
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@wavespeed/mcp
Advanced tools
WaveSpeed MCP server — run any model on the live WaveSpeed catalog (image, video, audio, 3D) with schema introspection, local-file upload, and price quotes.
An MCP server for the WaveSpeed platform: run any model on the live catalog — image, video, audio, 3D — from Claude Code, Claude Desktop, Cursor, Cline, or any MCP client.
Built on the same design as the open-source @wavespeed/cli:
run_model executes anything; get_model_schema tells the agent what inputs a model actually accepts, so it reads before it writes.@path marker — a "@./photo.jpg" value inside input uploads the file and substitutes its hosted URL. Bare paths are passed through untouched.get_price quotes before you spend and names the inputs the quote was blind to (unpriced_inputs) instead of presenting a formula's floor as "the" price.| Tool | What it does |
|---|---|
list_models | Search the live catalog by text or modality type |
get_model_schema | A model's real input schema (required, properties, defaults) |
run_model | Submit + wait; @path inputs upload automatically; returns output URLs |
get_price | Cost estimate with unpriced_inputs / at_base_price disclosure |
get_balance | Account credit balance |
upload_file | Local file → hosted URL (24h content-hash dedupe) |
get_prediction | Recover status/outputs of any run by id |
If run_model hits its wait limit the task keeps running server-side — the error names the prediction id, and get_prediction picks it up.
Auth resolves from WAVESPEED_API_KEY, or from the CLI's stored login (wavespeed login) — one login covers both tools. Keys: wavespeed.ai/accesskey.
Claude Code
claude mcp add wavespeed -- npx -y @wavespeed/mcp
Claude Desktop / other clients (mcpServers config):
{
"mcpServers": {
"wavespeed": {
"command": "npx",
"args": ["-y", "@wavespeed/mcp"],
"env": { "WAVESPEED_API_KEY": "wsk_..." }
}
}
}
"@./photo.jpg")npm install
npm run dev # run from source (stdio)
npm run lint # typecheck
npm run build # tsc → dist/
FAQs
WaveSpeed MCP server — run any model on the live WaveSpeed catalog (image, video, audio, 3D) with schema introspection, local-file upload, and price quotes.
The npm package @wavespeed/mcp receives a total of 0 weekly downloads. As such, @wavespeed/mcp popularity was classified as not popular.
We found that @wavespeed/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.