
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@wyrdsekai/researchzosho-mcp
Advanced tools
Starts ResearchZosho, the research librarian for the rest of us, as an MCP server over stdio: npx @wyrdsekai/researchzosho-mcp
Starts ResearchZosho, the research librarian for the rest of us, as an MCP server
over stdio. Any MCP client that can run npx can run it:
{ "mcpServers": { "librarian": { "command": "npx", "args": ["-y", "@wyrdsekai/researchzosho-mcp"] } } }
claude mcp add --scope user librarian -- npx -y @wyrdsekai/researchzosho-mcp
There is no Java in this package and no copy of the program. The launcher finds an installed ResearchZosho
and starts researchzosho mcp. When none is installed it fetches the release of the same version from GitHub,
checks it against the release's own SHA256SUMS (no sums, no install), unpacks it under ~/.researchzosho/launcher,
and starts it: the small tarball when Java 21 or newer is on the machine, otherwise the build for this platform
that carries its own runtime, so nothing has to be installed first. A machine with no library gets one made at ~/researchzosho-library; researchzosho setup
names a model server and installs the service, and the pages at http://127.0.0.1:4649/ come with it.
Nothing but the MCP stream is written to stdout. Every message from the launcher goes to stderr.
| variable | meaning |
|---|---|
RESEARCHZOSHO_PREFIX | where the one-line installer put the program (default ~/.local, or %LOCALAPPDATA%\Programs) |
RESEARCHZOSHO_LIBRARY | the library folder (default ~/researchzosho-library) |
The version of this package is the version of ResearchZosho it starts. Docs: LIBRARIAN_HOWTOUSE.md, LIBRARY_PROTOCOL.md. License: Apache 2.0.
FAQs
Starts ResearchZosho, the research librarian for the rest of us, as an MCP server over stdio: npx @wyrdsekai/researchzosho-mcp
We found that @wyrdsekai/researchzosho-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.