
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@commonninja/cli
Advanced tools
Common Ninja CLI + MCP server — create and manage website widgets from the command line or any AI assistant.
A Model Context Protocol (MCP) server implementation for Common Ninja Widgets+, allowing AI assistants to interact with the Common Ninja API.
npm install
The server runs in one of two transports:
command/args. The token comes from COMMONNINJA_ACCOUNT_ACCESS_TOKEN./mcp/<TOKEN>) or a CN-API-Token header.# stdio (local)
npm start
# HTTP (hosted) — any of these enable HTTP mode:
MCP_TRANSPORT=http npm start # or: node build/index.js --http (PORT defaults to 3000)
Once the server is deployed (anything that sets PORT, e.g. Render/Railway/Fly, runs HTTP mode automatically), connecting is one line. Grab your Account Access Token from the dashboard, then:
# Claude Code
claude mcp add --transport http commonninja https://mcp.commoninja.com/mcp/YOUR_API_TOKEN
Or point any MCP-compatible client at https://mcp.commoninja.com/mcp/YOUR_API_TOKEN. The token can also be sent as a CN-API-Token header instead of in the path. GET /healthz returns server status. (Stateless mode: only POST is served; GET/DELETE return 405.)
See DEPLOY.md for deploying the hosted server to Heroku at mcp.commoninja.com.
When OAUTH_ENABLED=true, users connect with just the URL — no token to paste. The client
discovers Common Ninja's authorization server and opens a browser login:
claude mcp add --transport http commonninja https://mcp.commoninja.com/mcp
# Claude opens a Common Ninja login + consent screen, then connects.
OAuth is opt-in and depends on a few authorization-server pieces (dynamic client registration, PKCE)
landing in widgets-api. Until then, use the token methods above. Full design + turn-on checklist:
OAUTH.md.
{
"globalShortcut": "",
"mcpServers": {
"commonninja": {
"command": "node",
"args": ["/path/to/commonninja-mcp-server/build/index.js"],
"env": {
"COMMONNINJA_ACCOUNT_ACCESS_TOKEN": "your_access_token_here"
}
}
}
}
Get current path with process.cwd(), and use it as the path to the MCP server.
The MCP server is a Node.js application that listens for MCP connections from the Common Ninja desktop app.
commonninja)A token-cheap CLI for agents and automation — every command outputs structured JSON. Install from npm:
npm install -g @commonninja/cli
export COMMONNINJA_ACCOUNT_ACCESS_TOKEN="your_access_token_here"
commonninja help # list all commands
commonninja widget-types
commonninja widgets:list --limit 5
commonninja widget:create --type faq --name "My FAQ" --data @faq.json
commonninja widget:update <widgetId> --name "New name" --description "New description"
commonninja widget:embed <widgetId>
Or run without installing: npx @commonninja/cli widget-types. The MCP server bin is commonninja-mcp. Full reference: docs.commoninja.com/docs/reference/cli.
This project is licensed under the MIT License. See the LICENSE file for details.
FAQs
Common Ninja CLI + MCP server — create and manage website widgets from the command line or any AI assistant.
The npm package @commonninja/cli receives a total of 1 weekly downloads. As such, @commonninja/cli popularity was classified as not popular.
We found that @commonninja/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.