
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@paragraph-com/mcp
Advanced tools
MCP (Model Context Protocol) server for Paragraph — expose your publication to AI agents in Claude Desktop, Cursor, VS Code Copilot, and any MCP-compatible client.
Use the hosted server at mcp.paragraph.com — no installation or API key management required. You'll authenticate through your Paragraph account in the browser.
claude mcp add paragraph --transport http https://mcp.paragraph.com/mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"paragraph": {
"url": "https://mcp.paragraph.com/mcp"
}
}
}
Add to .cursor/mcp.json:
{
"mcpServers": {
"paragraph": {
"url": "https://mcp.paragraph.com/mcp"
}
}
}
Add to .vscode/mcp.json:
{
"servers": {
"paragraph": {
"url": "https://mcp.paragraph.com/mcp"
}
}
}
If you prefer to run the server locally, you can use npx. Requires Node.js 18+.
npx @paragraph-com/mcp
The remote server handles auth automatically. For local usage, set your API key via environment variable:
PARAGRAPH_API_KEY=your-key npx @paragraph-com/mcp
Or log in with the Paragraph CLI — the MCP server shares the same config:
npx @paragraph-com/cli login
npx @paragraph-com/mcp
claude mcp add paragraph -- npx @paragraph-com/mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"paragraph": {
"command": "npx",
"args": ["@paragraph-com/mcp"],
"env": {
"PARAGRAPH_API_KEY": "your-key"
}
}
}
}
Add to .cursor/mcp.json or .vscode/mcp.json:
{
"servers": {
"paragraph": {
"command": "npx",
"args": ["@paragraph-com/mcp"],
"env": {
"PARAGRAPH_API_KEY": "your-key"
}
}
}
}
npx @paragraph-com/mcp --http --port 3100
HTTP mode binds to
127.0.0.1(localhost only) and accepts POST requests. A health check is available atGET /health.
Drafted short-form content — X posts and threads, LinkedIn posts, one-off emails, and X Articles. These tools draft only; the writer sends the piece from the Paragraph app.
One identity for a post and everything made out of it — the post, the thread drawn from it, the LinkedIn version, the newsletter. The writer sees it as a single stacked row under Content. Seed a group from the post, then pass its bucketId on every create-content derived from it.
Only expose the tools your agent needs:
npx @paragraph-com/mcp --toolsets posts,search
Available toolsets: posts, content, buckets, publications, subscribers, users, coins, search, feed, me, analytics, emails
Prompt: "Search for posts about onchain governance and give me a summary of the top results"
The MCP server calls search-posts with the query. Claude receives the matching posts and synthesizes a summary of the key themes, authors, and publications.
Prompt: "Write a post titled 'Weekly Update #12' about our new token-gating feature, then publish it"
The server calls create-post with the title and generated markdown content, creating it as a draft. After you confirm, it calls update-post to set the status to published, making it live on your publication.
Prompt: "Turn my latest post into an X thread and a LinkedIn post"
The server calls create-post-content-bucket with the post's id to get the group, then create-content twice with that bucketId. The writer opens Content and sees the post with the thread and the LinkedIn version stacked under it, ready to review and send.
Prompt: "How many subscribers does my publication have? Show me the most recent ones."
The server calls get-me to identify your publication, then get-subscriber-count for the total, and list-subscribers to return the latest subscribers with their details.
Prompt: "What's my average open rate over the last 30 days, and which posts performed best?"
The server calls analytics-query with a scoped SQL query against post_analytics_summary, returning open rates, CTR, and views for each post. Claude summarizes the trend and highlights the top performers.
Prompt: "What's trending on Paragraph right now?"
The server calls get-feed to retrieve the curated platform feed and Claude summarizes the top posts, their authors, and topics.
Prompt: "Show me my drafts and send a test email for the most recent one"
The server calls list-posts with status: draft to retrieve your drafts, then send-test-email with the latest draft's ID so you can preview the newsletter in your inbox before sending it to subscribers.
npm run release patch # 1.0.0 → 1.0.1
npm run release minor # 1.0.0 → 1.1.0
npm run release major # 1.0.0 → 2.0.0
Builds, tests, publishes to npm, deploys the Cloudflare Worker at mcp.paragraph.com, and creates a GitHub release. The script will prompt for any missing credentials.
This MCP server connects to the Paragraph API on your behalf. See the Paragraph Privacy Policy for details on data collection, usage, storage, and your rights.
MIT
FAQs
MCP server for Paragraph — expose your publication to AI agents
The npm package @paragraph-com/mcp receives a total of 45 weekly downloads. As such, @paragraph-com/mcp popularity was classified as not popular.
We found that @paragraph-com/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.