
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
weavatrix-refactor
Advanced tools
Transactional MCP refactoring extension: evidence-backed plans, hash-bound previews, crash-recoverable writes, and rollback.
Transactional refactoring MCP extension for coding agents: 11 evidence-backed plan/apply tools, hash-bound previews, crash-recoverable writes, and rollback. It uses the Rust Weavatrix graph internally without exporting Core methods.
npx -y weavatrix-refactor mcp /absolute/path/to/repository
For rename-only sessions, keep the agent context small:
npx -y weavatrix-refactor mcp /absolute/path/to/repository --profile=rename
That profile exposes only rename_symbol and rollback_last_apply. The default
--profile=refactor surface exposes all 11 Refactor methods.
When a separate Weavatrix Core server already supplies the 43 read-only tools, load only the 11 Refactor extensions:
npx -y weavatrix-refactor mcp /absolute/path/to/repository --profile=refactor
The official Cursor, Codex, Claude Code, and Grok Build plugin bundle uses this extension-only profile to avoid duplicate MCP definitions.
Core methods cannot be called through this package. Use the separate Weavatrix product for read-only repository intelligence.
This package ships the native Rust binary. Nothing is compiled at install time, there are no lifecycle scripts, and no runtime dependencies.
Producing a plan is a read. Applying one requires two enforced gates:
WEAVATRIX_ALLOW_SOURCE_EDITS=1 and a single-use token bound to that exact plan
and repository. Selecting this write-capable package or a narrower tool profile
does not grant write authority.
1.0 is the engine change. Versions 0.1.x were a JavaScript package. That package line continues as
weavatrix-refactor-js, which picks up the version line at 0.1.6 whereweavatrix-refactor@0.1.5left off. The two keep separate state directories, so they never share a lock, a token store, or a rollback journal.
Full documentation: github.com/sergii-ziborov/weavatrix-refactor
MIT.
FAQs
Transactional MCP refactoring extension: evidence-backed plans, hash-bound previews, crash-recoverable writes, and rollback.
The npm package weavatrix-refactor receives a total of 90 weekly downloads. As such, weavatrix-refactor popularity was classified as not popular.
We found that weavatrix-refactor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.