
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@klarefi/mcp
Advanced tools
MCP server for Klarefi connector installation, intake sessions, and case retrieval.
MCP stdio server for agent access to Klarefi. It wraps the
@klarefi/node SDK for customer-plane API calls and the
applicant-plane intake driver.
Applicant-plane tools work from a signed intake URL or from
session_id/access_token; they do not require KLAREFI_API_KEY.
Customer-plane tools require KLAREFI_API_KEY.
{
"mcpServers": {
"klarefi": {
"command": "npx",
"args": ["-y", "@klarefi/mcp"],
"env": {
"KLAREFI_API_KEY": "sk_test_...",
"KLAREFI_API_BASE_URL": "https://api.klarefi.com"
}
}
}
}
Omit KLAREFI_API_KEY when you only need applicant-plane intake tools.
KLAREFI_API_BASE_URL is optional and defaults to https://api.klarefi.com.
open_intake - open an intake from url or from session_id plus
access_token; returns the current intake state.get_intake_state - return the selected or most recently opened intake
state.answer_question - answer an active applicant question with free text.answer_fields - answer structured requested facts by fact_id; yes_no
values are "yes" or "no", and dates use YYYY-MM-DD.upload_document - upload by file_path or inline content_base64.
Inline uploads are limited to 5MB decoded; use file_path for documents up
to 25MB.submit_intake - submit the intake and return { submitted, blockers, state }.save_intake_draft - save draft form fields without submitting.wait_for_next_action - poll for the next applicant action. If timed_out
is true, call it again.create_connector_from_openapi - import a public OpenAPI JSON URL as a
verification connector.create_connectordelete_connectorcreate_intake_sessionget_caseFAQs
Stateless MCP server for Klarefi intake sessions, cited cases, workflows, and connectors.
The npm package @klarefi/mcp receives a total of 25 weekly downloads. As such, @klarefi/mcp popularity was classified as not popular.
We found that @klarefi/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.