
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@weavatrix/wvq
Advanced tools
Native Weavatrix Quality CLI, MCP server, live benchmark, and typed JavaScript client.
@weavatrix/wvqNative Weavatrix Quality binaries (wvq, wvq-mcp, wvq-bench) for
Windows / macOS / Linux (x64 + arm64), plus a typed JavaScript client.
Rust remains the only implementation of policy, selection, evidence, proof, budgets, and MCP schemas. This package is a process boundary — never a second engine.
Alpha 0.1.0-alpha.5. CHANGELOG ·
GitHub ·
MCP Registry (io.github.Weavatrix/weavatrix-quality)
npm install --save-dev @weavatrix/wvq@0.1.0-alpha.5
# or without adding a dependency
npx @weavatrix/wvq@0.1.0-alpha.5 --help
Unscoped wvq is reserved by npm similarity rules. Always use @weavatrix/wvq.
Bins on PATH after install:
| Bin | Role |
|---|---|
wvq | CLI |
wvq-mcp | MCP host (also: wvq mcp …) |
wvq-bench | Impacted-vs-full shadow bench |
Override native paths with WVQ_BINARY, WVQ_MCP_BINARY, WVQ_BENCH_BINARY
when you install matching binaries yourself.
# discovery (read-only)
npx @weavatrix/wvq@0.1.0-alpha.5 doctor
# first-time policy
npx @weavatrix/wvq@0.1.0-alpha.5 init
# compile OpenSpec obligations
npx @weavatrix/wvq@0.1.0-alpha.5 spec validate --change current
# plan without executing
npx @weavatrix/wvq@0.1.0-alpha.5 plan --change current
# impacted run (also publishes .weavatrix/coverage/lcov.info for Weavatrix coverage_map)
npx @weavatrix/wvq@0.1.0-alpha.5 run \
--change current \
--base origin/main \
--head HEAD \
--scope impacted \
--evidence-policy minimal
# composite verdict
npx @weavatrix/wvq@0.1.0-alpha.5 verify --change current
# Stage A CI (exit 0 even when UNPROVEN)
npx @weavatrix/wvq@0.1.0-alpha.5 verify --change current --observe-only true
# passive browser capture
npx @weavatrix/wvq@0.1.0-alpha.5 record --change current --route /dashboard
# shadow selected vs full
npx @weavatrix/wvq@0.1.0-alpha.5 bench \
--repo . --change current --base origin/main --head WORKTREE
wvq --repo <path> <command> …
wvq run --scope impacted|all --evidence-policy standard|minimal|none
wvq verify --observe-only true|false
wvq record --route /path --idle-ms 3000 --max-events 200
Exit 2 = blocking contradicted verify. Exit 1 = unresolved / ordinary failure.
{
"mcpServers": {
"weavatrix-quality": {
"command": "npx",
"args": [
"-y",
"@weavatrix/wvq@0.1.0-alpha.5",
"mcp",
"--repo",
"."
]
}
}
}
Prefer an absolute --repo path in real configs.
quality_context quality_plan quality_run quality_status
quality_verify quality_explain quality_evidence
Ask the agent:
Call
quality_planfor changecheckout-fix, thenquality_runwith baseorigin/mainand headWORKTREE, thenquality_verify.
npx @weavatrix/wvq@0.1.0-alpha.5 mcp --repo . \
--profile authoring \
--change current \
--base origin/main \
--head WORKTREE
quality_test_draft quality_test_validate quality_test_preview
quality_test_promote quality_test_record quality_test_heal
No arbitrary shell. Large artifacts return as handles.
import { WvqClient } from '@weavatrix/wvq'
import { WvqMcpClient } from '@weavatrix/wvq/mcp'
const repo = process.cwd()
const change = 'current'
// ——— typed CLI boundary ———
const wvq = new WvqClient({ repo })
await wvq.specValidate({ change })
const plan = await wvq.plan({ change })
const run = await wvq.run({
change,
base: 'origin/main',
head: 'WORKTREE',
scope: 'impacted',
evidencePolicy: 'minimal',
})
const verify = await wvq.verify({ change })
console.log({
runId: run.run_id,
outcome: run.outcome,
state: verify.state,
proven: verify.quality.proof.proven,
unproven: verify.quality.proof.unproven,
})
const debt = await wvq.debt({ change, base: 'origin/main', head: 'HEAD' })
const selected = await wvq.select({ change, base: 'origin/main', head: 'HEAD' })
const status = await wvq.status()
// cancel a long run
const ac = new AbortController()
setTimeout(() => ac.abort(), 120_000)
await wvq.run({ change, base: 'origin/main', head: 'HEAD', signal: ac.signal })
// ——— MCP one-shot tools ———
const mcp = new WvqMcpClient({ repo, profile: 'default', change })
await mcp.call('quality_context', { change, purpose: 'implementation' })
await mcp.call('quality_verify', { change })
const authoring = new WvqMcpClient({
repo,
profile: 'authoring',
change,
base: 'origin/main',
head: 'WORKTREE',
})
const draft = await authoring.draft({ useModel: false })
// agent fills candidateProgram from draft.obligations + draft.context
const validated = await authoring.validate(candidateProgram)
const preview = await authoring.preview(validated.program, {
screenshot: true,
trace: true,
})
if (preview.passed) {
const promoted = await authoring.promote(preview.preview_id, validated.program)
await authoring.heal(promoted.program_id, promoted.program_revision, [
{ edit: 'insert_wait', after: 0, condition: { kind: 'url', route: '/ready' } },
])
}
Types: src/index.d.ts. More samples:
examples on GitHub.
Authoring preview and UI programs use Playwright from the verified repo
(browser.module_root in .weavatrix-quality/config.yaml):
npm install --save-dev playwright
npx playwright install chromium
wvq nameMIT
FAQs
Native Weavatrix Quality CLI, MCP server, live benchmark, and typed JavaScript client.
The npm package @weavatrix/wvq receives a total of 360 weekly downloads. As such, @weavatrix/wvq popularity was classified as not popular.
We found that @weavatrix/wvq demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.