
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
Let your agent edit Excel files without butchering them. MCP server + engine.
Let your agent edit Excel files without butchering them.
An MCP server that gives Claude Code, Cursor, Codex or any MCP host a safe way to
edit the .xlsx files you already have:
save_workbook is the only tool that touches disk.review_url: a local page that
shows the workbook with changed cells highlighted, before/after per cell, and
Accept / Reject per batch and Save. Run with --review-required and only that
page can save — the agent just hands you the link.run_script runs the agent's JavaScript against the
workbook in a worker with a hard timeout, and lands the result as one batch.npx gridpath mcp --allow ~/models
Files outside the --allow directories are refused. Default: the working directory.
Add --review-required if only a human should be able to write the file.
Pending changes live next to the workbook (.gridpath/<file>.batches.json) until
saved or rejected, so gridpath review model.xlsx can reopen the review page later.
claude mcp add gridpath -- npx -y gridpath mcp --allow ~/models
mcp.json){
"mcpServers": {
"gridpath": { "command": "npx", "args": ["-y", "gridpath", "mcp", "--allow", "/Users/you/models"] }
}
}
~/.codex/config.toml)[mcp_servers.gridpath]
command = "npx"
args = ["-y", "gridpath", "mcp", "--allow", "/Users/you/models"]
Then: "In model.xlsx, add an FY2029E column to the income statement."
Reads: describe_workbook, find_rows, read_range.
Writes (pending until saved): set_cell, set_range, set_format, run_script,
clear_range, insert_rows/delete_rows, insert_columns/delete_columns,
create_sheet/rename_sheet/delete_sheet, widths, heights, freeze panes,
hide/show, define_name, notes, merges.
Batches: list_batches, reject_batch, save_workbook (gated by --review-required).
Every tool takes path. Coordinates are A1 notation.
open parses the .xlsx into an in-process calculation engine (a fork of
IronCalc, compiled to WebAssembly).
Tools mutate that model and read back evaluated results. save_workbook diffs
the model against the file as loaded and patches the original bytes at the
zip-part level. Untouched parts are copied through; the engine never
regenerates the package.
v0. Not yet in v0: fetch_web/edgar_lookup sourcing tools, copy_range,
stage_data, per-cell reject in the review page, and the desktop app's own
agent loop as a tool. Benchmarks against other approaches are in the
gridpath-evals repo.
FSL-1.1-Apache-2.0. Each release becomes Apache 2.0 after two years.
FAQs
Real Excel files in your web app and in your agent: an embeddable spreadsheet with a Rust/WebAssembly engine, in-place .xlsx saves and AI tools, plus an MCP server for coding agents.
The npm package gridpath receives a total of 15 weekly downloads. As such, gridpath popularity was classified as not popular.
We found that gridpath demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.