
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
cvm-server
Advanced tools
Cognitive Virtual Machine (CVM) - A deterministic bytecode VM with AI cognitive operations
The executable MCP server application for CVM. This is the npm package that users install to run CVM with Claude Desktop.
This app provides:
Claude Desktop
↓ (stdio)
cvm-server (this app)
↓
CVMMcpServer (@cvm/mcp-server)
↓
VMManager (@cvm/vm)
↓
Storage + VM Engine
Add to Claude Desktop's MCP settings:
{
"mcpServers": {
"cvm": {
"command": "npx",
"args": ["cvm-server@latest"],
"env": {
"CVM_STORAGE_TYPE": "file",
"CVM_DATA_DIR": ".cvm"
}
}
}
}
# Clone repository
git clone https://github.com/LadislavSopko/cvm.git
cd cvm
# Install dependencies
npm install
# Build all packages
npx nx build cvm-server
# Run locally
node apps/cvm-server/dist/main.js
The server uses environment variables for configuration:
# File storage (default)
CVM_STORAGE_TYPE=file
CVM_DATA_DIR=.cvm
# MongoDB storage
CVM_STORAGE_TYPE=mongodb
MONGODB_URL=mongodb://localhost:27017/cvm
# Log levels: debug, info, warn, error
CVM_LOG_LEVEL=info
# Log format: pretty (default) or json
CVM_LOG_FORMAT=pretty
# Environment: development, production
NODE_ENV=production
apps/cvm-server/
├── src/
│ ├── main.ts # Entry point
│ ├── config.ts # Configuration management
│ └── logger.ts # Logging setup
├── bin/
│ └── cvm-server.cjs # Executable wrapper
├── package.json # Package metadata
└── README.md # This file
# Development build
npx nx build cvm-server --configuration=development
# Production build
npx nx build cvm-server --configuration=production
# Bump version and publish
npx nx release
# Or manually
cd apps/cvm-server/dist
npm publish --otp=YOUR_OTP
Once installed, Claude can interact with CVM through MCP tools:
mcp__cvm__loadmcp__cvm__startmcp__cvm__getTaskmcp__cvm__submitTaskSee the main project README for detailed usage examples.
# Set environment variables
export CVM_STORAGE_TYPE=file
export CVM_DATA_DIR=.cvm-dev
export CVM_LOG_LEVEL=debug
# Run the server
node apps/cvm-server/dist/main.js
npx nx build cvm-server{
"mcpServers": {
"cvm": {
"command": "node",
"args": ["/path/to/cvm/apps/cvm-server/dist/main.js"]
}
}
}
Enable debug logging:
export CVM_LOG_LEVEL=debug
export CVM_LOG_FORMAT=pretty
Check logs for:
Apache 2.0 - See LICENSE file for details
FAQs
Cognitive Virtual Machine (CVM) - A deterministic bytecode VM with AI cognitive operations
We found that cvm-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.