
Research
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@smithery/gateway
Advanced tools

Supergateway runs a MCP stdio-based servers over SSE (Server-Sent Events) with one command. This is useful for remote access, debugging, or connecting to SSE-based clients when your MCP server only speaks stdio.
Supported by superinterface.ai and supercorp.ai.
Run Supergateway via npx:
npx -y supergateway --stdio "uvx mcp-server-git"
--port 8000: Port to listen on (default: 8000)--stdio: Command that runs an MCP server over stdioOnce started:
GET http://localhost:8000/ssePOST http://localhost:8000/messagenpx -y supergateway --port 8000 \
--stdio "npx -y @modelcontextprotocol/server-filesystem /Users/MyName/Desktop"
npx @modelcontextprotocol/inspector --uri http://localhost:8000/sse
You can then read resources, list tools, or run other MCP actions through Supergateway.You can use ngrok to share your local MCP server with remote clients:
npx -y supergateway --port 8000 \
--stdio "npx -y @modelcontextprotocol/server-filesystem ."
# In another terminal:
ngrok http 8000
ngrok then provides a public URL.
Model Context Protocol standardizes how AI tools exchange data. If your MCP server only speaks stdio, Supergateway exposes an SSE-based interface so remote clients (and tools like MCP Inspector) can connect without extra server changes.
Issues and PRs are welcome. Please open one if you have ideas or encounter any problems.
FAQs
Run MCP stdio servers over SSE
The npm package @smithery/gateway receives a total of 2 weekly downloads. As such, @smithery/gateway popularity was classified as not popular.
We found that @smithery/gateway demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.