
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@mcp-web/bridge
Advanced tools
A bridge server that enables web frontend applications to be controlled by AI agents through the Model Context Protocol (MCP). The bridge mediates between web applications (via WebSocket) and AI agents (via HTTP/JSON-RPC).
A bridge server that enables web frontend applications to be controlled by AI agents through the Model Context Protocol (MCP). The bridge mediates between web applications (via WebSocket) and AI agents (via HTTP/JSON-RPC).
The bridge server:
import { MCPWebBridgeNode } from '@mcp-web/bridge';
const bridge = new MCPWebBridgeNode({
name: 'My App',
description: 'My awesome application',
port: 3001,
});
// Graceful shutdown
process.on('SIGINT', async () => {
await bridge.close();
process.exit(0);
});
import { MCPWebBridgeDeno } from '@mcp-web/bridge';
const bridge = new MCPWebBridgeDeno({
name: 'My App',
description: 'My awesome application',
port: 3001,
});
// Bridge is now listening on ws://localhost:3001 and http://localhost:3001
import { MCPWebBridgeBun } from '@mcp-web/bridge';
const bridge = new MCPWebBridgeBun({
name: 'My App',
description: 'My awesome application',
port: 3001,
});
// server.ts
import { createPartyKitBridge } from '@mcp-web/bridge';
export default createPartyKitBridge({
name: 'My App',
description: 'My awesome application on the edge',
});
The bridge supports multiple JavaScript runtimes through adapters. Each adapter wraps the runtime-agnostic core and provides I/O specific to that runtime.
Status: Production Ready ✅
The Node.js adapter uses http.createServer() with the ws library for WebSocket support.
import { MCPWebBridgeNode } from '@mcp-web/bridge';
const bridge = new MCPWebBridgeNode({
name: 'My App',
description: 'My application',
port: 3001, // Single port for HTTP + WebSocket
host: '0.0.0.0', // Optional: bind address
});
// Access the core for advanced usage
const handlers = bridge.getHandlers();
// Graceful shutdown
await bridge.close();
Features:
Status: Experimental 🧪
The Deno adapter uses Deno.serve() with native WebSocket upgrade support.
import { MCPWebBridgeDeno } from '@mcp-web/bridge';
const bridge = new MCPWebBridgeDeno({
name: 'My App',
description: 'My application',
port: 3001,
hostname: '0.0.0.0', // Optional
});
Deno Deploy:
// main.ts - Entry point for Deno Deploy
import { MCPWebBridgeDeno } from '@mcp-web/bridge';
new MCPWebBridgeDeno({
name: 'Production Bridge',
description: 'MCP Web bridge on Deno Deploy',
port: Number(Deno.env.get('PORT')) || 8000,
});
Features:
Limitations:
Status: Experimental 🧪
The Bun adapter uses Bun.serve() with native WebSocket support.
import { MCPWebBridgeBun } from '@mcp-web/bridge';
const bridge = new MCPWebBridgeBun({
name: 'My App',
description: 'My application',
port: 3001,
hostname: '0.0.0.0', // Optional
});
Features:
Status: Experimental 🧪
The PartyKit adapter enables deployment to Cloudflare's edge network with Durable Objects for state management.
// server.ts
import { createPartyKitBridge } from '@mcp-web/bridge';
export default createPartyKitBridge({
name: 'My App',
description: 'My application on the edge',
sessionCheckIntervalMs: 60000, // Optional: alarm interval
});
partykit.json:
{
"name": "my-mcp-bridge",
"main": "server.ts",
"compatibility_date": "2024-01-01"
}
Deploy:
npx partykit deploy
Features:
Key Differences:
AlarmScheduler instead of TimerSchedulerParty.storageYou can create custom adapters for other runtimes by using the core MCPWebBridge class directly:
import { MCPWebBridge, TimerScheduler } from '@mcp-web/bridge';
import type { BridgeHandlers, WebSocketConnection, HttpRequest, HttpResponse } from '@mcp-web/bridge';
// Create the core with a scheduler
const scheduler = new TimerScheduler();
const core = new MCPWebBridge(config, scheduler);
// Get handlers to wire up to your runtime
const handlers: BridgeHandlers = core.getHandlers();
// Implement these in your adapter:
// - handlers.onWebSocketConnect(sessionId, ws, url)
// - handlers.onWebSocketMessage(sessionId, ws, data)
// - handlers.onWebSocketClose(sessionId)
// - handlers.onHttpRequest(req) -> Promise<HttpResponse>
All adapters accept these common options from MCPWebConfig:
| Option | Type | Default | Description |
|---|---|---|---|
name | string | required | Server name displayed to clients |
description | string | required | Server description |
icon | string | undefined | Optional icon URL or data URI |
agentUrl | string | undefined | URL of the AI agent for query forwarding |
authToken | string | undefined | Auth token for agent communication |
maxSessionsPerToken | number | undefined | Max sessions per auth token |
onSessionLimitExceeded | 'reject' | 'close_oldest' | 'reject' | Behavior when limit exceeded |
maxInFlightQueriesPerToken | number | undefined | Max concurrent queries per token |
sessionMaxDurationMs | number | undefined | Max session duration (ms) |
Node.js / Deno / Bun:
| Option | Type | Default | Description |
|---|---|---|---|
port | number | 3001 | Port to listen on |
host / hostname | string | '0.0.0.0' | Hostname to bind to |
PartyKit:
| Option | Type | Default | Description |
|---|---|---|---|
sessionCheckIntervalMs | number | 60000 | Alarm interval for session checks |
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ AI Agent │────▶│ Bridge Server │◀────│ Web Frontend │
│ (HTTP/JSON-RPC)│ │ (Single Port) │ │ (WebSocket) │
└─────────────────┘ └─────────────────┘ └─────────────────┘
│
┌──────────┴──────────┐
│ MCPWebBridge │
│ (Runtime-Agnostic │
│ Core Logic) │
└─────────────────────┘
│
┌───────────────────┼───────────────────┐
│ │ │
┌──────┴──────┐ ┌──────┴──────┐ ┌──────┴──────┐
│ Node.js │ │ Deno │ │ PartyKit │
│ Adapter │ │ Adapter │ │ Adapter │
└─────────────┘ └─────────────┘ └─────────────┘
The bridge server acts as the central hub:
Build the package:
pnpm build
Run tests:
pnpm test
Once your bridge server is running:
FAQs
A bridge server that enables web frontend applications to be controlled by AI agents through the Model Context Protocol (MCP). The bridge mediates between web applications (via WebSocket) and AI agents (via HTTP/JSON-RPC).
The npm package @mcp-web/bridge receives a total of 3 weekly downloads. As such, @mcp-web/bridge popularity was classified as not popular.
We found that @mcp-web/bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.