
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
Mojulo — a 3D compiler for coding agents: a local MCP server where you build worlds, objects, and games by talking to the agent you already run (Claude Code, Codex, or any MCP host). Each one is stored as a small deterministic recipe on your own machine —

Mojulo is a 3D compiler for coding agents: a local MCP server where everything your agent makes is stored as a small recipe (the source), compiled back to the same geometry on every read, and emitted to Godot, Blender, STL and more. A compiler, not a generator.
npx mojulo init
That wires mojulo into the coding agents on this machine (Claude Code, Codex, Claude Desktop — one yes/no each) and opens the dashboard. Node 22.12+. No API key; your agent is the reasoning loop.
You talk to the agent you already run; it does the reasoning, and mojulo is the machine it works in. Build objects, worlds, and games by conversation. An object blocks out at literal scale, a world is a place you can walk, a level is a world under a game contract, a game composes the levels — and music folds in as an asset, synthesized from seeded math with no samples. Each rung is a small deterministic recipe: readable, seeded to regenerate identically, never a render.
Two pipelines out. DIGITAL: worlds, levels and scenes render dependency-free in the browser and export to Godot as a real project, to Unity and Unreal as a data pack plus importer (each with an advisory gate when the engine is installed), and to Blender as an art-pass pack — with .glb and OpenUSD for everything else. PHYSICAL: objects, vehicles and wordmarks export as print-ready STL or 3MF at true scale — mm units, z-up, slicer-ready, with a slicer gate that stamps what it measured.
Mojulo is the upstream that feeds the tools you already use. It does not try to out-render a game engine, and it is not just an exporter: the recipe is where the thing is born and re-renders; the engine or the printer is where it is optionally finished. Every handoff carries a ledger of what did not travel.
Not a second brain — a body. Your agent is the only intelligence in the loop. Mojulo holds state, runtime, and the audit trail, and needs no LLM credentials of its own. Optional local workers — Blender, a slicer, a mesh sculptor — are yours to host and never dependencies.
The bins, one install:
mojulo — stdio MCP server (npx -y mojulo, wired into Claude Code, Codex, or any other MCP host); also the installer and a CLI front door (below).mojulo-ui — local dashboard (npx -y -p mojulo mojulo-ui).mojulo-config — provider key CLI, only needed for directed images or the optional chatbot pack.mojulo and mojulo-ui share the same ~/.mojulo/ state, so anything you mint from your agent shows up in the dashboard immediately.
Prerequisite: Node.js 22.12+ (node --version). Everything below runs through
npx, which ships with Node — if you don't have it, install it from
nodejs.org, or ask your coding agent to install it for you.
No provider key: your agent is the reasoning loop. Verified on macOS (Apple Silicon),
on native Windows (init and a first render, under Claude Code), and, for a cold
install, on Linux x64 and arm64.
# 1. Wire mojulo into your MCP-capable agent. The one-shot installer detects
# the MCP hosts on this machine by declared profile (Claude Code, Codex,
# Claude Desktop, and others), asks y/n per host, and opens the dashboard:
npx mojulo init
# Or wire manually —
# Claude Code:
# claude mcp add --scope user mojulo -- npx -y mojulo
# Codex CLI: add to ~/.codex/config.toml
# [mcp_servers.mojulo]
# command = "npx"
# args = ["-y", "mojulo"]
# Claude Desktop: add under "mcpServers" in claude_desktop_config.json, then restart it
# "mojulo": { "command": "npx", "args": ["-y", "mojulo"] }
# Other MCP hosts: register the same `npx -y mojulo` stdio command.
# 2. In an agent session, just ask:
# what is this? → mojulo orients itself, out loud
# make me a coffee mug, 90 mm tall → a solid; download the .stl
# generate a 3D city at night → a world; open the /scene URL
# turn that into a game → a game; export it for Godot
# 3. Optional. The chatbot factory is an install-gated pack (a compiled bot
# is the one artifact that needs an LLM key of its own):
# npx -y -p mojulo mojulo install chatbot
# npx -y -p mojulo mojulo-config set anthropic sk-ant-...
First install is the big one: npx pulls a ~27 MB tarball plus its native dependencies (measured at about 885 MB on disk), and the first launch fetches a ~130 MB embedding model in the background. Measured sizes, lazy downloads, and what each engine leg needs: docs/tech-requirements.md.
