
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@takehub/mcp
Advanced tools
MCP (Model Context Protocol) server giving AI agents authenticated access to the takehub API — topic create/manage, voting results, AI insights, and invites.
Published on npm as @takehub/mcp.
No API key or config needed — you log in at runtime via the authenticate tool
(browser flow), so every install below works as-is.
Claude Code (one command, no config file):
claude mcp add takehub -- npx -y @takehub/mcp
# --scope user → all your projects
# --scope project → shared, committed to .mcp.json for your team
Claude Desktop — install the one-click .mcpb bundle (see
mcpb/), or add this to claude_desktop_config.json
(~/Library/Application Support/Claude/ on macOS,
%APPDATA%\Claude\ on Windows):
{
"mcpServers": {
"takehub": { "command": "npx", "args": ["-y", "@takehub/mcp"] }
}
}
Any other MCP client — point it at npx -y @takehub/mcp (stdio).
# From repo root
npx turbo run build --filter=@takehub/mcp
# Offline smoke test (asserts the full tool surface boots over stdio)
cd packages/mcp && npm run smoke
By default the server talks to production (api.takehub.app /
takehub.app). Override with VP_API_BASE_URL / VP_CLIENT_BASE_URL to point
at a local or preview backend.
Call the authenticate tool: it opens a browser to the takehub web app, you log
in, and tokens are POSTed back to a temporary localhost callback server. Tokens
are held in memory for the life of the server process — login and any
subsequent tool calls must happen against the same running process. See
src/tools/auth.ts.
.mcp.json points at the local build (intentional)The repo's /.mcp.json registers the takehub server as:
{ "command": "node", "args": ["packages/mcp/dist/index.js"] }
rather than the published package (npx @takehub/mcp). This is deliberate:
in this monorepo we want the MCP server to reflect the code in the working tree
(including in-flight changes on a branch), not whatever version is published to
npm. The trade-off: you must run the build above before the server will start
(or after pulling changes), since it runs dist/, not source.
If you need the released package instead, temporarily switch the command back to
npx @takehub/mcp.
FAQs
MCP server for AI agent access to the takehub API
We found that @takehub/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.