
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@photon-ai/mcp
Advanced tools
Run Photon's MCP tools locally over stdio with your own Photon API key.
Run Photon's MCP tools locally over stdio with your own Photon key.
If your client supports remote MCP servers with OAuth (Claude, ChatGPT, Cursor),
connect to the hosted server instead: https://mcp.photon.codes/mcp. No key is
needed. Use this local server when your client only runs stdio servers.
pho_ask_...) in the Photon dashboard.Claude Code:
claude mcp add photon --env PHOTON_API_KEY=pho_ask_... -- npx -y @photon-ai/mcp
Cursor, Claude Desktop and other JSON-configured clients:
{
"mcpServers": {
"photon": {
"command": "npx",
"args": ["-y", "@photon-ai/mcp"],
"env": { "PHOTON_API_KEY": "pho_ask_..." }
}
}
}
| Variable | Default | Description |
|---|---|---|
PHOTON_API_KEY | required | Your Account Service Key |
PHOTON_API_URL | https://api.photon.codes | API origin. Only photon.codes and loopback hosts are accepted |
The server offers the same tools as the hosted server. Operations that manage keys, account security, SSO or billing checkout are not available. Your client decides when to ask before running a tool, so set it to confirm writes.
FAQs
Run Photon's MCP tools locally over stdio with your own Photon API key.
The npm package @photon-ai/mcp receives a total of 6 weekly downloads. As such, @photon-ai/mcp popularity was classified as not popular.
We found that @photon-ai/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.