
Security News
Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.
@mpakmcp/cli
Advanced tools
CLI for publishing MCPB bundles to the mpak package directory.
npm install -g @mpak/cli
mpak --help
mpak --version
Authenticate with the mpak registry using OAuth:
mpak auth login
Options:
-p, --port <port> - Port for local OAuth callback server (default: 41248)-t, --timeout <ms> - OAuth timeout in milliseconds (default: 300000)-f, --force - Force re-authentication even if already logged in-v, --verbose - Enable verbose loggingThe authentication flow will:
~/.mpak/config.jsonnpm install
npm run dev - Run CLI in development mode with tsxnpm run build - Build TypeScript to JavaScriptnpm test - Run unit testsnpm run test:ui - Run tests with UInpm run test:coverage - Run tests with coverage reportnpm run typecheck - Type check without buildingnpm run lint - Lint source codenpm run lint:fix - Fix linting errorsPre-release versions (alpha, beta, rc) must be published with a distribution tag:
npm publish --tag beta
Stable releases use the default latest tag:
npm publish
# Run tests
npm test
# Run tests in watch mode
npm test -- --watch
# Run tests with coverage
npm run test:coverage
src/
├── index.ts # CLI entry point
├── program.ts # Commander program configuration
├── commands/
│ └── auth/
│ └── login.ts # OAuth login flow
├── lib/
│ └── auth/
│ ├── clerk-oauth-client.ts # Clerk OAuth 2.0 + PKCE
│ ├── local-server.ts # Local OAuth callback server
│ └── token-manager.ts # Auth session management
├── utils/
│ ├── config-manager.ts # Config file management
│ ├── config.ts # Config singleton
│ ├── errors.ts # Error handling utilities
│ └── version.ts # Version helper
└── types/
└── auth.ts # Authentication type definitions
Configuration is stored in ~/.mpak/config.json with the following structure:
{
"version": "1.0.0",
"lastUpdated": "2025-10-19T...",
"registryUrl": "http://localhost:3000",
"auth": {
"bearerToken": "...",
"expiresAt": 1234567890,
"user": {
"id": "user_...",
"email": "user@example.com",
"firstName": "John",
"lastName": "Doe"
}
}
}
CLERK_OAUTH_CLIENT_ID - Clerk OAuth client ID (default: 96WRYcxabFktp9wn)CLERK_OAUTH_DOMAIN - Clerk OAuth domain (default: clerk.nimblebrain.ai)MPAK_DEFAULT_PORT - Default OAuth callback port (default: 41248)MPAK_OAUTH_TIMEOUT - OAuth timeout in ms (default: 300000)mpak login or mpak auth login - Authenticate with OAuth
--port, --timeout, --force, --verbosempak whoami - Display current authenticated user
✅ mpak publish <file> - Publish an MCPB bundle
--dry-run✅ mpak list or mpak packages - List your published packages
--json, --limit, --offset, --sort✅ mpak search <query> - Search public packages
--type, --sort, --limit, --offset, --json✅ mpak show <package> or mpak info <package> - Show package details
--json✅ mpak pull <package> or mpak install <package> - Download a package
--output <path>, --jsonmpak pull @scope/packagempak pull @scope/package@1.0.0scope-package-version.mcpb--output to specify custom file pathmpak logout - Clear authenticationFAQs
CLI for publishing MCPB bundles to the mpak package directory
The npm package @mpakmcp/cli receives a total of 0 weekly downloads. As such, @mpakmcp/cli popularity was classified as not popular.
We found that @mpakmcp/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.