
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@mentu/metamcp
Advanced tools
A meta-MCP server that collapses N child MCP servers into 4 tools. Intent routing, lazy spawning, connection pooling, semantic search, and sandboxed code execution.
MetaMCP is a meta-MCP server that sits in front of N child MCP servers, collapsing hundreds of tools into 4 meta-tools (~1,000 schema tokens). Built to be composable, lazy, isolated, and fast.
┌─── playwright (52 tools)
│
LLM ──► MetaMCP ────────┼─── fetch (3 tools)
(4 tools) │
├─── sqlite (6 tools)
│
└─── ... N more servers
Your LLM sees 4 tools. MetaMCP handles discovery, routing, connection lifecycle, and sandboxed execution across all child servers.
Full documentation at metamcp.org.
npx @mentu/metamcp # run directly (no install)
npm install -g @mentu/metamcp # or install globally
Auto-configure your MCP client (Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, and more):
npx @mentu/metamcp init
Note: MetaMCP optionally uses
better-sqlite3for semantic search (vector embeddings). This requires a C++ compiler for native compilation. If compilation fails, MetaMCP still works fully with keyword-only search. On macOS, runxcode-select --installif you see build errors. On Linux, installbuild-essential.
1. Create a .mcp.json in your project root:
{
"mcpServers": {
"playwright": {
"command": "npx",
"args": ["-y", "@playwright/mcp@latest"]
},
"sqlite": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-sqlite", "/path/to/db"]
}
}
}
2. Run MetaMCP:
npx @mentu/metamcp --config .mcp.json
3. Connect your LLM. MetaMCP speaks MCP over stdio — point Claude Desktop, Claude Code, or any MCP client at it.
mcp_discover — Search & listSearch tool catalogs across all child servers. Without a query, returns server status and tool counts.
| Parameter | Type | Required | Description |
|---|---|---|---|
query | string | no | Search query for tools |
server | string | no | Filter to a specific server |
{ "query": "screenshot" }
mcp_provision — Intent-based routingDescribe what you need and MetaMCP resolves the right server. Searches local catalogs first, then the npm registry for installable MCP servers.
| Parameter | Type | Required | Description |
|---|---|---|---|
intent | string | yes | What capability you need |
context | string | no | Additional context for resolution |
autoProvision | boolean | no | Auto-provision if trusted (default: false) |
{ "intent": "I need to crawl a website and extract links" }
mcp_call — Forward to child serverForward a tool call to a specific child server. Retries once on crash for vital servers.
| Parameter | Type | Required | Description |
|---|---|---|---|
server | string | yes | Target server name |
tool | string | yes | Tool name to call |
args | object | no | Arguments to pass to the tool |
{ "server": "playwright", "tool": "browser_navigate", "args": { "url": "https://example.com" } }
mcp_execute — Sandboxed code executionExecute code in a V8 sandbox with access to all provisioned servers. Supports async/await, sleep(ms), and console.log. No access to process, require, fs, or the network.
| Parameter | Type | Required | Description |
|---|---|---|---|
code | string | yes | Code to execute |
{ "code": "const result = await servers.sqlite.call('query', { sql: 'SELECT count(*) FROM users' }); return result;" }
MetaMCP reads .mcp.json — the same format used by Claude Desktop and Claude Code.
npx package:
{
"mcpServers": {
"playwright": {
"command": "npx",
"args": ["-y", "@playwright/mcp@latest"]
}
}
}
Local binary:
{
"mcpServers": {
"my-server": {
"command": "/usr/local/bin/my-mcp-server",
"args": ["--port", "8080"]
}
}
}
With environment variables:
{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],
"env": {
"GITHUB_TOKEN": "ghp_..."
}
}
}
}
Remote server (SSE):
{
"mcpServers": {
"remote-tools": {
"url": "https://mcp.example.com/sse",
"transportType": "sse",
"headers": {
"Authorization": "Bearer your-token"
}
}
}
}
Remote server (Streamable HTTP) with OAuth:
{
"mcpServers": {
"cloud-server": {
"url": "https://mcp.example.com/api",
"oauth": true
}
}
}
MetaMCP supports three transport types: stdio (local process, default), http (Streamable HTTP), and sse (Server-Sent Events). Servers with a url field use HTTP by default. Set transportType to sse for SSE servers. OAuth triggers a browser-based authorization flow on first connect, with tokens persisted at ~/.metamcp/oauth/.
| Flag | Default | Description |
|---|---|---|
--config <path> | .mcp.json | Path to config file |
--max-connections <n> | 20 | Connection pool max size |
--idle-timeout <ms> | 300000 | Idle connection timeout (ms) |
--failure-threshold <n> | 5 | Circuit breaker consecutive failures |
--cooldown <ms> | 30000 | Circuit breaker cooldown (ms) |
--help | Show help | |
--version | Show version |
MetaMCP manages child server lifecycles with:
mcp_execute runs in a locked-down vm.Context with frozen prototypes, no eval, no require, no network accessSee CONTRIBUTING.md for development setup, commit conventions, and PR guidelines.
FAQs
A secure on-demand gateway for long-tail MCP servers with lazy calls and declarative Method Mode.
The npm package @mentu/metamcp receives a total of 93 weekly downloads. As such, @mentu/metamcp popularity was classified as not popular.
We found that @mentu/metamcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.