
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@zapier/mcp-integration
Advanced tools
SDK for integrating with Model Context Protocol (MCP) servers, designed for use in Zapier integrations
SDK for integrating with Model Context Protocol (MCP) servers, designed for use in Zapier integrations.
Install the package via npm:
npm install @zapier/mcp-integration
If you're migrating from the embedded MCP SDK in mcp-client-integration
, this package is a drop-in replacement. Simply update your import statement:
Before:
import { Proxy } from '../sdk/index.js';
After:
import { Proxy } from '@zapier/mcp-integration';
All other code remains unchanged. The API is identical, and all functionality is preserved.
You can use @zapier/mcp-integration
in two ways:
In this mode, you use @zapier/mcp-integration
to handle authentication and all or most actions.
Create e.g. src/mcp.ts
with the following content:
import { Proxy } from '@zapier/mcp-integration';
import packageJson from '../package.json' with { type: 'json' };
export const mcp = new Proxy({
name: packageJson.name,
version: packageJson.version,
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
});
Update src/index.ts
to use the singleton:
import { mcp } from './mcp.js';
export default defineApp({
...mcp.app(),
// .. (your actions)
// If you need additional `beforeRequest` middleware:
// beforeRequest: [mcp.beforeRequest(), yourMiddleware],
});
In this mode, you handle authentication yourself, and use @zapier/mcp-integration
for some of the actions.
Create e.g. src/mcp.ts
with the following content:
import { Proxy } from '@zapier/mcp-integration';
import packageJson from '../package.json' with { type: 'json' };
export const mcp = new Proxy({
name: packageJson.name,
version: packageJson.version,
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
auth: {
type: 'oauth',
},
});
Update src/index.ts
to use the singleton:
import { mcp } from './mcp.js';
export default defineApp({
...mcp.app({ handleAuth: false }),
authentication: yourAuthConfig,
// .. (your actions)
});
Use the singleton to call a tool:
import { mcp } from './mcp.js';
const perform = async (z: ZObject, bundle: Bundle) => {
const result = await mcp.callTool({
name: 'my_tool',
arguments: {
hello: 'world',
},
// Override these default options as needed:
// parse: true,
// error: true,
// filter: "content[0].json",
});
return result;
};
// Action configuration, leveraging perform
Use z.request()
as normally, as unless you have called mcp.app
with { handleAuth: false }
, it will have injected beforeRequest
middleware to inject tokens into requests.
The Proxy class supports multiple authentication methods:
import { Proxy } from '@zapier/mcp-integration';
const mcp = new Proxy({
name: 'my-integration',
version: '1.0.0',
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
auth: {
type: 'oauth',
// OAuth configuration handled automatically
},
});
import { Proxy } from '@zapier/mcp-integration';
const mcp = new Proxy({
name: 'my-integration',
version: '1.0.0',
serverUrl: process.env.SERVER_URL,
transport: process.env.TRANSPORT,
auth: {
type: 'bearer',
// Bearer token configuration handled automatically
},
});
Configure how MCP tools are called:
const result = await mcp.callTool({
name: 'my_tool',
arguments: { param: 'value' },
parse: true, // Parse JSON responses (default: true)
error: true, // Throw on MCP errors (default: true)
filter: 'data.items', // JSONata filter expression (optional)
});
The main class for interacting with MCP servers.
new Proxy(config: ProxyConfig)
ProxyConfig:
name: string
- Integration nameversion: string
- Integration versionserverUrl: string
- MCP server URLtransport: string
- Transport protocolauth?: AuthConfig
- Authentication configurationapp(options?: AppOptions): Partial<App>
Returns Zapier app configuration with MCP integration.
AppOptions:
handleAuth?: boolean
- Whether to handle authentication (default: true)callTool(options: CallToolOptions): Promise<any>
Calls an MCP tool with the specified arguments.
CallToolOptions:
name: string
- Tool namearguments: Record<string, any>
- Tool argumentsparse?: boolean
- Parse JSON responses (default: true)error?: boolean
- Throw on errors (default: true)filter?: string
- JSONata filter expressionbeforeRequest(): BeforeRequestMiddleware
Returns middleware for handling authentication in API requests.
Handles Bearer token authentication for API requests.
Handles OAuth 2.0 authentication flow and token management.
convertInputSchemaToFields(schema: any): PlainInputField[]
Converts MCP tool input schemas to Zapier input field format.
isTextContentItem(item: any): boolean
Type guard to check if content item is text-based.
This package is written in TypeScript and includes comprehensive type definitions. All types are automatically available when using TypeScript:
import {
Proxy,
type ProxyConfig,
type CallToolOptions,
} from '@zapier/mcp-integration';
const config: ProxyConfig = {
name: 'my-integration',
version: '1.0.0',
serverUrl: process.env.SERVER_URL!,
transport: process.env.TRANSPORT!,
};
const mcp = new Proxy(config);
ProxyConfig
- Configuration for Proxy constructorCallToolOptions
- Options for calling MCP toolsAuthConfig
- Authentication configurationBeforeRequestMiddleware
- Middleware function typeBundle
- Zapier bundle type (internalized)ZObject
- Zapier z object type (internalized)App
- Zapier app configuration type (internalized)PlainInputField
- Zapier input field type (internalized)This package is part of the Zapier MCP integration project. For issues and contributions, please visit the GitLab repository.
MIT © Zapier
FAQs
SDK for integrating with Model Context Protocol (MCP) servers, designed for use in Zapier integrations
The npm package @zapier/mcp-integration receives a total of 961 weekly downloads. As such, @zapier/mcp-integration popularity was classified as not popular.
We found that @zapier/mcp-integration demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 286 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.