
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
CanvasSaaS CLI — AI business framework generation for coding agents. 19 strategy frameworks from a single business idea.
AI business framework generation from the terminal. 19 investor-grade strategy frameworks (SWOT, Business Model Canvas, Lean Canvas, Porter's Five Forces, TAM-SAM-SOM, Financial Forecast, and more) from a single business idea.
Zero dependencies. Node.js 18+.
npm install -g canvasaas
# 1. Register + get API key (5 free credits)
cvs signup "My Venture" --email agent@firm.com
# 2. Explore
cvs frameworks # List all 19 frameworks
cvs frameworks --detail swot # Framework details
# 3. Generate
cvs generate swot "AI-powered scheduling for remote teams" # 1 credit
cvs generate --all "My business idea" --venture myapp # All 19 (5 credits)
# 4. Deck
cvs deck create myapp # Shareable investor deck (1 credit)
# 5. Chat (free, unlimited)
cvs chat "What pricing methodology should I use?"
cvs chat "How do I improve my weaknesses?" --framework swot
# 6. Status
cvs me # Account overview
cvs balance # Credits remaining
cvs topup "Client presentation" # Request more credits
Priority: --key flag > CVS_API_KEY env > ./.cvs/config.json > ~/.cvs/config.json
| Flag | Description |
|---|---|
--key KEY | API key (overrides config) |
--sa-key KEY | Superadmin API key (admin commands) |
--url URL | Base URL (default: https://canvasaas.com) |
--json | JSON output for programmatic use |
--local | Save config to .cvs/ (project-local) |
Add to .mcp.json:
{
"mcpServers": {
"canvasaas": { "type": "stdio", "command": "cvs", "args": ["mcp-serve"] }
}
}
Exposes 8 tools: canvasaas_list_frameworks, canvasaas_generate, canvasaas_full_package, canvasaas_create_deck, canvasaas_chat, canvasaas_balance, canvasaas_me, canvasaas_request_topup.
Full superadmin surface — tenants, admin users, impersonation, AI providers. Tenant commands accept slug, name, or ID.
# Tenants
cvs admin tenants # List all tenants
cvs admin tenant-view SLUG # Tenant detail
cvs admin tenant-create NAME --owner USER_ID [--plan pro]
cvs admin tenant-update SLUG --name X --email Y --status Z
cvs admin tenant-plan SLUG --plan pro
cvs admin tenant-suspend SLUG --reason "why"
cvs admin tenant-activate SLUG
cvs admin tenant-delete SLUG --confirm [--hard]
# Impersonation
cvs admin impersonate USER_ID TENANT # Get impersonation token
cvs admin impersonate-end TOKEN
# Superadmin users
cvs admin users
cvs admin admin-create EMAIL --password P --name N [--role superadmin|support|readonly]
cvs admin admin-update ID --role R --name N --password P
cvs admin admin-delete ID --confirm
# Platform
cvs admin plans
cvs admin stats
cvs admin audit --days 7
# AI providers
cvs admin ai-config # Show config (keys masked)
cvs admin ai-config-set --primary openai --openai-model gpt-5.1
cvs admin ai-status openai|ollama # Health check
cvs admin ai-test openai|ollama # Live generation test
| Action | Cost |
|---|---|
cvs generate {framework} | 1 credit |
cvs generate --all | 5 credits |
cvs deck create | 1 credit |
cvs chat | free |
New accounts get 5 free credits. Request more with cvs topup "reason".
https://canvasaas.com | Tyga.Cloud Ltd
FAQs
CanvasSaaS CLI — AI business framework generation for coding agents. 19 strategy frameworks from a single business idea.
The npm package canvasaas receives a total of 27 weekly downloads. As such, canvasaas popularity was classified as not popular.
We found that canvasaas demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.