
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@klarefi/mcp
Advanced tools
Stateless MCP server for Klarefi intake sessions, cited cases, workflows, and connectors.
Klarefi supports the stateless MCP 2026-07-28 protocol and legacy MCP
clients. The hosted server is the default. It wraps the
@klarefi/node SDK for
customer-plane API calls and the applicant-plane intake driver.
Applicant-plane tools work from a signed intake URL. They do not require a
Klarefi API key. Customer-plane tools require an API key in the MCP
Authorization header.
With cases:review, the server also exposes bounded operator-queue discovery,
cited case workspaces, signed case packages, intake-review commands, and
command polling. API-key tools cannot complete or reopen a case; every command
is attributed to the API key and runs through the Python-owned command queue.
Hosts supporting MCP Apps can render ui://klarefi/case-review, associated
with get_case_workspace. Workflow tools can list declarations and save
validated drafts, but cannot publish them.
Connect Klarefi MCP opens the client chooser. It uses Klarefi's published server manifest. The manifest does not contain a secret.
The MCP endpoint is:
https://www.klarefi.com/mcp
When the client asks for Authorization, enter Bearer sk_test_... or
Bearer sk_live_.... Omit the header when you only need applicant intake
tools.
Use the package only when a client cannot connect to a remote MCP URL:
{
"mcpServers": {
"klarefi": {
"command": "bunx",
"args": ["--bun", "@klarefi/mcp"],
"env": {
"KLAREFI_API_KEY": "sk_test_...",
"KLAREFI_API_BASE_URL": "https://www.klarefi.com"
}
}
}
}
Omit KLAREFI_API_KEY when you only need applicant intake tools.
KLAREFI_API_BASE_URL is optional and defaults to https://www.klarefi.com.
open_intake - read an intake from url or from session_id plus
access_token; returns the current intake state.get_intake_state - return the current intake state.answer_question - answer an active applicant question with free text.answer_fields - answer structured requested facts by fact_id; yes_no
values are "yes" or "no", and dates use YYYY-MM-DD.upload_document - upload by file_path or inline content_base64.
Inline uploads are limited to 5MB decoded; use file_path for documents up
to 25MB.submit_intake - submit the intake and return { submitted, blockers, state }.save_intake_draft - save draft form fields without submitting.wait_for_next_action - poll for the next applicant action. If timed_out
is true, call it again.The hosted server is stateless. Include url, or session_id with
access_token, in each applicant tool call. A local stdio client can call
open_intake once and omit the credentials from later calls on that
connection.
| Tool | Required scope | Boundary |
|---|---|---|
create_intake_session | intake:sessions:create | Creates a hosted intake session. |
get_case | cases:read | Read-only case projection. |
list_operator_queue | cases:review | Read-only bounded queue for the key environment. |
get_case_workspace | cases:read | Read-only cited operator workspace. |
get_case_package | cases:read | Read-only package and signed case-file link. |
submit_case_review | cases:review | Submits an auditable review command; cannot complete or reopen a case. |
get_review_command | cases:read | Read-only command polling. |
list_workflows | workflows:read | Read-only versioned workflow declarations. |
save_workflow_draft | workflows:write | Validates and saves a draft; cannot publish or activate it. |
create_connector_from_openapi | connectors:write | Imports and activates a connector from public OpenAPI JSON. |
create_connector | connectors:write | Creates or updates an active connector. |
delete_connector | connectors:write | Deletes a connector. |
FAQs
Stateless MCP server for Klarefi intake sessions, cited cases, workflows, and connectors.
We found that @klarefi/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.