
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@gessa/mcp-server
Advanced tools
Gessa MCP stdio proxy for Claude Code, Cursor, Continue, and local subprocess clients.
mcp-name: ai.gessa/mcp-server
Thin stdio proxy for Gessa MCP.
{
"mcpServers": {
"gessa": {
"command": "npx",
"args": ["-y", "@gessa/mcp-server"],
"env": {
"GESSA_API_KEY": "mcpkey_xxx",
"GESSA_API_URL": "https://api.gessa.ai"
}
}
}
}
The package does not run engine logic locally. It starts an SDK stdio MCP server, mirrors the remote Gessa tool/resource/prompt surface through the SDK Streamable HTTP client, and authenticates to /mcp/rpc with GESSA_API_KEY.
Initial npm release: 0.1.0.
Publish by tagging the repo with the package version:
git tag mcp-server-v0.1.0
git push origin mcp-server-v0.1.0
The publish workflow verifies the tag matches packages/mcp-server/package.json, builds the workspace, runs an npm pack dry-run, and publishes @gessa/mcp-server with npm provenance.
Keep the package version synchronized with the engine MCP API it proxies. Any change that alters /mcp/rpc authentication semantics, tool/resource/prompt names, required input schemas, or response shapes must update this package and the engine MCP docs in the same PR.
Use patch bumps for proxy-only fixes that do not change the remote MCP contract. Use minor bumps for additive MCP surface changes or authentication/client behavior changes. Reserve major bumps for breaking changes to the remote MCP contract.
FAQs
Gessa MCP stdio proxy for Claude Code, Cursor, Continue, and local subprocess clients.
The npm package @gessa/mcp-server receives a total of 21 weekly downloads. As such, @gessa/mcp-server popularity was classified as not popular.
We found that @gessa/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.