
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@wipcomputer/markdown-viewer
Advanced tools
Live markdown viewer for AI pair-editing. Updates render instantly in any browser.
Live markdown viewer for AI pair-editing. When you collaborate, the updates render instantly. Works with any AI agent and web browser.
@wipcomputer/markdown-viewer globallyOpen multiple tabs to work on multiple documents at once.
Open your AI coding tool and say:
Install @wipcomputer/markdown-viewer globally,
start mdview, and add live viewer support to this project.
Your AI will install the package, start the server, and add the right instructions to your project so it knows to open the viewer whenever you edit markdown together. That's it.
npm install -g @wipcomputer/markdown-viewer
mdview
That's it. Global install gives you the mdview command anywhere.
mdview # Start server on port 3000
mdview --port 8080 # Use custom port
mdview --root /path/to/dir # Restrict file access to this directory
git clone https://github.com/wipcomputer/wip-markdown-viewer.git
cd wip-markdown-viewer
npm install
node server.js
Server starts at http://127.0.0.1:3000. Open any markdown file:
http://127.0.0.1:3000/view?path=/absolute/path/to/your/file.md
This works with any AI agent that can run shell commands and edit files.
| Tool | Instruction file | How to add support |
|---|---|---|
| Claude Code | CLAUDE.md | Add the snippet below to your project's CLAUDE.md |
| OpenAI Codex CLI | AGENTS.md | Add the snippet below to your project's AGENTS.md |
| Cursor | .cursorrules | Add the snippet below to .cursorrules |
| Windsurf | .windsurfrules | Add the snippet below to .windsurfrules |
| OpenClaw | SKILL.md | Install the live-viewer skill |
| Any other agent | Whatever config it reads | Add the snippet below |
If your tool reads a project-level instruction file... it works. The snippet is the same for all of them.
Everything below is for you, the AI agent. The human doesn't need to read this. When the user asks you to set up the live markdown viewer, follow these steps.
If installed globally via npm (npm install -g @wipcomputer/markdown-viewer):
curl -s http://127.0.0.1:3000/ > /dev/null 2>&1 || mdview &
Or if cloned from source, resolve the full path and start the server:
curl -s http://127.0.0.1:3000/ > /dev/null 2>&1 || node {absolute path to wip-markdown-viewer}/server.js &
The server runs at http://127.0.0.1:3000 and stays running in the background. Note: the server doesn't survive reboots or long idle periods. The check above starts it only if it's not already running.
Add the following to whatever instruction file your tool uses (CLAUDE.md, AGENTS.md, .cursorrules, .windsurfrules, or equivalent). The content is the same regardless of the file:
## Live Markdown Viewer
When editing a .md file, check the server is running and open it in the viewer:
curl -s http://127.0.0.1:3000/ > /dev/null 2>&1 || node {path to server.js} &
open "http://127.0.0.1:3000/view?path={absolute path to the file}"
Then make your edits. The user sees every change as you write. No refresh needed.
Do this every time you edit a markdown file.
open "http://127.0.0.1:3000/view?path={absolute path to the file}"That's it. The server watches the file and pushes updates via SSE. You don't need to do anything else.
open command can drop query strings when Safari is already running. Prefer AppleScript:
osascript -e 'tell application "Safari" to open location "http://127.0.0.1:3000/view?path={absolute path}"'
Fallback: open "http://127.0.0.1:3000/view?path={absolute path}"xdg-open. Windows: Use start.mdview or node server.js). Starting with a path locks the server to that directory.Page shows the index instead of my file:
The --root flag restricts which files can be viewed. If the server was started with --root /some/dir, files outside that directory will redirect to the homepage. Restart without --root to allow any path.
Safari shows a blank page or stalls: Safari aggressively caches SSE connections. Hard refresh with Cmd+Shift+R, or restart the server:
kill $(lsof -ti :3000); mdview &
open command drops the query string:
macOS open can strip ?path=... when Safari is already running. Use AppleScript instead:
osascript -e 'tell application "Safari" to open location "http://127.0.0.1:3000/view?path=/your/file.md"'
Or navigate directly in the Safari URL bar.
127.0.0.1 only. It is not accessible from other machines./view?path= parameter reads files from your local filesystem. Use --root to restrict access to a specific directory tree:mdview --root /path/to/your/project
When --root is set, the server will only serve files under that directory. Requests for files outside it return 404. Recommended when running in shared or multi-user environments.
MIT
Built by Parker Todd Brooks, with Claude Code and Lēsa (OpenClaw).
FAQs
Live markdown viewer for AI pair-editing. Updates render instantly in any browser.
The npm package @wipcomputer/markdown-viewer receives a total of 29 weekly downloads. As such, @wipcomputer/markdown-viewer popularity was classified as not popular.
We found that @wipcomputer/markdown-viewer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.