
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@colpero/mcp
Advanced tools
MCP server for the Colpero spatial network. Exposes scene query, pathfinding, and attestation verification as Model Context Protocol tools.
MCP server for the Colpero spatial network.
Three tools an LLM agent can call to read, navigate, and verify a physical scene:
| Tool | What it does | Backend |
|---|---|---|
query_scene | Look up objects in a scene by name, semantic type, or zone | GET /scenes/:id/search |
get_path | Compute a navigable path between two nodes | POST /scenes/:id/path |
verify_attestation | Verify an Ed25519-signed scan attestation (RFC-COL-001 Phase 1) | GET /scenes/:id/verify/:attestation_id |
claude mcp add colpero -- npx -y @colpero/mcp
~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"colpero": {
"command": "npx",
"args": ["-y", "@colpero/mcp"]
}
}
}
Restart Claude Desktop. The three tools appear in the tool picker.
| Env var | Default | Notes |
|---|---|---|
COLPERO_API_BASE | https://spatial-api-production-3a0d.up.railway.app | Point at your own deployment for local dev |
get_path is paid via x402 (USDC on Base Sepolia). On the
hosted backend it returns HTTP 402 with payment instructions; client-side x402
payment is out of scope for v0.0.1, so the tool surfaces the 402 as an error.
query_scene and verify_attestation are free.
To run all three tools free against a local backend:
git clone https://github.com/lucatrevisanii/colpero
cd colpero/colpero-spatial-api
PAY_TO_ADDRESS= PORT=3099 npx ts-node src/server.ts
# then
COLPERO_API_BASE=http://localhost:3099 npx -y @colpero/mcp
The MCP server is a thin wrapper. Each tool maps 1:1 to a curl call.
# query_scene
curl "$API/scenes/lidar_room/search?q=desk"
# get_path
curl -X POST "$API/scenes/lidar_room/path" \
-H "content-type: application/json" \
-d '{"from":"obj_001","to":"obj_020"}'
# verify_attestation
curl "$API/scenes/lidar_room/verify/att_4b29f3861b9945c1a53b97d7"
Once installed in Claude Code or Desktop:
Find the desk in scene
lidar_room, then verify attestationatt_4b29f3861b9945c1a53b97d7and tell me whether the scan is genuine.
Claude calls query_scene then verify_attestation, returns the bbox plus
the Ed25519 signature verification result. Both endpoints are free on the
hosted backend; get_path is paywalled (see below).
MIT.
FAQs
MCP server for the Colpero spatial network. Exposes scene query, pathfinding, and attestation verification as Model Context Protocol tools.
The npm package @colpero/mcp receives a total of 16 weekly downloads. As such, @colpero/mcp popularity was classified as not popular.
We found that @colpero/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.