
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@codebyai/file-mcp
Advanced tools
MCP server for file operations including XLSX manipulation and file analysis
@codebyai/file-mcp acts as a Model-Context-Protocol (MCP) server, giving your AI coding assistant access to
powerful file operations and frontend development tools.
@codebyai/file-mcp communicates with the CodeByAI web service (https://codebyai.com)
to process design files and AI analysis requests. Design files and content you submit will
be sent to this service. Avoid submitting sensitive or confidential information.
Before installing, generate or obtain an API_KEY. This key starts with "sk-" and is referred to as CODEBYAI_API_KEY. Replace {CODEBYAI_API_KEY} in the installation command with your actual key.
Add the following config to your MCP client:
{
"mcpServers": {
"file": {
"command": "npx",
"args": ["-y", "@codebyai/file-mcp@latest"],
"env": {
"CODEBYAI_API_KEY" : "{CODEBYAI_API_KEY}"
}
}
}
}
[!NOTE] Using
@codebyai/file-mcp@latestensures that your MCP client will always use the latest version of the File MCP server.
[!IMPORTANT] All client configurations below require you to replace
{CODEBYAI_API_KEY}with your actual API key obtained from https://codebyai.com/console/api-keys.
claude mcp add file npx @codebyai/file-mcp@latest --env CODEBYAI_API_KEY={CODEBYAI_API_KEY}
Alternatively, manually edit your Claude Code MCP configuration file and add the environment variable.
codex mcp add file --env CODEBYAI_API_KEY={CODEBYAI_API_KEY} -- npx @codebyai/file-mcp@latest
Start Copilot CLI:
copilot
Start the dialog to add a new MCP server by running:
/mcp add
Configure the following fields and press CTR-S to save the configuration:
file[1] Localnpx-y, @codebyai/file-mcp@latestCODEBYAI_API_KEY with your API key valuecode --add-mcp '{"name":"file","command":"npx","args":["@codebyai/file-mcp@latest"],"env":{"CODEBYAI_API_KEY":"{CODEBYAI_API_KEY}"}}'
Go to Cursor Settings -> MCP -> New MCP Server. Use the config provided above (including the CODEBYAI_API_KEY environment variable).
Project wide:
gemini mcp add file --env CODEBYAI_API_KEY={CODEBYAI_API_KEY} npx @codebyai/file-mcp@latest
Globally:
gemini mcp add -s user file --env CODEBYAI_API_KEY={CODEBYAI_API_KEY} npx @codebyai/file-mcp@latest
Alternatively, follow the MCP guide and use the standard config from above (including the CODEBYAI_API_KEY environment variable).
Go to Settings | Tools | AI Assistant | Model Context Protocol (MCP) -> Add. Use the config provided above (including the CODEBYAI_API_KEY environment variable).
The same way @codebyai/file-mcp can be configured for JetBrains Junie in Settings | Tools | Junie | MCP Settings -> Add. Use the config provided above.
Follow the Visual Studio MCP configuration guide and use the config provided above (including the CODEBYAI_API_KEY environment variable).
Go to Settings | AI | Manage MCP Servers -> + Add to add an MCP Server. Use the config provided above (including the CODEBYAI_API_KEY environment variable).
Enter the following prompt in your MCP Client to check if everything is working:
List available knowledge base documents
Your MCP client should connect to the CodeByAI service and retrieve the knowledge base listing.
file_understandingAnalyze and extract content from PDF, MP4, or MP3 files using Google Gemini AI.
Parameters:
file_path (string, required): The absolute file path(s) to analyze. Multiple files can be separated by commasinstruction (string, required): Natural language instruction for file analysissave_to_path (string, optional): The local file absolute path where the parsing result is savedReturns:
Note: For PDF files, this tool should only be used when the file size exceeds 2MB.
XLSX manipulation tools for reading, writing, filtering, and appending Excel files with multi-sheet support. Built on the xlsx library, these tools provide comprehensive Excel file operations including sheet management, row/column manipulation, and data validation.
xlsx_summaryGet XLSX document summary including all sheets with their headers and row counts.
Parameters:
filePath (string, required): The absolute file path to the XLSX fileReturns:
Example response:
XLSX Document Summary:
Total Sheets: 2
Sheet: "Users"
Header: Name(A), Age(B), City(C)
Total Rows: 4 (including header row)
Sheet: "Products"
Header: Product(A), Price(B), Stock(C)
Total Rows: 4 (including header row)
Use case: Quickly understand the structure of an XLSX file, including all available sheets and their column headers.
xlsx_row_readGet the content of rows from a range in a specific sheet. Returns rows in markdown table format with row numbers as the first column.
Parameters:
filePath (string, required): The absolute file path to the XLSX filesheet (string, required): The name of the sheet to read fromrowNumFrom (number, required): The start row number to retrieve (1-based: 1=header, 2=first content row)rowNumEnd (number, required): The end row number to retrieve (1-based). Must be >= rowNumFromReturns:
Example response:
XLSX Content from Sheet "Users" (Rows 1-3)
| Row No. | Name(A) | Age(B) | City(C) |
|---------|---------|--------|---------|
| 1 | Name | Age | City |
| 2 | Alice | 26 | New York |
| 3 | Bob | 26 | San Francisco |
Note: The 'Row No.' column is not part of the XLSX file.
