
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
@proventools/mcp
Advanced tools
Beta local stdio MCP access to the ProvenTools curated idea library, stored evidence, build prompts, credit balances, and existing validation reports. The package uses Node.js built-ins only and does not host a remote MCP endpoint.
https://www.proventools.net/dashboard/api-keysRun proventools login once to save the key in the private ProvenTools CLI
config. The MCP server reuses that file and prefers PROVENTOOLS_API_KEY when
your MCP client provides it through a secret store or inherited environment.
Never place a literal key in command arguments, shell history, checked-in MCP
configuration, an agent prompt, or a log.
The examples pin the exact beta version so an agent cannot silently execute a newer release.
codex mcp add proventools -- npx --yes @proventools/mcp@0.1.0-beta.3
claude mcp add proventools -- npx --yes @proventools/mcp@0.1.0-beta.3
Add this non-secret definition to .cursor/mcp.json:
{
"mcpServers": {
"proventools": {
"command": "npx",
"args": ["--yes", "@proventools/mcp@0.1.0-beta.3"]
}
}
}
{
"command": "npx",
"args": ["--yes", "@proventools/mcp@0.1.0-beta.3"]
}
The transport is JSON-RPC 2.0 over newline-delimited stdin/stdout. It
implements initialize, tools/list, and tools/call.
search_ideas({ query?, category?, difficulty?, page? })get_idea({ id })get_build_prompt({ id })whats_new()get_idea_evidence({ id, historyLimit? })get_validation_report({ id })get_credit_balance()recommend_ideas({ query, ...filters })shortlist_ideas({ query, ...filters })discover_ideas({ query, ...filters })compare_ideas({ ideaIds, query? })explain_idea_score({ id })Evidence reads use stored PostgreSQL snapshots and cost zero credits. Intelligence tools may send natural-language input and selected stored idea fields to OpenAI for semantic retrieval and bounded synthesis when the server-side feature is enabled.
Every tool in this beta costs zero credits. It cannot request evidence refreshes, submit validations, spend credits, or start paid jobs. Existing validation reports and credit balances remain available as read-only data.
The MCP process sends the ProvenTools API key only to approved production origins or HTTP loopback origins, rejects redirects, bounds request and output sizes, limits concurrent calls, and writes protocol messages only to stdout.
Use https://www.proventools.net/contact for support or security reports.
The local MCP server code is licensed under MIT. The license does not grant rights to the ProvenTools API, datasets, content, trademarks, paid features, or service access; those remain governed by ProvenTools terms.
FAQs
Read-only local MCP server for the ProvenTools idea library
The npm package @proventools/mcp receives a total of 35 weekly downloads. As such, @proventools/mcp popularity was classified as not popular.
We found that @proventools/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.