
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
MCP server for the XKnow Knowledge Base — search and explore curated, source-backed SEO, SaaS, and LLM-wiki knowledge from any AI agent.
An MCP server for the XKnow Knowledge Base — a curated, cross-linked body of SEO, SaaS, and LLM-wiki knowledge. Give any MCP-capable agent (Claude, Cursor, Cline, opencode, and others) the ability to search and cite it.
explore_concept walks the cross-links between
notes, so an agent can follow a topic instead of getting a flat list.Add it to your MCP client.
Claude Desktop (claude_desktop_config.json), Cursor, Cline, and most clients:
{
"mcpServers": {
"xknow": {
"command": "npx",
"args": ["-y", "xknow-mcp"]
}
}
}
Claude Code
claude mcp add xknow -- npx -y xknow-mcp
opencode (opencode.json)
{
"mcp": {
"xknow": { "type": "local", "command": ["npx", "-y", "xknow-mcp"], "enabled": true }
}
}
Then ask your agent something like:
"Use the xknow tools to explain keyword difficulty and cite the source." "Search XKnow for SaaS pricing models and summarise the trade-offs."
| Tool | What it does |
|---|---|
search_knowledge | Ranked search over the knowledge base. Returns titles, snippets, and URLs. |
get_page | Full text of one note by title or slug (preserves [[wikilinks]]). |
explore_concept | A note plus its outbound links and backlinks — walks the knowledge graph. |
list_topics | Lists every note grouped by section (seo, saas, blog). |
lint_rules | The XKnow SEO/SaaS content self-check rubric — each rule with priority (P0–P3), reasoning, fix, and the knowledge-base notes that back it. |
cite | Returns the canonical citation (title, description, URL) for a note. |
| Layer | Content | How |
|---|---|---|
| Free (default) | The 57 public XKnow guides and blog posts | Bundled snapshot — just npx -y xknow-mcp |
| Full vault | Your purchased XKnow Knowledge Base (500+ linked notes) | npx -y xknow-mcp --vault /path/to/SEO-SaaS-Vault |
The full-vault mode reads a local folder of Markdown notes, so your purchased copy never
leaves your machine. Set it once with the XKNOW_VAULT environment variable if you prefer:
export XKNOW_VAULT="/path/to/SEO-SaaS-Vault"
npx -y xknow-mcp
xknow-mcp is a Node.js stdio server. The free layer is a static JSON snapshot generated
from the public site and bundled in the package (data/knowledge.json); search is a small,
dependency-free ranking pass over the bundled notes. Vault mode parses Markdown notes from
a local folder on the fly. No network calls, no vector database, no telemetry.
npm install
npm run build:data # refresh data/knowledge.json from https://xknow.org/mcp/knowledge.json
npm run build # tsc
npm run smoke # exercise every tool over a real stdio connection
# also test against a local vault
SMOKE_VAULT=/path/to/SEO-SaaS-Vault npm run smoke
MIT — see LICENSE.
FAQs
MCP server for the XKnow Knowledge Base — search and explore curated, source-backed SEO, SaaS, and LLM-wiki knowledge from any AI agent.
The npm package xknow-mcp receives a total of 55 weekly downloads. As such, xknow-mcp popularity was classified as not popular.
We found that xknow-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.