
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
reviewable-artifacts-mcp
Advanced tools
Read-only stdio MCP server for Reviewable artifact handoffs and workspace discovery.
Reviewable is the human review layer for AI-generated artifacts. Its reviewable-artifacts-mcp package is a dependency-free, read-only stdio MCP server. Workspace mode discovers reviews linked to the configured owner key; share mode exposes only explicitly configured reviewer links.
The package publication and MCP Registry listing are release steps. After publishing, configure workspace mode with a credential-free HTTPS origin and a local workspace key. Treat the key as a password and keep it out of committed files and logs.
REVIEWABLE_MCP_BASE_URL='https://review.example' \
REVIEWABLE_MCP_WORKSPACE_KEY='your-local-workspace-key' \
npx -y reviewable-artifacts-mcp
This mode lists active reviews by default. list_reviews can filter by lifecycle (active, archived, or all) and handoff state (no_handoff, stale, ready_to_regenerate, blocked, or no_actionable_handoff).
For review-specific, least-privilege access, use share mode with one or more reviewer links separated by whitespace or commas:
REVIEWABLE_MCP_REVIEWS='https://one.example/?session=one#cap=token-one, https://two.example/?session=two#cap=token-two'
Claude Code configuration:
claude mcp add --transport stdio reviewable-artifacts \
--env REVIEWABLE_MCP_BASE_URL='https://review.example' \
--env REVIEWABLE_MCP_WORKSPACE_KEY='your-local-workspace-key' \
-- npx -y reviewable-artifacts-mcp
Codex configuration:
[mcp_servers.reviewable-artifacts]
command = "npx"
args = ["-y", "reviewable-artifacts-mcp"]
[mcp_servers.reviewable-artifacts.env]
REVIEWABLE_MCP_BASE_URL = "https://review.example"
REVIEWABLE_MCP_WORKSPACE_KEY = "your-local-workspace-key"
/demo reviewer links are also accepted in share mode: the server follows the redirect once at startup and reads the reviewer session and capability from the final URL.
See the published MCP tool contract for tool semantics and the agent-context/v1 consumer boundary.
FAQs
Read-only stdio MCP server for Reviewable artifact handoffs and workspace discovery.
We found that reviewable-artifacts-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.