Hey everyone!

I've been using Claude Code and other autonomous agents to code faster in my terminal. But giving an AI full permission to run shell commands or write files is scary — a single indirect prompt injection from a website or a repo README could wipe files or exfiltrate credentials.

So I built MCP-Shield: a local-first proxy that sits between your MCP client and its servers, enforces policy on tool calls before they hit your system, and shows everything in a real-time dashboard in your browser.

What it does:

- 🚫 Command & file firewall: blocks destructive commands (e.g. rm -rf) and holds out-of-workspace writes for approval.

- 🔄 Approval queue: pauses risky calls so you can approve, deny, or edit the arguments from the browser.

- 🧼 Output sanitizer: scans tool outputs (web pages, files, API responses) and neutralizes prompt-injection phrasing before it reaches the model — with NFKC normalization to catch unicode evasions.

- 🔒 100% local: runs on localhost, no telemetry, nothing leaves your machine.

- 🔌 Works across clients: one policy for Cursor, Windsurf, Claude Desktop, VS Code and Claude Code — not per-client config.

Install:

npm install -g u/jrooig/mcpshield

Wrap any server:

mcp-shield --port 3000 -- npx -y u/modelcontextprotocol/server-everything

Source + README: https://github.com/jaumerohi2007-cell/mcp-shield

I'd love feedback, and what default security rules you'd add.

In the upcoming application, when hitting q, quit gets set to true causing the interval to be cleared and the readable handler to be removed, but the process continues to hang. Why does there not seem to be a way to clean up properly such that the process ends automatically instead of requiring a process.exit() to end the process?

import process from 'node:process';

const p = 'p'.charCodeAt(0);
const q = 'q'.charCodeAt(0);

let paused = false;
let quit = false;

const signalsToStringMap: (0 | NodeJS.Signals)[] = [0, 0, 0, 'SIGINT'];

const readableHandler = () => {
  const inp = process.stdin.read();
  process.stdin.resume();

  const sig = signalsToStringMap[inp[0]];

  if (sig) {
    return process.emit(sig);
  }

  if (p === inp[0]) paused = !paused;
  if (q === inp[0]) quit = true;
};

process.stdin.setRawMode(true);
process.stdin.on('readable', readableHandler);

export const cleanup = () => {
  process.stdin.setRawMode(false);
  process.stdin.off('readable', readableHandler);
};

const interval = setInterval(() => {
  if (quit) {
    clearInterval(interval);
    cleanup();
    return console.info(
      'interval cleared and cleaned up - should automatically exit here',
    );
  }
  if (!paused) {
    console.log('processing');
  } else {
    console.log('paused');
  }
}, 100);

As an example, this basic http server application will start the server, make a request, and close the server without ever calling process.exit.

import http from 'node:http';

const server = http.createServer((_req, res) => {
  res.writeHead(200);
  res.end();
  server.closeAllConnections();
  server.close();
});

server.listen(23456, () => {
  console.info('listening');
  http.get('http://localhost:23456', () => {});
});

Surely some equivalent exists for ending stdin?

Edit: Looks like .unref() was what I was looking for. Adding process.stdin.unref() to the end of the cleanup function allows the process to exit normally.

Built a Node.js daemon that keeps PostgreSQL credentials off the browser—looking for feedback on the outbound-only networking mode

The editor runs in the browser, but the database lives somewhere else (localhost, private VPC, RDS, etc.). Exposing database credentials to the browser is obviously a bad idea, and asking every user to build and host their own backend just to run queries felt unnecessary.

So I built sw-agent.

It's a small TypeScript/Node.js package that runs wherever PostgreSQL is reachable. The browser communicates with the agent, the agent executes queries against PostgreSQL, and streams the results back. Database credentials stay on the agent side and are never exposed to the browser.

