
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
@zenarc/zenarc
Advanced tools
ZenArc replaces scattered TODO.md files with structured, AI-agent-friendly task files. It provides both an MCP server for Claude Code integration and a web dashboard for human browsing — with optional cloud sync for multi-device access.
TODO.md | ZenArc | |
|---|---|---|
| Cross-project view | ❌ Need to cat each file | ✅ Unified dashboard + MCP queries |
| AI actionable | ❌ Unstructured markdown | ✅ Schema-validated YAML with tool hooks |
| Status tracking | ✅ Checkboxes | ✅ Typed status + priority + assignee |
| Context links | 🔶 Manual backticks | ✅ Structured files, urls, dependencies |
| Git-friendly | ✅ Plain text | ✅ Human-readable YAML |
| Agent attribution | ❌ Unknown who wrote what | ✅ created_by, assigned_to |
| Mobile access | ❌ Desktop only | ✅ Optional Firebase sync |
zenarc/
├── web/ # Next.js 15 dashboard + workspace root
│ ├── app/ # Routes (dashboard, login, landing)
│ ├── components/ # React components (board, modals)
│ ├── lib/ # Firebase, sync server, utilities
│ ├── bin/zenarc.js # CLI entry point (starts web dashboard)
│ └── packages/
│ ├── core/ # Task schema (Zod), YAML store, registry
│ └── sync-firebase/ # Optional Firestore sync layer
Data flow (Local Server Mode):
┌─────────────┐ stdio ┌─────────────┐ ┌─────────────┐
│ Claude Code │◄────────────►│ zenarc-mcp │────►│ Local YAML │
└─────────────┘ └─────────────┘ └──────┬──────┘
│
┌───────────────────────────────┘
│ (optional)
▼
┌─────────────────┐
│ Firebase │
│ Firestore │
└────────┬────────┘
│
▼
┌─────────────────┐
│ Web Dashboard │
│ (Next.js) │
└─────────────────┘
Data flow (Browser Mode):
┌─────────────────┐ File System Access API ┌─────────────┐
│ Web Dashboard │◄───────────────────────────────►│ Browser YAML│
│ (Next.js) │ │ (disk) │
└────────┬────────┘ └──────┬──────┘
│ │
│ ┌─────────────────────────────────────┘
│ │ (optional)
▼ ▼
┌─────────────────┐ ┌─────────────┐
│ Firebase │◄───►│ Browser │
│ Firestore │ │ (IndexedDB │
└─────────────────┘ │ handles) │
└─────────────┘
MCP works in both modes.
zenarc-mcpis a separate CLI tool that reads/writes YAML directly via Node.jsfs. It does not need thezenarcserver running. Install it withnpm install -g zenarc-mcpand configure it in Claude Code regardless of which dashboard mode you use.
Design principles:
tasks/ directory. Works offline.ZenArc runs in two modes. Pick the one that fits your workflow:
| Browser Mode | Local Server Mode | |
|---|---|---|
| Install | None — open in browser | npm install -g @zenarc/zenarc |
| Data storage | File System Access API (YAML in your repos) | Local filesystem (YAML in your repos) |
| MCP / Claude Code | ✅ Install zenarc-mcp separately | ✅ Included with CLI |
| Cloud sync | ✅ Firebase sync | ✅ Firebase sync |
| Best for | Quick start, no setup | Full features, AI agent integration |
Your tasks are saved as YAML files in each project's .zenarc/tasks/ folder.
Browser support: Chrome and Edge (File System Access API required). Firefox/Safari are not supported for folder access.
npm install -g @zenarc/zenarc
zenarc # Start on localhost:3000, auto-opens browser
Options:
zenarc --dev # Development mode with hot reload
zenarc --build # Build for production
zenarc --port 3001 # Custom port
zenarc --help
On first run, ZenArc auto-builds itself. Subsequent starts are instant.
Requires access to the private @zenarc npm scope.
npm install -g @zenarc/zenarc
git clone <private-repo-url> zenarc
cd zenarc/web
npm install
npm run build
npm run dev at localhost:3000)zenarcIn both modes:
| Feature | Browser | Local | Description |
|---|---|---|---|
| Kanban board | ✅ | ✅ | Drag-and-drop tasks across todo, in_progress, done, blocked, deferred |
| Project sidebar | ✅ | ✅ | Switch between projects, see active task counts |
| Filters | ✅ | ✅ | Filter by status and priority |
| Cross-project board | ✅ | ✅ | Kanban view across all projects with drag-and-drop |
| Task modals | ✅ | ✅ | Create and edit tasks with full metadata |
| Project management | ✅ | ✅ | Add local projects (browser: "Add Folder", local: "Add Project") |
| Cloud sync | ✅ | ✅ | Bidirectional sync between local YAML and Firestore |
| MCP / Claude Code | ✅* | ✅ | Natural language task management via zenarc-mcp (install separately in browser mode) |
Enable sync to access tasks from the mobile app or multiple computers.
