
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@semore/mcp-adapter
Advanced tools
MCP (Model Context Protocol) adapter — JSON-RPC 2.0 client + server scaffold for the Semore agentic-commerce 5-tool surface.
Adapter helpers for the Model Context Protocol (MCP) — Anthropic's
JSON-RPC 2.0 protocol for connecting AI agents to external tools and
resources. This package is a thin client wrapper around the externally
exposed Semore MCP surface at mcp.semore.net, plus reusable shapes for
building your own MCP server.
Source of Truth: this directory in the Semore monorepo until repo split. The production MCP server lives in the internal Semore API at
apps/api/src/routes/mcp.ts. This package exposes the stable, framework- agnostic contract for third-party agents and orchestrators.Standards-body posture [LEGAL-PENDING]: References to the Model Context Protocol are nominative fair use. Semore claims no endorsement by, affiliation with, or co-authorship of Anthropic. Any co-branded integration is (proposed, subject to joint agreement) with the respective body. [EXTERNAL-ADVISORY]
npm install @semore/mcp-adapter
# or
pnpm add @semore/mcp-adapter
The Semore MCP server advertises exactly five tools, mirroring the agentic-commerce primitive surface:
| Tool | Purpose |
|---|---|
search_product | Catalog search — k-beauty / k-fashion / electronics |
get_product | Fetch a product by SKU id |
create_cart | Build a cart from a list of { skuId, qty } items |
quote_checkout | Compute landed price (duty + tax + shipping) for a country |
submit_intent | Submit an AP2 intent mandate to begin the agentic flow |
import { McpAdapter, type JsonRpcRequest } from "@semore/mcp-adapter";
const adapter = new McpAdapter({
endpoint: "https://mcp.semore.net",
// Optional: intercept JSON-RPC for tests by passing your own fetch
// transport: globalThis.fetch,
});
const tools = await adapter.listTools();
console.log(tools.map((t) => t.name)); // 5 entries
const result = await adapter.callTool("search_product", {
query: "Korean sunscreen",
country: "US",
});
import { McpAdapter } from "@semore/mcp-adapter";
const adapter = new McpAdapter({ endpoint: "https://mcp.semore.net" });
adapter.registerHandler("search_product", async (args) => {
// your implementation
return { products: [] };
});
const response = await adapter.handleJsonRpc({
jsonrpc: "2.0",
id: 1,
method: "tools/call",
params: { name: "search_product", arguments: { query: "sunscreen" } },
});
McpAdapter class — JSON-RPC 2.0 wrapper for the Semore MCP server.listTools() — fetch the 5-tool advertisement.callTool(name, args) — invoke a tool over the wire.handleJsonRpc(req) — dispatcher for inbound requests when you mount your
own MCP server in front of @semore/mcp-adapter.JsonRpcRequest, JsonRpcResponse, JsonRpcError,
ToolDefinition, ToolCall, McpAdapterOptions.mcp.semore.net and are not open-sourced.did:web:semore.netsemore.hq@gmail.com · GitHub @semore_hqApache-2.0 — see LICENSE. Patent grant per Apache-2.0 §3.
Copyright (c) Semore Founding Team.
FAQs
MCP (Model Context Protocol) adapter — JSON-RPC 2.0 client + server scaffold for the Semore agentic-commerce 5-tool surface.
The npm package @semore/mcp-adapter receives a total of 0 weekly downloads. As such, @semore/mcp-adapter popularity was classified as not popular.
We found that @semore/mcp-adapter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.