
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@mcp-web/client
Advanced tools
An MCP (Model Context Protocol) client that connects AI applications like Claude Desktop to the MCP bridge server, enabling AI-powered control of web applications.
An MCP (Model Context Protocol) client that connects AI applications like Claude Desktop to the MCP bridge server, enabling AI-powered control of web applications.
This package provides the MCP client that acts as a bridge between AI applications (like Claude Desktop) and web applications. It should be installed and configured in your AI application to connect to the MCP bridge server that communicates with your web application.
The MCP client is typically installed via npm when configuring your AI application:
npx @mcp-web/client
The MCP client is configured through Claude Desktop's configuration file. However, you should not manually configure this. Instead, the configuration is automatically generated by your web application using the @mcp-web/core library.
When you integrate @mcp-web/core into your web application, it automatically generates the correct MCP configuration. Your web application should expose this configuration to users (typically through a help dialog or setup page).
Here's how a web application typically exposes the configuration:
// In your web application
import { MCPWeb } from '@mcp-web/core';
const mcp = new MCPWeb({
name: 'My Web App',
description: 'Control my web application',
});
// Get the MCP configuration for Claude Desktop
const mcpConfig = mcp.mcpConfig;
// Display this to users so they can copy it to Claude Desktop
console.log(JSON.stringify(mcpConfig, null, 2));
The generated configuration will look like this:
{
"My Web App": {
"command": "npx",
"args": ["@mcp-web/client"],
"env": {
"MCP_SERVER_URL": "http://localhost:3002",
"AUTH_TOKEN": "your-unique-auth-token"
}
}
}
This configuration should be added to your Claude Desktop config file at:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%/Claude/claude_desktop_config.jsonUnder the mcpServers section:
{
"mcpServers": {
"My Web App": {
"command": "npx",
"args": ["@mcp-web/client"],
"env": {
"MCP_SERVER_URL": "http://localhost:3002",
"AUTH_TOKEN": "your-unique-auth-token"
}
}
}
}
The MCP client uses these environment variables (automatically set by the configuration):
MCP_SERVER_URL: URL of the bridge server (typically http://localhost:3002)AUTH_TOKEN: Authentication token for secure communication (automatically generated by your web app)@mcp-web/core to register tools and connect to the bridge serverClaude Desktop ↔ MCP Client ↔ Bridge Server ↔ Web Application
Install the web library in your web application:
npm install @mcp-web/core
Integrate MCP tools in your web application using @mcp-web/core
Get the configuration from your web app (usually shown in a help dialog)
Copy the configuration to Claude Desktop's config file
Restart Claude Desktop to load the new MCP server
Start using your web application through Claude Desktop!
mcp.addTool()The MCP client uses secure authentication tokens that are:
This package is part of the MCP Frontend Integration System. For development:
npm run build # Build the client
npm run dev # Watch mode for development
See the HiGlass demo for a complete example of:
@mcp-web/core in a React applicationFAQs
An MCP (Model Context Protocol) client that connects AI applications like Claude Desktop to the MCP bridge server, enabling AI-powered control of web applications.
The npm package @mcp-web/client receives a total of 4 weekly downloads. As such, @mcp-web/client popularity was classified as not popular.
We found that @mcp-web/client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.