Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
By Sarah Gooding - Sep 18, 2026
New:Microsoft Teams Notifications Are Now Available in Socket.Learn more →
weavatrix-refactor
Advanced tools
weavatrix-refactor
Transactional refactoring MCP for coding agents: 11 evidence-backed plan/apply tools, hash-bound previews, atomic writes, and rollback.
weavatrix-refactor
Transactional refactoring MCP for coding agents: 11 evidence-backed plan/apply tools, hash-bound previews, atomic writes, and rollback — plus the 43 read-only operations of the Weavatrix engine, in one process.
npx -y weavatrix-refactor mcp /absolute/path/to/repository
This package ships the native Rust binary. Nothing is compiled at install time, there are no lifecycle scripts, and no runtime dependencies.
Producing a plan is a read. Applying one requires all three gates: the host
exposes the edit capability, WEAVATRIX_ALLOW_SOURCE_EDITS=1 is set, and the
call presents a single-use token bound to that exact plan and repository.
1.0 is the engine change. Versions 0.1.x were a JavaScript package. That implementation continues as
weavatrix-refactor-js, which picks up the version line at 0.1.6 whereweavatrix-refactor@0.1.5left off. The two keep separate state directories, so they never share a lock, a token store, or a rollback journal.
Full documentation: github.com/sergii-ziborov/weavatrix-refactor
MIT.
FAQs
Transactional MCP refactoring extension: evidence-backed plans, hash-bound previews, crash-recoverable writes, and rollback.
The npm package weavatrix-refactor receives a total of 53 weekly downloads. As such, weavatrix-refactor popularity was classified as not popular.
We found that weavatrix-refactor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Package last updated on 11 Aug 2026
Related posts
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
By Karlo Zanki - Sep 17, 2026
Security News
GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.
By Sarah Gooding - Sep 16, 2026