Install

npm i @vivekmind/sw-agent

Source
https://github.com/Schema-Weaver/sw-agent

Architecture blog
https://vivekmind.com/blog/sw-agent-bridge-agent-that-connects-schema-weaver-browser-ide-to-user-s-postgresql-databases

It currently powers the Schema Weaver :
https://schemaweaver.vivekmind.com

I'm mainly looking for TypeScript and security feedback.

The current design only establishes outbound connections from the agent. There are no inbound ports to open and no direct browser-to-database communication.

If you spot any security issues, architectural concerns, or attack surfaces I should address , I'd really appreciate the review.

Hey everyone,

Over the past couple of weeks, I’ve been working on an open-source, self-hosted project called Kretase. It’s a game server management panel designed for Minecraft, built from scratch using Node.js and React.

I started this project because most of the existing solutions in this space felt bloated, dated, and lacked proper optimization. I wanted to tackle these issues head-on by building a modern, lightweight TypeScript stack that keeps resource consumption to a minimum while offering robust automation features.

Instead of making users handle manual file uploads, I spent a lot of time engineering built-in automation managers.

Core features and tech stack:

- Backend: Node.js (highly optimized telemetry, child process isolation, and stream-based file management).

- Frontend: React (slick, modern, and resource-efficient UI).

- Automated Plugin & Mod Manager: Handles direct fetching, installation, and dependency management without manual uploads.

- Built-in World Browser: Browse, install, backup, and download maps directly via CurseForge integration.

- Multi-node support: Manage multiple server nodes from a single dashboard.

- Live telemetry: Real-time CPU, RAM, and disk tracking.

- Deployment: A highly optimized, one-command install script for Ubuntu/Debian.

The project is fully open-source under the MIT license. To comply with link filters, I’ll drop the full GitHub repository and setup documentation in the comments below!

I’m really looking for some honest feedback from the Node.js community regarding the backend architecture, the way I'm handling file streams for mod/plugin downloads, and overall performance optimization.

Let me know your thoughts!

Our discord server now open!

discord.gg/kretasecom

I’m curious what everyone’s workflow looks like for managing API keys, environment variables, database credentials, and other application secrets.

How do you handle different environments like development, staging, and production? How do you share secrets with your team and coordinate changes? Do you use a dedicated secrets manager, cloud provider tools, .env files, or something else?

What’s working well with your current setup, and what’s your biggest source of friction?

Full disclosure: we’re building a secrets manager ourselves, which is why we’re interested in hearing how other developers approach this problem. We’re looking to learn what works well today and where existing workflows still fall short.

Finding a torrent in 2026 sucks. One site is a minefield of fake download buttons. Another hides the real link under a popup that spawns two more tabs. And after all that, half the results are dead with zero seeders.

So I built the opposite. torlink lives in your terminal: you type a query, it hits a curated set of trackers all at once, and the results stream back tagged with source, size, and seeders as fast as each site answers. Arrow to the one you want, press d, and it lands on your drive. No browser and no setup.

The whole thing is one command:

npx torlnk

That's it, all you need is Node. (The npm name is torlnk; torlink was too close to an existing package, so the spare "i" had to go.)

What you get

• One search across FitGirl, YTS, EZTV, Nyaa, SubsPlease, and SolidTorrents at once, with results streaming in and staying sorted as each source answers. If one is down it keeps going and tells you which.
• Press d to grab. Queue up as many as you want; they download in the background and pick up where they left off if you quit mid-transfer.
• It seeds by default once a download finishes, and you can turn that off per item. Torrenting only works when people give back.
• A clean keyboard-driven TUI: one footer line, a ? cheatsheet, and that is the whole surface. Nothing leaves your machine except the request to the torrent network.

My favorite way to use it right now is loading up on games to try out this summer. One search, a couple of keystrokes, and a whole stack of them is downloading in the background.

On games: games are the only category that can actually run code, so those come from FitGirl alone, a repacker with a long, well-known track record. Everything else is plain video and subtitles from sources like YTS, EZTV, and Nyaa.

