json emits newline-delimited authentication status;
the final JSON object is always the push result. Use --no-login to fail fast
instead of starting interactive authentication, such as in CI.
Visibility values: private, team, anyone-with-link (prints a tokened share URL), public.
Which team a push lands in is decided in order: --team flag → .thing.json in the
working directory → a local thing use override → your server-side default
(thing default) → your personal space. Login no longer pins a team, so with none of
the overrides set the server picks your default (e.g. the Unravel org for Unravel members).
Claude Code, Cursor, Codex, and anything else that speaks Model Context Protocol can publish through thing. No terminal login needed: create a token at usething.ai under Settings, then Tokens, and paste this into your client's MCP config.
{
"mcpServers": {
"thing": {
"command": "npx",
"args": ["-y", "@unravel-tech/thing", "mcp"],
"env": { "THING_TOKEN": "paste-your-token-here" }
}
}
}
On a machine that has Bun but no Node, swap npx for bunx:
{
"mcpServers": {
"thing": {
"command": "bunx",
"args": ["-y", "@unravel-tech/thing", "mcp"],
"env": { "THING_TOKEN": "paste-your-token-here" }
}
}
}
The server exposes three tools: push_artifact to publish a file or inline
content and get back a link, list_artifacts to see what you have, and
whoami to check which account and team you are pushing to.
If you already ran thing login, the stored credential is used and
THING_TOKEN can be left out.
Node >= 18 or Bun, no runtime dependencies. The thing executable launches under
whichever of the two is on your PATH (Node first), so a global install works on a
machine that has never installed Node:
bun i -g @unravel-tech/thing
thing login
FAQs
Artifacts for any coding agent. Publish what Claude Code, Codex, Cursor or Gemini CLI builds to a durable link, with versions and comments on the page.
The npm package @unravel-tech/thing receives a total of 361 weekly downloads. As such, @unravel-tech/thing popularity was classified as not popular.
We found that @unravel-tech/thing demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.