
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@dudko.dev/tabellum-mcp
Advanced tools
Tabellum MCP shim (stdio): forwards MCP clients without HTTP transport to the MCP server the Tabellum desktop app hosts on loopback.
The stdio shim for Tabellum's MCP server. The Tabellum desktop app hosts an MCP server on loopback while it runs; this package forwards MCP clients that only speak stdio (Claude Code, Cursor, …) to it. It has no tools of its own — the tool list, the approval gate, and the privacy rules are the app's.
// Claude Code: .mcp.json
{
"mcpServers": {
"tabellum": {
"command": "npx",
"args": ["-y", "@dudko.dev/tabellum-mcp"]
}
}
}
The shim reads the app's discovery file, ~/.tabellum/mcp.json, for the port
and the per-install token. If the app is not running, every call answers
"Tabellum is not running" instead of starting anything.
Requires Node.js 24 or newer. Desktop only: the app hosts the server on macOS, Windows, and Linux.
The same tools as the in-app agent: list_connections, describe_schema,
describe_object, sample_rows, run_read, propose_write, explain,
draft_to_editor, plus open_editor_tab. Reads run at once; anything else
waits for the user's click in the app. Row data crosses the boundary only when
the connection shares it.
Proprietary — see LICENSE. Free for commercial use below the thresholds in Section 3; a paid license above them.
FAQs
Tabellum MCP shim (stdio): forwards MCP clients without HTTP transport to the MCP server the Tabellum desktop app hosts on loopback.
We found that @dudko.dev/tabellum-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.