
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@aauth/mcp-stdio
Advanced tools
Stdio-to-HTTP proxy for MCP with AAuth signatures. Bridges a local stdio MCP client (like Claude Code) to a remote HTTP MCP server, signing all requests with AAuth.
Part of aauth-dev/packages-js. Protocol spec: dickhardt/AAuth.
npm install @aauth/mcp-stdio
npx @aauth/mcp-stdio --server https://api.example.com/mcp --agent https://user.github.io
| Flag | Env var | Description |
|---|---|---|
--server, -s | AAUTH_MCP_SERVER | Remote MCP server URL (required) |
--agent, -a | AAUTH_AGENT_URL | Agent identity URL (required) |
--delegate, -d | AAUTH_DELEGATE | Delegate name (default: claude) |
--token-lifetime | AAUTH_TOKEN_LIFETIME | Agent token lifetime in seconds (default: 3600) |
Add to your MCP server config:
{
"mcpServers": {
"my-server": {
"command": "npx",
"args": ["@aauth/mcp-stdio", "--server", "https://api.example.com/mcp", "--agent", "https://user.github.io"]
}
}
}
Or with environment variables:
{
"mcpServers": {
"my-server": {
"command": "npx",
"args": ["@aauth/mcp-stdio"],
"env": {
"AAUTH_MCP_SERVER": "https://api.example.com/mcp",
"AAUTH_AGENT_URL": "https://user.github.io"
}
}
}
}
bridgeTransports(local, remote): Promise<void>Bridges two MCP transports for bidirectional message forwarding.
import { bridgeTransports } from '@aauth/mcp-stdio'
parseArgs(argv): StdioArgsParses CLI arguments with env var fallbacks.
import { parseArgs } from '@aauth/mcp-stdio'
const args = parseArgs(process.argv.slice(2))
// { serverUrl, agentUrl, delegate?, tokenLifetime? }
MIT
FAQs
Stdio-to-HTTP proxy for MCP with AAuth signatures
The npm package @aauth/mcp-stdio receives a total of 48 weekly downloads. As such, @aauth/mcp-stdio popularity was classified as not popular.
We found that @aauth/mcp-stdio demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.