
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
programmable-devkit
Advanced tools
One command for Programmable Market: scaffold a v4 hook, check it against the live admission invariants, and run the MCP server
One command for Programmable Market on Robinhood Chain: scaffold a Uniswap v4 hook, check it against the live admission invariants, and run the MCP server.
npm install -g programmable-devkit
programmable new my-hook --template creator-fee-hook --fee 3000 --symbol MYT
The scaffolded project depends on @aabxtract/programmable-sdk and is already wired
to your agent. The SDK and MCP server are dependencies, not copied source — they update
with npm install rather than going stale in your repo.
my-hook/
├── src/CreatorFeeHook.sol checked before the command returns
├── programmable-launch.config.json --fee 3000 already substituted
├── package.json depends on @aabxtract/programmable-sdk
├── .mcp.json MCP tools for Claude Code / Cursor / Windsurf
├── AGENTS.md compiler pin, 14 bits, return shapes
├── foundry.toml solc pinned to the platform toolchain
├── .git-hooks/pre-commit key leak guard
└── scripts/
├── watch-launch.mjs wait for `authorized`, print the sign URL
└── capabilities.mjs read the live profileDigest
| Command | Does |
|---|---|
programmable new <name> | Scaffold, substitute values, check the output |
programmable check [path] | Run the 7 hard blocks locally (default ./src) |
programmable doctor | Key, API reachability, submission gate, your launches |
programmable profile | Pinned compiler, permission bits, invariants |
programmable mcp | Run the MCP server on stdio |
programmable templates | Templates as JSON, for tooling |
programmable new my-hook --template buyback-hook \
--name "My Token" --symbol MYT --treasury 0x… --bps 100
programmable new fees --template creator-fee-hook \
--name "Creator Coin" --symbol CRTR --fee 3000
--fee is in pips (hundredths of a bip): 3000 = 0.30%. Values are validated before
anything is written — --fee 0.3% is rejected rather than landing in a config file.
Anything you don't supply stays TODO in the config, and the command tells you what's
left.
PASS submission gate api create OPEN
PASS launch feed unavailable (absence is not authoritative while degraded)
PASS authenticated 5 custom launch(es)
994fcdf5-b23f-4569-9… action_required SOURCE_LIQUIDITY_LOCK_OR_CUSTODY_SURFACE
Checks in the order that matters: is the gate open, is the platform up, is your key working — each answer changes whether the next one matters.
A custom launch request is immutable. A rejected submission burns the attempt and
you only find out afterwards. programmable check runs the platform's own admission
invariants against your source first; exit 0 means nothing would hard-block.
Every rule is grounded in the live contract manifest, not inferred. See
programmable profile.
PROGRAMMABLE_API_KEY goes in .env, loaded with node --env-file=.env, or exported so
.mcp.json can expand it. Never inline it in .mcp.json — that file gets committed.
Unofficial. Not affiliated with or endorsed by Programmable.
FAQs
One command for Programmable Market: scaffold a v4 hook, check it against the live admission invariants, and run the MCP server
We found that programmable-devkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.