
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@seldonframe/mcp
Advanced tools
Open-source GoHighLevel alternative for agencies. 146+ MCP tools that let Claude Code spin up white-labeled client workspaces — CRM, booking, intake forms, landing pages, AI chatbot, and pre-wired agent archetypes (speed-to-lead, missed-call-text-back, re
Official SeldonFrame MCP server for Claude Code and Claude Desktop.
One command, one real workspace. The first time you run it, no API key is needed. Say create_workspace({ name: "Dental Clinic Laval" }) and the server mints a real hosted workspace on dental-clinic-laval.app.seldonframe.com — with CRM, Cal.diy booking, Formbricks intake, and Brain v2 pre-installed — and returns live URLs. No signup wall, no "guest mode", no claim step.
# 1. From the repo root
cd skills/mcp-server && npm install
# 2. Register with Claude Code — no env vars needed
claude mcp add seldonframe -s user -- node "$(pwd)/src/index.js"
# 3. In Claude Code, just ask:
# create_workspace({ name: "My Business OS" })
That call returns something like:
{
"workspace": { "id": "wsp_…", "slug": "my-business-os", "tier": "free" },
"urls": {
"dashboard": "https://my-business-os.app.seldonframe.com",
"book": "https://my-business-os.app.seldonframe.com/book",
"intake": "https://my-business-os.app.seldonframe.com/intake"
},
"installed": ["crm", "caldiy-booking", "formbricks-intake", "brain-v2"],
"next": [ "…" ]
}
Every subsequent tool response includes a next: array — follow the rails.
| Situation | What happens |
|---|---|
| First ever call | create_workspace POSTs with no auth. Server mints a workspace + bearer token. MCP stores the token in ~/.seldonframe/device.json. |
| Subsequent calls | MCP sends Authorization: Bearer <workspace token> automatically. |
SELDONFRAME_API_KEY set | Takes precedence over device tokens. Unlocks Pro capabilities. |
You never have to juggle modes. The first workspace is free forever.
SELDONFRAME_API_KEYGet one at https://app.seldonframe.com/settings/api, then:
export SELDONFRAME_API_KEY=sk-…
Restart the MCP server. Your existing workspaces continue to work untouched.
The repo ships a .claude-plugin/plugin.json at the root. From inside Claude Code:
/plugin install <path-to-repo>
claude mcp add seldonframe -- npx -y @seldonframe/mcp
This is the canonical install command surfaced on the marketing site,
the /docs/quickstart page, and the repo README. It uses npx -y
so users never have to globally install anything; the latest version
is fetched and run on demand.
SELDONFRAME_API_KEY (optional) — Enables Pro capabilities (second workspace, custom domains, full Brain v2).SELDONFRAME_API_BASE (optional) — Override the API base URL. Defaults to https://app.seldonframe.com/api/v1.Workspace: create_workspace, list_workspaces, switch_workspace, clone_workspace, link_workspace_owner, get_workspace_snapshot.
Blocks: install_caldiy_booking, install_formbricks_intake, install_vertical_pack.
Customize (typed, no backend LLM): update_landing_content, customize_intake_form, configure_booking, update_theme.
Soul: fetch_source_for_soul, submit_soul.
Ops: list_automations, connect_custom_domain, export_agent, store_secret, list_secrets, rotate_secret.
Natural-language reasoning happens in the MCP session (Claude Code on the user's side). The backend only accepts structured commands and applies them deterministically. There is no seldon_it endpoint that parses prompts server-side; the old query_brain is replaced by get_workspace_snapshot, which returns raw state for Claude to reason over. Seldon spends $0 on LLM for the free tier — the user's Claude Code subscription is the reasoning engine.
Soul compilation runs in your Claude Code session, not on Seldon's servers:
fetch_source_for_soul({ url }) — returns up to 256KB of normalized text.submit_soul({ soul }) — persists it to the workspace.Seldon API 401 — Your SELDONFRAME_API_KEY is invalid or expired. Regenerate at https://app.seldonframe.com/settings/api, or unset the env var to fall back to your device token.
Seldon API 402 — You tried a Pro capability without a key. Set SELDONFRAME_API_KEY and restart.
Want to reset device state? Delete ~/.seldonframe/device.json. Your hosted workspaces stay live at app.seldonframe.com; only the local tokens are cleared.
Full policy: https://www.seldonframe.com/privacy
app.seldonframe.com over HTTPS. The only thing it stores on your machine is a workspace bearer token in ~/.seldonframe/device.json.~/.seldonframe/device.json.This package (skills/mcp-server, the SeldonFrame MCP connector) is MIT-licensed. The SeldonFrame platform in the rest of the repository remains AGPL-3.0 — see the repository root LICENSE.
FAQs
Open-source GoHighLevel alternative for agencies. 146+ MCP tools that let Claude Code spin up white-labeled client workspaces — CRM, booking, intake forms, landing pages, AI chatbot, and pre-wired agent archetypes (speed-to-lead, missed-call-text-back, re
The npm package @seldonframe/mcp receives a total of 114 weekly downloads. As such, @seldonframe/mcp popularity was classified as not popular.
We found that @seldonframe/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.