Total rows in sheet "Users": 4 (including header)
Sheet validation: If the specified sheet doesn't exist, returns an error message listing all available sheets in the format: sheet不存在,此xlsx文件拥有的sheet名称为["Sheet1","Sheet2"]
xlsx_row_editModify cell values across a row range in a specific sheet. Updates the same column for all rows in the specified range with the same value.
Parameters:
filePath (string, required): The absolute file path to the XLSX filesheet (string, required): The name of the sheet to modifyrowNumFrom (number, required): The start row number to modify (1-based: 1=header, 2=first content row)rowNumEnd (number, required): The end row number to modify (1-based). Must be >= rowNumFromcolLetter (string, required): The column letter (A, B, C, ..., Z, AA, AB, ...)content (string, required): The new cell content to apply to all rows in the rangeReturns:
Example:
{
"filePath": "/path/to/file.xlsx",
"sheet": "Users",
"rowNumFrom": 2,
"rowNumEnd": 3,
"colLetter": "B",
"content": "26"
}
Example response:
Successfully updated 2 cell(s) in column B (rows 2-3) of sheet "Users" with value: "26"
Sheet validation: If the specified sheet doesn't exist, returns an error message listing all available sheets.
xlsx_row_filterFilter rows in a specific sheet by searching for a keyword in a specified column. Performs case-insensitive substring matching.
Parameters:
filePath (string, required): The absolute file path to the XLSX filesheet (string, required): The name of the sheet to search incolLetter (string, required): The column letter to search in (A, B, C, ..., Z, AA, AB, ...)keyword (string, required): The keyword to search for (case-insensitive substring matching)Returns:
rowNum and columnContent for each matchxlsx_row_read to retrieve full row detailsExample request:
{
"filePath": "/path/to/file.xlsx",
"sheet": "Users",
"colLetter": "C",
"keyword": "New"
}
Example response:
Found 1 matching row(s) in sheet "Users". Use the "xlsx_row_read" tool to retrieve the full content of a specific row.
[
{
"rowNum": "2",
"columnContent": "New York"
}
]
Features:
xlsx_row_appendAppend multiple rows to an XLSX sheet. If the file or sheet doesn't exist, it will be created with the first row as the header.
Parameters:
filePath (string, required): The absolute file path to the XLSX filesheet (string, required): The name of the sheet to append torows (string, required): JSON string representing a 2D array of rows to append (e.g., [["value1","value2"],["value3","value4"]])Returns:
Example:
{
"filePath": "/path/to/file.xlsx",
"sheet": "Users",
"rows": "[[\"Alice\",\"25\",\"New York\"],[\"Bob\",\"30\",\"San Francisco\"]]"
}
Example responses:
Successfully appended 2 row(s) to sheet "Users". Total rows in sheet: 6 (including header)
Successfully created new sheet "Users" with 4 row(s). First row is set as the header.
Successfully created new XLSX file with sheet "Users" containing 4 row(s). First row is set as the header.
Features:
XLSX Format Details:
--no-category-xlsx command-line flagThe File MCP server supports the following environment variables:
CODEBYAI_API_KEY (Required): Your CodeByAI API key for authentication
sk-CODEBYAI_BASE_URL (Optional): Override the CodeByAI API endpoint
https://codebyai.comSet environment variables via the env property in the JSON configuration:
{
"mcpServers": {
"frontend": {
"command": "npx",
"args": ["-y", "@codebyai/frontend-mcp@latest"],
"env": {
"CODEBYAI_API_KEY": "{CODEBYAI_API_KEY}",
"CODEBYAI_BASE_URL": "https://custom-domain.com"
}
}
}
}
The Frontend MCP server supports the following command-line arguments:
--no-category-csv (Optional): Disable all CSV-related tools
args array to disable CSV tools if you don't need them{
"mcpServers": {
"frontend": {
"command": "npx",
"args": ["-y", "@codebyai/frontend-mcp@latest", "--no-category-csv"],
"env": {
"CODEBYAI_API_KEY": "{CODEBYAI_API_KEY}"
}
}
}
}
Note: For Claude Code CLI, you can add these arguments after the package name:
# Auto-detect encoding
claude mcp add frontend npx @codebyai/frontend-mcp@latest --env CODEBYAI_API_KEY={CODEBYAI_API_KEY}
# Or specify explicit encoding
claude mcp add frontend npx @codebyai/frontend-mcp@latest --env CODEBYAI_API_KEY={CODEBYAI_API_KEY}
The server logs all activities to $tmpdir/codebyai-file-mcp-log/codebyai-file-mcp-YYYY-MM-DD.log, including:
The server handles various error scenarios:
All errors are logged and returned to the calling application with descriptive messages.
For issues, questions, or feature requests, please visit CodebyAI.
FAQs
MCP server for file operations including XLSX manipulation and file analysis
We found that @codebyai/file-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.