
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Full servers. Forged in seconds. Gone when done.
Ephemeral machines for developers and AI agents.
Docker, root, SSH, your repo — ready in one command.
You're deep in a feature on main. Slack: "can you check why tests fail on feat/payments?" You stash, checkout, install deps, run tests, debug, switch back. 15 minutes gone. Flow destroyed.
Or: three people need to test three different branches on one laptop. One Docker daemon. Port conflicts. Everyone waits for CI instead.
gibil gives every branch its own machine. Your local stays on main. The branch runs on a real Linux server for $0.007/hr.
npm install -g gibil
gibil init # enter your Hetzner API token
gibil branch feat/payments --run "pnpm test" # spins up a server, checks out the branch, runs tests
gibil ssh feat-payments # SSH in to debug
gibil destroy feat-payments # gone, no trace
npm install -g gibil
# Forge a server with your repo cloned and ready
gibil create --name my-app --repo github.com/you/project --ttl 30
# Let your agent work on it
gibil run my-app "pnpm install && pnpm test"
# Or give Claude Code direct access via MCP
gibil mcp my-app
# Burn it when done
gibil destroy my-app
gibil branch feat/X gives the branch its own Linux machine. Your local stays on main.--agent claude installs Claude Code on the server. Also supports aider and codex. Direct filesystem access, no MCP latency.gibil ssh <name> drops you into a real terminal. Debug live, not from CI logs.--port 3000 tunnels the app to localhost. Open your browser, see the branch running live.gibil branch feat/A feat/B feat/C boots three servers in parallel. Zero interference.gibil mcp gives Claude Code direct access to a remote server via MCP tools.| Command | Description |
|---|---|
gibil init | Set up gibil — Hetzner token, MCP config, agent skill |
gibil create | Forge an ephemeral server |
gibil branch <branch> | Spin up a branch on a clean server (auto-detects repo) |
gibil checkout <branch> | Alias for gibil branch |
gibil ssh <name> | SSH into a running server |
gibil run <name> <cmd> | Execute a command remotely (--background for async) |
gibil job <cmd> | Manage background jobs (status, list, cancel, logs) |
gibil exec <name> | Upload and run a local script |
gibil mcp [name] | Start MCP server for AI agents (--print-config for setup) |
gibil list | List all active servers |
gibil extend <name> | Extend a server's TTL |
gibil destroy [name] | Burn down a server |
gibil auth | Manage authentication |
gibil usage | View usage and plan limits |
Your agent runs locally and reaches into the server via MCP tools. Good for quick tasks where you want to watch the agent work.
gibil create --name my-app --repo github.com/you/project
gibil mcp # Claude Code gets vm_bash, vm_read, vm_write tools
| Pros | Cons |
|---|---|
| See everything the agent does | Every file/command is a network round-trip |
| Agent uses your local config | Your laptop stays busy (fans, battery) |
| Works with any MCP-compatible agent | Long commands block with no streaming |
The agent runs directly on the server. Your laptop is just a terminal. Good for heavy work, long sessions, or when you want your laptop free.
gibil branch feat/payments --agent claude
gibil ssh feat-payments
# Set your API key in the session (stays in memory, never written to disk)
export ANTHROPIC_API_KEY=sk-ant-...
claude # direct filesystem access, full Docker, zero latency
# Also supports aider and codex:
gibil branch feat/payments --agent aider # then: export ANTHROPIC_API_KEY=...
gibil branch feat/payments --agent codex # then: export OPENAI_API_KEY=...
| Pros | Cons |
|---|---|
| Direct filesystem — no MCP latency | Need to SSH in to interact |
| Full Docker, real Linux tools | Set API key manually after SSH |
| Your laptop is free | Need tmux to persist sessions |
| Works with claude, aider, codex |
Security note: Don't pass API keys via
--env— they end up on disk in/etc/environment. Instead, SSH in andexportthe key. It stays in memory and vanishes when the server is destroyed.
Rule of thumb: Quick checks → MCP (Option A). Heavy work or "let it run" → remote agent (Option B).
Run a dev server on a gibil server and open it in your browser:
gibil branch feat/payments --run "pnpm dev" --port 3000
# → Server created, branch checked out, dev server started
# → Local: http://localhost:3000 ← open in your browser
# → Tunnel running in background
Or with an interactive SSH session and port forwarding:
gibil ssh feat-payments --port 3000 --port 8080
# → Forwarding localhost:3000 → feat-payments:3000
# → Forwarding localhost:8080 → feat-payments:8080
# → Tunnel active while SSH session is open
Both approaches tunnel traffic through SSH — encrypted, no public ports exposed, works behind any firewall.
Every command supports --json for programmatic use:
gibil create --name task --repo https://github.com/user/repo --json --ttl 30
gibil run task "cd /root/project && pnpm install && pnpm test" --json
gibil destroy task --json
Teach your AI agent how to use gibil. Works with Claude Code, Cursor, Copilot, Gemini CLI, and 40+ other agents.
npx skills add https://github.com/AlexikM/gibil-skills --skill gibil
Proprietary. See LICENSE for details.
Named after the Sumerian god of fire. The oldest flame, forging the newest servers.
FAQs
Your own machine, on demand. Forge, use, burn.
The npm package gibil receives a total of 54 weekly downloads. As such, gibil popularity was classified as not popular.
We found that gibil demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.