
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@ev3lynx/oh-my-mcp
Advanced tools
Native MCP gateway with management layer — stdio and supergateway transports
Manage MCP servers and proxy JSON-RPC over HTTP
oh-my-mcp is a gateway and process manager for Model Context Protocol servers. It starts MCP servers (via supergateway), monitors their health, and exposes a unified HTTP API for clients like Claude Desktop, Cursor, and Windsurf.
POST /mcp) with server selection via Server-Id header./metrics)# 1. Clone and build
git clone https://github.com/ev3lynx/oh-my-mcp
cd oh-my-mcp
npm ci
npm run build
# 2. Create config (see config.example.yaml)
cp config.example.yaml config.yaml
# Edit config.yaml with your MCP servers
# 3. Run
node dist/index.js config.yaml
The app starts:
http://localhost:8080http://localhost:8090Comprehensive guides for advanced usage, deployment, and integration:
| Guide | Purpose |
|---|---|
| USAGE.md | Detailed usage examples, API reference, Docker, Kubernetes, OpenClaw, CI/CD |
| SETUP.md | Installation, configuration, security best practices |
| DEPLOYMENT.md | Docker, Kubernetes, systemd, production hosting |
| ARCHITECTURE.md | System design, modules, extension points |
| CONTRIBUTING.md | How to contribute, code style, testing |
Start with USAGE.md for practical patterns.
config.yaml:
managementPort: 8080
gatewayPort: 8090
logLevel: info
compression: true
auth:
enabled: true
tokens:
- "your-secret-token"
servers:
github:
command: ["npx", "-y", "@modelcontextprotocol/server-github"]
env:
GITHUB_TOKEN: "${GH_TOKEN}"
timeout: 60000
enabled: true
transport: "supergateway"
healthCheck:
interval: 30000
timeout: 5000
unhealthyThreshold: 3
See config.example.yaml for all options.
| Endpoint | Method | Auth | Description |
|---|---|---|---|
/health | GET | no | Application health: { status, servers } |
/servers | GET | yes | List all servers with status |
/servers/:id | GET | yes | Get single server details |
/servers/:id/start | POST | yes | Start a server |
/servers/:id/stop | POST | yes | Stop a server |
/servers/:id/restart | POST | yes | Restart a server |
/_start-all | POST | yes | Start all enabled servers |
/_stop-all | POST | yes | Stop all running servers |
/metrics | GET | no | Prometheus metrics |
Authentication: Include Authorization: Bearer <token> if auth enabled.
POST /mcp proxies any JSON-RPC request to the selected backend.
Headers:
Server-Id (optional): which server to route to (default: first enabled)Authorization: Bearer <token> (if auth enabled)Body: Standard MCP JSON-RPC 2.0 request.
Example:
curl -X POST http://localhost:8090/mcp \
-H "Authorization: Bearer your-secret-token" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{}}}'
Response is passed through from the backend server. For servers using supergateway transport (dedicated port), the gateway returns 501 — clients connect to the server's SSE endpoint directly.
GET http://localhost:8080/metrics (Prometheus format). Includes:
ohmy_mcp_servers_total{status}ohmy_mcp_requests_total{method,route,status_code}ohmy_mcp_request_duration_seconds{method,route}process_* system metricsX-Request-ID and logs. Audit events logged with component=audit.GET /health for overall; per-server: GET /servers/:id/health (future).X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After headers.docker build -t oh-my-mcp .
docker run -d -p 8080:8080 -p 8090:8090 -v $(pwd)/config.yaml:/app/config.yaml oh-my-mcp
See docs/deployment/docker.md.
Manifests provided: docs/deployment/kubernetes.md.
Use ConfigMap for config, Secret for tokens, and HPA for scaling.
npm run dev # watch mode with tsx
npm run build # compile to dist
npm test # unit + integration
npm run lint # eslint
Project structure:
src/domain – Pure domain model (MCPServer, ServerTransport)src/application – ProcessManager, PortAllocator, EventBus, HealthCheckersrc/infrastructure – Config, HTTP, transports, metricssrc/middleware – Express middleware (timeout, rate-limit, audit, logging, etc.)src/index.ts – App bootstrap and wiringArchitecture overview: docs/architecture.md.
See docs/contributing.md. We welcome issues and PRs.
MIT – see LICENSE for details.
FAQs
Native MCP gateway with management layer — stdio and supergateway transports
The npm package @ev3lynx/oh-my-mcp receives a total of 10 weekly downloads. As such, @ev3lynx/oh-my-mcp popularity was classified as not popular.
We found that @ev3lynx/oh-my-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.