How it works:
Setup:
.env.example to .env.local and fill in your Firebase configLocal Server Mode only. MCP requires the
zenarc-mcpCLI tool, which runs as a subprocess on your local machine. It is not available in Browser Mode because the File System Access API has no local subprocess access.ZenArc's MCP server uses stdio transport. There is no HTTP, SSE, or remote MCP endpoint. Claude spawns
zenarc-mcpas a subprocess. It reads and writes YAML files directly on your filesystem.The web dashboard is a separate human interface — not an MCP endpoint. Both share data through the same local YAML files (and optional Firebase sync).
3-step setup:
npm install -g zenarc-mcp
Add to your Claude Code settings (~/.claude/settings.json or a project's .claude/settings.local.json):
{
"mcpServers": {
"zenarc": {
"command": "zenarc-mcp"
}
}
}
Restart Claude Code. That's it — no server to run, no API keys, no ports to open. zenarc-mcp auto-initializes on first use.
First run: Ask Claude to scan your projects:
"Scan my projects in ~/dev"
Then use natural language for everything:
"List my critical tasks for loa-web"
"Mark the GA4 tracking task as done"
"Create a new high-priority task in codeyourreality to update the hero copy"
"Search for anything related to SEO across all projects"
| Tool | Description |
|---|---|
zenarc_scan | Scan directories for ZenArc projects and sync to registry |
zenarc_list | List tasks with filters (status, priority, project, tag, assignee) |
zenarc_get | Get full task details by ID |
zenarc_create | Create a new task with structured metadata |
zenarc_update | Update task fields (status, priority, assignee, notes) |
zenarc_search | Keyword search across titles, tags, and notes |
zenarc_context_add | Link file paths or URLs to an existing task |
| stdio | HTTP/SSE |
|---|---|
| Zero config — Claude manages the process | Requires running a server, managing ports |
| Works offline | Needs network |
| No authentication needed | Needs API keys / OAuth |
| Instant startup | Cold start latency |
| Tasks live in your repo (git-native) | Data lives in the cloud |
If you need multi-device access, use Firebase sync (below) rather than a remote MCP endpoint. The dashboard reads from the same cloud data without requiring an HTTP MCP server.
Each task is a standalone YAML file in {project}/tasks/:
id: tm-20260602-a1b2c3d4
title: Fix GA4 '(not set)' page tracking
status: in_progress
priority: critical
project: loa-web
tags: [analytics, seo, bugfix]
created_at: "2026-05-10T09:00:00Z"
updated_at: "2026-05-18T14:30:00Z"
created_by: human
assigned_to: claude
context:
files:
- app/components/PageViewTracker.jsx
- app/ClientLayout.js
urls:
- https://analytics.google.com/analytics/web/
notes: >
Fires manual page_view on App Router client-side navigations
with 100ms delay for document.title to settle. Skips first
render to avoid duplicating gtag('config') initial page_view.
dependencies: []
| Field | Type | Description |
|---|---|---|
id | string | Unique ID (tm-YYYYMMDD-xxxxxxxx) |
title | string | Short task title |
status | enum | todo, in_progress, done, blocked, deferred |
priority | enum | critical, high, medium, low |
project | string | Project name (from registry) |
tags | string[] | Category tags |
created_at | ISO datetime | Creation timestamp |
updated_at | ISO datetime | Last update timestamp |
created_by | enum | human, claude, other-agent |
assigned_to | string? | Current assignee |
context.files | string[] | Related file paths |
context.urls | string[] | Related URLs |
context.notes | string | Freeform description |
dependencies | string[] | Task IDs this task depends on |
Projects are tracked in ~/.zenarc/projects.json:
[
{ "name": "loa-web", "path": "/Users/.../loa/loa-web", "format": "yaml" },
{ "name": "codeyourreality", "path": "/Users/.../codeyourreality", "format": "yaml" }
]
The registry is auto-populated during migration and zenarc_scan.
npm run build
npm run dev
npm run migrate -- <project-name> <project-path>
zenarc-mcp
This runs zenarc-mcp over stdio for local testing. It does not start an HTTP server — Claude Code/Desktop spawns this process automatically.
node scripts/publish.js patch # or minor / major
@modelcontextprotocol/sdk (stdio transport)@dnd-kitzenarc) for quick launchFAQs
ZenArc — AI-native task manager with MCP server and web dashboard
The npm package @zenarc/zenarc receives a total of 12 weekly downloads. As such, @zenarc/zenarc popularity was classified as not popular.
We found that @zenarc/zenarc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.