Corulix

Version: 1.1.0 License: AGPL-3.0-only Publisher / maintainer: WhaTalker Inc. (https://whatalker.com) Product website: https://corulix.com

@whatalker/corulix is the npm distribution of Corulix, WhaTalker Inc.'s enterprise code-intelligence and controlled-mutation MCP (Model Context Protocol) server. This package is a thin native-binary launcher: it does no parsing, indexing, or MCP protocol handling itself — it resolves the correct platform binary for your OS/CPU and execs it with argv/stdio forwarded unchanged.

For what's actually live on the registry right now (published versions, dist-tags, download stats), see https://www.npmjs.com/package/@whatalker/corulix — that page is the single source of truth for publication status; nothing below should be read as a claim that a specific version is currently published.

What Corulix is

Corulix gives an AI coding agent governed, auditable code intelligence and controlled code-mutation capability over a real software workspace, behind a single MCP stdio server:

• Structural + semantic understanding — Tree-sitter-backed parsing and symbol/scope extraction, plus compiler-grade semantics (definitions, references, diagnostics, rename preview) through language-specific LSP providers Corulix resolves and launches itself.
• A governed mutation workflow — file edits happen only inside an explicit ChangeSession: open it with a stated intent and scope, submit edits, run a real revalidation gate (e.g. cargo check), and only then complete it.
• Managed toolchains — Corulix downloads, SHA-256-verifies, and runs its own LSP servers, formatters, and build/lint/test tools in a sandboxed, Corulix-owned location rather than trusting whatever happens to already be on the host PATH.
• Fail-closed workspace security — every workspace-relative path is canonicalized and confined to the approved root; a workspace is UNTRUSTED by default.

Corulix is not a general-purpose file editor, a shell-command runner, or a Git client. Every mutation path is a declared, auditable MCP tool call.

Installation

This package automatically resolves and installs the correct native platform package for your OS/CPU as an optional dependency; you never install a platform package directly.

Global CLI installation:

npm install -g @whatalker/corulix

Project-local installation:

npm install @whatalker/corulix

One-shot usage without a persistent install:

npx @whatalker/corulix --version

Verify installation

corulix --version
# corulix 1.1.0

corulix --help

Supported platforms

Corulix 1.1.0 ships native optional-dependency packages for:

| Platform | Architecture | npm package | Status | | -------- | ------------ | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | | Linux | x86_64 | @whatalker/corulix-linux-x64 | Native build, full native workspace test suite, native runtime/CLI/MCP verification | | Linux | arm64 | @whatalker/corulix-linux-arm64 | Cross-built aarch64-unknown-linux-gnu binary, architecture-verified; native ARM64 runtime execution not yet performed | | Windows | x86_64 | @whatalker/corulix-win32-x64 | Native MSVC build, full native workspace test suite, PE32+/AMD64 format certification, native runtime/CLI/MCP verification | | macOS | x86_64 | — | Not included in this NPM distribution | | macOS | arm64 | — | Not included in this NPM distribution |

The current Corulix product has completed its certification arc on Linux (native x86_64, cross-built ARM64) and native Windows. No real macOS build/certification environment has been used, so macOS NPM binaries are not part of this release; native macOS support is deferred to a future release pending real Apple-platform build and certification. This is a distribution-scope decision, not a temporary gap — do not install a Linux/Windows package on macOS as a substitute.

If your OS/CPU combination has no matching platform package, corulix fails closed on stderr with an explicit message — on macOS specifically, an "unsupported NPM binary platform: darwin" message naming the Linux/ Windows-only distribution scope and the deferral to a future release pending real Apple build and certification — and exits non-zero. It never silently falls back to downloading or compiling a substitute binary, and never selects another platform's binary.

Node.js / npm requirements

"engines": { "node": ">=18" }

This launcher itself has no other runtime Node.js dependency once installed — all actual code intelligence and MCP logic runs in the native binary. Node.js is required only to run the launcher script (bin/corulix.js) and to drive the platform-package optionalDependencies resolution during npm install.

MCP usage

Start the MCP server over stdio for a single-root workspace:

corulix mcp stdio --workspace <DIR>

Or for a multi-root VS Code .code-workspace file:

corulix mcp stdio --workspace-file <FILE.code-workspace>

stdout carries only MCP protocol frames once the session starts; diagnostics and logging go to stderr.

Optional host-only configuration

An operator may grant one server process a wider provider-resolution envelope (an approved toolchain directory, an explicit provider path, or authorization to run the workspace's own build/test commands) with:

corulix mcp stdio --workspace <DIR> --host-config <ABSOLUTE_FILE>

--host-config names a TOML file the operator authors — never a value a workspace, an MCP request, or a repository can set for itself. Omitting it is safe and unchanged: no approved provider directories, no trusted workspace execution, and ambient PATH is never consulted for provider resolution either way. Run corulix mcp stdio --help for the exact file format and every fail-closed validation rule.

Workspace configuration (1.1.0)

A workspace may optionally carry its own WhaTalker_Corulix_JSON_Config.json — the exact canonical filename, read only from its canonical fixed location (beside a .code-workspace descriptor for a multi-root workspace, or directly inside a single root). It can narrow, never widen, MCP tool exposure and provider-category availability; an absent file preserves the full default behavior (all 14 tools, no category narrowing).

{
  "configName": "WhaTalker Corulix JSON Config",
  "schemaVersion": 1,
  "toolPolicy": {
    "disabledTools": [
      "begin_change",
      "submit_edit",
      "validate_change",
      "change_status",
      "complete_change",
      "abort_change"
    ]
  },
  "defaults": { "disabledCategories": ["FORMATTER"] }
}

This example disables the entire six-tool mutation family (the canonical read-only pattern), leaving the 8 non-mutation tools visible, and disables the FORMATTER provider category workspace-wide. Workspace configuration can only ever reduce the effective tool set below the canonical 14 — it can never add a 15th tool.

corulix config validate --workspace <DIR>
corulix config inspect  --workspace <DIR>
corulix config schema

See https://corulix.com and the project's full wht_docs/wht_workspace_json_config_reference.md (in the source distribution) for the complete schema, field reference, and CLI documentation.

Other CLI commands

corulix toolchain status --workspace <DIR>
corulix languages list --workspace <DIR>
corulix workspace detect --workspace <DIR>
corulix workspace inspect --workspace <DIR>
corulix parse <FILE> --workspace <DIR>

Run corulix help <COMMAND> or corulix <COMMAND> --help for the full, authoritative flag reference for your installed version.

Managed toolchains

Corulix provisions its own LSP servers, formatters, and build/lint/test tools into a Corulix-owned, sandboxed location, verifying each download against a pinned SHA-256 hash rather than trusting the host PATH. Managed components are versioned and can be fully uninstalled with zero-residual verification.

Workspace trust

Every workspace Corulix opens is UNTRUSTED by default. Trusted-execution operations (e.g. running a project's own build/test tooling) require an explicit, operator-level trust decision — Corulix never elevates trust on its own.

License

AGPL-3.0-only. See the included LICENSE file for the complete, verbatim GNU Affero General Public License v3 text.

Documentation / homepage

• Product website: https://corulix.com
• Corporate website: https://whatalker.com
• npm package page (live publication status): https://www.npmjs.com/package/@whatalker/corulix