
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@growthbook/mcp
Advanced tools
With the GrowthBook MCP server, you can interact with GrowthBook right from your LLM client. See experiment details, add a feature flag, and more.
Environment Variables Use the following env variables to configure the MCP server.
| Variable Name | Status | Description |
|---|---|---|
| GB_API_KEY | Required | A GrowthBook API key or PAT. When using a PAT, MCP server capabilities are limited by its permissions. E.g., if the user can't create an experiment in the app, they also won't be able to create one with the MCP server. |
| GB_EMAIL | Required | Your email address used with GrowthBook. Used when creating feature flags and experiments. |
| GB_API_URL | Optional | Your GrowthBook API URL. Defaults to https://api.growthbook.io. |
| GB_APP_ORIGIN | Optional | Your GrowthBook app URL Defaults to https://app.growthbook.io. |
Add the MCP server to your AI tool of choice. See the official docs for complete a complete guide.
FAQs
Thin MCP server for GrowthBook — skill loader + authenticated API passthrough
The npm package @growthbook/mcp receives a total of 5,803 weekly downloads. As such, @growthbook/mcp popularity was classified as popular.
We found that @growthbook/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.