
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Filesystem-backed local Symphifo orchestrator with a TypeScript CLI, MCP mode, and multi-agent Codex or Claude workflows.
Symphifo is a filesystem-backed local orchestrator with a TypeScript runtime, codex and claude agent support, and durable state stored under the current workspace by default.
claude, codex) with sensible defaults.pino with file + console output.s3db.js.s3db.js ApiPlugin.codex and claude.Install dependencies and run from the package root:
pnpm install --ignore-workspace
Runtime requirement:
Run the standard local runtime:
npx -y symphifo
Run the MCP server over stdio:
npx -y symphifo mcp
Start the API and dashboard:
npx -y symphifo --port 4040
Override the persistence root:
npx -y symphifo --persistence /path/to/root
By default:
./.symphifo/When --port is set, open:
http://localhost:4040http://localhost:4040/docsRun the local UI:
npx -y symphifo --port 4040
Default local flow:
http://localhost:4040POST /issueslabels and paths when you want stronger automatic routingView Sessions on an issue to inspect the current pipeline, turns, directives, and latest outputMinimal issue payload:
{
"title": "Build release workflow",
"description": "Prepare the first stable npm release",
"labels": ["devops", "release"],
"paths": [".github/workflows/ci.yml", "package.json"]
}
Useful app routes:
/ — dashboard/docs — OpenAPI docs from ApiPlugin/state — runtime snapshot with capability counts/issues — issue CRUD (GET, POST, PUT, DELETE)/events — event records/events/feed — filtered event feed with ?since=&kind=&issueId=/issue/:id/pipeline — pipeline snapshot for one issue/issue/:id/sessions — session history for one issueUseful API examples:
curl -X POST http://localhost:4040/issues \
-H 'content-type: application/json' \
-d '{
"title":"Prepare release notes",
"labels":["documentation","release"],
"paths":["README.md","RELEASE.md"]
}'
curl 'http://localhost:4040/issues?state=Todo&capabilityCategory=devops'
bin/symphifo.js — published CLI entrypointsrc/cli.ts — command router built on cli-args-parsersrc/mcp/server.ts — stdio MCP serversrc/runtime/run-local.ts — thin main entrypointsrc/runtime/types.ts — shared type definitionssrc/runtime/logger.ts — pino-based structured loggingsrc/runtime/constants.ts — paths, env vars, state constantssrc/runtime/helpers.ts — pure utility functionssrc/runtime/store.ts — s3db state persistencesrc/runtime/providers.ts — provider detection, profile resolution, capability routingsrc/runtime/workflow.ts — WORKFLOW.md loading and source bootstrappingsrc/runtime/issues.ts — issue CRUD, config, metrics, eventssrc/runtime/agent.ts — agent session/pipeline executionsrc/runtime/scheduler.ts — issue scheduling, parallelism analysis, graceful shutdownsrc/runtime/api-server.ts — HTTP API and dashboard servingsrc/runtime/skills.ts — skill discovery and hydrationsrc/routing/capability-resolver.ts — task classification enginesrc/integrations/catalog.ts — agent/skill integration discoverysrc/dashboard/{index.html,app.js,styles.css} — web UIsrc/fixtures/local-issues.json — optional seed issue catalogIf the target workspace contains WORKFLOW.md, Symphifo reads its YAML front matter and Markdown body.
Supported fields:
tracker.kindhooks.after_createhooks.before_runhooks.after_runpoll.interval_msagent.provideragent.providers[]agent.profileagent.max_concurrent_agentsagent.max_attemptsagent.max_turnscodex.commandclaude.commandcodex.timeout_msserver.portrouting.enabledrouting.prioritiesrouting.overrides[]routing.overrides[].match.pathsThe Markdown body is rendered as the issue prompt and exported through:
SYMPHIFO_PROMPTSYMPHIFO_PROMPT_FILEIf no command is configured, Symphifo auto-detects available providers (claude, codex) and uses sensible defaults.
Each agent turn receives:
SYMPHIFO_AGENT_PROVIDERSYMPHIFO_AGENT_ROLESYMPHIFO_AGENT_PROFILESYMPHIFO_AGENT_PROFILE_FILESYMPHIFO_AGENT_PROFILE_INSTRUCTIONSSYMPHIFO_SESSION_IDSYMPHIFO_SESSION_KEYSYMPHIFO_TURN_INDEXSYMPHIFO_MAX_TURNSSYMPHIFO_TURN_PROMPTSYMPHIFO_TURN_PROMPT_FILESYMPHIFO_PREVIOUS_OUTPUTSYMPHIFO_RESULT_FILEThe agent can advance the session by:
SYMPHIFO_STATUS=continue|done|blocked|failedsymphifo-result.json with status, summary, and optional nextPromptSession and pipeline state are persisted in the local s3db store.
Workspace JSON files are temporary CLI handoff artifacts only.
