
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ContextVM Interface (CVMI) is a CLI tool that allows you to navigate and use the ContextVM protocol. It provides a set of tools and skills to help you interact, and implement the protocol.
Note: This project is a fork of the
skillsCLI by Vercel Labs.
# Install ContextVM skills interactively
npx cvmi add
# Install a specific skill from the ContextVM repository
npx cvmi add --skill overview
cvmi add - Install skills with interactive pickercvmi add --skill <name> - Install specific skillscvmi serve - Expose a server (gateway)cvmi use - Use a server from nostr as stdio (proxy)cvmi discover - Discover announced servers on relayscvmi cn - Compile a server to code (ctxcn)cvmi call - Call methods from a servercvmi inspect - Inspect server schemaConfiguration is stored in JSON format with the following priority:
--config <path>./.cvmi.json~/.cvmi/config.jsonGlobal config path: ~/.cvmi/config.json (separate from ~/.agents/ used for skills)
Nostr MCP environment variables:
CVMI_SERVE_* / legacy CVMI_GATEWAY_* for serve/gateway settingsCVMI_USE_* / legacy CVMI_PROXY_* for use/proxy settingsCVMI_CALL_PRIVATE_KEY for direct cvmi call requestsAdditional serve env vars:
CVMI_SERVE_URL / CVMI_GATEWAY_URL to set the remote Streamable HTTP MCP server URLLogging environment variables (SDK-level):
The underlying @contextvm/sdk uses these env vars to control logging:
| Variable | Values | Description |
|---|---|---|
LOG_LEVEL | debug, info, warn, error, silent | Minimum log level to output (default: info) |
LOG_DESTINATION | stderr, stdout, file | Where to write logs (default: stderr) |
LOG_FILE | path string | Path to log file (used when LOG_DESTINATION=file) |
LOG_ENABLED | true, false | Disable all logging with false (default: true) |
Example: Run serve with debug logging to a file
LOG_LEVEL=debug LOG_DESTINATION=file LOG_FILE=./cvmi.log cvmi serve -- npx -y @modelcontextprotocol/server-filesystem /tmp
Example: Run use with only warnings and errors
LOG_LEVEL=warn cvmi use npub1q...
Example global config (~/.cvmi/config.json):
{
"serve": {
"url": "https://my.mcp.com/mcp",
"command": "npx",
"args": ["@modelcontextprotocol/server-filesystem", "."],
"relays": ["wss://relay.damus.io"],
"public": false,
"encryption": "optional"
},
"use": {
"relays": ["wss://relay.damus.io"],
"serverPubkey": "npub1...",
"encryption": "optional"
},
"servers": {
"weather": {
"pubkey": "npub1...",
"relays": ["wss://relay.contextvm.org"]
}
}
}
Private keys are not stored in JSON config. Set them with environment variables or CLI flags instead.
cvmi callcvmi call resolves server targets using this order:
--relays and --config--config <path>./.cvmi.json~/.cvmi/config.jsonCreate reusable aliases from the CLI:
# Save an alias in the current project's .cvmi.json
cvmi config add weather nprofile1example
# Save an alias globally
cvmi config add --global weather nprofile1example
# Call through the alias
cvmi call weather tool:weather.get_current city=Lisbon
# Use an alternate config file
cvmi call weather tool:weather.get_current city=Lisbon --config ./custom.cvmi.json
cvmi discovercvmi discover queries relay-stored server announcement events so you can find public ContextVM servers before using cvmi call.
It is intentionally config-less and straightforward:
--relays, orExamples:
# Discover public servers on the default relays
cvmi discover
# Discover on a specific relay
cvmi discover --relays wss://relay.contextvm.org
# Limit the number of returned announcements
cvmi discover --limit 10
# Get machine-readable JSON output
cvmi discover --raw
Note: For serve, you should configure either serve.url (remote Streamable HTTP MCP server) or serve.command/serve.args (spawn local stdio MCP server).
The underlying SDK can publish two complementary discoverability artifacts:
kind:11316-11320 server announcement events for capabilities and metadatakind:10002 relay-list metadata so clients can discover where the server is reachableRecommended behavior:
relays list focused on where the server actually runsbootstrapRelayUrls to publish discoverability metadata more broadlypublishRelayList enabled unless you explicitly want to opt out, including for private serversThis mirrors the CEP-17 model where discoverability publication targets can be broader than the relays advertised to clients.
cvmi serve spawns the MCP server directly (no shell). Prefer passing the command and its arguments as separate tokens:
cvmi serve -- npx -y @modelcontextprotocol/server-filesystem /tmp
If you accidentally pass a full command as a single quoted string (e.g. "npx -y ..."), cvmi will split it into an executable + args for you.
Use --env / -e (repeatable):
cvmi serve -e LOG_LEVEL=debug -- npx -y @modelcontextprotocol/server-filesystem /tmp
You can also set it in config under serve.env.
Note: The CLI auto-generates a private key if none is provided. Keys can be specified in hex format (with or without 0x prefix) or NIP-19 bech32 format (nsec1... for private keys, npub1... for public keys).
MIT
FAQs
ContextVM Interface
The npm package cvmi receives a total of 625 weekly downloads. As such, cvmi popularity was classified as not popular.
We found that cvmi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.