
Security News
Open VSX Begins Implementing Pre-Publish Security Checks After Repeated Supply Chain Incidents
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.
The official e18e MCP server for advising agents on modern and performant best practices
@e18e/mcp (STDIO)MCP server that flags inefficient or outdated npm packages and serves migration docs. It exposes tools for checking install commands or source files, a resource template with curated replacement guides, and a helper prompt for task-oriented workflows.
npm-i-checker: Input an install command (npm i, pnpm add, yarn add, bun i). Returns suggestions[] for packages that have better-native or better-maintained alternatives.code-checker: Input a full source file (JS/TS/JSX/TSX). Parses imports and returns suggestions[] when a listed module should be replaced.replacement-docs (template): URI e18e://docs/{slug}. Lists/reads text guides for migrating away from specific packages (auto-complete on slug; list returns all available docs).task: Returns a task-focused system prompt that reminds the model to run npm-i-checker for installs and code-checker on code before replying.Prereqs: Node.js ≥18 and npm/pnpm (build uses pnpm, runtime works via npx/pnpm dlx/bunx).
The local (or stdio) version of the MCP server is available via the @e18e/mcp npm package. You can either install it globally and then reference it in your configuration or run it with npx:
npx -y @e18e/mcp
Here's how to set it up in some common MCP clients:
To include the local MCP version in Claude Code, simply run the following command:
claude mcp add -t stdio -s [scope] e18e -- npx -y @e18e/mcp
The [scope] must be user, project or local.
In the Settings > Developer section, click on Edit Config. It will open the folder with a claude_desktop_config.json file in it. Edit the file to include the following configuration:
{
"mcpServers": {
"e18e": {
"command": "npx",
"args": ["-y", "@e18e/mcp"]
}
}
}
Add the following to your config.toml (which defaults to ~/.codex/config.toml, but refer to the configuration documentation for more advanced setups):
[mcp_servers.e18e]
command = "npx"
args = ["-y", "@e18e/mcp"]
To include the local MCP version in Gemini CLI, simply run the following command:
gemini mcp add -t stdio -s [scope] e18e npx -y @e18e/mcp
The [scope] must be user, project or local.
Run the command:
opencode mcp add
and follow the instructions, selecting 'Local' under the 'Select MCP server type' prompt:
opencode mcp add
┌ Add MCP server
│
◇ Enter MCP server name
│ e18e
│
◇ Select MCP server type
│ Local
│
◆ Enter command to run
│ npx -y @e18e/mcp
npx -y @e18e/mcp in the input and press Entere18eGlobal or Workspace MCP serverIt will open a file with your MCP servers where you can add the following configuration:
{
"mcpServers": {
"e18e": {
"command": "npx",
"args": ["-y", "@e18e/mcp"]
}
}
}
Model Context Protocol (MCP) ServersIt will open a popup with MCP server config where you can add the following configuration:
{
"e18e": {
"command": "npx",
"args": ["-y", "@e18e/mcp"]
}
}
If we didn't include the MCP client you are using, refer to their documentation for stdio servers and use npx as the command and -y @e18e/mcp as the arguments.
FAQs
The official e18e MCP server for advising agents on modern and performant best practices
The npm package @e18e/mcp receives a total of 14 weekly downloads. As such, @e18e/mcp popularity was classified as not popular.
We found that @e18e/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Following multiple malicious extension incidents, Open VSX outlines new safeguards designed to catch risky uploads earlier.

Research
/Security News
Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.

Security News
Lodash 4.17.23 marks a security reset, with maintainers rebuilding governance and infrastructure to support long-term, sustainable maintenance.