
Security News
OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.
@photon-ai/mcp
Advanced tools
Run Photon's MCP tools locally over stdio with your own Photon key.
If your client supports remote MCP servers with OAuth (Claude, ChatGPT, Cursor),
connect to the hosted server instead: https://mcp.photon.codes/mcp. No key is
needed. Use this local server when your client only runs stdio servers.
pho_ask_...) in the Photon dashboard.Claude Code:
claude mcp add photon --env PHOTON_API_KEY=pho_ask_... -- npx -y @photon-ai/mcp
Cursor, Claude Desktop and other JSON-configured clients:
{
"mcpServers": {
"photon": {
"command": "npx",
"args": ["-y", "@photon-ai/mcp"],
"env": { "PHOTON_API_KEY": "pho_ask_..." }
}
}
}
| Variable | Default | Description |
|---|---|---|
PHOTON_API_KEY | required | Your Account Service Key |
PHOTON_API_URL | https://api.photon.codes | API origin. Only photon.codes and loopback hosts are accepted |
The server offers the same tools as the hosted server. Operations that manage keys, account security, SSO or billing checkout are not available. Your client decides when to ask before running a tool, so set it to confirm writes.
FAQs
Run Photon's MCP tools locally over stdio with your own Photon API key.
The npm package @photon-ai/mcp receives a total of 47 weekly downloads. As such, @photon-ai/mcp popularity was classified as not popular.
We found that @photon-ai/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Security News
An OpenCode user faced harassment after reporting a free AI usage loophole, drawing a bitter backlash in a GitHub thread that has since been deleted.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.