
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@relyt/mcp-server-relytone
Advanced tools
Interact with the RelytONE Console API through the Model Context Protocol without hand-written wrappers. The server loads the bundled OpenAPI spec, auto-generates one tool per endpoint, and proxies requests to the live service. This is a preview build (0.0.2); expect changes before a stable release.
Install nothing locally—point your MCP client at the published npm package:
{
"mcpServers": {
"relytone": {
"command": "npx",
"args": ["--yes", "@relyt/mcp-server-relytone"],
"env": {
"RELYTONE_BEARER_TOKEN": "replace-with-real-token"
}
}
}
}
RELYTONE_BEARER_TOKEN is required and injected automatically as Authorization: Bearer <token>. Provide bearerToken in the tool call only if you need to override the default.<method>-<path> (for example get-organizations, post-projects).pathParams, query, headers, body) with validation derived from the spec.structuredContent block summarising the request and response.Once published, npx pulls the latest release from npm (no repo checkout needed).
Use the repository directly when making changes or testing unpublished work.
npm install
RELYTONE_BEARER_TOKEN=your-token node index.js
node --check index.js catches syntax issues.doc/api-spec-v1.yaml whenever the upstream API changes; restarting the server regenerates tools automatically.Create a publishable tarball placed in dist/:
npm run package
The script runs npm pack --pack-destination dist, producing dist/relyt-mcp-server-relytone-0.0.2.tgz. You can point an MCP client at the tarball before publishing:
RELYTONE_BEARER_TOKEN=your-token npx --yes ./dist/relyt-mcp-server-relytone-0.0.2.tgz
When ready, publish with npm publish or distribute the tarball directly.
After building or installing the package, reference it from your MCP configuration:
Run from a local tarball via npx:
{
"mcpServers": {
"relytone": {
"command": "npx",
"args": [
"--yes",
"-p",
"/absolute/path/to/dist/relyt-mcp-server-relytone-0.0.2.tgz",
"mcp-server-relytone"
],
"env": {
"RELYTONE_BEARER_TOKEN": "your-token"
}
}
}
}
Install and call the CLI directly:
npm install -g ./dist/relyt-mcp-server-relytone-0.0.2.tgz
```json
{
"mcpServers": {
"relytone": {
"command": "mcp-server-relytone",
"env": {
"RELYTONE_BEARER_TOKEN": "your-token"
}
}
}
}
For local (non-global) installs, add "cwd": "/path/with/node_modules/.bin" so your client resolves the binary.
Bundled dependencies mean npx can execute the tarball without reaching the npm registry, which is useful in restricted or air-gapped environments.
@relyt scope:
npm login --scope=@relyt
npm run package
npm run publish:public
After publishing, clients can use the hosted package directly:
{
"mcpServers": {
"relytone": {
"command": "npx",
"args": ["--yes", "@relyt/mcp-server-relytone"],
"env": {
"RELYTONE_BEARER_TOKEN": "your-token"
}
}
}
}
FAQs
MCP server that exposes the RelytONE OpenAPI v1 specification.
The npm package @relyt/mcp-server-relytone receives a total of 7 weekly downloads. As such, @relyt/mcp-server-relytone popularity was classified as not popular.
We found that @relyt/mcp-server-relytone demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.