
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
@mtop-devtools/cloud-server
Advanced tools
Cloud WebSocket server for Mtop DevTools — bridges cloud agents to local connectors
云端 WebSocket Server,用于中转云端 Agent 请求到本地连接器。
npm install -g @mtop-devtools/cloud-server
# 或
pnpm add -g @mtop-devtools/cloud-server
mtop-devtools-cloud-server [options]
选项:
--port <port> - 服务器端口(默认 8080)--path <path> - WebSocket 路径(默认 /ws)--token <token> - 鉴权密钥(未指定时自动生成)--heartbeat <seconds> - 心跳超时时间(默认 90 秒)--max-connections <n> - 最大连接数(默认 100)示例:
# 默认配置启动(自动生成 token)
mtop-devtools-cloud-server
# 自定义端口和鉴权
mtop-devtools-cloud-server --port 9000 --token your-secret-token
# 限制连接数和心跳超时
mtop-devtools-cloud-server --max-connections 50 --heartbeat 120
启动后会在控制台输出 WebSocket URL,例如:
[CloudServer] Public URL (for cloud client): ws://10.0.1.100:8080/ws?token=xxx
[CloudServer] Local URL (for connector): ws://localhost:8080/ws?token=xxx
[CloudServer] Config written to: ~/.mtop-devtools/cloud-server.json
环境变量:
MTOP_DEVTOOLS_TOKEN - 鉴权密钥(覆盖 --token 选项)CLOUD_SERVER_HOST - 公网主机名(默认自动获取)import { CloudServer } from '@mtop-devtools/cloud-server';
const server = new CloudServer({
port: 8080,
path: '/ws',
token: 'your-secret-token',
heartbeatTimeout: 90,
maxConnections: 100,
maxMessageSize: 10 * 1024 * 1024,
});
await server.start();
// 获取统计信息
const stats = server.getStats();
console.log(stats);
// { connections: 2, agents: 1, connectors: 1, pendingRequests: 0 }
// 优雅关闭
await server.stop();
云端 Agent
↓
@mtop-devtools/cloud-client
↓ (WebSocket)
@mtop-devtools/cloud-server (本进程)
↓ (WebSocket)
@mtop-devtools/cloud-connector (本地)
↓ (Unix Socket)
@mtop-devtools/native-host
↓
Chrome Extension / CDP
Server 接受两种类型的连接:
Server 会自动识别连接类型,并将 Agent 的请求转发到可用的 Connector。
{
"id": "unique-id",
"action": "get_requests",
"data": { "count": 5 },
"version": "1.30.0"
}
{
"id": "unique-id",
"success": true,
"data": { ... },
"versionWarning": "..."
}
{ "type": "ping", "timestamp": 1234567890 }
{ "type": "pong", "timestamp": 1234567890 }
设置 token 后,所有连接必须携带正确的 token:
# Agent 连接
ws://server.com/ws?token=your-secret-token
# Connector 连接
ws://server.com/ws?token=your-secret-token
[Unit]
Description=Mtop DevTools Cloud Server
After=network.target
[Service]
Type=simple
User=your-user
ExecStart=/usr/bin/mtop-devtools-cloud-server --port 8080 --token your-token
Restart=always
RestartSec=5
[Install]
WantedBy=multi-user.target
FROM node:20-alpine
RUN npm install -g @mtop-devtools/cloud-server
EXPOSE 8080
CMD ["mtop-devtools-cloud-server", "--token", "your-token"]
pm2 start mtop-devtools-cloud-server --name mtop-cloud-server -- --port 8080 --token your-token
maxConnections 限制资源占用token 鉴权保护服务安全FAQs
Cloud WebSocket server for Mtop DevTools — bridges cloud agents to local connectors
The npm package @mtop-devtools/cloud-server receives a total of 38 weekly downloads. As such, @mtop-devtools/cloud-server popularity was classified as not popular.
We found that @mtop-devtools/cloud-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.