
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@mcpspend/proxy
Advanced tools
Transparent proxy CLI for MCP servers — tracks tool calls, latency, and cost via MCPSpend.
Transparent observability proxy for MCP (Model Context Protocol) servers.
Wraps any stdio MCP server, intercepts JSON-RPC tools/call traffic, and reports each call (tool, latency, success, approximate token sizes) to MCPSpend for cost attribution and analytics.
Fire-and-forget: the proxy never blocks the MCP wire — if the MCPSpend API is unreachable, your agent keeps working.
npm install -g @mcpspend/proxy
mcpspend config set apiKey mcps_live_xxx
mcpspend wrap -- npx @modelcontextprotocol/server-filesystem /path
Wherever you have an MCP server configured, prepend mcpspend wrap -- to the command:
Before:
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["@modelcontextprotocol/server-filesystem", "/Users/me"]
}
}
}
After:
{
"mcpServers": {
"filesystem": {
"command": "mcpspend",
"args": ["wrap", "--key", "mcps_live_xxx", "--", "npx", "@modelcontextprotocol/server-filesystem", "/Users/me"]
}
}
}
CLI flags, environment variables, and ~/.mcpspend/config.json are merged in that order (CLI wins).
| Setting | Flag | Env var | Config key |
|---|---|---|---|
| API key | --key | MCPSPEND_API_KEY | apiKey |
| API endpoint | --endpoint | MCPSPEND_ENDPOINT | endpoint |
| Project ID | --project | MCPSPEND_PROJECT_ID | projectId |
| Agent name | --agent | MCPSPEND_AGENT_NAME | agentName |
| Disable tracking | --disable | MCPSPEND_DISABLED=1 | disabled: true |
The proxy reports:
read_file)filesystem)It does not send the actual tool arguments or response bodies to MCPSpend.
support@mcpspend.com · mcpspend.com
© NewRzs SRL · CUI RO48756557
FAQs
Transparent proxy CLI for MCP servers — tracks tool calls, latency, and cost via MCPSpend.
The npm package @mcpspend/proxy receives a total of 48 weekly downloads. As such, @mcpspend/proxy popularity was classified as not popular.
We found that @mcpspend/proxy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.