
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@typeship-ax/mcp
Advanced tools
MCP server for typeship. API reference
Generated from the OpenAPI spec by typeship. Change the spec or generation settings, then regenerate; generated files are not hand-edited.
fetch in Node 18+Run these commands in the downloaded or cloned package directory:
npm install
npm run build
Requires Node.js 18+. The package is ESM.
To run the local MCP server, configure your MCP client with node and the absolute path to dist/mcp.js, as shown below. The server communicates over stdio.
Generation does not publish a package. Before using the registry command below, confirm name and version in package.json, publish under a name you control, and verify that release is available on npm.
npm install --global @typeship-ax/mcp@0.10.0
The npm connections below require @typeship-ax/mcp to be published under your package identity. To use downloaded source before publishing, use the local configuration in the next section. Hosted connections require a deployed server.
Authentication: provide TYPESHIP_TOKEN through the MCP client's environment or secret settings. Keep credential values out of URLs and command arguments.
Cursor: Cursor 3.2 is not supported: it opens with the legacy initialize handshake, while this server speaks MCP 2026-07-28.
claude mcp add typeship -- npx -y --package @typeship-ax/mcp typeship-mcpcodex mcp add typeship -- npx -y --package @typeship-ax/mcp typeship-mcpclaude mcp add typeship-readonly -- npx -y --package @typeship-ax/mcp typeship-mcp --read-onlycodex mcp add typeship-readonly -- npx -y --package @typeship-ax/mcp typeship-mcp --read-onlyclaude mcp add --transport http typeship https://typeship.dev/mcpcodex mcp add typeship --url https://typeship.dev/mcpclaude mcp add --transport http typeship-readonly https://typeship.dev/mcp/readonlycodex mcp add typeship-readonly --url https://typeship.dev/mcp/readonlyA zero-dependency stdio server exposing a compact discovery surface: search_docs, read_docs, and execute. Read an operation before executing it to get its complete schema, example arguments, and safety classification. After building, add the local server to an MCP client:
{
"mcpServers": {
"typeship": {
"command": "node",
"args": [
"/absolute/path/to/package/dist/mcp.js"
],
"env": {
"TYPESHIP_TOKEN": "replace-with-your-credential"
}
}
}
}
Replace the path with the absolute path to this package's built dist/mcp.js.
Replace the credential placeholder using the MCP client's secret storage when it has one. The local server reads TYPESHIP_TOKEN from its environment; credentials never belong in command arguments. If you also generated the CLI, its typeship login command stores credentials the local MCP server can reuse.
Tool input schemas are derived from the OpenAPI spec, so agents see real parameter types and required fields. Arguments are checked before anything reaches the API (unknown or mistyped ones come back as one isError result, nothing is dropped), every tool takes fields to keep only the result keys it needs, and errors carry a stable code and next_steps.
Add --read-only to args (or set TYPESHIP_MCP_READ_ONLY=1) for a server that cannot write, --tools generate,projects (or TYPESHIP_MCP_TOOLS) to expose a subset, and TYPESHIP_MCP_MAX_RESULT_CHARS to change the result size cap (64,000).
server.json describes the npm executable and any hosted transports. Its dev.typeship/typeship identity matches package.json#mcpName.
Install the official mcp-publisher, publish this npm package first, then validate or publish the listing:
npm run mcp:validate
npm run mcp:publish
FAQs
MCP server for typeship.
The npm package @typeship-ax/mcp receives a total of 36 weekly downloads. As such, @typeship-ax/mcp popularity was classified as not popular.
We found that @typeship-ax/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.