
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
patchxnote-agent
Advanced tools
English README | 简体中文说明 | 飞书公开使用指南
This npm package is the installer and thin launcher wrapper for PatchXNote Agent. It downloads or verifies the matching native patchxnote CLI binary from GitHub Releases, verifies checksums.txt, and installs it into a user-writable directory before delegating runtime commands to that binary.
PatchXNote Agent is the local AI assistant connector for PatchXNote. It lets an MCP-capable AI assistant find PatchXNote records, inspect AI-generated results, create Markdown drafts, and manually send user-approved messages to Feishu, DingTalk, or another webhook.
Give this one-line prompt to a local-command-capable AI assistant:
Connect PatchXNote Agent by following the public guide at https://patchx2025.feishu.cn/wiki/PnVRwYT7IirFPckairGcWPnHnCd: run npx -y patchxnote-agent@latest setup --client <my-client>, keep MCP config secret-free, and guide me through login in the same runtime that will launch the MCP server. Do not ask me to paste OTP codes, access tokens, or refresh tokens into chat. GitHub repository: https://github.com/ZsTs119/patchxnote-agent
Run setup for a supported local client:
npx -y patchxnote-agent@latest setup --client cursor
npx -y patchxnote-agent@latest setup --client vscode
npx -y patchxnote-agent@latest setup --client codex
PatchXNote Agent currently exposes two login surfaces and two MCP service shapes:
| Mode | Entry | Use when |
|---|---|---|
| Browser MCP login | npx -y patchxnote-agent@latest mcp login | Recommended for desktop editors and local MCP hosts. |
| Terminal CLI login | npx -y patchxnote-agent@latest login | Terminal-only users, headless runtimes, or the legacy local Agent path. |
| Local MCP service | npx -y patchxnote-agent@latest mcp serve | VS Code, Cursor, Codex, Claude Desktop, Windsurf, Trae, Qoder, WorkBuddy, and other stdio MCP clients. |
| Hosted remote MCP gateway | https://ws-lab.patch-x.cn/patchnote-test-api/mcp | Feishu Aily, Doubao Work Partner, Tencent Agent Development Platform, enterprise WorkBuddy, and other platform clients that cannot run local commands. |
Log in with browser OAuth, then check or clear the MCP login state:
npx -y patchxnote-agent@latest mcp login
npx -y patchxnote-agent@latest mcp status
npx -y patchxnote-agent@latest mcp logout --local-only
Print the generic MCP config manually:
npx -y patchxnote-agent@latest mcp config
The generated config uses this universal local stdio MCP command:
npx -y patchxnote-agent@latest mcp serve
The older terminal Agent login remains available for legacy local CLI/MCP fallback:
npx -y patchxnote-agent@latest login
setup reuses the same mcp login browser OAuth flow. The GoServer website owns phone OTP input; the local Agent owns the loopback callback, token exchange, secure storage, and stdio bridge. mcp serve never opens a browser during editor startup. It stores credentials in the OS-native keychain and keeps MCP config free of phone numbers, OTP codes, access tokens, refresh tokens, webhook secrets, and base URL by default.
P0 local client IDs: vscode, cursor, codex, claude-code, claude-desktop, windsurf, trae, qoder, workbuddy.
Platform clients such as Feishu Aily, Doubao Work Partner, Tencent Agent Development Platform, and enterprise WorkBuddy need the hosted remote MCP gateway plus platform-console acceptance; local npx setup is for desktop and terminal clients.
If a client rejects npx or times out during first binary download, run the stable absolute-path fallback:
npx -y patchxnote-agent@latest install --print-config
It currently exposes 19 MCP tools grouped around account/record lookup, webhook configuration and sending, and explicit AI result inspection.
Common CLI examples:
patchxnote model-io list --platform mobile
patchxnote model-io packaged-result --memory-id <memory_or_request_id> --platform mobile --out ./packaged-result.json
patchxnote model-io provider-response --request-id <request_id> --platform mobile --out ./provider-response.json
patchxnote webhook set "Product Feishu" --type feishu --url-stdin
patchxnote webhook send --target "Product Feishu" --file ./message.md
Webhook aliases can contain Chinese text, spaces, and dots.
Server-backed PatchXNote data access remains read-only through dedicated /v1/agent/** APIs. Record lookup can include formal saved results and readable model-generated outputs returned by the server. Local webhook tools can configure named targets and perform explicit manual sends. AI result tools can inspect source text, AI response, parsed result, and final result when explicitly called. MCP config contains no phone number, OTP, access token, refresh token, webhook secret, or base URL by default. The CLI stores credentials and webhook secrets in the OS-native keychain when available, never lists webhook URLs or signing secrets back, and does not expose raw audio, audio downloads, hardware write actions, payment flows, or Admin APIs.
For full installation, MCP setup, security notes, and troubleshooting, read the GitHub documentation:
FAQs
Installer wrapper for the PatchX Freenote Agent CLI, local MCP server, and PatchX Freenote MCP Skill.
The npm package patchxnote-agent receives a total of 59 weekly downloads. As such, patchxnote-agent popularity was classified as not popular.
We found that patchxnote-agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.