
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@instanode/mcp
Advanced tools
MCP server for instanode.dev — lets AI coding agents provision ephemeral Postgres databases and webhook receivers over HTTPS, with optional bearer-token auth for paid users.
MCP server for instanode.dev. Lets AI coding agents (Claude Code, Cursor, Windsurf, Continue, etc.) provision ephemeral Postgres databases and webhook receivers over HTTPS — no Docker, no signup required for the free tier.
postgres:// URL, usable immediately as DATABASE_URL.INSTANODE_TOKEN.claude mcp add instanode -- npx -y @instanode/mcp@latest
To authenticate (unlock paid tier, list_resources, delete_resource):
claude mcp add instanode \
--env INSTANODE_TOKEN=<paste from https://instanode.dev/dashboard> \
-- npx -y @instanode/mcp@latest
Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"instanode": {
"command": "npx",
"args": ["-y", "@instanode/mcp@latest"],
"env": {
"INSTANODE_TOKEN": "<optional — paste from dashboard for paid tier>"
}
}
}
}
Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"instanode": {
"command": "npx",
"args": ["-y", "@instanode/mcp@latest"],
"env": {
"INSTANODE_TOKEN": "<optional>"
}
}
}
}
Add to your ~/.continue/config.yaml:
mcpServers:
- name: instanode
command: npx
args: ["-y", "@instanode/mcp@latest"]
env:
INSTANODE_TOKEN: "<optional>"
For a drop-in CLAUDE.md / .cursorrules that tells the agent exactly when
to reach for this MCP, see https://instanode.dev/agent.html.
| Variable | Required | Default | Purpose |
|---|---|---|---|
INSTANODE_TOKEN | No | — | Bearer JWT minted at https://instanode.dev/dashboard. Required for list_resources, claim_token, delete_resource, get_api_token. Unlocks paid-tier limits on create_*. |
INSTANODE_API_URL | No | https://api.instanode.dev | Override the API base URL. Only set this for local development. |
| Tool | Description |
|---|---|
create_postgres | Provision a Postgres database (pgvector included). Returns a postgres:// URL. name required. |
create_webhook | Provision an inbound webhook receiver URL. name required. |
list_resources | List resources on the caller's account. Requires INSTANODE_TOKEN. |
claim_token | Attach an anonymous token to the authenticated account. Requires INSTANODE_TOKEN. |
delete_resource | Hard-delete a resource you own. Paid tier only. Requires INSTANODE_TOKEN. |
get_api_token | Mint a fresh 30-day bearer JWT (for rotation). Requires an existing INSTANODE_TOKEN. |
You: Claude, I need a Postgres database for this project.
Claude: calls
create_postgres({ name: "my-side-project" })Returns a
connection_urllikepostgres://usr_a1b2:...@pg.instanode.dev:5432/db_a1b2?sslmode=require.Claude then: writes
DATABASE_URL=...to.env, adds.envto.gitignore, runs your migrations.
You: Give me a webhook URL I can point Stripe at.
Claude: calls
create_webhook({ name: "stripe-sandbox" })Returns a
receive_urlthat captures every request.curl $receive_urlpulls back the stored log.
You: I want to keep the database you made yesterday past 24h.
Claude: (with
INSTANODE_TOKENset) callsclaim_token({ token: "a1b2c3d4-..." })→ resource is now linked to your account withtier=paidand no expiry.
The free tier works without any setup. To unlock permanent resources, paid
limits, and the list_resources / delete_resource tools:
INSTANODE_TOKEN in the MCP server's env block (see examples
above).Rotate any time by calling get_api_token, which mints a fresh 30-day JWT.
npm install
npm run build
# Integration test (optional — requires a running instanode.dev server):
INSTANODE_API_URL=http://localhost:30080 npm test
MIT — (c) instanode.dev
FAQs
MCP server for instanode.dev — lets AI coding agents provision ephemeral Postgres databases and webhook receivers over HTTPS, with optional bearer-token auth for paid users.
We found that @instanode/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.