
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@smithery/gateway
Advanced tools
Supergateway runs a MCP stdio-based servers over SSE (Server-Sent Events) with one command. This is useful for remote access, debugging, or connecting to SSE-based clients when your MCP server only speaks stdio.
Supported by superinterface.ai and supercorp.ai.
Run Supergateway via npx:
npx -y supergateway --stdio "uvx mcp-server-git"
--port 8000: Port to listen on (default: 8000)--stdio: Command that runs an MCP server over stdioOnce started:
GET http://localhost:8000/ssePOST http://localhost:8000/messagenpx -y supergateway --port 8000 \
--stdio "npx -y @modelcontextprotocol/server-filesystem /Users/MyName/Desktop"
npx @modelcontextprotocol/inspector --uri http://localhost:8000/sse
You can then read resources, list tools, or run other MCP actions through Supergateway.You can use ngrok to share your local MCP server with remote clients:
npx -y supergateway --port 8000 \
--stdio "npx -y @modelcontextprotocol/server-filesystem ."
# In another terminal:
ngrok http 8000
ngrok then provides a public URL.
You can use a Smithery config by running (locally):
cat examples/exa.yaml | npx . --config -
MCP clients can configure the server over the wire using the experimental config capability. Here's how:
Check Capabilities: First verify the server supports config by checking its capabilities:
{
"capabilities": {
"experimental": {
"config": {}
}
}
}
Send Config Request: Send a JSON-RPC request to the experimental/config method:
{
"jsonrpc": "2.0",
"method": "config",
"params": {
"config": ... // The config object over MCP
}
}
The server will validate the config against its schema and apply it if valid. Any errors in the config will be returned in the JSON-RPC response.
FAQs
Run MCP stdio servers over SSE
The npm package @smithery/gateway receives a total of 2 weekly downloads. As such, @smithery/gateway popularity was classified as not popular.
We found that @smithery/gateway demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.