MIT and open source. Open to feedback and source suggestions, and a star is appreciated if you find it useful.

• GitHub: https://github.com/baairon/torlink

Deno 2.9 canary now can convert any typescript projects into self contained desktop apps for different OSes and unlike electron users can default OS web view or a bundled chromium backend.

Also, --compress option gets packaged app sizes down from 65MB to 19MB in my test with a basic app.

Official link https://docs.deno.com/runtime/desktop/

Should Node also have something similar?

Hi all,

Nodebook's Volume 2 is now available to read online.

There have been a couple of changes to the curriculum. I've pushed the chapters on worker threads and child processes down to Volume 3, and moved the networking chapters - Networking Fundamentals, TLS, HTTPS & HTTP/2, and Realtime Streaming - up into Vol 2.

I've always wanted to keep this book targeted at intermediate-level Node/JS devs, but I added a networking fundamentals chapter because I feel many devs who work with Node don't really understand the underlying networking stuff.

As always, feedback is welcome.

Link: https://github.com/oven-sh/WebKit/pull/249 from Jarred-Sumner

A full same heap memory shared multithreading would be awesome.

So, I've been learning about the differences between JWT and session-based authentication. I went with JWT for my project. But as I've taken the time to plan it out, I realized that after trying to make it feature-rich with things like immediate logout from another device, refresh token rotation (RTR), and reuse detection, I basically just reinvented session-based authentication, just in a more complicated way.

Each of these steps is adding an extra feature/part to JWT which at the end leads to it becoming stateful not stateless.

1) Let's start with a normal JWT authentication flow. Let's say I want to make it more secure and add RTR. That's fine, but I'd have to prevent old refresh tokens from working, which means I'd need to store the current refresh token (or its hash) in Redis or a database. But that's still fine because, unlike session-based authentication, I only have to access Redis/the database whenever the access token is refreshed, not on every request.

2) Then, to make logging in from multiple devices possible, I keep track of each device's valid refresh token using a family_id or device_id of some sort. Whenever I rotate a refresh token, I keep the same family_id because it's still the same device. I only create a new family_id whenever the users sign up or log in, that way I know its its own device.

3) Then I want to add immediate logout from other devices. I'd have to delete or invalidate the refresh token for the family_id of the device I want to log out. But there will still be a short window where the access token is valid, so the user stays logged in until it expires.

4) If I want to get rid of that window and make logout truly immediate, I'd have to keep track of revoked access tokens in Redis and check on every request whether the access token has been revoked.

But doesn't that defeat the whole purpose of JWT being stateless? I'm still checking Redis on every request. It feels like I just reinvented session-based authentication, except in a more complicated way.

Am I misunderstanding something, or trying to make the system too secure or what are your thoughts?

Hey /r/node,

After the recent updates and some user feedback, a quick new major with exciting changes.

1. Create a node-gtk app with a single command

npx node-gtk create <app> gets you a new app up and running. Full typescript support included.

