
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
whitemagic-mcp
Advanced tools
WhiteMagic MCP server — local-first memory and session continuity for AI coding agents. Installs and runs the wm binary; no telemetry by default, no cloud.
WhiteMagic — local-first memory and session continuity for AI coding agents, over MCP. One static Rust binary, no telemetry, no cloud service. MIT.
This package installs and runs the official wm binary from the
GitHub releases
(checksum-verified at install time) so an MCP client can launch it
without a manual download step.
Point any MCP client (Claude Desktop, Cursor, Codex, Gemini CLI, opencode) at:
{
"mcpServers": {
"whitemagic": {
"command": "whitemagic-mcp",
"args": ["serve", "--profile", "curated"]
}
}
}
Or try it directly:
npx whitemagic-mcp --version # wm 9.2.1
npx whitemagic-mcp doctor # environment health check
The binary is cached under ~/.cache/whitemagic/bin/<release-tag>/
(respects XDG_CACHE_HOME); the package version's major tracks the
release tag (the v9 tag line). Pin a different release with
WHITEMAGIC_RELEASE.
Linux x86-64 (static musl), macOS arm64/x64, Windows x64. No asset for your platform? Build from source: https://github.com/lbailey94/whitemagic#install
Your memory store lives on your machine. wm does not phone home; this
installer contacts GitHub releases only to download the binary and its
checksum. See PRIVACY_POLICY.md.
mcp-name: io.github.lbailey94/whitemagic-mcp
FAQs
WhiteMagic MCP server — local-first memory and session continuity for AI coding agents. Installs and runs the wm binary; no telemetry by default, no cloud.
We found that whitemagic-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.