
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@workflow/web
Advanced tools
Observability Web UI Package bundled in the Workflow SDK.
Security notice: The
@workflow/webpackage does not include authentication or authorization. All users who can reach the deployment share the same backend credentials configured via environment variables. If you self-host this UI, you must place it behind your own authentication layer (e.g. VPN, reverse proxy with auth, OAuth). Exposing it to untrusted users without authentication is at your own risk and may allow unauthorized access to your workflow data.
While this UI is bundled with the Workflow CLI, you can also self-host it.
There are multiple approaches:
npx workflow web --noBrowser on a server@workflow/web packageAll options require the environment to be configured with the right environment variables for the World you're using.
npx workflow web --noBrowser
This will start the web UI on the default port 3456.
@workflow/web packageThe published @workflow/web package contains a prebuilt .next directory and package.json.
You can install it and run next start from the package directory.
Example (Node server / container):
mkdir workflow-observability-ui
cd workflow-observability-ui
npm init -y
# You must provide React runtime dependencies in your host project.
npm i @workflow/web react react-dom
# Run Next.js from the installed package (it contains the .next output)
cd node_modules/@workflow/web
npx --yes next start -p "${PORT:-3456}"
If you prefer, you can set a start script in your host package.json like:
{
"scripts": {
"start": "cd node_modules/@workflow/web && next start -p $PORT"
}
}
The UI reads configuration on the server via environment variables.
Vercel (remote observability):
WORKFLOW_TARGET_WORLD=vercelWORKFLOW_VERCEL_TEAMWORKFLOW_VERCEL_PROJECTWORKFLOW_VERCEL_ENV (optional; defaults to production)VERCEL_WORKFLOW_SERVER_URL (optional; routes all Vercel analytics and primary-storage requests to a different workflow-server deployment)Local (filesystem-backed observability):
WORKFLOW_TARGET_WORLD=localWORKFLOW_LOCAL_DATA_DIR (absolute path to the workflow data dir, e.g. /path/to/project/.workflow-data)WORKFLOW_MANIFEST_PATH (optional; enables the Graph tab)Postgres:
WORKFLOW_TARGET_WORLD=postgresWORKFLOW_POSTGRES_URLFor a complete list and CLI flags, see npx workflow inspect --help and npx workflow web --help.
If you're deploying this to Vercel, setting WORKFLOW_TARGET_WORLD to vercel is enough
for the server to infer your other project details at runtime. Note that observability will be scoped to the project and environment you're deploying to.
FAQs
Workflow Observability UI
The npm package @workflow/web receives a total of 414,314 weekly downloads. As such, @workflow/web popularity was classified as popular.
We found that @workflow/web demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.