
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@kasyml/rivalize-mcp
Advanced tools
Rivalize MCP server — competitive intelligence as agent-callable tools. Tear down any competitor's full strategy (positioning, pricing, ads, social, reviews, hiring, momentum) right in Claude, Claude Code, Cursor, or Codex.
Tear down any competitor's full strategy — right inside Claude, Claude Code, Cursor, or Codex. One prompt → their positioning, pricing, ads, social, reviews, hiring, momentum, and where they're weak. Source-backed and dated, not guessed — questions a general model literally can't answer because it has no live data.
Ad-teardown tools stop at the ads. Rivalize tears down the whole playbook — positioning, pricing, ads, social, reviews, hiring, momentum — and tells you who's even in the space.
Competitive intelligence as agent-callable tools. Your Claude, Cursor, or any
MCP client pulls structured, cited, dated facts about any company in the
Rivalize universe, plus your own projects and reports. Read-only by default;
set RIVALIZE_MCP_ALLOW_WRITES=1 to also let your assistant add competitors.
Included with every paid Rivalize plan (Starter and up). A free account can still create an API key for rate-limited reads (100 requests/hour), so you can try it before you upgrade; plan-gated tools return an explicit upgrade message. Higher plans raise the limits and unlock cited battlecards, deeper timeline and landscape history, webhooks, API report triggers and deeper watches. Plans: rivalize.ai/pricing.
| Tool | Type | What it does |
|---|---|---|
list_universe_companies | read | Search the cross-customer universe by keyword, category slug, or populated intelligence layer. Compact rows; limit/offset, continue with pagination.next_offset |
get_universe_company | read | Profile for one domain — identity, pricing, features, ads, social, reviews, funding/hiring, rankings, signals, momentum. layers returns only the named layers; long arrays are capped with counts |
teardown_competitor | read | One-call strategy teardown — positioning, pricing, ads (the creatives), social, reviews, hiring, momentum + weaknesses to attack, as ready-to-read Markdown |
list_projects | read | What products/projects you have — the ids the project-scoped tools take |
list_reports | read | Your reports, newest first (reading is free; never generates one) |
get_report | read | One report as Markdown — TL;DR, biggest threat, blind spots, per-competitor sections, cited battlecards. section returns one named section (see below); competitor returns one competitor's sections; page reads a long report page by page |
list_competitors | read | Which competitors you are tracking (tenant-isolated). limit/offset, continue with pagination.next_offset |
get_competitor_intelligence | read | Latest stored intelligence for one tracked competitor; each field is present only when measured |
get_battlecard | read | Cited sales battlecard for one tracked competitor (Pro); may come from the competitor's latest report (source: "report", report_id) |
get_strategic_timeline | read | Five-lane temporal arc with move clusters, tracking-since dates, and evidence URLs; lanes to keep only pricing, product, people, funding or content-social; page for long timelines |
get_competitive_landscape | read | Current or stored weekly activity × importance positions with an honest history start; page for long views |
get_freshness | read | How current a project's data is: its latest report, and per tracked competitor the date it was last actually observed and how (report_run, site_crawl, monitoring_page_capture). A competitor never observed says so, with no date |
get_evidence | read | The sources behind the facts for your product (no competitor_id) or one competitor: each source's URL, what it supports, and when the report run read it. Withheld claims stay withheld; corrected figures show the correction |
add_competitor | write, opt-in | Add competitor URLs to a project — consumes credits and triggers analysis (a competitor Rivalize has never seen also queues a free Scout crawl). Registered only with RIVALIZE_MCP_ALLOW_WRITES=1 |
get_report shows any claim the report's fabrication check flagged as
[removed — unverified], exactly as the report itself does.
A whole report is several thousand to over a hundred thousand characters; one
section is a fraction of that. Ask get_report for the section a question needs:
| Section | Holds |
|---|---|
tldr, biggest-threat, blind-spots, actions | the report's headline sections (actions: what your product should do) |
battlecards | the cited sales battlecards |
competitors | every competitor's section, in full |
pricing, momentum, app-store, strengths, weaknesses, key-findings, creators, ads, tech-stack | one topic gathered from every competitor's section, under each competitor's name |
A report has only the sections it has data for. A name that is not one of the
report's sections is an error listing the ones it has. section combines with
competitor ("pricing" + "Notion" is Notion's pricing). Without section,
get_report returns the whole report exactly as before.