Why these dependencies. The install is mostly three things, and all of them run on your machine.
onnxruntime-node and @huggingface/transformers run the local search model behind
semantic_search — the runtime ships binaries for every platform in one package, which is most
of the size. puppeteer-core drives a local headless Chrome for stills and bakes; the browser
itself is fetched on first use, or skipped if you already have Chrome. better-sqlite3 is the one
database file under ~/.mojulo/. Nothing in that list reaches the network on its own. The
per-dependency sheet, with sizes, is in the same tech-requirements page.
The same mojulo bin doubles as a command-line front door over the same
engine and data — no agent, no dashboard, no API key required. Useful for
spot checks, cron jobs, and CI:
npx mojulo tools # the connect surface: spine + packs
npx mojulo tools pack_object # one pack's members
npx mojulo packs # pack ids with their recognizers
npx mojulo help export_model # full description + input schema
npx mojulo call version # invoke any tool
npx mojulo call export_model --json '{"ref":"sk_…","format":"3mf"}'
npx mojulo pack_object # open a pack: orientation + member manual
Arguments can be inline JSON (--json '{…}', @file.json, or - for
stdin) or per-property flags derived from the tool's schema
(--theme dungeon --seed 7; flags win over --json). --timeout <ms>
bounds long-poll tools (exit code 124), --quiet keeps only the exit code
(0 success, 1 tool error, 2 usage). Results print to stdout as-is, so
npx mojulo call version | jq . works; diagnostics go to stderr. Bare
npx mojulo remains the stdio MCP server.
Iterate in place — update_sketch changes a field on the stored recipe; nothing is re-minted — and keep what you tuned: save_recipe writes it to a cookbook of plain files in a local git repo with no remote, recallable by intent in a later session. Attach the public recipe book to add chapters and whole new kinds from disk.
Also in the box, present by default and never in the way: diagrams and charts, directed images an external model paints, publications, research, plans, local apps whose inference parks back on your agent, and connected services over the MCPs you already run. The chatbot factory is opt-in.
mojulo install chatbot). Uninstalled packs neither list nor run, so your agent's context isn't spent on tools this host doesn't have.npx -y -p mojulo mojulo-ui # auto-port, opens browser
npx -y -p mojulo mojulo-ui --port 3999 # pin the port
npx -y -p mojulo mojulo-ui --no-open # skip browser launch
Same primitives as the MCP, different face: Studio leads and opens by default — browse the Library, walk your worlds, play your games in the Arcade, review motion, beats, and voice at a glance — with Ideate (research, plans, stashes) beside it and Operate tiles appearing only once something actually runs there. It renders state and hands authoring back to your agent — the workshop is driven from the conversation.
The dashboard starts in English but ships fully translated in every locale under messages/, including right-to-left scripts — switch anytime under Settings → Language; the choice is remembered per browser.
The five paradigm loops (media · game · connected service · app · bot) and the recipe format are the stable surface: additive-only DB migrations, deterministic re-render of stored recipes, loopback-only transport. A kernel's output for given params is a compatibility promise over already-minted rows. The creative vocabularies keep growing in minor releases. See the changelog.
FAQs
Mojulo — a 3D compiler for coding agents: a local MCP server where you build worlds, objects, and games by talking to the agent you already run (Claude Code, Codex, or any MCP host). Each one is stored as a small deterministic recipe on your own machine —
The npm package mojulo receives a total of 779 weekly downloads. As such, mojulo popularity was classified as not popular.
We found that mojulo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.