
Security News
Google’s OSV Fix Just Added 500+ New Advisories — All Thanks to One Small Policy Change
A data handling bug in OSV.dev caused disputed CVEs to disappear from vulnerability feeds until a recent fix restored over 500 advisories.
@openfeature/mcp
Advanced tools
This project is in active development.
A local Model Context Protocol (MCP) server that provides OpenFeature SDK installation guidance and Open Feature Remote Evaluation Protocol (OFREP) over stdio.
Add to ~/.cursor/mcp_settings.json
:
{
"mcpServers": {
"OpenFeature": {
"command": "npx",
"args": ["-y", "@openfeature/mcp"]
}
}
}
Add to .continue/config.json
:
{
"mcpServers": {
"OpenFeature": {
"command": "npx",
"args": ["-y", "@openfeature/mcp"]
}
}
}
Add the server via CLI:
claude mcp add --transport stdio openfeature npx -y @openfeature/mcp
Then manage the connection in the CLI with /mcp
.
In the "Manage MCP servers" raw config, add:
{
"mcpServers": {
"OpenFeature": {
"command": "npx",
"args": ["-y", "@openfeature/mcp"]
}
}
}
Edit your Claude Desktop config and add:
{
"mcpServers": {
"openfeature": {
"command": "npx",
"args": ["-y", "@openfeature/mcp"]
}
}
}
Restart Claude Desktop after saving.
If you prefer a global install instead of NPX:
npm install -g @openfeature/mcp
Now in your MCP config use openfeature-mcp
as the command:
{
"mcpServers": {
"openfeature": {
"command": "openfeature-mcp"
}
}
}
All logs are written to stderr. The MCP protocol messages use stdout.
install_openfeature_sdk
Fetches Markdown instructions for installing the OpenFeature SDK for a given technology. Optionally augments the prompt with installation guidance for one or more feature flag providers.
Parameters:
technology
(string enum): One of the supported technologies listed belowproviders
(string array, optional): Zero or more provider identifiers. If
present, adds provider-specific installation notes to the prompt (or removes
placeholder sections when empty).Supported Technologies:
The technologies list is build from the avaliable prompts/*.md
, updated automatically using scripts/build-prompts.js
Supported Providers:
The provider list is sourced automatically from the OpenFeature open-feature/openfeature.dev
repo; newly added providers there become available here without manual edits.
See scripts/build-providers.js
for details.
ofrep_flag_eval
Evaluate feature flags via OpenFeature Remote Evaluation Protocol (OFREP).
If flag_key
is omitted, performs bulk evaluation.
References:
open-feature/protocol
repo,
OFREP OpenAPI spec
Parameters (all optional unless noted):
base_url
(string, optional): Base URL of your OFREP-compatible flag
service. If omitted, the server uses env/config (see below).flag_key
(string, optional): If provided, calls single flag evaluation:
/ofrep/v1/evaluate/flags/{key}
. If omitted, calls bulk:
/ofrep/v1/evaluate/flags
.context
(object, optional): Evaluation context, e.g. { "targetingKey": "user-123", ... }
.etag
(string, optional): For bulk requests, sent as If-None-Match
to
enable 304 caching semantics.auth
(object, optional): Inline auth for this call only.
bearer_token
(string, optional): Sets Authorization: Bearer <token>
.api_key
(string, optional): Sets X-API-Key: <key>
.Auth and base URL resolution (priority):
base_url
, auth.bearer_token
, auth.api_key
OPENFEATURE_OFREP_BASE_URL
(or OFREP_BASE_URL
),
OPENFEATURE_OFREP_BEARER_TOKEN
(or OFREP_BEARER_TOKEN
),
OPENFEATURE_OFREP_API_KEY
(or OFREP_API_KEY
)~/.openfeature-mcp.json
(override with
OPENFEATURE_MCP_CONFIG_PATH
)Example ~/.openfeature-mcp.json
:
{
"OFREP": {
"baseUrl": "https://flags.example.com",
"bearerToken": "<token>",
"apiKey": "<key>"
}
}
Notes:
ETag
. Pass it back via etag
to leverage 304 Not
Modified.Install dependencies:
npm install
Add or edit install guides in the prompts/
folder (Markdown). These are
bundled at build time.
Build prompts bundle:
npm run build-prompts
Build TypeScript:
npm run build
Run locally (binary entrypoint):
node dist/cli.js
FAQs
**This project is in active development.**
We found that @openfeature/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A data handling bug in OSV.dev caused disputed CVEs to disappear from vulnerability feeds until a recent fix restored over 500 advisories.
Research
/Security News
175 malicious npm packages (26k+ downloads) used unpkg CDN to host redirect scripts for a credential-phishing campaign targeting 135+ organizations worldwide.
Security News
Python 3.14 adds template strings, deferred annotations, and subinterpreters, plus free-threaded mode, an experimental JIT, and Sigstore verification.