
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
@huggingface/mcp-client
Advanced tools
Client for the Model Context Protocol (MCP).
This package provides a client implementation for interacting with MCP servers, built on top of our InferenceClient, @huggingface/inference
.
It includes an example CLI smol Agent that can leverage MCP tools.
This package is part of the Hugging Face JS monorepo. To install dependencies for all packages, run from the root of the repository:
pnpm install
The package includes a command-line interface (CLI) agent that demonstrates how to use the MCP client.
export HF_TOKEN="hf_..."
Navigate to the package directory and run the agent script:
cd packages/mcp-client
pnpm agent
Alternatively, run from the root of the monorepo:
pnpm --filter @huggingface/mcp-client agent
The agent will load available MCP tools (by default, connecting to a filesystem server for your Desktop and a Playwright server) and prompt you for input (>
).
HF_TOKEN
(Optional): Your Hugging Face API token. Required if you use an Inference Provider on HF.MODEL_ID
(Optional): The model ID to use for the agent's inference. Defaults to Qwen/Qwen2.5-72B-Instruct
.PROVIDER
(Optional): The inference provider. Defaults to together
. See @huggingface/inference
for available providers.ENDPOINT_URL
or BASE_URL
(Optional): A custom base URL (local for instance) to call.Example with custom model:
export HF_TOKEN="hf_..."
export MODEL_ID="Qwen/Qwen2.5-72B-Instruct"
pnpm agent
Common development tasks can be run using pnpm scripts:
pnpm build
: Build the package.pnpm lint
: Lint and fix code style.pnpm format
: Format code using Prettier.pnpm test
: Run tests using Vitest.pnpm check
: Type-check the code using TypeScript.MIT
FAQs
Client for the Model Context Protocol
The npm package @huggingface/mcp-client receives a total of 220 weekly downloads. As such, @huggingface/mcp-client popularity was classified as not popular.
We found that @huggingface/mcp-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.