
Security News
/Company News
Socket Is Sponsoring Composer and Packagist
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.
Turn an AI agent's implementation and design plans into polished, visual web pages instead of walls of text. A plan is written as MDX and compiled to a single self-contained HTML page: architecture diagrams, charts, metric cards, file-change trees, option comparisons, callouts, math, and a numbered phase timeline.
Documentation and live examples: visualplan.dev
It comes in two parts that work together:
vplan is a CLI that renders a plan .mdx file to a single self-contained HTML page.visual-plan is an agent skill that teaches any AI agent (Claude Code, Cursor, Codex, and
others) the plan vocabulary, so it writes visual plans instead of prose.Installs the visual-plan skill into your coding agent so it authors plans visually:
npx skills add brandonburrus/visualplan
The skill renders plans with vplan, so install it too (the skill prompts for this if it is
missing):
npm i -g vplan
# or run without installing:
npx vplan plan.mdx
vplan plan.mdx # render to plan.plan.html and open it
vplan plan.mdx --watch # live-reloading dev server while you edit
vplan check plan.mdx # validate a plan without rendering it
vplan components # print the component vocabulary
A plan is an MDX file that starts with a # Title (no frontmatter) and uses a fixed set of
components, always in scope (no imports):
# Add rate limiting to the API
We add a sliding-window limiter at the gateway, behind a flag.
```mermaid
flowchart LR
Client --> Gateway --> Limiter --> API
```
<Phase title="Build the limiter" status="active">
Implement the Redis-backed window and return 429 over the limit.
</Phase>
<Callout type="risk">
A Redis outage must fail open, not closed.
</Callout>
```mermaid (flowchart, sequence, state, class, ER, and XY diagrams)```math (LaTeX, typeset as MathML)Phase (timeline/execution/planning steps)FileTree (file-change maps)Chart (bar, line, area, scatter, radar, gauge, funnel, treemap, and pie graphs, with optional stacking)Stat (headline metric cards)Compare (option tradeoffs)Matrix (scorecards)Callout (note/tip/risk/decision/warning)QuestionsChecklistEvery rendered plan has a share button that copies a link encoding the entire plan. The plan is base64url encoded into a query param where it is securely decompressed into a sandboxed iframe in the browser at visualplan.dev. This means you can share a plan with anyone simply by sharing the URL, without having to send files or make any kind of account.
Full docs, guides, and rendered examples live at visualplan.dev.
FAQs
Render an AI agent's plans as visual MDX pages instead of walls of text
The npm package vplan receives a total of 80 weekly downloads. As such, vplan popularity was classified as not popular.
We found that vplan demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.

Research
/Security News
Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.

Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.