
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
statelode-bridge
Advanced tools
statelode-bridge lets stdio-first MCP clients talk to StateLode's hosted Streamable HTTP
MCP endpoint.
npx statelode-bridge --token statelode_live_...
Prefer environment variables in checked-in IDE config:
STATELODE_TOKEN=statelode_live_... npx statelode-bridge
The bridge forwards newline-delimited JSON-RPC from stdio to POST /mcp, keeps
the Mcp-Session-Id header in sync, and relays GET /mcp server-sent events
back to stdio as JSON-RPC notifications.
Different IDEs auto-load different instruction files, so the bridge writes the StateLode rules where each agent will actually see them. There are two commands.
setup — once per machinenpx statelode-bridge setup # add --dry-run to preview
Installs a global StateLode protocol into each installed IDE's global
instruction file — ~/.claude/CLAUDE.md (Claude Code), ~/.codex/AGENTS.md
(Codex), ~/.codeium/windsurf/memories/global_rules.md (Windsurf) — and prints a
block to paste into the IDEs that keep global rules in app settings (Cursor → User
Rules; VS Code → Copilot instructions). It only touches IDEs that are installed,
and upserts a delimited block so it never clobbers your existing rules.
After setup, any agent:
statelode.json, andinit — pin one repo to a projectnpx statelode-bridge init <project-slug> # defaults to the directory name
Writes statelode.json (the marker that maps this repo to a StateLode project)
and a ## StateLode block into every IDE's repo guide file so the project is in
context even without the global setup:
| File | IDE |
|---|---|
AGENTS.md | Codex, Cursor |
CLAUDE.md | Claude Code |
.github/copilot-instructions.md | VS Code (Copilot) |
.cursor/rules/statelode.mdc | Cursor (project rule, alwaysApply) |
Re-run after a project rename to refresh the block; --no-agents writes only the
marker.
Keep your token in
STATELODE_TOKEN(or the MCP server config) — never instatelode.jsonor any of the guide files.
FAQs
stdio to Streamable HTTP MCP bridge for StateLode
The npm package statelode-bridge receives a total of 15 weekly downloads. As such, statelode-bridge popularity was classified as not popular.
We found that statelode-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.