Every tool response stays under 25,000 characters, and nothing is cut silently:
get_report, get_strategic_timeline, get_competitive_landscape):
a document over the limit is split into pages at section boundaries. Each page
starts with Page N of M, how many characters remain, the exact call for the
next page ({"page": N+1}), and the sections on later pages. A document that
fits is returned unchanged.list_universe_companies, list_competitors, list_reports):
pagination carries returned and next_offset; if a page does not fit, fewer
rows come back, pagination.limit says how many, and next_offset resumes at
the first row not shown.get_universe_company, JSON timeline/landscape): long arrays are
capped and listed in _capped (kept/total); a field that still does not fit is
left out and listed in _omitted with the call that fetches it. The JSON is
always valid.Requires Node.js 22 or newer (node --version).
rk_live_...)~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or
%APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"rivalize": {
"command": "npx",
"args": ["-y", "@kasyml/rivalize-mcp"],
"env": { "RIVALIZE_API_KEY": "rk_live_..." }
}
}
}
claude mcp add rivalize -e RIVALIZE_API_KEY=rk_live_... -- npx -y @kasyml/rivalize-mcp
.cursor/mcp.json in your project (or ~/.cursor/mcp.json globally):
{
"mcpServers": {
"rivalize": {
"command": "npx",
"args": ["-y", "@kasyml/rivalize-mcp"],
"env": { "RIVALIZE_API_KEY": "rk_live_..." }
}
}
}
npxSome clients on Windows cannot launch npx directly (it is npx.cmd there).
Run it through cmd instead:
{
"mcpServers": {
"rivalize": {
"command": "cmd",
"args": ["/c", "npx", "-y", "@kasyml/rivalize-mcp"],
"env": { "RIVALIZE_API_KEY": "rk_live_..." }
}
}
}
| Env var | Required | Default | Purpose |
|---|---|---|---|
RIVALIZE_API_KEY | yes | — | Your rk_live_* key (any plan, incl. free) |
RIVALIZE_API_URL | no | https://rivalize.ai | API base origin. A key only works on the server that issued it: a key created on a staging or self-hosted Rivalize needs this set to that server's origin, or every call returns 401 |
RIVALIZE_MCP_ALLOW_WRITES | no | off | 1 / true / yes registers add_competitor, which spends credits and queues analysis |
HTTPS_PROXY / HTTP_PROXY (and NO_PROXY) | no | — | Behind a corporate proxy: requests are routed through it (via undici's EnvHttpProxyAgent). Network errors name the server, the proxy host and the cause code (e.g. ECONNREFUSED, ENOTFOUND) |
| Plan | Requests/hour | add_competitor/day | Webhooks | API report triggers |
|---|---|---|---|---|
| Free | 100 | 10 | — | — |
| Starter | 300 | uncapped | yes | yes |
| Growth | 1,000 | uncapped | yes | yes |
| Pro | 5,000 | uncapped | yes | yes |
| Agency | 10,000 | uncapped | yes | yes |
Limits above mirror the enforcing server-side source of truth
(packages/shared/src/api-tier.ts). Cited battlecards (get_battlecard) unlock
on Pro and up.
Rate-limit headers (X-RateLimit-Limit, X-RateLimit-Remaining,
X-RateLimit-Reset) are returned on every response; 429 responses include
Retry-After. Requests without a valid key are limited too: 200 a minute per
client.
Reports are private until their owner shares them. get_report reads your own
reports with your API key. A shared report is also readable without a key at
GET https://rivalize.ai/api/shared-reports/{share-token}/ai (JSON; add
?format=md for Markdown) until the owner revokes the link; the id-keyed
/api/reports/{id}/ai answers only the owner.
"Tear down cursor.com" →
teardown_competitor(their positioning, pricing, ads, social, reviews, hiring and momentum, dated — one prompt)"Who are all the players in the AI dev-tools space?" →
list_universe_companies"What does linear.app charge now?" →
get_universe_company"What strategic moves have competitors made this quarter?" →
get_strategic_timeline"Who is the biggest moving threat this month?" →
get_competitive_landscape"Summarise my latest report" →
list_reports→get_report"What did my report say about Watershed?" →
get_reportwithcompetitor: "Watershed""What do my competitors charge?" →
get_reportwithsection: "pricing""How fresh is this?" →
get_freshness"Where does that claim about Notion come from?" →
get_evidencewith itscompetitor_id"Who is my top competitor?" →
list_competitors(highestthreat_level, thenmomentum_score)"Add a competitor to my project" →
add_competitor, with writes enabled (the watch starts — Rivalize enriches it across 8 intelligence layers)
bun install
bun run typecheck
bun run test
bun run build # emits dist/ for the rivalize-mcp bin
FAQs
Rivalize MCP server — competitive intelligence as agent-callable tools. Tear down any competitor's full strategy (positioning, pricing, ads, social, reviews, hiring, momentum) right in Claude, Claude Code, Cursor, or Codex.
The npm package @kasyml/rivalize-mcp receives a total of 0 weekly downloads. As such, @kasyml/rivalize-mcp popularity was classified as not popular.
We found that @kasyml/rivalize-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.