
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
statelode-bridge
Advanced tools
statelode-bridge lets stdio-first MCP clients talk to StateLode's hosted Streamable HTTP
MCP endpoint.
npx statelode-bridge --token statelode_live_...
Prefer environment variables in checked-in IDE config:
STATELODE_TOKEN=statelode_live_... npx statelode-bridge
The bridge forwards newline-delimited JSON-RPC from stdio to POST /mcp, keeps
the Mcp-Session-Id header in sync, and relays GET /mcp server-sent events
back to stdio as JSON-RPC notifications.
Different IDEs auto-load different instruction files, so the bridge writes the StateLode rules where each agent will actually see them. There are two commands.
setup — once per machinenpx statelode-bridge setup # add --dry-run to preview
Installs a global StateLode protocol into each installed IDE's global
instruction file — ~/.claude/CLAUDE.md (Claude Code), ~/.codex/AGENTS.md
(Codex), ~/.codeium/windsurf/memories/global_rules.md (Windsurf) — and prints a
block to paste into the IDEs that keep global rules in app settings (Cursor → User
Rules; VS Code → Copilot instructions). It only touches IDEs that are installed,
and upserts a delimited block so it never clobbers your existing rules.
After setup, any agent:
statelode.json, andinit — pin one repo to a projectnpx statelode-bridge init <project-slug> # defaults to the directory name
Writes statelode.json (the marker that maps this repo to a StateLode project)
and a ## StateLode block into both AGENTS.md (Codex / Cursor) and CLAUDE.md
(Claude Code) so the project is in context even without the global setup. Re-run
after a project rename to refresh the block; --no-agents writes only the marker.
Keep your token in
STATELODE_TOKEN(or the MCP server config) — never instatelode.json,AGENTS.md, orCLAUDE.md.
FAQs
stdio to Streamable HTTP MCP bridge for StateLode
The npm package statelode-bridge receives a total of 34 weekly downloads. As such, statelode-bridge popularity was classified as not popular.
We found that statelode-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.