
Security News
arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.
claude-config-ui
Advanced tools
Local, open-source UI for editing every Claude Code config file — settings, CLAUDE.md, MCP servers, subagents, slash commands, credentials, hooks. User / project-shared / project-local / enterprise scopes, with community presets and tooltips.
Run a terminal grid of live Claude agents, edit every config file from one place, watch your usage limits tick down, move your whole setup between machines encrypted — all in one fast, local, open-source desktop app. Nothing leaves your machine.
or, in any terminal: npx claude-config-ui
Files saved by this tool land in Claude Code's standard locations — Claude Code picks them up automatically on the next session start. No daemons, no symlinks, no special integration step.
The headline feature: a full terminal environment for Claude Code, inside the app. Stop juggling terminal tabs — run your agents in a grid and watch them all at once.
claude CLI) as you want. Actual PTYs, full color, resize, scrollback.cd into a project) and the tree jumps to that folder automatically so its files are right there. "Open terminal here" on any folder./context, /compact, /clear, /help — no typing..md / .pdf / text file from Finder onto any view (or from the workspace tree onto the header) and it opens in a full-screen reader. Read-only, instant, Esc to close.A gauge next to the header shows exactly how much you have left — pulled from Claude's own local usage cache, so it matches the app precisely:
No more guessing when you'll hit a limit mid-flow.
| ⚙️ Config, all of it | Edit settings.json, CLAUDE.md, .mcp.json, subagents, slash commands, output styles, keybindings — across all four scopes, every field with a tooltip that says what it does and why it matters. |
| 🔑 Credentials once | Set GitHub / AWS / Vercel / Stripe / 28+ services one time at user scope; they're available to every project. Masked inputs, deep links to each token page. |
| 🧭 Agent Orchestrator | A live board to launch one agent or a whole team, watch the tool/sub-agent tree render in real time, and resume any run. Discovers agents already running on your machine. |
| 📦 Encrypted Transfer | Pack your entire Claude world into one AES-256-GCM .ccsync file and restore it on another laptop with a per-file preview. |
| 🗂️ Projects & sessions | A bird's-eye view of every project that uses Claude, plus a per-project decision log (logic.md) and key tracker (credentials.md). |
| 💬 Conversation archive | Saves a verbatim Markdown copy of every Claude Code conversation, grouped per project — a readable local record that costs zero context-window tokens. |
| 🏠 Home dashboard | Opens on a control center: KPI tiles + Recommended next steps derived from your actual setup (lock down credentials, enable the sandbox, review a risky bypassPermissions default…). |
Download from the latest release:
Claude Config-X.Y.Z-arm64.dmg — Apple Silicon (M1 / M2 / M3 / M4, 2020+)Claude Config-X.Y.Z-x64.dmg — Intel Macs (2019 and earlier)Open the .dmg, drag Claude Config to Applications, launch from Spotlight or Launchpad.
First launch (one time): the app is signed ad-hoc but not notarized (no paid Apple Developer certificate), so macOS Gatekeeper blocks it once. Right-click the app → Open, then Open in the dialog. Or clear the quarantine flag:
xattr -dr com.apple.quarantine "/Applications/Claude Config.app"The "app is damaged" seal bug from builds ≤ v0.9.0 is fixed in current releases.
Download Claude-Config-X.Y.Z-x64-setup.exe from the latest release, run the installer, launch Claude Config from the Start menu.
First launch (one time): Windows SmartScreen blocks the unsigned installer. Click More info → Run anyway. Standard for indie/OSS apps without a code-signing cert.
npx claude-config-ui
The launcher picks a free port, opens your browser, and detects your OS-correct paths automatically. Ctrl+C to stop.
The embedded-terminal, drag-and-drop, and macOS onboarding features are richest in the desktop app (they need OS access the browser sandbox doesn't allow). Everything else runs identically over
npx.
Claude Code reads config from 30+ possible files across user, project, project-local, and enterprise scopes. Most people learn the system by trial-and-error or by copy-pasting community gists. This turns that into a guided, visual workflow — and then goes further, giving you a place to actually run and watch your agents.
~/.claude/ on macOS/Linux, %APPDATA%\Claude\ on Windows, project paths from your repo, enterprise paths from /Library/Application Support/ClaudeCode/ or /etc/claude-code/.*.bak-<timestamp>. Nothing is lost.Mirrors how Claude Code actually resolves config:
| Tab | What | Path |
|---|---|---|
| Global Claude | Your personal user-level config (all projects) | ~/.claude/ |
| Global Project | Team-shared project config (committed to git) | <project>/.claude/ + CLAUDE.md + .mcp.json |
| Local Claude | Personal overrides for one project (gitignored) | <project>/.claude/settings.local.json + CLAUDE.local.md |
| Project Local (Enterprise) | Organization policy deployed by IT (highest precedence) | /Library/Application Support/ClaudeCode/ · C:\Program Files\ClaudeCode\ · /etc/claude-code/ |
Precedence (later wins): user → project shared → project local → enterprise.
