
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@webuplink/mcp
Advanced tools
MCP server for WebUplink — give any AI agent the ability to browse and interact with the web.
Give any MCP client the ability to browse and interact with the web via WebUplink.
Add to claude_desktop_config.json:
{
"mcpServers": {
"webuplink": {
"command": "npx",
"args": ["--yes", "--package", "@webuplink/mcp", "webuplink-mcp"],
"env": {
"WEBUPLINK_API_KEY": "wup_your_api_key"
}
}
}
}
Add to .cursor/mcp.json:
{
"mcpServers": {
"webuplink": {
"command": "npx",
"args": ["--yes", "--package", "@webuplink/mcp", "webuplink-mcp"],
"env": {
"WEBUPLINK_API_KEY": "wup_your_api_key"
}
}
}
}
That's it — your AI can now browse and interact with any website.
browseBrowse a web page or execute tools on a page.
| Parameter | Type | Description |
|---|---|---|
url | string | URL to open a new browser session |
session_id | string | Existing session ID to continue browsing |
tool | string | Tool name to execute on the page |
params | object | Parameters for the tool |
include_page_content | boolean | Include detailed page content |
close_sessionClose a browser session to free resources.
| Parameter | Type | Description |
|---|---|---|
session_id | string | Session ID to close |
| Variable | Required | Default | Description |
|---|---|---|---|
WEBUPLINK_API_KEY | ✅ | — | Your WebUplink API key |
WEBUPLINK_BASE_URL | — | https://api.webuplink.ai | API base URL |
PORT | — | 3001 | Local HTTP transport port |
MCP_HTTP_HOST | — | 127.0.0.1 | Local HTTP transport bind address |
MCP_HTTP_ALLOWED_HOSTS | non-loopback HTTP only | loopback names | Comma-separated Host/Origin names accepted by the HTTP boundary |
For a local Streamable HTTP endpoint, invoke the HTTP binary explicitly:
WEBUPLINK_API_KEY=wup_... npx --yes --package @webuplink/mcp webuplink-mcp-http
The server accepts stateless MCP POST requests at /mcp and listens on
127.0.0.1:3001 by default. Set PORT to change the port.
Binding to a non-loopback interface is an explicit opt-in:
WEBUPLINK_API_KEY=wup_... MCP_HTTP_HOST=0.0.0.0 \
MCP_HTTP_ALLOWED_HOSTS=mcp.internal.example \
npx --yes --package @webuplink/mcp webuplink-mcp-http
The listener rejects missing or unlisted Host headers before allocating MCP
resources and applies the same allowlist to browser Origin headers. This
protects the loopback default from DNS rebinding; it is not client
authentication. Every accepted request still uses the single configured
WEBUPLINK_API_KEY, so do not expose the listener directly to an untrusted
network. Put an authenticated boundary in front of it for controlled remote use.
MIT
FAQs
MCP server for WebUplink — give any AI agent the ability to browse and interact with the web.
The npm package @webuplink/mcp receives a total of 22 weekly downloads. As such, @webuplink/mcp popularity was classified as not popular.
We found that @webuplink/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.