Agent profiles can be resolved from:
./.codex/agents/<name>.md./agents/<name>.md~/.codex/agents/<name>.md~/.claude/agents/<name>.mdCommand resolution order:
SYMPHIFO_AGENT_COMMANDcodex.command or claude.commandcodex or claudeExample mixed pipeline:
agent:
max_turns: 4
providers:
- provider: claude
role: planner
- provider: codex
role: executor
- provider: claude
role: reviewer
Example routing override:
routing:
priorities:
security: 0
bugfix: 1
backend: 2
overrides:
- match:
labels: ["frontend", "marketing"]
paths: ["src/web", "src/dashboard"]
overlays: ["impeccable", "frontend-design"]
providers:
- provider: claude
role: planner
profile: agency-ui-designer
reason: Marketing frontend needs stronger design planning.
- provider: codex
role: executor
profile: agency-frontend-developer
reason: Frontend implementation.
- provider: claude
role: reviewer
profile: agency-accessibility-auditor
reason: Review with stronger UX and accessibility standards.
Issue payloads can include paths so the resolver can classify by target files and directories, not only title and labels:
{
"title": "Harden websocket reconnect flow",
"labels": ["backend", "protocol"],
"paths": ["src/protocol/session.ts", "src/api/ws-handler.ts"]
}
If paths is omitted, Symphifo still tries to infer routing signals from:
Symphifo also derives queue labels such as capability:<category> and overlay:<name> from the resolver output.
The scheduler uses capability priority as a tie-breaker after issue priority, and routing.priorities can override the default category order.
./.symphifo/WORKFLOW.local.md./.symphifo/s3db/./.symphifo/symphifo-local.logResource endpoints (s3db auto-generated):
GET /issues — list issues (supports ?state=&capabilityCategory=)POST /issues — create issuePUT /issues/:id — update issueDELETE /issues/:id — delete issueGET /events — list eventsGET /runtime_state — raw runtime stateGET /agent_sessions — list agent sessionsGET /agent_pipelines — list agent pipelinesCustom endpoints:
GET /state — runtime snapshot with capability countsGET /status — health checkGET /events/feed?since=&kind=&issueId= — filtered event feedGET /issue/:id/pipeline — pipeline snapshot for one issueGET /issue/:id/sessions — session history for one issuePOST /issue/:id/state — transition issue statePOST /issue/:id/retry — retry issuePOST /issue/:id/cancel — cancel issueGET /providers — detected providers with availabilityGET /parallelism — parallelizability analysisPOST /config/concurrency — update worker concurrencyThe built-in dashboard filters issues by both runtime state and capability category, and mirrors the scheduler's capability-aware ordering.
GET /state and the MCP status summary also expose aggregated capability counts.
The live events panel filters by kind and issueId, backed by the partitioned /events/feed route.
Native ApiPlugin resources:
runtime_stateissueseventsagent_sessionsagent_pipelinesThese resources also define s3db partitions for the main operational access patterns:
byState, byCapabilityCategory, byStateAndCapabilitybyIssueId, byKind, byIssueIdAndKindbyIssueId, byIssueAttempt, byProviderRolebyIssueId, byIssueAttemptThe issue inspection routes use these partitions directly, including pipeline/session lookups by issueId + attempt.
npx -y symphifo mcp starts a stdio MCP server backed by the same s3db filesystem store as the runtime.
Resources:
symphifo://guide/overviewsymphifo://guide/runtimesymphifo://guide/integrationsymphifo://state/summarysymphifo://issuessymphifo://workspace/workflowsymphifo://issue/<id>Tools:
symphifo.statussymphifo.list_issues with optional state, capabilityCategory, or categorysymphifo.create_issuesymphifo.update_issue_statesymphifo.integration_configsymphifo.resolve_capabilitiesPrompts:
symphifo-integrate-clientsymphifo-plan-issuesymphifo-review-workflowMinimal MCP client configuration:
{
"mcpServers": {
"symphifo": {
"command": "npx",
"args": ["-y", "symphifo", "mcp", "--workspace", "/path/to/workspace", "--persistence", "/path/to/workspace"]
}
}
}
pull_request: runs the quality gatepush to main: runs quality and publishes symphifo@nextv*: runs quality, publishes stable, and creates a GitHub ReleaseRequired repository secret:
NPM_TOKEN for pnpm publishNPM_TOKEN is configured in GitHub Actionspackage.json has the version you want to releasemain@next publish to passCommands:
git push origin main
git tag v0.1.0
git push origin v0.1.0
After publish:
npx -y symphifo@latest --port 4040
npx -y symphifo@latest mcp
Release checklist:
FAQs
Filesystem-backed local Symphifo orchestrator with a TypeScript CLI, MCP mode, and multi-agent Codex or Claude workflows.
We found that symphifo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.