
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@pipedream/mcp
Advanced tools
Run your own MCP server for over 2,500 apps and APIs.
You can:
npx @pipedream/mcpPipedream's MCP servers use the Pipedream Connect API to manage auth and make API requests. To run an MCP server, you'll need a Pipedream project and Pipedream API credentials.
PIPEDREAM_CLIENT_ID=your_client_id
PIPEDREAM_CLIENT_SECRET=your_client_secret
PIPEDREAM_PROJECT_ID=your_project_id
PIPEDREAM_PROJECT_ENVIRONMENT=development
If you're running MCP servers for your app, you'll likely want to use the SSE interface. The SSE server accepts two route params:
external_user_id — This is your user’s ID, in your system — whatever you use to uniquely identify them. Any requests made to that route are coupled to that end user, and would use the auth Pipedream stores for that user. See the docs for more detail.app — The app's "name slug" (the unique identifier for the app), found in the Authentication section of any Pipedream app. For example, the app slug for Slack is slack.If your user 123 wants to connect to the slack MCP server, your MCP client would make a request to the /123/slack route. See the SSE docs below for more detail.
npxPipedream MCP servers provide two interfaces clients can connect to:
First, set these variables in your environment.
Run the stdio server for a specific app, passing the app's name slug to the --app option:
npx @pipedream/mcp stdio --app slack
You can also specify an optional external user ID — whatever ID you use to identify your user in your app (otherwise a random UUID will be generated):
npx @pipedream/mcp stdio --app slack --external-user-id user123
First, set these variables in your environment.
Run the SSE server:
npx @pipedream/mcp sse
This exposes a generic MCP server that allows you to connect to any of our 2,500+ apps by passing the app's name slug directly in the route:
❯ npx @pipedream/mcp sse
Server is running on port 3010
Routes configured:
- GET / - Health check
- GET /:external_user_id/:app - App-specific SSE connection endpoint
- POST /:external_user_id/:app/messages - App-specific message handler
To connect to the server:
Connect to http://localhost:3010/:external_user_id/:app where:
:external_user_id is a unique identifier for the session:app is the Pipedream app to use (e.g., "slack")The server will establish an SSE connection and register tools for the specified app.
To send messages, post to http://localhost:3010/:external_user_id/:app/messages?sessionId=<sessionId> where:
<sessionId> is provided in the response from the initial connectionYou can also specify an app and port via CLI:
npx @pipedream/mcp sse --app slack --port 8080
❯ npx @pipedream/mcp sse --app slack --port 8080
Server is running on port 8080
Routes configured:
- GET / - Health check
- GET /:external_user_id/slack - App-specific SSE connection endpoint
- POST /:external_user_id/slack/messages - App-specific message handler
The SSE server runs as a Node.js Express app. The implementation is simple and meant to be a reference implementation. You should add authorization and customize the app you need.
Clone the repo and install dependencies:
npm install
Set these variables in your environment in using whatever env / secrets store you use in your infra. To test this locally, copy the .env.example file:
cp .env.example .env
and fill in the values:
# Pipedream OAuth credentials
PIPEDREAM_CLIENT_ID=your_client_id
PIPEDREAM_CLIENT_SECRET=your_client_secret
# From the project settings
PIPEDREAM_PROJECT_ID=your_project_id
PIPEDREAM_PROJECT_ENVIRONMENT=development
# Pipedream can send you webhook notifications on account connection, account failure, etc.
PIPEDREAM_WEBHOOK_URI=https://your-webhook.m.pipedream.net
# Optional: Default app to use (defaults to "slack")
APP=slack
# Optional: Port for the SSE server (defaults to 3010)
PORT=3010
Run the build:
npm run build
And run the SSE server:
npm run start:sse:prod
MCP recently added support for servers authorizing requests using OAuth. When you host your own server, you should implement OAuth support to protect access to customer data.
First, set these variables in your environment.
Use the MCP Inspector or your preferred MCP client to connect to the server:
npx @modelcontextprotocol/inspector node ./dist/src/cli.js stdio --app APP --external-user-id USER_ID
Open http://localhost:5173/ and set the transport type to STDIO.

You can customize this implementation in any way you'd like, for example:
config.ts to change default settingsregisterComponentTools.ts to add additional tools, or limit tools to a fixed set.Pipedream Source Available License Version 1.0 - See https://github.com/PipedreamHQ/pipedream/blob/master/LICENSE
FAQs
Pipedream stdio and SSE MCP servers
We found that @pipedream/mcp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.