
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@yepcode/mcp-server
Advanced tools

An MCP (Model Context Protocol) server that enables AI platforms to interact with YepCode's infrastructure. Run LLM generated scripts and turn your YepCode processes into powerful tools that AI assistants can use directly.
YepCode MCP server can be integrated with AI platforms like Cursor or Claude Desktop using either a remote approach (we offer a hosted version of the MCP server) or a local approach (NPX or Docker installation is required).
For both approaches, you need to get your YepCode API credentials:
Settings > API credentials to create a new API token.{
"mcpServers": {
"yepcode-mcp-server": {
"url": "https://cloud.yepcode.io/mcp/sk-c2E....RD/sse"
}
}
}
{
"mcpServers": {
"yepcode-mcp-server": {
"url": "https://cloud.yepcode.io/mcp/sse",
"headers": {
"Authorization": "Bearer <sk-c2E....RD>"
}
}
}
}
Make sure you have Node.js installed (version 18 or higher), and use a configuration similar to the following:
{
"mcpServers": {
"yepcode-mcp-server": {
"command": "npx",
"args": ["-y", "@yepcode/mcp-server"],
"env": {
"YEPCODE_API_TOKEN": "your_api_token_here"
}
}
}
}
docker build -t yepcode/mcp-server .
{
"mcpServers": {
"yepcode-mcp-server": {
"command": "docker",
"args": [
"run",
"-d",
"-e",
"YEPCODE_API_TOKEN=your_api_token_here",
"yepcode/mcp-server"
]
}
}
}
Debugging MCP servers can be tricky since they communicate over stdio. To make this easier, we recommend using the MCP Inspector, which you can run with the following command:
npm run inspector
This will start a server where you can access debugging tools directly in your browser.
The MCP server provides several tools to interact with YepCode's infrastructure:
Executes code in YepCode's secure environment.
// Input
{
code: string; // The code to execute
options?: {
language?: string; // Programming language (default: 'javascript')
comment?: string; // Execution context
settings?: Record<string, unknown>; // Runtime settings
}
}
// Response
{
returnValue?: unknown; // Execution result
logs?: string[]; // Console output
error?: string; // Error message if execution failed
}
YepCode MCP server supports the following options:
runCodeCleanup: Skip the run_code cleanup. By default, run_code processes source code is removed after execution. If you want to keep it for audit purposes, you can use this option.Options can be passed as a comma-separated list in the YEPCODE_MCP_OPTIONS environment variable.
You can control which tools are enabled by setting the YEPCODE_MCP_TOOLS environment variable with a comma-separated list of tool categories and process tags:
Built-in tool categories:
run_code: Enables the code execution toolexecutions: Enables execution management toolsenv_vars: Enables environment variable management toolsstorage: Enables storage management toolsProcess tags:
mcp-tool, core, api, automation, etc.)run_ycp_<process_slug> (or run_ycp_<process_id> if the name is longer than 60 characters)If not specified, all built-in tools are enabled by default, but no process tools will be exposed.
// SSE server configuration with options
{
"mcpServers": {
"yepcode-mcp-server": {
"url": "https://cloud.yepcode.io/mcp/sk-c2E....RD/sse?mcpOptions=runCodeCleanup&tools=run_code,storage,env_vars,core,api"
}
}
}
// NPX configuration with options
{
"mcpServers": {
"yepcode-mcp-server": {
"command": "npx",
"args": ["-y", "@yepcode/mcp-server"],
"env": {
"YEPCODE_API_TOKEN": "your_api_token_here",
"YEPCODE_MCP_OPTIONS": "runCodeCleanup",
"YEPCODE_MCP_TOOLS": "run_code,storage,env_vars,core,api"
}
}
}
}
Example scenarios:
YEPCODE_MCP_TOOLS=run_code,storage - Only enables built-in code execution and storage toolsYEPCODE_MCP_TOOLS=core,automation - Only exposes processes tagged with "core" or "automation" as toolsYEPCODE_MCP_TOOLS=run_code,storage,core - Enables built-in tools plus all processes tagged with "core"Sets an environment variable in the YepCode workspace.
// Input
{
key: string; // Variable name
value: string; // Variable value
isSensitive?: boolean; // Whether to mask the value in logs (default: true)
}
Removes an environment variable from the YepCode workspace.
// Input
{
key: string; // Name of the variable to remove
}
YepCode provides a built-in storage system that allows you to upload, list, download, and delete files. These files can be accessed from your code executions using the yepcode.storage helper methods.
Lists all files in your YepCode storage.
// Input
{
prefix?: string; // Optional prefix to filter files
}
// Response
{
files: Array<{
filename: string; // File name or path
size: number; // File size in bytes
lastModified: string; // Last modification date
}>;
}
Uploads a file to YepCode storage.
// Input
{
filename: string; // File path (e.g., 'file.txt' or 'folder/file.txt')
content: string | { // File content
data: string; // Base64 encoded content for binary files
encoding: "base64";
};
}
// Response
{
success: boolean; // Upload success status
filename: string; // Uploaded file path
}
Downloads a file from YepCode storage.
// Input
{
filename: string; // File path to download
}
// Response
{
filename: string; // File path
content: string; // File content (base64 for binary files)
encoding?: string; // Encoding type if binary
}
Deletes a file from YepCode storage.
// Input
{
filename: string; // File path to delete
}
// Response
{
success: boolean; // Deletion success status
filename: string; // Deleted file path
}
The MCP server can expose your YepCode Processes as individual MCP tools, making them directly accessible to AI assistants. This feature is enabled by specifying process tags in the YEPCODE_MCP_TOOLS environment variable.
How it works:
core, api, automation, mcp-tool, etc.)YEPCODE_MCP_TOOLS environment variableThere will be a tool for each exposed process: run_ycp_<process_slug> (or run_ycp_<process_id> if tool name is longer than 60 characters).
For more information about process tags, see our process tags documentation.
// Input
{
parameters?: any; // This should match the input parameters specified in the process
options?: {
tag?: string; // Process version to execute
comment?: string; // Execution context
};
synchronousExecution?: boolean; // Whether to wait for completion (default: true)
}
// Response (synchronous execution)
{
executionId: string; // Unique execution identifier
logs: string[]; // Process execution logs
returnValue?: unknown; // Process output
error?: string; // Error message if execution failed
}
// Response (asynchronous execution)
{
executionId: string; // Unique execution identifier
}
Retrieves the result of a process execution.
// Input
{
executionId: string; // ID of the execution to retrieve
}
// Response
{
executionId: string; // Unique execution identifier
logs: string[]; // Process execution logs
returnValue?: unknown; // Process output
error?: string; // Error message if execution failed
}
This project is licensed under the MIT License - see the LICENSE file for details.
FAQs
MCP server for YepCode
The npm package @yepcode/mcp-server receives a total of 28 weekly downloads. As such, @yepcode/mcp-server popularity was classified as not popular.
We found that @yepcode/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.