
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
Aoexl exposes a hosted MCP server at https://mcp.aoexl.com/mcp for creating signing requests, checking status, sending reminders, and managing templates from Claude Desktop, Cursor, and other MCP-compatible clients.
This folder now serves two roles:
aoexl-mcp) that lets users connect with npxThe main monorepo can remain private. The public connector metadata now points at the standalone public repo:
https://github.com/rails2track/aoexl-mcp
The public package is intended to be used like this:
AOEXL_API_KEY=your_key_here npx -y aoexl-mcp
The package starts a local stdio proxy via mcp-remote and forwards requests to:
https://mcp.aoexl.com/mcp
create_signing_requestget_signing_request_statuslist_signing_requestssend_signing_remindercancel_signing_requestduplicate_signing_requestreopen_signing_requestlist_templatescreate_request_from_templateget_audit_artifactsThe hosted endpoint expects:
Authorization: Bearer <AOEXL_API_KEY>
Where AOEXL_API_KEY is a customer-owned key generated inside Aoexl Settings → MCP API Keys.
Internally the Worker resolves that API key to a user_id, then performs user-scoped operations against Supabase using the service-role key. This is what makes the connector multi-tenant and safe to distribute.
Install dependencies from the repository root:
npm install
The Worker is configured in wrangler.jsonc and includes:
MCP_OBJECT Durable Object binding required by McpAgentmcp.aoexl.com/*Required Worker secrets:
npx wrangler secret put AOEXL_SUPABASE_ANON_KEY --cwd mcp-connector
npx wrangler secret put AOEXL_SERVICE_ROLE_KEY --cwd mcp-connector
Run locally:
npm run mcp:dev
or directly:
npm run dev --workspace=aoexl-mcp -- --ip 127.0.0.1 --port 8787
Health check:
curl http://127.0.0.1:8787/health
The /mcp endpoint is SSE/streamable HTTP, so a short test looks like:
curl --max-time 2 -i http://127.0.0.1:8787/mcp -H "Authorization: Bearer aok_live_example"
{
"mcpServers": {
"aoexl-sign": {
"command": "npx",
"args": ["-y", "aoexl-mcp"],
"env": {
"AOEXL_API_KEY": "YOUR_API_KEY"
}
}
}
}
mcp-remote alternative{
"mcpServers": {
"aoexl-sign": {
"command": "npx",
"args": [
"-y",
"mcp-remote",
"https://mcp.aoexl.com/mcp",
"--header",
"Authorization: Bearer YOUR_API_KEY"
]
}
}
}
This folder is prepared to publish aoexl-mcp publicly from npm without making the monorepo public.
Sanity check the package:
npm run package:check --workspace=aoexl-mcp
Publish from this folder:
cd mcp-connector
npm publish --access public
Two viable paths:
https://mcp.aoexl.com/mcp directly in Smitherysmithery.yaml in a small public repo that contains only this connectorThe smithery.yaml included here is ready for a repo/package-based install flow that injects AOEXL_API_KEY.
This folder includes server.json, prepared for the current registry model:
mcpName in package.jsonpackages entry for aoexl-mcpremotes entry for https://mcp.aoexl.com/mcpBefore publishing:
https://mcp.aoexl.com/mcp is publicly reachableserver.json points at a real public repoThen publish with the current registry tooling, not the old PR flow.
bin/aoexl-mcp.cjs — npm-exposed stdio wrappersmithery.yaml — Smithery config schema / start commandserver.json — MCP Registry metadataaoexl-mcp.io.github.rails2track/aoexl-sign.server.json and package.json#mcpName.FAQs
Aoexl MCP connector for Claude Desktop, Cursor, and other MCP clients.
The npm package aoexl-mcp receives a total of 33 weekly downloads. As such, aoexl-mcp popularity was classified as not popular.
We found that aoexl-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.