
Security News
Agent Baseline Publishes Security Reference Architecture for Software Factories
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.
Official alias for create-cmp-cli — the AI delivery harness for Kotlin/Compose Multiplatform: scaffold a green-building Android + iOS app (one Kotlin codebase) in minutes, then hold AI-driven changes to a machine-enforced verify lane (8 gates, evidence re
Scaffold a production-shaped Kotlin Multiplatform app (Android + iOS, Compose Multiplatform UI) in one command — the official
npm createalias forcreate-cmp-cli.
npm create kmp@latest my-app
Fully non-interactive (for scripts and AI agents):
npx create-kmp my-app --name Acme --package com.acme.app --yes --verify
One command stamps a frozen, CI-verified template — deterministic output, never LLM-freehanded project code:
--verify builds the app before reporting
success; the CLI exits non-zero on failure.node qa/verify.mjs), evidence receipts bound to a content hash, and CI that
refuses "done" without proof. See it working in the
public showcase repo — including
a PR the harness refuses.The tool also ships doctor (diagnose/heal any KMP project's toolchain and version catalog),
upgrade (migrate to the next proven-green version set), clean, and verify — they work on
any KMP project, not just generated ones.
This is the official alias for create-cmp-cli, published by the same maintainer so the
conventional npm create kmp invocation works. It contains a single delegating bin and no
logic of its own: it resolves the installed create-cmp-cli and re-executes it, forwarding
all arguments, stdio, and the exit code. Either name runs the same tool with the same flags —
this one just matches what you'd naturally type.
npx create-kmp --helpFAQs
Official alias for create-cmp-cli — the AI delivery harness for Kotlin/Compose Multiplatform: scaffold a green-building Android + iOS app (one Kotlin codebase) in minutes, then hold AI-driven changes to a machine-enforced verify lane (evidence receipts) w
The npm package create-kmp receives a total of 9 weekly downloads. As such, create-kmp popularity was classified as not popular.
We found that create-kmp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Agent Baseline’s new reference architecture shows how to secure software factories with four boundaries enforced outside the AI agent.

Security News
arXiv now limits authors to two submissions a month as AI slop overwhelms moderators, delays good papers, and sparks debate over applying the limit to everyone.

Research
/Security News
A new GhostAction wave hits hundreds of GitHub repos, expanding CI/CD secret theft to cloud and AI credentials in source code and git history.