
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@mcp-web/mcpb
Advanced tools
Generate pre-configured MCPB bundles for one-click installation in Claude Desktop.
Generate pre-configured MCPB bundles for one-click installation in Claude Desktop.
@mcp-web/mcpb enables websites running MCP-Web to generate .mcpb files (MCP Bundle format) that users can install in Claude Desktop with a single click. The auth token and bridge connection URL are pre-baked into the bundle, eliminating any manual configuration.
npm install @mcp-web/mcpb
# or
pnpm add @mcp-web/mcpb
# or
yarn add @mcp-web/mcpb
import { MCPWeb } from '@mcp-web/core';
import { getMcpBundle } from '@mcp-web/mcpb';
// Create your MCP-Web instance
const mcp = new MCPWeb({
name: 'My Todo App',
description: 'AI-controllable todo application',
autoConnect: true,
});
// Register your tools
mcp.addTool({
name: 'create_todo',
description: 'Create a new todo',
handler: (input) => {
// Your logic here
},
});
// Generate MCPB bundle
async function handleInstallClick() {
const bundle = await getMcpBundle(mcp, {
displayName: 'My Todo App - Claude Extension',
version: '1.0.0',
author: {
name: 'Your Name',
url: 'https://yourwebsite.com'
}
});
// Trigger browser download
bundle.download();
}
const bundle = await getMcpBundle(mcp, {
displayName: 'My App',
version: '1.0.0',
icon: 'https://yourwebsite.com/icon.png', // URL to icon
// or
icon: iconBlob, // Blob object
});
If you want to host the client bundle yourself:
const bundle = await getMcpBundle(mcp, {
clientBundleUrl: 'https://yourcdn.com/mcp-web-client.js',
});
getMcpBundle(mcpWeb, options?)Generates a pre-configured MCPB bundle.
Parameters:
mcpWeb (MCPWeb): The MCPWeb instance to create a bundle foroptions (McpBundleOptions, optional):
displayName (string): Display name in Claude Desktop (defaults to mcpWeb config name)version (string): Semantic version (defaults to "1.0.0")description (string): Bundle description (defaults to mcpWeb config description)author (object): Author info with name, email, and url fieldsicon (string | Blob): Icon as URL or Blob (PNG recommended)clientBundleUrl (string): Custom URL for client bundleReturns: Promise<McpBundleResult>
blob (Blob): The .mcpb file as a Blobfilename (string): Suggested filename (e.g., "my-app.mcpb")download() (function): Helper to trigger browser downloadGenerate Manifest: Creates a manifest.json with pre-baked environment variables:
MCP_SERVER_URL: Bridge connection URLAUTH_TOKEN: Unique authentication tokenFetch Client Bundle: Downloads the standalone @mcp-web/client from CDN (unpkg with jsdelivr fallback)
Create Archive: Packages everything into a .mcpb zip file:
my-app.mcpb
├── manifest.json
├── server/
│ └── index.js (standalone client)
└── icon.png (optional)
Download: User downloads the .mcpb file and double-clicks to install in Claude Desktop
From the user's perspective:
.mcpb fileThe auth token is:
fetch and Blob supportclientBundleUrl)MIT
FAQs
Generate pre-configured MCPB bundles for one-click installation in Claude Desktop.
The npm package @mcp-web/mcpb receives a total of 12 weekly downloads. As such, @mcp-web/mcpb popularity was classified as not popular.
We found that @mcp-web/mcpb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.