
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
patchxnote-agent
Advanced tools
English README | 简体中文说明 | 飞书公开使用指南
This npm package is the installer and thin launcher wrapper for PatchXNote Agent. It downloads or verifies the matching native patchxnote CLI binary from GitHub Releases, verifies checksums.txt, and installs it into a user-writable directory before delegating runtime commands to that binary.
PatchXNote Agent is the local AI assistant connector for PatchXNote. It lets an MCP-capable AI assistant find PatchXNote records, inspect AI-generated results, create Markdown drafts, and manually send user-approved messages to Feishu, DingTalk, or another webhook.
Give this one-line prompt to a local-command-capable AI assistant:
Connect PatchXNote Agent by following the public guide at https://patchx2025.feishu.cn/wiki/PnVRwYT7IirFPckairGcWPnHnCd: run npx -y patchxnote-agent@latest mcp config, add the printed MCP JSON config to this AI assistant, then guide me through npx -y patchxnote-agent@latest login in the editor terminal. Do not ask me to paste OTP codes, access tokens, or refresh tokens into chat. GitHub repository: https://github.com/ZsTs119/patchxnote-agent
Print the generic MCP config manually:
npx -y patchxnote-agent@latest mcp config
The generated config uses this universal local stdio MCP command:
npx -y patchxnote-agent@latest mcp serve
Log in from the editor terminal:
npx -y patchxnote-agent@latest login
If a client rejects npx or times out during first binary download, run the stable absolute-path fallback:
npx -y patchxnote-agent@latest install --print-config
It currently exposes 19 MCP tools grouped around account/record lookup, webhook configuration and sending, and explicit AI result inspection.
Common CLI examples:
patchxnote model-io list --platform mobile
patchxnote model-io packaged-result --memory-id <memory_or_request_id> --platform mobile --out ./packaged-result.json
patchxnote model-io provider-response --request-id <request_id> --platform mobile --out ./provider-response.json
patchxnote webhook set "Product Feishu" --type feishu --url-stdin
patchxnote webhook send --target "Product Feishu" --file ./message.md
Webhook aliases can contain Chinese text, spaces, and dots.
Server-backed PatchXNote data access remains read-only through dedicated /v1/agent/** APIs. Record lookup can include formal saved results and readable model-generated outputs returned by the server. Local webhook tools can configure named targets and perform explicit manual sends. AI result tools can inspect source text, AI response, parsed result, and final result when explicitly called. MCP config contains no phone number, OTP, access token, refresh token, webhook secret, or base URL by default. The CLI stores credentials and webhook secrets in the OS-native keychain when available, never lists webhook URLs or signing secrets back, and does not expose raw audio, audio downloads, hardware write actions, payment flows, or Admin APIs.
For full installation, MCP setup, security notes, and troubleshooting, read the GitHub documentation:
FAQs
Installer wrapper for the PatchX Freenote Agent CLI, local MCP server, and PatchX Freenote MCP Skill.
The npm package patchxnote-agent receives a total of 59 weekly downloads. As such, patchxnote-agent popularity was classified as not popular.
We found that patchxnote-agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.