
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
weavatrix-refactor
Advanced tools
Transactional MCP refactoring extension: evidence-backed plans, hash-bound previews, crash-recoverable writes, and rollback.
Transactional refactoring MCP extension for coding agents: 11 evidence-backed plan/apply tools, hash-bound previews, crash-recoverable writes, and rollback. It uses the Rust Weavatrix graph internally without exporting Core methods.
npx -y weavatrix-refactor mcp /absolute/path/to/repository
For rename-only sessions, keep the agent context small:
npx -y weavatrix-refactor mcp /absolute/path/to/repository --profile=rename
That profile exposes only rename_symbol and rollback_last_apply. The default
--profile=refactor surface exposes all 11 Refactor methods.
When a separate Weavatrix Core server already supplies the 43 read-only tools, load only the 11 Refactor extensions:
npx -y weavatrix-refactor mcp /absolute/path/to/repository --profile=refactor
The official Cursor, Codex, Claude Code, and Grok Build plugin bundle uses this extension-only profile to avoid duplicate MCP definitions.
Core methods cannot be called through this package. Use the separate Weavatrix product for read-only repository intelligence.
This package ships the native Rust binary. Nothing is compiled at install time, there are no lifecycle scripts, and no runtime dependencies.
Producing a plan is a read. Applying one requires two enforced gates:
WEAVATRIX_ALLOW_SOURCE_EDITS=1 and a single-use token bound to that exact plan
and repository. Selecting this write-capable package or a narrower tool profile
does not grant write authority.
1.0 is the engine change. Versions 0.1.x were a JavaScript package. That package line continues as
weavatrix-refactor-js, which picks up the version line at 0.1.6 whereweavatrix-refactor@0.1.5left off. The two keep separate state directories, so they never share a lock, a token store, or a rollback journal.
Full documentation: github.com/sergii-ziborov/weavatrix-refactor
MIT.
FAQs
Transactional MCP refactoring extension: evidence-backed plans, hash-bound previews, crash-recoverable writes, and rollback.
The npm package weavatrix-refactor receives a total of 90 weekly downloads. As such, weavatrix-refactor popularity was classified as not popular.
We found that weavatrix-refactor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.