
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
CLI tool that downloads documentation from 3rd party libraries, converts them to Markdown, and optimizes for LLMs
Stop copy-pasting docs. Start getting answers.
CodeCanon transforms your AI coding assistant from a general-purpose tool into a project-aware expert by automatically building a local, optimized knowledge base from your dependencies' documentation.
Modern AI assistants like GitHub Copilot, ChatGPT, and Claude are incredibly powerful, but they have a critical weakness: they work best with rich, relevant context. Without proper context, they're prone to "hallucinations"—generating plausible but incorrect code.
Currently, developers bridge this gap manually by:
copilot-instructions.mdThis manual process is time-consuming, error-prone, and doesn't scale across teams.
CodeCanon automates the entire Retrieval-Augmented Generation (RAG) pipeline for your project dependencies. With a single command, it transforms scattered web documentation into a local, queryable knowledge base that makes your AI assistants dramatically more effective.
.canon/ directory)CodeCanon follows the proven "Git model" for managing project state. Just like .git/ manages your version control, .canon/ manages your AI context:
.canon/
├── settings.json # Project configuration
├── cache/ # Raw and processed documentation
│ └── <package>/
│ └── <version>/
│ ├── raw/ # Original scraped content
│ └── chunks/ # Semantic chunks for AI
├── context/
│ ├── llms.txt # Context index (llms.txt standard)
│ └── llms-full.txt # Full concatenated context
└── db/ # Vector database
npm install -g codecanon
# Create .canon workspace in your project
canon init
# Add documentation for your dependencies
canon add react
canon add express
canon add zod
# Generate context files for AI assistants
canon context
Once you've run canon context, you can use the generated context with any AI assistant:
GitHub Copilot Chat:
Based on the context in #file:.canon/context/llms-full.txt, show me how to create a form with validation using react-hook-form and zod.
ChatGPT/Claude:
Upload or reference .canon/context/llms-full.txt in your conversation for accurate, project-specific assistance.
canon init [--model <model>] - Initialize workspace with optional default LLM modelcanon add <package>[@version] - Fetch and process package documentationcanon sync - Auto-sync all dependencies from package.jsoncanon context - Generate final context files for AI assistantscanon query "<question>" - Interactive Q&A with your documentationcanon login - Authenticate with codecanon.ai"Stop copy-pasting docs and start getting answers. CodeCanon makes your AI assistant an expert on the libraries you actually use, directly in your project."
"Ensure your entire team's AI assistants are working from the same, up-to-date set of documentation and best practices. Improve code consistency and accelerate onboarding."
# Install dependencies
pnpm install
# Run in development mode
pnpm dev
# Build for production
pnpm build
cli/ - Command implementations (init, add, query, etc.)lib/ - Core library functions (workspace, package handling, query engine).canon/ - Generated workspace directory (created by canon init)We welcome contributions! Please see our Contributing Guide for details.
git checkout -b feat/amazing-feature)git commit -m 'feat: add some amazing feature')git push origin feat/amazing-feature).canon/ directory)llms.txt standard)canon query interactive Q&AThis project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Built with ❤️ for the developer community
Making AI assistants smarter, one dependency at a time.
FAQs
CLI tool that downloads documentation from 3rd party libraries, converts them to Markdown, and optimizes for LLMs
We found that codecanon demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.