
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
claude-mpm
Advanced tools
NPM wrapper for claude-mpm Python package - Requires Python 3.8+. Orchestrate Claude with agent delegation and ticket tracking
A comprehensive workflow and agent management framework for Claude Code that transforms your AI coding assistant into a full-featured development platform with multi-agent orchestration, skills system, MCP integration, session management, and semantic code search.
⚠️ Important: Claude MPM requires Claude Code CLI (v2.1.3+), not Claude Desktop (app). All MCP integrations work with Claude Code's CLI interface only.
Don't have Claude Code? Install from: https://docs.anthropic.com/en/docs/claude-code
Quick Start: See Getting Started Guide to get running in 5 minutes!
Claude MPM transforms Claude Code into a comprehensive AI development platform with:
Python Version Warning:
- macOS default Python 3.9 is too old - use
--python 3.13flag- Python 3.13 is recommended and fully tested
- Python 3.14 is NOT yet supported - installation will fail
# Verify Claude Code is installed
claude --version
# If not installed, get it from:
# https://docs.anthropic.com/en/docs/claude-code
# Set GitHub token (recommended - avoids rate limits)
export GITHUB_TOKEN=your_github_token
IMPORTANT: Install from your home directory, NOT from within a cloned git repository.
uv (recommended):
# From home directory (IMPORTANT!)
cd ~
# Install with Python 3.13 (not 3.9 or 3.14)
uv tool install "claude-mpm[monitor,data-processing]" --python 3.13
Homebrew (macOS):
brew tap bobmatnyc/tools
brew install claude-mpm
pipx:
cd ~
pipx install "claude-mpm[monitor]"
These steps must be completed before running claude-mpm doctor:
# Create required directories
mkdir -p ~/.claude/{responses,memory,logs}
# Deploy agents
claude-mpm agents deploy
# Add skill source (recommended)
claude-mpm skill-source add https://github.com/bobmatnyc/claude-mpm-skills
# Run diagnostics (after completing setup above)
claude-mpm doctor --verbose
# Check versions
claude-mpm --version
claude --version
# Auto-configure your project
cd ~/your-project
claude-mpm auto-configure
What You Should See:
~/.claude/agents/Recommended Partners: Install these companion tools for enhanced capabilities:
uv tool install kuzu-memory --python 3.13
uv tool install mcp-vector-search --python 3.13
uv tool install mcp-ticketer --python 3.13
uv tool install mcp-browser --python 3.13
Tool Version Management: Use ASDF version manager to avoid Python/uv version conflicts across projects.
--resume flag for seamless continuity→ Learn more: Multi-Agent Development
claude-mpm agent-source add.claude/skills/ or skill repositories→ Learn more: Developer Use Cases
mpm-session-server) for programmatic session management--monitor flag and web dashboard→ Learn more: MCP Gateway | → MCP Session Server
claude-mpm setup notionclaude-mpm setup confluenceclaude-mpm setup slack# Set up Google Workspace OAuth
claude-mpm oauth setup workspace-mcp
# Set up Notion (API token)
claude-mpm setup notion
# Set up Confluence (URL + API token)
claude-mpm setup confluence
# Set up Slack (OAuth user token)
claude-mpm setup slack
# Check token status
claude-mpm oauth status workspace-mcp
# List OAuth-capable services
claude-mpm oauth list
→ Google Workspace Setup | → Notion Setup | → Confluence Setup | → Slack Setup
~/.claude-mpm/migrations.yaml→ Learn more: Startup Migrations
# Start interactive mode
claude-mpm
# Start with monitoring dashboard
claude-mpm run --monitor
# Resume previous session
claude-mpm run --resume
# Force sync agents/skills from GitHub (overrides 24-hour TTL)
claude-mpm --force-sync
# Skip sync for maximum startup speed
claude-mpm --no-sync
# Semantic code search
claude-mpm search "authentication logic"
# or inside Claude Code:
/mpm-search "authentication logic"
# Health diagnostics
claude-mpm doctor
# Verify MCP services
claude-mpm verify
# Manage memory
claude-mpm cleanup-memory
💡 Startup Performance: Claude MPM syncs agents and skills once per day. Subsequent launches are near-instant (~100ms). Use --force-sync to pull the latest content immediately or set CLAUDE_MPM_SYNC_TTL (seconds) to customize the sync interval.
💡 Update Checking: Claude MPM automatically checks for updates and verifies Claude Code compatibility on startup. Configure in ~/.claude-mpm/configuration.yaml or see docs/update-checking.md.
→ Complete usage examples: User Guide
Starting in v5.9.46, Claude MPM syncs agents and skills once per day instead of checking GitHub on every launch. Subsequent startups skip all network requests and launch in approximately 100ms.
Before: 500ms–2s on every launch (HTTP HEAD requests to GitHub for each file). After: ~100ms after the first daily sync (no network activity).
# Normal launch — uses cached content if synced within 24 hours
claude-mpm
# Force an immediate sync of agents and skills from GitHub
claude-mpm --force-sync
# Skip sync entirely (use cached content regardless of age)
claude-mpm --no-sync
Configuration: Override the 24-hour default with the CLAUDE_MPM_SYNC_TTL environment variable (value in seconds):
# Sync every 12 hours instead of 24
export CLAUDE_MPM_SYNC_TTL=43200
# Sync every 7 days
export CLAUDE_MPM_SYNC_TTL=604800
Sync state is stored in ~/.claude-mpm/cache/sync-state.json. All five startup skill operations — bundled deploy, remote sync, discovery, summary, and PM skills verify — are gated and only run when content has actually changed.
→ Full sync documentation: Agent Synchronization Guide
Quick Start with Custom Repositories:
# Add custom agent repository
claude-mpm agent-source add https://github.com/yourorg/your-agents
# Add custom skill repository
claude-mpm skill-source add https://github.com/yourorg/your-skills
# Test repository without saving
claude-mpm agent-source add https://github.com/yourorg/your-agents --test
📚 Complete Documentation Hub - Start here for all documentation!
doctor command with auto-fixClaude MPM supports multiple integrations for enhanced functionality. See Complete Integration Documentation for detailed setup guides.
# Setup any integration with one command
claude-mpm setup <integration>
# Examples:
claude-mpm setup kuzu-memory
claude-mpm setup mcp-vector-search
claude-mpm setup gworkspace-mcp # Canonical name (preferred)
claude-mpm setup google-workspace-mcp # Legacy alias (also works)
claude-mpm setup slack
claude-mpm setup notion
claude-mpm setup confluence
# Setup multiple at once
claude-mpm setup kuzu-memory mcp-vector-search gworkspace-mcp
Integration Features:
Contributions are welcome! Please see:
Development Workflow:
# Complete development setup
make dev-complete
# Or step by step:
make setup-dev # Install in development mode
make setup-pre-commit # Set up automated code formatting
Licensed under the Elastic License 2.0 - free for internal use and commercial products.
Main restriction: Cannot offer as a hosted SaaS service without a commercial license.
📖 Licensing FAQ | 💼 Commercial licensing: bob@matsuoka.com
FAQs
NPM wrapper for claude-mpm Python package - Requires Python 3.8+. Orchestrate Claude with agent delegation and ticket tracking
The npm package claude-mpm receives a total of 906 weekly downloads. As such, claude-mpm popularity was classified as not popular.
We found that claude-mpm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.