
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
@proventools/mcp
Advanced tools
Beta local stdio MCP access to the ProvenTools curated idea library, stored evidence, build prompts, credit balances, and existing validation reports. The package uses Node.js built-ins only and does not host a remote MCP endpoint.
https://www.proventools.net/dashboard/api-keysRun proventools login once to save the key in the private ProvenTools CLI
config. The MCP server reuses that file and prefers PROVENTOOLS_API_KEY when
your MCP client provides it through a secret store or inherited environment.
Never place a literal key in command arguments, shell history, checked-in MCP
configuration, an agent prompt, or a log.
The examples pin the exact beta version so an agent cannot silently execute a newer release.
codex mcp add proventools -- npx --yes @proventools/mcp@0.1.0-beta.2
claude mcp add proventools -- npx --yes @proventools/mcp@0.1.0-beta.2
Add this non-secret definition to .cursor/mcp.json:
{
"mcpServers": {
"proventools": {
"command": "npx",
"args": ["--yes", "@proventools/mcp@0.1.0-beta.2"]
}
}
}
{
"command": "npx",
"args": ["--yes", "@proventools/mcp@0.1.0-beta.2"]
}
The transport is JSON-RPC 2.0 over newline-delimited stdin/stdout. It
implements initialize, tools/list, and tools/call.
search_ideas({ query?, category?, difficulty?, page? })get_idea({ id })get_build_prompt({ id })whats_new()get_idea_evidence({ id, historyLimit? })get_validation_report({ id })get_credit_balance()recommend_ideas({ query, ...filters })shortlist_ideas({ query, ...filters })discover_ideas({ query, ...filters })compare_ideas({ ideaIds, query? })explain_idea_score({ id })Evidence reads use stored PostgreSQL snapshots and cost zero credits. Intelligence tools may send natural-language input and selected stored idea fields to OpenAI for semantic retrieval and bounded synthesis when the server-side feature is enabled.
Every tool in this beta costs zero credits. It cannot request evidence refreshes, submit validations, spend credits, or start paid jobs. Existing validation reports and credit balances remain available as read-only data.
The MCP process sends the ProvenTools API key only to approved production origins or HTTP loopback origins, rejects redirects, bounds request and output sizes, limits concurrent calls, and writes protocol messages only to stdout.
Use https://www.proventools.net/contact for support or security reports.
The local MCP server code is licensed under MIT. The license does not grant rights to the ProvenTools API, datasets, content, trademarks, paid features, or service access; those remain governed by ProvenTools terms.
FAQs
Read-only local MCP server for the ProvenTools idea library
The npm package @proventools/mcp receives a total of 49 weekly downloads. As such, @proventools/mcp popularity was classified as not popular.
We found that @proventools/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.