
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
TaiBu 的本地 stdio MCP Server,适合直接接入 Claude Desktop、Cursor、Cherry Studio 等支持 MCP 的客户端。
在 MCP 客户端配置中加入:
{
"mcpServers": {
"taibu": {
"command": "npx",
"args": ["-y", "taibu-mcp"]
}
}
}
要求:
stdio 连接方式如需从 GitHub Packages 安装镜像包,请改用 @hhszzzz/taibu-mcp,并把 @hhszzzz scope 指向 https://npm.pkg.github.com。npmjs 主包名仍然是 taibu-mcp。
| 工具 | 说明 |
|---|---|
bazi | 八字排盘 |
bazi_pillars_resolve | 四柱反推 |
bazi_dayun | 大运、小运、流年链路 |
ziwei | 紫微斗数排盘 |
ziwei_horoscope | 紫微运限 |
ziwei_flying_star | 紫微飞星 |
liuyao | 六爻排卦分析 |
meihua | 梅花易数起卦与断卦 |
tarot | 塔罗抽牌 |
almanac | 黄历查询 |
astrology | 西方占星命盘与流运 |
qimen | 奇门遁甲排盘 |
taiyi | 太乙九星观测 |
daliuren | 大六壬排盘 |
xiaoliuren | 小六壬占测 |
本地 taibu-mcp 的工具结果统一分成两条通道:
content[0].text
structuredContent
outputSchema 时返回 canonical JSON,字段结构与 outputSchema 对齐,适合程序消费如果你要稳定的结构化结果,请始终读取 structuredContent。
npm install -g taibu-mcp
全局安装后也可以在 MCP 客户端中改成:
{
"mcpServers": {
"taibu": {
"command": "taibu-mcp"
}
}
}
pnpm install
pnpm -C packages/core build
pnpm -C packages/mcp build
node packages/mcp/dist/index.js
taibu-core: 共享算法、工具定义与 transport 适配器taibu-mcp 使用 MIT 许可证,详见当前目录下的 LICENSE 文件。
| 版本 | 批次说明 |
|---|---|
3.4.1 | 修复 npm 包中 taibu-core 依赖误发为 workspace:*,恢复 npx -y taibu-mcp 可用性 |
3.4.0 | 新增 astrology 西方占星命盘与流运 |
3.3.0 | 新增 taiyi 太乙九星观测 |
3.2.0 | 新增 xiaoliuren 小六壬占测 |
3.1.0 | 新增 meihua 梅花易数起卦与断卦 |
3.0.0 | 重构包结构,优化输出与函数暴露接口 |
2.0.0 | 规范输出结构:content 输出规范文本,structuredContent 输出 JSON |
1.5.0 | 同步导出、共享、结构化输出策略与在线服务对齐 |
1.4.0 | 新增 daliuren 大六壬 |
1.3.0 | 新增 qimen 奇门遁甲 |
1.2.6 | 补丁,集中修复输出契约、鉴权与运行时边界 |
1.2.5 | 旧基线版本,作为本次版本重排的对比起点 |
FAQs
TaiBu MCP Server - 命理计算工具 (stdio)
The npm package taibu-mcp receives a total of 61 weekly downloads. As such, taibu-mcp popularity was classified as not popular.
We found that taibu-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.