
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@docshub/mcp
Advanced tools
A production-grade Model Context Protocol (MCP) server for DocsHub, built with FastMCP and running on Vercel.
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ MCP Client │────▶│ MCP Server │────▶│ DocsHub API │
│ (Claude, etc.) │ SSE │ (FastMCP) │HTTP │ │
└─────────────────┘ └─────────────────┘ └─────────────────┘
│ │
▼ ▼
┌─────────────┐ ┌─────────────┐
│ Supabase │ │ Storage │
│ (Tokens) │ │ (Documents) │
└─────────────┘ └─────────────┘
# Clone the repository
git clone https://github.com/docshub/docshub-mcp-fastmcp.git
cd docshub-mcp-fastmcp
# Install dependencies
npm install
# Copy environment variables
cp .env.example .env
# Configure your .env file with actual values
# Run development server
npm run dev
# Run tests
npm test
# Type check
npm run typecheck
# Lint
npm run lint
# Deploy to Vercel
vercel
# Deploy to production
vercel --prod
| Variable | Description | Required |
|---|---|---|
SUPABASE_URL | Supabase project URL | Yes |
SUPABASE_SERVICE_ROLE_KEY | Supabase service role key | Yes |
JWT_SECRET | Secret for JWT signing (min 32 chars) | Yes |
DOCSHUB_API_URL | DocsHub API endpoint | Yes |
DOCSHUB_APP_URL | DocsHub app URL | Yes |
OAUTH_CLIENT_ID | OAuth client ID | Yes |
OTEL_EXPORTER_OTLP_ENDPOINT | OpenTelemetry endpoint | No |
Configure your MCP client (e.g., Claude Desktop) with:
{
"mcpServers": {
"docshub": {
"command": "npx",
"args": ["-y", "@docshub/mcp@latest"]
}
}
}
list_documents - List all documents with optional folder filteringget_document - Get a specific document by IDcreate_document - Create a new documentupdate_document - Update document title/contentdelete_document - Delete a documentsearch_documents - Search documents by querylist_folders - List folders with hierarchycreate_folder - Create a new folderupdate_folder - Update folder propertiesdelete_folder - Delete a foldermove_folder - Move folder to new location/oauth/authorize/oauth/tokenThe server includes OpenTelemetry instrumentation for:
Metrics are exported to your configured OTLP endpoint.
src/
├── index.ts # Main server entrypoint
├── auth/
│ ├── oauth.ts # OAuth provider implementation
│ └── jwt.ts # JWT token handling
├── tools/
│ ├── documents.ts # Document management tools
│ ├── folders.ts # Folder management tools
│ └── index.ts # Tool exports
├── config/
│ └── index.ts # Configuration management
└── utils/
├── supabase.ts # Database client
└── tracing.ts # OpenTelemetry setup
# Unit tests
npm test
# Coverage report
npm run test:coverage
# E2E tests
npm run test:e2e
src/tools/src/tools/index.tsEnable debug logging:
ENABLE_DEBUG_LOGS=true npm run dev
MIT License - see LICENSE file for details
The MCP server is deployed at: https://mcp.docshub.app
FAQs
FastMCP server for DocsHub document management
We found that @docshub/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.