
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Unified Modyo MCP Server - Model Context Protocol server for Modyo platform
A Model Context Protocol (MCP) server for managing Modyo platform instances. Connect your AI assistants directly to Modyo's APIs for content management, site building, and platform administration.
Add to your claude_desktop_config.json:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.json{
"mcpServers": {
"modyo": {
"command": "npx",
"args": ["-y", "@modyo/mcp"],
"env": {
"MODYO_URL": "https://your-org.modyo.com",
"MODYO_TOKEN": "your-admin-token"
}
}
}
}
Restart Claude Desktop after saving.
claude mcp add modyo \
--scope project \
--env MODYO_URL=https://your-org.modyo.com \
--env MODYO_TOKEN=your-token \
-- npx -y @modyo/mcp
Use --scope user instead of --scope project to apply the configuration globally across all projects.
Verify the server was registered:
claude mcp list
Requires Copilot with Agent Mode enabled.
Per project (recommended — commit with your repo):
Create .vscode/mcp.json in your project root:
{
"servers": {
"modyo": {
"command": "npx",
"args": ["-y", "@modyo/mcp"],
"env": {
"MODYO_URL": "https://your-org.modyo.com",
"MODYO_TOKEN": "your-token"
}
}
}
}
A Start button will appear at the top of the file. Click it to start the server and let Copilot discover the available tools.
Global (applies to all projects):
Open Command Palette → Chat: Open User MCP Configuration and add the same configuration.
Note for organizations: If your account is Copilot Business or Enterprise, an administrator must enable the "MCP servers in Copilot" policy in your organization settings.
Option A — Interactive (recommended):
Inside a Copilot CLI session, run:
/mcp add
Follow the wizard: select Local or STDIO, enter npx -y @modyo/mcp as the command, and add the environment variables.
Option B — Edit config file directly:
Edit ~/.copilot/mcp-config.json:
{
"mcpServers": {
"modyo": {
"type": "local",
"command": "npx",
"args": ["-y", "@modyo/mcp"],
"env": {
"MODYO_URL": "https://your-org.modyo.com",
"MODYO_TOKEN": "your-token"
},
"tools": ["*"]
}
}
}
Verify the server is registered:
/mcp show
Note: Copilot CLI's auto-compaction can corrupt the message history during large tool call responses, producing a
CAPIError: 400error. See Troubleshooting for workarounds.
Edit ~/.gemini/settings.json for a global setup, or .gemini/settings.json in your project for a per-project setup:
{
"mcpServers": {
"modyo": {
"command": "npx",
"args": ["-y", "@modyo/mcp"],
"env": {
"MODYO_URL": "https://your-org.modyo.com",
"MODYO_TOKEN": "your-token"
}
}
}
}
Important: Gemini CLI automatically redacts environment variables matching sensitive patterns like
*TOKEN*. Always declareMODYO_TOKENexplicitly in theenvblock as shown above — do not rely on shell environment variables.
Verify inside Gemini CLI:
/mcp
Edit ~/.cursor/mcp.json:
{
"mcpServers": {
"modyo": {
"command": "npx",
"args": ["-y", "@modyo/mcp"],
"env": {
"MODYO_URL": "https://your-org.modyo.com",
"MODYO_TOKEN": "your-token"
}
}
}
}
Any client that supports the MCP stdio transport:
command: npx
args: ["-y", "@modyo/mcp"]
env:
MODYO_URL: https://your-org.modyo.com
MODYO_TOKEN: your-token
| Variable | Required | Description |
|---|---|---|
MODYO_URL | Yes | Platform URL (e.g., https://company.modyo.cloud) |
MODYO_TOKEN | Yes | API token — Modyo Admin → Settings → API Access |
MODYO_PLATFORM_NAME | No | Display name for the platform (default: "default") |
DEBUG | No | Enable debug logging |
Without MODYO_URL and MODYO_TOKEN, the server starts in public mode and only exposes tools that don't require authentication. Useful for exploring available capabilities.
| Module | Description |
|---|---|
| Content | Spaces, types, entries, assets, categories |
| Channels | Sites, pages, widgets, templates, navigation |
| Customers | Realms, users, forms, submissions |
| Core | Admin users, groups, roles |
"List all spaces in my platform"
"Create a content type called 'Products' with name and price fields"
"Show all widgets for site ID 5"
"Publish all pending changes for site 123"
"Create a new page at /about with the Base layout"
git clone https://github.com/modyo/modyo-mcp-server
cd modyo-mcp-server
npm install
npm run build
npm test
npm run lint:fix
See CLAUDE.MD for development guidelines and architecture details.
"Platform not configured" error:
# Verify environment variables are set
echo $MODYO_URL
echo $MODYO_TOKEN
# Test the API token directly
curl -H "Authorization: Bearer $MODYO_TOKEN" "$MODYO_URL/api/admin/account"
Build errors:
npm run clean && npm run build
Gemini CLI — authentication fails silently:
Gemini CLI filters environment variables matching *TOKEN* before passing them to MCP servers. Make sure MODYO_TOKEN is declared explicitly in the env block of your settings.json, not just exported in your shell.
GitHub Copilot CLI — CAPIError: 400 after tool calls:
Copilot CLI's auto-compaction can drop the tool_calls message while retaining the tool response, corrupting the conversation history. This is a known CLI bug, not a server issue.
Workarounds:
rm -rf ~/.copilot/session-state && copilot --allow-all-tools"list sites, return only id, name and host")Modyo Agreement © Modyo
FAQs
Unified Modyo MCP Server - Model Context Protocol server for Modyo platform
We found that @modyo/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.