
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@refgrow/mcp
Advanced tools
A Model Context Protocol (MCP) server that wraps the Refgrow REST API. This allows AI agents -- Claude Desktop, Cursor, ChatGPT, and other MCP-compatible clients -- to manage your affiliate program directly.
rgk_npm install @refgrow/mcp
Or clone and build from source:
git clone https://github.com/refgrow/refgrow-mcp.git
cd refgrow-mcp
npm install
npm run build
The server requires two environment variables:
| Variable | Required | Default | Description |
|---|---|---|---|
REFGROW_API_KEY | Yes | -- | Your Refgrow API key (starts with rgk_) |
REFGROW_API_URL | No | https://refgrow.com | Base URL of your Refgrow instance |
rgk_ and is shown only once)Add this to your Claude Desktop config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"refgrow": {
"command": "npx",
"args": ["-y", "@refgrow/mcp"],
"env": {
"REFGROW_API_KEY": "rgk_your_api_key_here"
}
}
}
}
Or if installed globally / from source:
{
"mcpServers": {
"refgrow": {
"command": "node",
"args": ["/path/to/packages/mcp-server/dist/index.js"],
"env": {
"REFGROW_API_KEY": "rgk_your_api_key_here"
}
}
}
}
In Cursor settings, add an MCP server with:
npx -y @refgrow/mcpREFGROW_API_KEY=rgk_your_api_key_hereOr add to .cursor/mcp.json in your project root:
{
"mcpServers": {
"refgrow": {
"command": "npx",
"args": ["-y", "@refgrow/mcp"],
"env": {
"REFGROW_API_KEY": "rgk_your_api_key_here"
}
}
}
}
Add to your project's .mcp.json:
{
"mcpServers": {
"refgrow": {
"command": "npx",
"args": ["-y", "@refgrow/mcp"],
"env": {
"REFGROW_API_KEY": "rgk_your_api_key_here"
}
}
}
}
| Tool | Description |
|---|---|
list_affiliates | List all affiliates with stats (clicks, signups, purchases, earnings) |
get_affiliate_details | Get details for a specific affiliate by email |
create_affiliate | Create a new affiliate with optional custom referral code |
update_affiliate | Update affiliate email, referral code, status, or partner slug |
delete_affiliate | Remove an affiliate from the project |
| Tool | Description |
|---|---|
list_referrals | List referred users, filterable by affiliate or status |
get_referral_details | Get details for a specific referred user by email |
create_referral | Manually create a referred user record |
| Tool | Description |
|---|---|
list_conversions | List conversions with filters for type, affiliate, date range, paid status |
get_conversion | Get a specific conversion by ID |
create_conversion | Create a conversion (signup/purchase) with auto-commission calculation |
update_conversion | Update conversion details or mark as paid |
delete_conversion | Delete a conversion record |
| Tool | Description |
|---|---|
list_coupons | List coupon codes with affiliate info |
get_coupon | Get a specific coupon by ID |
create_coupon | Create a coupon linked to an affiliate (with optional Stripe/LemonSqueezy IDs) |
update_coupon | Update coupon details |
delete_coupon | Delete a coupon (also removes from Stripe if linked) |
Once connected, you can ask your AI agent things like:
# Install dependencies
npm install
# Build
npm run build
# Watch mode for development
npm run dev
# Run the server (requires REFGROW_API_KEY env var)
REFGROW_API_KEY=rgk_your_key npm start
Full setup guide with examples and troubleshooting: https://refgrow.com/docs/mcp-server
REST API reference (for direct HTTP integration): https://refgrow.com/docs/api-reference
MIT
FAQs
Model Context Protocol server for Refgrow affiliate program management API
The npm package @refgrow/mcp receives a total of 17 weekly downloads. As such, @refgrow/mcp popularity was classified as not popular.
We found that @refgrow/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.