
Product
Introducing Socket Scanning for VS Code Marketplace Extensions
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.
Warning: This is experimental software. It comes without support and is not intended for production use.
A prioritization tool that uses the relative weight method to rank stories and tickets by different criteria. Built on SQLite (Node's built-in node:sqlite) for embedded, zero-dependency data storage, exposed through a CLI or as a Docker-based MCP server.
Each ticket is scored on four dimensions using the agile Fibonacci scale (1, 2, 3, 5, 8, 13, 21):
| Dimension | Measures |
|---|---|
| Benefit | Value gained by implementing the story |
| Penalty | Cost of not implementing the story |
| Estimate | Resources required for implementation |
| Risk | Uncertainty or complexity in implementation |
From these, the tool calculates priority at runtime:
Value = Benefit + Penalty
Cost = Estimate + Risk
Priority = Value / Cost
Higher priority means better return on investment. Relative weights normalize scores across the full backlog or within a tagged subset (e.g. a feature). See calculations.md for the full specification.
Tickets are organized through a flexible tag system using prefix:value pairs. Tags replace fixed fields for state, feature grouping, and any other classification:
state:backlog, state:wip, state:donefeature:checkout, feature:authteam:platform, priority:criticalEvery tag assignment and removal on a ticket is tracked in an audit log, enabling lead time and cycle time calculations from state: tag transitions.
The tool maintains full revision history at two levels:
This means you can reconstruct the exact state of any ticket at any point in time.
The database schema is defined in db/create.sql and documented as DBML in db/model.dbml.
projects
+-- tickets (B, P, E, R scores)
| +-- ticket_revisions (content + tag snapshots)
+-- tags (prefix:value pairs)
| +-- tag_revisions
+-- ticket_tags (current assignments)
+-- ticket_tag_changes (audit log: added/removed)
+-- ticket_relations (blocks, depends-on, relates-to)
+-- ticket_deletions (deleted tickets, for project diff)
+-- weight_configs (per-project B/P/E/R weights)
node:sqlite, no server and no native modules requiredrw project create|list|delete|history|diff
Manage projects, view history and changes
rw ticket create|list|update|upsert|delete|history
Manage tickets and view revision history
rw tag create|assign|remove|delete|list|rename|log
Manage tags and view audit log
rw relation create|remove|list|list-all
Ticket relations (blocks, depends-on, relates-to)
rw config weights View/set/reset per-project B/P/E/R weights
rw calc weights|priority Relative weights and weighted priority calculations
rw export csv|json Export project data
rw import csv|json Import project data
rw report summary|group|distribution|health|times|dashboard|event-log
Reporting, HTML dashboard and event stream
rw serve Start MCP server (stdio transport)
Global options: --db <path>, --json, --csv, --quiet (and --no-color, accepted for compatibility: rw never prints colour)
The tool is designed around projects as the top-level boundary. Tags, tickets, and all calculations are scoped to a project, so multiple teams or products can use the same instance independently.
Four GitHub Actions workflows in .github/workflows/ cover building, releasing and publishing:
| Workflow | Runs on | Does |
|---|---|---|
ci.yml | pushes and pull requests to main | Type check, build, test, and a smoke test of the Docker image |
release.yml | pushing a v* tag | Checks the tag matches package.json, tests, and creates the GitHub release with the npm tarball, SBOM, OCI image and changelog; pushes the image to ghcr.io/sebs/rewelo |
publish.yml | manual (with a version) | Publishes that tagged version to npm via trusted publishing, with provenance |
pages.yml | pushes to main | Builds the website from site/ and the docs, and deploys it to GitHub Pages |
To release:
npm version patch # 0.1.0 → 0.1.1 (or minor, major)
release.yml builds the release:git push --follow-tags
gh workflow run publish.yml -f version=0.1.1. Prereleases such as 0.2.0-beta.1 are published under the next dist-tag, and a backport older than the current latest (0.5.2 after 0.6.1) under backport, so npm install rewelo keeps getting the newest stable version.One-time setup: add sebs/rewelo with workflow publish.yml as a trusted publisher of the rewelo package on npmjs.com, and set Settings → Pages → Source to "GitHub Actions".
To run the released image:
# CLI
docker run --rm -v rw-data:/data ghcr.io/sebs/rewelo:latest project list
# MCP server
docker run --rm -i -v rw-data:/data ghcr.io/sebs/rewelo:latest serve
Use a named volume (rw-data) or a bind mount to persist the database across container restarts. Without one, the database stays inside the container and is lost when it is removed (with --read-only it can't be written at all); rw warns about this on stderr.
The CLI doubles as an MCP server over stdio, letting AI assistants manage projects, tickets, tags, and calculations directly. See mcp.md for client configuration, available tools, and troubleshooting.
See examples.md for step-by-step scenarios, each as a copy-pasteable Claude Code prompt (MCP) and as rw commands with their output: CSV import, dependency mapping, custom weights, quick wins, tracking work, scripting, and sharing and backing up a backlog.
FAQs
Prioritisation tool using the relative weight method with SQLite
The npm package rewelo receives a total of 65 weekly downloads. As such, rewelo popularity was classified as not popular.
We found that rewelo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.

Research
/Security News
Socket uncovered two malicious VS Code themes in a GlassWorm-linked cluster with thousands of installs across VS Code Marketplace and Open VSX.

Security News
/Company News
Capital One is partnering with Socket to proactively secure its open source supply chain.