
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Let your agent edit Excel files without butchering them.
An MCP server that gives Claude Code, Cursor, Codex or any MCP host a safe way to
edit the .xlsx files you already have:
save_workbook is the only tool that touches disk.review_url: a local page that
shows the workbook with changed cells highlighted, before/after per cell, and
Accept / Reject per batch and Save. Run with --review-required and only that
page can save — the agent just hands you the link.run_script runs the agent's JavaScript against the
workbook in a worker with a hard timeout, and lands the result as one batch.npx gridpath mcp --allow ~/models
Files outside the --allow directories are refused. Default: the working directory.
Add --review-required if only a human should be able to write the file.
Pending changes live next to the workbook (.gridpath/<file>.batches.json) until
saved or rejected, so gridpath review model.xlsx can reopen the review page later.
claude mcp add gridpath -- npx -y gridpath mcp --allow ~/models
mcp.json){
"mcpServers": {
"gridpath": { "command": "npx", "args": ["-y", "gridpath", "mcp", "--allow", "/Users/you/models"] }
}
}
~/.codex/config.toml)[mcp_servers.gridpath]
command = "npx"
args = ["-y", "gridpath", "mcp", "--allow", "/Users/you/models"]
Then: "In model.xlsx, add an FY2029E column to the income statement."
Reads: describe_workbook, find_rows, read_range.
Writes (pending until saved): set_cell, set_range, set_format, run_script,
clear_range, insert_rows/delete_rows, insert_columns/delete_columns,
create_sheet/rename_sheet/delete_sheet, widths, heights, freeze panes,
hide/show, define_name, notes, merges.
Batches: list_batches, reject_batch, save_workbook (gated by --review-required).
Every tool takes path. Coordinates are A1 notation.
open parses the .xlsx into an in-process calculation engine (a fork of
IronCalc, compiled to WebAssembly).
Tools mutate that model and read back evaluated results. save_workbook diffs
the model against the file as loaded and patches the original bytes at the
zip-part level. Untouched parts are copied through; the engine never
regenerates the package.
v0. Not yet in v0: fetch_web/edgar_lookup sourcing tools, copy_range,
stage_data, per-cell reject in the review page, and the desktop app's own
agent loop as a tool. Benchmarks against other approaches are in the
gridpath-evals repo.
FSL-1.1-Apache-2.0. Each release becomes Apache 2.0 after two years.
FAQs
Real Excel files in your web app and in your agent: an embeddable spreadsheet with a Rust/WebAssembly engine, in-place .xlsx saves and AI tools, plus an MCP server for coding agents.
The npm package gridpath receives a total of 36 weekly downloads. As such, gridpath popularity was classified as not popular.
We found that gridpath demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.