
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
Generate portable AI workspace configs for any web development project — one manifest for Copilot, Claude, Codex, and MCP.
Generate portable AI workspace configs for any web development project — one manifest for Copilot, Claude, Codex, MCP, Cursor, and Windsurf.
Define one canonical ai-workspace.json manifest, then generate tool-specific configuration files for all six targets from a single source of truth.
# Install once:
npm install -g agenv-cli
# Then in any web project directory:
agenv init --yes
agenv generate
That's it. agenv inspects your repo, creates ai-workspace.json, and generates tool-specific files for your enabled targets.
ai-workspace.json — a single manifest describing your AI workspaceSupports seven project types: dashboard, web-app, api-service, full-stack, library, cli-tool, and mobile.
npm install -g agenv-cli
agenv --help
| Command | Description |
|---|---|
agenv init | Create ai-workspace.json from repo inspection + interactive prompts |
agenv init --yes | Non-interactive mode with recommended defaults |
agenv generate | Generate all planned files from the manifest |
agenv generate --dry-run | Preview what would be generated without writing |
agenv generate --force | Overwrite files modified outside agenv |
agenv diff | Show what generate would change |
agenv doctor | Validate manifest and repo compatibility |
agenv templates list | List available starter templates |
agenv init → ai-workspace.json (your manifest)
agenv generate → AGENTS.md, .github/copilot-instructions.md,
.claude/*, .mcp.json, docs/ai-prompts/*
agenv diff → preview changes before writing
agenv doctor → validate everything is consistent
Generated files include a header comment so agenv knows which files it manages. Files you edit by hand are protected from overwrite (unless you use --force). Backups are created in .agenv-backups/ before any overwrite.
| Target | Output |
|---|---|
codex | AGENTS.md |
copilot | .github/copilot-instructions.md |
claude | .claude/README.md, .claude/skills/*.md, .claude/agents/*.md, .claude/settings.local.json |
mcp | .mcp.json, .mcp.local.json |
cursor | .cursor/rules/context.mdc, .cursor/rules/coding-style.mdc, .cursor/rules/framework.mdc, .cursor/rules/code-review.mdc |
windsurf | .windsurf/rules/context.md, .windsurf/rules/coding-style.md, .windsurf/rules/framework.md, .windsurf/rules/code-review.md |
| Type | Description |
|---|---|
dashboard | Internal data/admin dashboard |
web-app | Consumer-facing web application |
api-service | Backend API service |
full-stack | Combined frontend + backend (e.g. Next.js full-stack) |
library | Reusable npm package or component library |
cli-tool | Node.js command-line tool |
mobile | React Native / Expo mobile app |
Built-in presets with trust annotations: filesystem, github, fetch, memory, postgres, sqlite, puppeteer, sequential-thinking, notion, stripe, atlassian.
Select presets during agenv init or add them to generated.mcpPresets in your manifest. Non-safe presets include _trustLevel and _trustNote annotations in .mcp.json.
| Doc | Purpose |
|---|---|
| Getting Started | Contributor onboarding |
| Product Requirements | Product goals and scope |
| Technical Requirements | Architecture and technical design |
| CLI Spec | Command contract and flag reference |
| Manifest Spec | Manifest schema and field definitions |
| Output Map | Which files are generated and when |
| Adapter Contract | How adapters work |
See CONTRIBUTING.md for setup, development commands, and PR guidelines.
See SECURITY.md for the vulnerability reporting policy.
npm install
npm run build
npm test
npm run typecheck
FAQs
Generate portable AI workspace configs for any web development project — one manifest for Copilot, Claude, Codex, and MCP.
We found that agenv-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.