
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@zeugwerk/plcsense
Advanced tools
MCP server for read-only TwinCAT Structured Text intelligence. Lets AI agents resolve symbols, inspect project and library APIs (.library / .compiled-library), pull docs, and validate PLC projects before editing — without TwinCAT XAE. Requires PLCSENSE_TO
npm launcher for the plcsense MCP server (Windows x64).
plcsense is commercial software (license: UNLICENSED). MCP tools stay unavailable
until a valid plcsense licence is activated on the machine.
The launcher downloads the Windows binary from api.zeugwerk.dev. Set the same
token Scoop uses:
$env:PLCSENSE_TOKEN = '<your token>'
Without it, the first npx / MCP start fails before any binary is cached.
plcsense license activate <licence-key>--license-key / set PLCSENSE_LICENSE_KEY when starting MCP)npx)PLCSENSE_TOKEN (download bearer token){
"mcpServers": {
"plcsense": {
"command": "npx",
"args": ["-y", "@zeugwerk/plcsense", "mcp"],
"env": {
"PLCSENSE_TOKEN": "<your token>"
}
}
}
}
Alternatively install the CLI from plcsense.com and run
plcsense setup cursor in your project folder.
Copyright (c) Zeugwerk GmbH. See LICENSE.
FAQs
MCP server for read-only TwinCAT Structured Text intelligence. Lets AI agents resolve symbols, inspect project and library APIs (.library / .compiled-library), pull docs, and validate PLC projects before editing — without TwinCAT XAE. Requires PLCSENSE_TO
The npm package @zeugwerk/plcsense receives a total of 97 weekly downloads. As such, @zeugwerk/plcsense popularity was classified as not popular.
We found that @zeugwerk/plcsense demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.