
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@paragraph-com/mcp
Advanced tools
MCP (Model Context Protocol) server for Paragraph — expose your publication to AI agents in Claude Desktop, Cursor, VS Code Copilot, and any MCP-compatible client.
Use the hosted server at mcp.paragraph.com — no installation or API key management required. You'll authenticate through your Paragraph account in the browser.
claude mcp add paragraph --transport http https://mcp.paragraph.com/mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"paragraph": {
"url": "https://mcp.paragraph.com/mcp"
}
}
}
Add to .cursor/mcp.json:
{
"mcpServers": {
"paragraph": {
"url": "https://mcp.paragraph.com/mcp"
}
}
}
Add to .vscode/mcp.json:
{
"servers": {
"paragraph": {
"url": "https://mcp.paragraph.com/mcp"
}
}
}
If you prefer to run the server locally, you can use npx. Requires Node.js 18+.
npx @paragraph-com/mcp
The remote server handles auth automatically. For local usage, set your API key via environment variable:
PARAGRAPH_API_KEY=your-key npx @paragraph-com/mcp
Or log in with the Paragraph CLI — the MCP server shares the same config:
npx @paragraph-com/cli login
npx @paragraph-com/mcp
claude mcp add paragraph -- npx @paragraph-com/mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"paragraph": {
"command": "npx",
"args": ["@paragraph-com/mcp"],
"env": {
"PARAGRAPH_API_KEY": "your-key"
}
}
}
}
Add to .cursor/mcp.json or .vscode/mcp.json:
{
"servers": {
"paragraph": {
"command": "npx",
"args": ["@paragraph-com/mcp"],
"env": {
"PARAGRAPH_API_KEY": "your-key"
}
}
}
}
npx @paragraph-com/mcp --http --port 3100
HTTP mode binds to
127.0.0.1(localhost only) and accepts POST requests. A health check is available atGET /health.
Only expose the tools your agent needs:
npx @paragraph-com/mcp --toolsets posts,search
Available toolsets: posts, publications, subscribers, users, coins, search, feed, me, analytics
Prompt: "Search for posts about onchain governance and give me a summary of the top results"
The MCP server calls search-posts with the query. Claude receives the matching posts and synthesizes a summary of the key themes, authors, and publications.
Prompt: "Write a post titled 'Weekly Update #12' about our new token-gating feature, then publish it"
The server calls create-post with the title and generated markdown content, creating it as a draft. After you confirm, it calls update-post to set the status to published, making it live on your publication.
Prompt: "How many subscribers does my publication have? Show me the most recent ones."
The server calls get-me to identify your publication, then get-subscriber-count for the total, and list-subscribers to return the latest subscribers with their details.
Prompt: "What's my average open rate over the last 30 days, and which posts performed best?"
The server calls analytics-query with a scoped SQL query against post_analytics_summary, returning open rates, CTR, and views for each post. Claude summarizes the trend and highlights the top performers.
Prompt: "What's trending on Paragraph right now?"
The server calls get-feed to retrieve the curated platform feed and Claude summarizes the top posts, their authors, and topics.
Prompt: "Show me my drafts and send a test email for the most recent one"
The server calls list-posts with status: draft to retrieve your drafts, then send-test-email with the latest draft's ID so you can preview the newsletter in your inbox before sending it to subscribers.
npm run release patch # 1.0.0 → 1.0.1
npm run release minor # 1.0.0 → 1.1.0
npm run release major # 1.0.0 → 2.0.0
Builds, tests, publishes to npm, deploys the Cloudflare Worker at mcp.paragraph.com, and creates a GitHub release. The script will prompt for any missing credentials.
This MCP server connects to the Paragraph API on your behalf. See the Paragraph Privacy Policy for details on data collection, usage, storage, and your rights.
MIT
FAQs
MCP server for Paragraph — expose your publication to AI agents
The npm package @paragraph-com/mcp receives a total of 39 weekly downloads. As such, @paragraph-com/mcp popularity was classified as not popular.
We found that @paragraph-com/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.