
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@smithery/cli
Advanced tools
Smithery CLI connects your agents to thousands of skills and MCP servers directly from the command line. To get started, simply run npx skills add smithery/cli.
npm install -g @smithery/cli@latest
Requires Node.js 20+.
smithery mcp search [term] # Search the Smithery registry
smithery mcp add <url> # Add an MCP server connection
smithery mcp list # List your connections
smithery mcp remove <ids...> # Remove connections
Interact with tools from MCP servers connected via smithery mcp.
smithery tool list [connection] # List tools from your connected MCP servers
smithery tool find [query] # Search tools by name or intent
smithery tool get <connection> <tool> # Show full details for one tool
smithery tool call <connection> <tool> [args] # Call a tool
Browse and install skills from the Smithery Skills Registry.
smithery skill search [query] # Search skills
smithery skill add <skill> --agent <name> # Add a skill
smithery skill upvote <skill> # Upvote a skill
smithery skill downvote <skill> # Downvote a skill
# Reviews
smithery skill review list <skill> # List reviews
smithery skill review add <skill> --up -b "text" # Add review + vote
smithery skill review remove <skill> # Remove your review
smithery skill review upvote <skill> <review-id> # Upvote a review
smithery skill review downvote <skill> <review-id> # Downvote a review
smithery auth login # Login with Smithery (OAuth)
smithery auth logout # Log out
smithery auth whoami # Check current user
smithery auth token # Mint a service token
smithery auth token --policy '<json>' # Mint a restricted token
smithery namespace list # List your namespaces
smithery namespace use <name> # Set current namespace
smithery mcp publish <url> -n <org/server> # Publish an MCP server URL
# Search and connect to an MCP server
smithery mcp search "github"
smithery mcp add https://server.smithery.ai/github --id github
# Find and call tools from your connected MCP servers
smithery tool find "create issue"
smithery tool call github create_issue '{"title":"Bug fix","body":"..."}'
# Browse and install skills
smithery skill search "frontend" --json --page 2
smithery skill add anthropics/frontend-design --agent claude-code
# Publish your MCP server URL
smithery mcp publish "https://my-mcp-server.com" -n myorg/my-server
git clone https://github.com/smithery-ai/cli
cd cli && pnpm install && pnpm run build
npx . --help
Contributions welcome! Please submit a Pull Request.
FAQs
An NPX command to install and list Model Context Protocols from Smithery
The npm package @smithery/cli receives a total of 28,214 weekly downloads. As such, @smithery/cli popularity was classified as popular.
We found that @smithery/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.