
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
AI Config Manager - A TypeScript-based CLI tool to manage and install AI tool configuration files across multiple AI development tools.
Idea is manage your AI tools config in same place and then reuse everywhere.
npm install airc-cli -g
airc --help
# Or use npx directly
npx airc-cli --help
Initialize your local config directory:
airc init
This creates:
~/.airc/ - User config directory~/.airc/config/skills/ - Local skills config storage~/.airc/config/commands/ - Local commands config storage~/.airc/config/agents/ - Local commands config storage~/.airc/config/mcp-config.json - MCP server configurations~/.aircrc - Configuration file for airc cliAdd a git repository containing AI configs. This automatically copies config files to your local directory:
# Add from GitHub (full repository)
airc source add https://github.com/vercel-labs/agent-skills
# Add with custom name
airc source add https://github.com/vercel-labs/agent-skills --name vercel-skills
# Add from GitHub tree URL
airc source add https://github.com/vercel-labs/agent-skills/tree/main/skills/react-best-practices
What happens:
~/.airc/temp/~/.airc/config/{type}/{source-name}/~/.aircrc for smart updatesList all configs in your local directory:
# List all configs
airc list
# Filter by type
airc list --type skills
Install your configs to specific AI tools:
# Install to Claude for your project only(<project-root>/.claude)
cd <project-root>
airc install claude
# Install globally(~/.claude)
airc install claude --global
airc source update react-best-practices
airc remove react-best-practices
Initially we have three folders in config folder(skills / commands / agents), but you can add your own custom folder, they will be copied to target folder when using airc install command:
airc/
├── config/ # Default configuration files
│ ├── commands/ # Command definitions
│ ├── skills/ # Skill definitions
│ ├── agents/ # Agent definitions
│ └── scripts/ # Add your own config folder
airc now supports managing MCP (Model Context Protocol) server configurations. MCPs allow AI tools to interact with external systems and services through standardized server interfaces.
MCP configurations are stored in ~/.airc/config/mcp-config.json:
{
"filesystem": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users"]
},
"github": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "your_token_here"
}
}
}
Field Descriptions:
type: Protocol type (currently only "stdio" is supported)command: The command to run the MCP server (e.g., "npx", "node")args: Array of command arguments (optional)env: Environment variables for the server (optional)List all available MCPs along with your other configs:
airc list
Example output:
📋 Your Configs
📦 Commands (2)
✏️ manual commit
✏️ manual push
📦 MCP Configs (2)
✏️ manual filesystem
type: stdio
✏️ manual github
type: stdio
Total: 4 configs
0 imported, 4 manual
When you run airc install <tool>, you'll be prompted to select which MCPs to install:
# Install to Claude (project-level)
cd <project-root>
airc install claude
# Install globally
airc install claude --global
Interactive MCP selection:
📦 MCP Configs
? Select MCPs to install: (Press <space> to select, <a> to toggle all)
❯◯ filesystem (stdio)
◯ github (stdio)
After selection, MCPs are merged into the tool's config file:
✅ Successfully installed 2 MCP configs
Installed to: .mcp.json
If an MCP with the same name already exists in the tool's config, use the --force flag to overwrite:
airc install claude --force
Without --force:
❌ Error: MCP conflicts detected: filesystem, github
These MCPs already exist in the config file.
Use --force to overwrite existing MCPs.
With --force:
✅ Successfully installed 2 MCP configs (overwrote 2 existing)
Remove an MCP from your local configuration:
airc remove <mcp-name> --force
Example:
airc remove github --force
Output:
🗑️ Remove Config
MCP Config: github
Type: stdio
Source: manual (MCP configuration)
✅ Successfully removed MCP "github"
MCP removed from ~/.airc/config/mcp-config.json
Different AI tools store MCPs in different locations with different field names:
| Tool | Project Mode Path | Global Mode Path | Field Name |
|---|---|---|---|
| Claude | .mcp.json | ~/.claude.json | mcpServers |
| Gemini | .gemini/settings.json | ~/.gemini/settings.json | mcpServers |
| Antigravity | N/A (global only) | ~/.gemini/antigravity/mcp_config.json | mcpServers |
| Cursor | .cursor/mcp.json | ~/.cursor/mcp.json | mcpServers |
| Copilot | .copilot/mcp-config.json | ~/.copilot/mcp-config.json | mcpServers |
| OpenCode | opencode.json | ~/.config/opencode/opencode.json | mcp |
Note: Antigravity only supports global mode. When installing to Antigravity in project mode, you'll see an informational message:
ℹ️ Note: Antigravity only supports global MCP installation
Use --global flag to install MCPs for Antigravity
MCPs not showing in airc list:
~/.airc/config/mcp-config.json exists and contains valid JSONMCP installation fails:
--global flag--force flag if MCPs already exist and you want to overwriteMCPs not working after installation:
npx @modelcontextprotocol/server-filesystem)FAQs
A CLI tool to install AI tool configuration files
We found that airc-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.