
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
Attribution-first MCP infrastructure for news and research discovery.
CiteWire gives agents structured, read-only access to news and research metadata while preserving credit and traffic for the original publisher. It can expose a compatible news platform as typed MCP tools, query optional public provider APIs, or do both in one server.
The Community edition is useful on its own. It includes the MCP core, stdio and HTTP transports, the generic platform adapter, and every provider adapter in this repository under the MIT license. Commercial product direction is additive and focused on managed operations, personalization, workflows, collaboration, retained history, and support. See Product tiers.
news.list, news.get, news.topics, and news.about.CiteWire is not a full-text ingestion service, crawler, publisher, editorial system, or rights-clearance service. It does not store or republish article bodies. Provider reachability does not replace review of the provider's current terms for your use case.
Requirements: Node.js 18 or newer. Community is an ESM-only Node package; it does not provide a CommonJS entry point.
Create citewire.config.json with one provider enabled:
{
"providers": {
"openalex": { "enabled": true }
}
}
Run the server over stdio:
npx -y citewire --config citewire.config.json
stdio is the default transport and is the usual choice when an MCP client launches citewire as a local process.
Use an absolute config path because clients do not always launch from the project directory:
{
"mcpServers": {
"citewire": {
"command": "npx",
"args": [
"-y",
"citewire",
"--config",
"/absolute/path/to/citewire.config.json"
]
}
}
}
Run the stateless HTTP transport on port 8722:
npx -y citewire --config citewire.config.json --http 8722
The local endpoint accepts JSON-RPC over POST /. It does not offer sessions
or an event stream.
Declare a platform with a display name, site URL, and read API base:
{
"platform": {
"name": "Example Industry News",
"siteUrl": "https://news.example",
"apiBase": "https://news.example/api/v1/news"
}
}
That configuration exposes four tools:
| Tool | Purpose |
|---|---|
news.list | List items newest first, with optional topic, industry, text, date-window, and pagination filters. |
news.get | Get one item by slug, including attribution and related coverage returned by the platform. |
news.topics | Read the platform's active topic taxonomy. |
news.about | Read static platform facts and the attribution policy. |
The required HTTP surface is documented in the platform read-API contract.
Provider adapters are included in Community and are disabled by default. A
provider becomes active only when its config entry sets enabled to true.
{
"providers": {
"gdelt-doc": { "enabled": true },
"arxiv": { "enabled": true },
"crossref": {
"enabled": true,
"mailto": "operator@example.com"
}
}
}
Crossref requires the deployer's own contact email so requests can identify the
operator to its polite pool. citewire sends that address only to Crossref in
the request mailto parameter and User-Agent. Do not copy the example
address.
The current adapters are:
| Provider | Tools | Focus |
|---|---|---|
| GDELT DOC 2.0 | gdelt.search | Worldwide news article metadata |
| GDELT Context 2.0 | gdelt.context | Snippet-level context around a term |
| arXiv | arxiv.search | Preprint metadata |
| OpenAlex | openalex.search | Scholarly works, authors, and venues |
| Crossref | crossref.search | DOI registration metadata |
| Semantic Scholar | semanticscholar.search | Papers and author graph metadata |
| Europe PMC | europepmc.search | Life-sciences literature metadata |
| dblp | dblp.search | Computer-science bibliography records |
| Hacker News | hackernews.top, hackernews.item | Stories and items from the official API |
| DEV | devto.search | Published DEV article metadata |
Read Providers before enabling one. That document records the endpoint, documentation, free-access basis, and known courtesy limits for each adapter. The provider's own documentation remains the source of truth.
platform is optional.providers is optional.tools/list is the authoritative tool list for a running deployment because
enabled tools depend on that deployment's config.A deployment can combine a platform and provider tools:
{
"platform": {
"name": "Example Industry News",
"siteUrl": "https://news.example",
"apiBase": "https://news.example/api/v1/news"
},
"providers": {
"openalex": { "enabled": true }
}
}
CiteWire can expose a local, read-only foundation for source policy, rights evaluation, and shadow inclusion scoring:
{
"community": {
"enabled": true,
"classifierMode": "shadow",
"thresholds": {
"adjacent_min": 0.5,
"standard_min": 0.6
}
}
}
Every bundled source remains disabled by default. This setting performs no
network calls, loads no credentials, and cannot publish. Credential-based
rights checks accept opaque secret-manager references in memory but never
return those references. The classifier is forced to shadow mode and always
reports publishable: false until a separately reviewed editorial system and
evaluation corpus exist.
Read Source registry and rights for the runtime validation, fail-closed policy, canonical MCP tools and resources, and current limitations.
These boundaries are maintained through the project governance policy.
PENDING.citewire was shaped through its first deployment for Karaya Group Industry News. The public platform contract is generic and can wrap any compatible read API.
Run the test suite with npm test. No install step is required. See
CONTRIBUTING.md before proposing a provider or a change to a
public contract.
Community is MIT licensed. See LICENSE.
FAQs
Attribution-first MCP server for free news sources and free article APIs.
The npm package citewire receives a total of 14 weekly downloads. As such, citewire popularity was classified as not popular.
We found that citewire demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.