
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@typeship-ax/mcp
Advanced tools
MCP server for typeship. API reference
Generated from the OpenAPI spec by typeship. Change the spec or generation settings, then regenerate; generated files are not hand-edited.
fetch in Node 18+Run these commands in the downloaded or cloned package directory:
npm install
npm run build
Requires Node.js 18+. The package is ESM.
To run the local MCP server, configure your MCP client with node and the absolute path to dist/mcp.js, as shown below. The server communicates over stdio.
Generation does not publish a package. Before using the registry command below, confirm name and version in package.json, publish under a name you control, and verify that release is available on npm.
npm install --global @typeship-ax/mcp@0.10.0
The npm connections below require @typeship-ax/mcp to be published under your package identity. To use downloaded source before publishing, use the local configuration in the next section. Hosted connections require a deployed server.
Authentication: provide TYPESHIP_TOKEN through the MCP client's environment or secret settings. Keep credential values out of URLs and command arguments.
Cursor: Cursor 3.2 is not supported: it opens with the legacy initialize handshake, while this server speaks MCP 2026-07-28.
claude mcp add typeship -- npx -y --package @typeship-ax/mcp typeship-mcpcodex mcp add typeship -- npx -y --package @typeship-ax/mcp typeship-mcpclaude mcp add typeship-readonly -- npx -y --package @typeship-ax/mcp typeship-mcp --read-onlycodex mcp add typeship-readonly -- npx -y --package @typeship-ax/mcp typeship-mcp --read-onlyclaude mcp add --transport http typeship https://typeship.dev/mcpcodex mcp add typeship --url https://typeship.dev/mcpclaude mcp add --transport http typeship-readonly https://typeship.dev/mcp/readonlycodex mcp add typeship-readonly --url https://typeship.dev/mcp/readonlyA zero-dependency stdio server exposing a compact discovery surface: search_docs, read_docs, and execute. Read an operation before executing it to get its complete schema, example arguments, and safety classification. After building, add the local server to an MCP client:
{
"mcpServers": {
"typeship": {
"command": "node",
"args": [
"/absolute/path/to/package/dist/mcp.js"
],
"env": {
"TYPESHIP_TOKEN": "replace-with-your-credential"
}
}
}
}
Replace the path with the absolute path to this package's built dist/mcp.js.
Replace the credential placeholder using the MCP client's secret storage when it has one. The local server reads TYPESHIP_TOKEN from its environment; credentials never belong in command arguments. If you also generated the CLI, its typeship login command stores credentials the local MCP server can reuse.
Tool input schemas are derived from the OpenAPI spec, so agents see real parameter types and required fields. Arguments are checked before anything reaches the API (unknown or mistyped ones come back as one isError result, nothing is dropped), every tool takes fields to keep only the result keys it needs, and errors carry a stable code and next_steps.
Add --read-only to args (or set TYPESHIP_MCP_READ_ONLY=1) for a server that cannot write, --tools generate,projects (or TYPESHIP_MCP_TOOLS) to expose a subset, and TYPESHIP_MCP_MAX_RESULT_CHARS to change the result size cap (64,000).
server.json describes the npm executable and any hosted transports. Its dev.typeship/typeship identity matches package.json#mcpName.
Install the official mcp-publisher, publish this npm package first, then validate or publish the listing:
npm run mcp:validate
npm run mcp:publish
FAQs
MCP server for typeship. Generated by typeship.
We found that @typeship-ax/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.