
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
@nimbletools/mcp-http-bridge
Advanced tools
Bridge the Model Context Protocol (MCP) stdio interface to HTTP-based MCP services. This allows MCP clients like Claude Code to seamlessly connect to remote MCP servers running over HTTP.
For more information about MCP and related tools, visit www.nimbletools.ai.
npm install -g @nimbletools/mcp-http-bridge
Or use directly with npx:
npx @nimbletools/mcp-http-bridge --endpoint "https://..." --token "..."
To update to the latest version:
npm install -g @nimbletools/mcp-http-bridge@latest
mcp-http-bridge \
--endpoint "https://api.example.com/mcp" \
--token "your-bearer-token" \
--timeout 15000 \
--retries 2
Add to your Claude Code configuration:
{
"mcpServers": {
"my-remote-server": {
"command": "npx",
"args": [
"@nimbletools/mcp-http-bridge",
"--endpoint",
"https://api.example.com/mcp",
"--token",
"your-bearer-token"
]
}
}
}
For better security, use environment variables:
{
"mcpServers": {
"my-remote-server": {
"command": "mcp-http-bridge",
"args": ["--endpoint", "https://api.example.com/mcp"],
"env": {
"MCP_BEARER_TOKEN": "your-bearer-token"
}
}
}
}
| Option | Alias | Default | Description |
|---|---|---|---|
--endpoint | -e | required | HTTP endpoint for the MCP service |
--token | -t | required | Bearer token for authentication |
--timeout | 30000 | Request timeout in milliseconds | |
--retries | 3 | Number of retry attempts | |
--verbose | -v | false | Enable verbose logging |
The bridge acts as a protocol translator:
mcp-session-id headersClaude Code ↔ stdio/JSON-RPC ↔ MCP HTTP Bridge ↔ HTTP/JSON ↔ Your MCP Service
mcp-session-id headersapplication/json and text/event-streamThe bridge adds Bearer token authentication to all HTTP requests:
POST /mcp HTTP/1.1
Authorization: Bearer your-token-here
Content-Type: application/json
{
"jsonrpc": "2.0",
"method": "tools/list",
"id": 1
}
mcp-http-bridge \
--endpoint "https://mcp.example.com/api" \
--token "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
mcp-http-bridge \
--endpoint "https://slow-service.com/mcp" \
--token "abc123" \
--timeout 60000 \
--retries 5
echo '{"jsonrpc":"2.0","method":"tools/list","id":1}' | \
mcp-http-bridge --endpoint "https://api.com/mcp" --token "token"
# Clone the repository
git clone https://github.com/nimbletools/mcp-http-bridge.git
cd mcp-http-bridge
# Install dependencies
npm install
# Build TypeScript
npm run build
# Run locally
npm run dev -- --endpoint "https://..." --token "..."
For testing during development, you can configure Claude Code to use either your local build or the published package:
Using local build:
{
"mcpServers": {
"national-parks": {
"command": "node",
"args": [
"/path/to/your/mcp-http-bridge/dist/cli.js",
"--endpoint",
"https://mcp.nimbletools.dev/v1/workspaces/your-workspace-id/servers/nationalparks-mcp/mcp",
"--token",
"your-auth-token-here",
"--insecure"
],
"auth": null,
"oauth": false
}
}
}
Using published package with npx:
{
"mcpServers": {
"national-parks": {
"command": "npx",
"args": [
"@nimbletools/mcp-http-bridge",
"--endpoint",
"https://mcp.nimbletools.dev/v1/workspaces/your-workspace-id/servers/nationalparks-mcp/mcp",
"--token",
"your-auth-token-here",
"--insecure"
],
"auth": null,
"oauth": false
}
}
}
Replace the workspace ID and token with your actual credentials. The --insecure flag is useful for development against local or test endpoints.
We welcome contributions! If you're interested in contributing, please read our Contributing Guide for details on our development process, how to propose bugfixes and improvements, and how to build and test your changes.
MIT License - see LICENSE file for details.
FAQs
Bridge MCP stdio protocol to HTTP-based MCP services
The npm package @nimbletools/mcp-http-bridge receives a total of 8 weekly downloads. As such, @nimbletools/mcp-http-bridge popularity was classified as not popular.
We found that @nimbletools/mcp-http-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.