
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@huggingface/mcp-client
Advanced tools
Client for the Model Context Protocol (MCP).
This package provides a client implementation for interacting with MCP servers, built on top of our InferenceClient, @huggingface/inference.
It includes an example CLI smol Agent that can leverage MCP tools.
This package is part of the Hugging Face JS monorepo. To install dependencies for all packages, run from the root of the repository:
pnpm install
The package includes a command-line interface (CLI) agent that demonstrates how to use the MCP client.
export HF_TOKEN="hf_..."
Navigate to the package directory and run the agent script:
cd packages/mcp-client
pnpm agent
Alternatively, run from the root of the monorepo:
pnpm --filter @huggingface/mcp-client agent
The agent will load available MCP tools (by default, connecting to a filesystem server for your Desktop and a Playwright server) and prompt you for input (>).
HF_TOKEN (Optional): Your Hugging Face API token. Required if you use an Inference Provider on HF.MODEL_ID (Optional): The model ID to use for the agent's inference. Defaults to Qwen/Qwen2.5-72B-Instruct.PROVIDER (Optional): The inference provider. Defaults to together. See @huggingface/inference for available providers.ENDPOINT_URL or BASE_URL (Optional): A custom base URL (local for instance) to call.Example with custom model:
export HF_TOKEN="hf_..."
export MODEL_ID="Qwen/Qwen2.5-72B-Instruct"
pnpm agent
Common development tasks can be run using pnpm scripts:
pnpm build: Build the package.pnpm lint: Lint and fix code style.pnpm format: Format code using Prettier.pnpm test: Run tests using Vitest.pnpm check: Type-check the code using TypeScript.MIT
FAQs
Client for the Model Context Protocol
The npm package @huggingface/mcp-client receives a total of 205 weekly downloads. As such, @huggingface/mcp-client popularity was classified as not popular.
We found that @huggingface/mcp-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.