
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@sassoftware/mcp-serverjs
Advanced tools
SAS developers who want to leverage agentic AI technologies to deliver their SAS based solutions via a "chat" interface. There are no additional skill sets required to use the mcp server
The source code is available to application developers to add their own tools or build their own mcp server The source code available with Apache-2.0 license.
MCP servers is one of the popular additions to the agentic-ai world. This repository shows that SAS developers can take advantage of this technology to deliver their solutions via a "chat".
The mcp server described here is designed for scoring with SAS Viya. In this document "scoring" is used to describe executing any code that takes some input and returns results.
Some examples are:
models created with SAS solutions like Model Studio, Intelligent Decisioning etc...
user written SAS program, SAS Studio Flow, job Definitions etc. using SAS Studio or other interfaces
functions that call SAS products using REST API to get results
See below for the capabilities in the starter kit and how you can modify it for your own use.
The source code is the repository restaf-demos. It is provided under the Apache-2.0 license.
Note: This server is designed to run locally on the client. A remote server implementation is coming soon.
The tools are designed to address common usage scenarios faced by SAS users.
Below is the default code for sas-sql-query job
data _null_;
length sql_final $5000.;
sql_final="%superq(sql)";
call symput("sql_final",sql_final);
run;
filename joutput filesrvc parenturi="&SYS_JES_JOB_URI" name="query_results.json";
%macro run_sql_code;
proc sql;
create table work.query_results as
&sql_final.;
quit;
proc print data=work.query_results;run;
proc json out= joutput nosastags;
export query_results;
run;
%mend;
%run_sql_code;
The server supports multiple ways to authenticate.
This mcp server cli works similar to SAS supplied sas-viya cli commands. Use the following command to create the necessary token and refresh token.
create a default auth Profile.
Issue this command and follow instruction: sas-viya profile init
create token
Issue this command and follow the instructions: sas-viya auth loginCode
You need to do this once every 90 days or whenever the refresh token expires.
At this point the tools can make authenticated calls to SAS Viya
In some cases you might have a token. Set the value in the .env file or in the mcp configuration.
Ths requires additional setup.
Similar methodologies can be used with other mcp enabled clients(ex: Claude Desktop, OpenAI desktop, etc...) Go to the vscode settings and search for mcp. Then select Model Server Context Protocol. Edit its config json Add the following to the list of mcp servers
This is ideal for running mcp servers locally.
"sasmcpio": {
"type": "stdio",
"command": "npx",
"args": [
"@sassoftware/mcp-serverjs@latest",
],
"env": {
"MCPTYPE": "stdio",
"AUTHFLOW": "sascli",
"SAS_CLI_PROFILE": "cli profile name or default",
"SAS_CLI_CONFIG":"where sas-cli stores authentication information",
"SSLCERT": "where you have stored the tls information(see below)",
"VIYA_SERVER": "viya server if AUTHFLOW=password|token",
"PASSWORD": "password if AUTHFLOW is password",
"USERNAME": "username if AUTHFLOW is password",
"CLIENTIDPW": "client password if AUTHFLOW is password",
"CLIENTSECRETPW": "client id if AUTHFLOW is password",
"TOKEN": "token if AUTHFLOW is token",
"ENVFILE": "NONE"
}
}
The SSLCERT should be a folder that has the following files:
- key.pem
- crt.pem
- ca.pem
This is an alternate to using stdio. This requires a .env file(see below).
Step 1: Configure the mpc client
The mcp configuration is show below
"sasmcp": {
"type": "http",
"url": "http://localhost:8080/mcp"``
}
Step 2: Start the mcp server
npx @sassoftware/mcp-serverjs@latest
Make sure that the .env file is in the current working directory(see below for details).
The environment variables you can set are:
```env
##
# mcp server environment variables
#
## server specific settings
# By default the server will run in HTTP mode
HTTPS=FALSE
## TLS settings
SSLCERT=<location of your SSL certificate>
# The directory must contain the files key.pem and crt.pem and optionally ca.pem
# This is used by the mcp server and in calls to SAS Via
## If using self-signed certificate set this to 0
NODE_TLS_REJECT_UNAUTHORIZED=0
## Viya authentication settings
## Valid values for AUTHFLOW are: sascli, password, token
AUTHFLOW=sascli
## sas-viya allows named profiles.
## set this to the profile you want to use or leave it blank to use the default profile.
## this is used to find the tokens for Viya
# replace i58 with your profile name
SAS_CLI_PROFILE=i58
# replace with the location where sas-cli stores authentication information
SAS_CLI_CONFIG=c:\Users\kumar
## Needed for the AUTHFLOW=password|token
VIYA_SERVER=<your Viya Server URL>
## Password authentication settings
PASSWORD=yourpassword
USERNAME=yourusername
CLIENTIDPW=your password clientid
CLIENTSECRETPW=your password clientsecret
## TOKEN authentication settings
# Useful for cases where you want to use a token directly
TOKEN=yourtoken
You can use many mcp servers to persist the scoring data. See this repository for an example of using mcp/redis to persist the scores in a CAS table.
This server is "stateless" - it does not cache any values, including any Viya sessions the tools might have created. One advantages is that the session does not timeout.
In a production system the designer has to make decisions on what needs to be cached and the implications of such caching.
The implication of this design choice is felt most when the tool needs is creating compute session - the requests will take longer than when the compute session is cached.
Also see https://communities.sas.com for articles on using mcp with SAS Viya
Use the stdio transport. Check their documentation for details.
In my limited experience, the copilot works better if Claude Desktop starts the mcp server. To achieve this I set the following in session.json:
In my limited experience, the copilot works better if VScode starts the mcp server. To achieve this I set the following in session.json:
MCP: AutoStart to onlyNew.
Warning: This is just my observation. Your mileage may vary.
To create a self-signed certificate for localhost
mkcert -install
The install also stores local root Certificate Authority (CA) on the system For windows the location is AppData/Local\mkcert
Now go to the location where you want to store the certificates Then create the certificates
mkcert --key key.pem --cert crt.pem localhost 127:0.0.1 ::1
One last step for windows nodejs users. Add this to the environment variable NODE_EXTRA_CA_CERTS
NODE_EXTRA_CA_CERTS=c:\Users\<your_username>\AppData\Local\mkcert\rootCA.pem
FAQs
A mcp server for SAS Viya
The npm package @sassoftware/mcp-serverjs receives a total of 86 weekly downloads. As such, @sassoftware/mcp-serverjs popularity was classified as not popular.
We found that @sassoftware/mcp-serverjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 20 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.