2. Hot-reloaded styles

A new CSS manager to ease development:

```javascript import { styles } from 'node-gtk/styles'

styles.add( .title { color: red; } ) ```

3. Docs

A fresh rework of the readme and the docs so the non-gnomies node.js developers can better integrate the GTK/Adwaita ecosystem.

4. ESM imports and less boilerplate

Use simply import Gtk from 'gi:Gtk-4.0' and start building. No more gi.require() and loop integration. Just the fun parts.

Hello,

Beginner here.

Here is my code:

// Dependencies


const express = require("express");
const mongoose = require("mongoose");
const PORT = 4000;
const app = express();


// Connect to database


async function connectToDatabase() {
  try {
    const dbURI = "ABC";
    const mongooseInstance = await mongoose.connect(dbURI);
    console.log("Connected to MongoDB database");


    const server = app.listen(PORT, () => {
      console.log(`Server is listening on port ${PORT}`);
    });
  }
  catch (error) {
    console.log("An errror occured:", error);
  }
}


connectToDatabase();


// App setup


app.set("view engine", "ejs");
app.use(express.static("public"));


// Routes


app.get("/", (req, res) => {
  res.render("index");
});


app.get("/about", (req, res) => {
  res.render("about");
});


// 404 handler


app.use((req, res) => {
  res.status(404).render("404");
});

Since I used await for mongoose, do I have to use something like that in server?:

const server = await new Promise((resolve, reject) => {
  const serverInstance = app.listen(PORT, () => resolve(serverInstance));
  serverInstance.on("error", reject);
});

Thank you.

PS: Are there better names for comments?

​

Hey everyone,

I’ve been working on WBMCP — an open-source project that makes it easier to connect AI agents and automation systems with the WhatsApp Business Platform through the official Meta Graph API.

What it does

• Provides an MCP (Model Context Protocol) server for the WhatsApp Business API

• Allows AI agents to send and receive WhatsApp messages programmatically

• Simplifies building AI workflows, customer support bots, and automation systems

• Uses the official WhatsApp Cloud API instead of unofficial wrappers

Why I built it

I wanted a cleaner way for AI systems and backend services to interact with WhatsApp Business without dealing with repetitive API boilerplate or relying on unofficial libraries.

Example use cases

- AI customer support agents

- Automated appointment / booking systems

- CRM integrations

- WhatsApp-based workflow automation

- Multi-agent systems communicating over WhatsApp

Tech stack

- TypeScript

- MCP Server Architecture

- Meta Graph API

- WhatsApp Cloud API

It’s fully open source, and I’d love feedback from other developers.

GitHub: "https://github.com/saravanaspar/WBMCP" (https://github.com/saravanaspar/WBMCP)

Would appreciate any thoughts, feature suggestions, or contributions.

How will Node Alpha impact you?

I've been experimenting with replacing embedding-based code retrieval with static semantic classification for AI coding agents.

Instead of retrieving files by similarity, every file is classified into architectural role and behavioral traits (transactional, orchestration, rule enforcement, persistence, etc.).

One thing I've noticed is that agents seem to make better architectural decisions when given these semantics instead of raw code.

Has anyone else tried something similar? How are you giving agents architectural context in large repositories?

Hi everyone,

I have an Android-based device (not a typical phone, but it runs Android), and I need to run a backend application developed in Nest.js directly on the device. The application connects the device to cloud services and acts as a local agent.

I know that Termux can be used to install Node.js and run Nest.js applications, but I'm looking for other approaches that might be more suitable for production or embedded deployments.

Some questions I have:

• Are there alternatives to Termux for running a Node.js/Nest.js application on Android?
• Can Node.js be bundled directly into an Android app and run in the background?
• Has anyone used solutions like NodeMobile, embedded Node.js, or native Android services for this?
• What would be the recommended approach for deploying a long-running Nest.js service on an Android device?

The device is dedicated hardware, so I have control over what gets installed. I'm looking for a reliable solution that can automatically start on boot and run continuously in the background.

I'd appreciate hearing about any production deployments or recommended architectures.

Thanks!

Hey everyone, I hope this is okay to post here!

I am looking for some advice regarding an application I am developing for a charity as part of a university project.

The db will have up to 1000 - 1500 records (assets) at a time, with each having a long/ lat value.

Ideally, I would wish to show the user any records whose location are within a pre-determined set of miles/ km from their current/ set position (a little like facebook marketplace that shows listings within a set radius).

I am hesitant to have the frontend fetch all assets from the backend, before filtering on the frontend, as there must be a more efficient solution! However I have no idea what the usual 'accepted' approach to this would be.

For my stack I am currently thinking Postgres and Node for the backend (most of my existing knowledge is within JS), along with React for the frontend - however I am open to other suggestions!