settings.json — every key in the Claude Code 2.1.28x settings reference, in 16 collapsible, filterable groups: model & reasoning (effort caps, fallback chain, fast mode, ultracode, prompt-cache lifetime), permissions and auto-mode classifier rules, the full sandbox (filesystem, network, credentials), MCP allow/deny lists, env, memory & context, interface & terminal, status line, git attribution, plugins & skills, agents & worktrees, Remote Control & notifications, auth helpers, updates & privacy, and managed-only policy keys. Toggles show Claude Code's real default when a key is unset.PreModelSwitch / PostModelSwitch), matcher hints per event, and all five handler types: command, http, mcp_tool, prompt, agent.env block of ~/.claude/settings.json.CLAUDE.md / CLAUDE.local.md — markdown editor with line/char counts, 12 section templates, and four full-doc presets (Karpathy, HumanLayer, Trail of Bits, Minimal)..mcp.json (stdio / http / sse / ws, OAuth, headers helper, per-server timeout) · keybindings.json (all 24 contexts, null to unbind) · agents/ · commands/ · skills/ · output-styles/ · managed-settings.json — all guided, all templated.A live, visual team board for running Claude agents. Launch one on a task, or launch several at once — each runs concurrently as its own card.
{inputs} and executes step by step, handing each agent's output to the next, with per-step status, outputs, and cost. Sequential or manager-delegated (hierarchical) modes.claude sessions you didn't launch here (other terminals/windows) and shows each one's activity, model, project, and a claude --resume command.Under the hood it spawns headless claude -p … --output-format stream-json and parses the event stream — no extra dependencies, using your already-authenticated claude CLI.
A dedicated MCP tab across all three scopes. See every server with its transport/auth/alwaysLoad state, enable/disable to save context (reversibly stashed, with a backup), add/edit/remove with guided fields, and resolve issues with per-server diagnostics that give the exact copy-paste fix (/mcp, claude mcp get, reset-project-choices). Secrets masked.
Pack your whole Claude world into one encrypted .ccsync file and restore it elsewhere.
~/.claude.json (MCP servers + API keys), settings, global CLAUDE.md, agents, skills, commands, keybindings, per-project auto-memory, and the app's own data. Add extra files/folders — .env files ride along.claude + /login once on the new laptop.A bird's-eye view of every project that uses Claude — discovered by scanning your code roots and decoding the working directories of recent Claude Code sessions. Edit each project's local files inline (CLAUDE.md, .claude/settings.json, .mcp.json, …).
/resume shows, with first prompt, last-worked time, message count, size, and detected project. Sort, rename, reassign, or delete throwaway sessions to reclaim disk.logic.md — a per-project decision log in a central context vault, so rationale isn't re-litigated across sessions. Toggle Auto-maintain to have Claude read + append it every session.credentials.md — a local-only, masked inventory of the keys each project uses, so you know what exists and when to rotate.~/.claude-config-ui/conversations/<project>/, in plain "You / Claude" turns with no summarization. It only reads the session files Claude already wrote and writes separate .mds — it never feeds anything back to Claude, so it uses zero context-window tokens.A redesigned, high-contrast mechanical interface: a monochrome canvas with a disciplined primary-color accent system — blue for interactive/active, red for live/destructive, yellow for warnings — over a precise engineering-grid backdrop. Animated view transitions, count-up metrics, and skeleton loaders throughout, all honoring prefers-reduced-motion. A motivational line greets you on open, and a first-run macOS gate walks you through the folder permissions Claude needs to create projects.
From source:
git clone https://github.com/HarshitSingh-PM/claude-config-manager.git
cd claude-config-manager
npm install
npm run dev # → http://localhost:3000
Global install:
npm install -g claude-config-ui
claude-config-ui # or: ccm
The npm package is
claude-config-ui(the bare name was taken); the GitHub repo keepsclaude-config-manager.
Everything is auto-detected. The only thing you set is the project directory for project-scoped tabs (defaults to where you launched). No .env, no config file.
PORT — override the default 3737.CCM_NO_OPEN=1 — don't auto-open the browser..bak-* first (autosave takes one per file per session).~, cwd, and known enterprise dirs; the same sandbox applies to the terminal file tree and viewer.~/.claude-config-ui/terminals/ (most-recent 100 retained).env block of ~/.claude/settings.json — plain text on disk. Fine for personal API keys; for high-blast-radius secrets use Claude Code's apiKeyHelper instead.npxnode-pty + @xterm/xterm for the embedded terminals (N-API prebuilds — no native rebuild).dmg / .exe distribution (the npm package is pure Node)npm install
npm run dmg # macOS arm64 .dmg → dist-electron/
npm run exe # Windows x64 NSIS .exe → dist-electron/
Cross-compiling to Windows from Apple Silicon needs Rosetta (
sudo softwareupdate --install-rosetta --agree-to-license). Builds are unsigned by default — setmac.identity/win.certificateFileinpackage.json#buildto sign for distribution.
See CONTRIBUTING.md. Easy wins: add a service to the Credentials catalog, a CLAUDE.md section template, or a subagent / slash-command template (src/lib/presets/).
MIT. See LICENSE.
Schema and presets drawn from the official Claude Code docs, awesome-claude-code, trailofbits/claude-code-config, awesome-claude-code-subagents, wshobson/commands, HumanLayer's "Writing a good CLAUDE.md", Karpathy's CLAUDE.md gist, and claude-code-hooks-mastery. Terminal file-tree UX inspired by Nimbalyst.
FAQs
Local, open-source UI for editing every Claude Code config file — settings, CLAUDE.md, MCP servers, subagents, slash commands, credentials, hooks. User / project-shared / project-local / enterprise scopes, with community presets and tooltips.
We found that claude-config-ui demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.