
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
resilireplay
Advanced tools
Inject deterministic MCP failures, verify bounded recovery, and generate executable regression tests.
Inject deterministic MCP failures, verify bounded recovery and duplicate-effect behavior, and turn causal failures into executable regression tests.
npx --yes resilireplay@latest mcp demo
The demo is a bundled local fixture: no config, account, credential, paid model, telemetry, or remote target. It runs a clean call, reproduces one deterministic failure, retries once, records zero duplicate effects, generates and executes a regression, prints an evidence digest, and cleans up.
Test a reviewed server without starting it:
npx --yes resilireplay@latest mcp test --config ./mcp.json --server my-server --tool echo --safety inert --dry-run
Repeat the displayed plan with --approve <plan-sha256> to execute it. --json, --output,
--no-regression, --timeout, and --retries map to the same bounded engine. The existing
mcp audit workflow remains supported.
npx --yes resilireplay@latest mcp serve --help
Node.js 22 and 24 are supported. Evidence persists metadata and hashes instead of unrestricted tool bodies or credentials. Remote targets retain explicit ownership controls.
Agent-runtime capture, campaigns, replay, Studio, adapters, MCP-RES v0.1/v0.2, security guidance, and the real packed-package MCP Everything example are documented in the repository README.
Apache-2.0.
FAQs
Inject deterministic MCP failures, verify bounded recovery, and generate executable regression tests.
The npm package resilireplay receives a total of 34 weekly downloads. As such, resilireplay popularity was classified as not popular.
We found that resilireplay demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.