
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@openpouch/mcp
Advanced tools
openpouch 🦘 MCP server — agent-native deploy tools for any MCP-capable harness (Claude Code, Codex, Cursor, Windsurf, …). stdio, open standard. No approve tool — production approval stays human-only.
The openpouch MCP server — the same governed deploy capabilities as the openpouch CLI, exposed as standard Model Context Protocol tools over stdio. Works with any MCP-capable harness (Claude Code, Codex, Cursor, Windsurf, …) — harness neutrality is a design rule.
Most agents don't need this — the
openpouchCLI (npx openpouch deploy) works in any shell. Use the MCP server when you want the typed tool surface in an MCP client.
Twelve tools wrapping the same command functions as the CLI (identical behavior, no drift): openpouch_init, openpouch_inspect, openpouch_plan, openpouch_deploy_preview, openpouch_deploy_production, openpouch_verify, openpouch_logs, openpouch_rollback, openpouch_list_approvals, openpouch_whoami, openpouch_list (list your account's instant-lane apps), openpouch_delete (delete one of your own apps to free a quota slot).
There is deliberately no approve tool. Approving a production deploy is human-only (interactive terminal) — an agent can never approve its own deploys, in any harness. If a tool returns approval-required with a request id, ask your human to run openpouch approve <id> in their own terminal.
No install needed:
npx -y @openpouch/mcp
It speaks stdio MCP — point your client's MCP config at that command.
claude mcp add openpouch -- npx -y @openpouch/mcp
{
"mcpServers": {
"openpouch": {
"command": "npx",
"args": ["-y", "@openpouch/mcp"]
}
}
}
(Codex uses ~/.codex/config.toml; the equivalent is command = "npx", args = ["-y", "@openpouch/mcp"] under an [mcp_servers.openpouch] table.)
Apache-2.0.
FAQs
openpouch 🦘 MCP server — agent-native deploy tools for any MCP-capable harness (Claude Code, Codex, Cursor, Windsurf, …). stdio, open standard. No approve tool — production approval stays human-only.
The npm package @openpouch/mcp receives a total of 26 weekly downloads. As such, @openpouch/mcp popularity was classified as not popular.
We found that @openpouch/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.