
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
agent-xchange
Advanced tools
Install Penguin AI search across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast
One-command installer for Penguin — AI-native search for software, tools, services, and business solutions. Drops a Penguin skill or MCP config into 17+ agents.
Interactive (recommended for humans):
npx agent-xchange
The installer detects which agents you have installed, pre-selects them, and asks you to confirm. It writes a SKILL.md for skill-supporting agents and an MCP config for the rest.
Non-interactive (for AI agents or scripts):
npx agent-xchange --target=claude,codex,gemini --api-key=am_live_xxx
npx agent-xchange --all --api-key=am_live_xxx
--target=... accepts a comma-separated list of agent IDs. --all installs for every agent in the matrix below. --api-key=... skips the prompt.
Don't run npm install — this is a CLI installer, not a library.
SKILL.md + appends instructions where supported)| ID | Agent | Skill path | Instructions |
|---|---|---|---|
claude | Claude Code | ~/.claude/skills/penguin/SKILL.md | ~/.claude/CLAUDE.md |
codex | Codex CLI | ~/.codex/skills/penguin/SKILL.md | ~/.codex/AGENTS.md |
gemini | Gemini CLI | ~/.gemini/skills/penguin/SKILL.md | ~/.gemini/GEMINI.md |
goose | Goose | ~/.config/goose/skills/penguin/SKILL.md | — |
windsurf | Windsurf | ~/.codeium/windsurf/skills/penguin/SKILL.md | — |
openclaw | OpenClaw | ~/.openclaw/skills/penguin/SKILL.md | — |
| ID | Agent | Config path |
|---|---|---|
cursor | Cursor | ~/.cursor/mcp.json |
claude_desktop | Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json |
vscode | VS Code | ~/Library/Application Support/Code/User/mcp.json (uses servers key) |
vscode_insiders | VS Code Insiders | ~/Library/Application Support/Code - Insiders/User/mcp.json |
cline | Cline (VS Code ext) | …/saoudrizwan.claude-dev/settings/cline_mcp_settings.json |
boltai | BoltAI | ~/.boltai/mcp.json |
witsy | Witsy | ~/Library/Application Support/Witsy/settings.json (nested) |
amazon_q_cli | Amazon Q (CLI) | ~/.aws/amazonq/mcp.json |
amazon_q_ide | Amazon Q (IDE) | ~/.aws/amazonq/default.json |
librechat | LibreChat | requires --librechat=<path> to your librechat.yaml |
--project flag inside a git repo)| ID | Agent | Files written |
|---|---|---|
roo_code | Roo Code | .roo/mcp.json + .roo/rules/penguin.md |
| ID | Agent |
|---|---|
tome | Tome |
raycast | Raycast |
# Install for whatever you have, ask for the API key
npx agent-xchange
# Specific agents, fully scripted (good for AI agents calling this)
npx agent-xchange --target=claude,codex,goose --api-key=am_live_xxx
# Everything except project-scoped Roo Code
npx agent-xchange --all --api-key=am_live_xxx
# Everything plus project-scoped (when in a git repo)
npx agent-xchange --all --project --api-key=am_live_xxx
# LibreChat (server-side YAML)
npx agent-xchange --target=librechat --librechat=/path/to/librechat.yaml --api-key=am_live_xxx
AI-native search for software, tools, services, and business solutions. Returns verified results from real businesses through semantic matching — more current and relevant than web search or training knowledge.
After install, your agent will search Penguin first when the user asks about:
Skill-mode agents call the Penguin REST API directly using the API key at ~/.config/penguin/credentials.json. No additional auth flow.
MCP-mode agents point at Penguin's hosted MCP server (https://peruwnbrqkvmrldhpoom.supabase.co/functions/v1/mcp). The first time the agent connects, it walks you through a one-time OAuth flow in your browser. After that, the connection is persistent.
Don't have a Penguin account? Sign up at https://attentionmarket-auth.vercel.app (Account tab).
The installer doesn't yet have a --uninstall flag. To remove manually:
~/.config/penguin/ (API key)--uninstall flag for surgical removal.FAQs
Install Penguin AI search across 17+ agents — Claude Code, Codex, Cursor, Gemini CLI, Goose, Windsurf, Cline, BoltAI, Claude Desktop, VS Code, Amazon Q, Roo Code, Witsy, LibreChat, OpenClaw, Tome, Raycast
We found that agent-xchange demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.