
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Local MCP client that syncs your ~/.claude/CLAUDE.md file to the Borg MCP cloud service.
~/.claude/CLAUDE.md and auto-syncs changes to cloudcd client
npm install
npm run build
Create a .env file or export these variables:
export GOOGLE_CLIENT_ID="your-client-id.apps.googleusercontent.com"
export GOOGLE_CLIENT_SECRET="your-client-secret"
Add the client to your Claude Code MCP configuration file at ~/.config/claude/mcp_config.json:
{
"mcpServers": {
"borg-mcp": {
"command": "node",
"args": [
"/absolute/path/to/mcp-claude-md-storage/client/dist/index.js"
],
"env": {
"GOOGLE_CLIENT_ID": "your-client-id.apps.googleusercontent.com",
"GOOGLE_CLIENT_SECRET": "your-client-secret"
}
}
}
}
Important: Replace /absolute/path/to/ with the actual path to your project directory.
On first run, the client will prompt you to authenticate:
🔐 Borg MCP Authentication
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📱 Please visit: https://www.google.com/device
🔑 And enter code: XXXX-XXXX
Waiting for authorization...
After authentication, create a subscription:
Tools available:
- subscribe: Create Stripe checkout session ($2/month, 7-day trial)
Use the subscribe tool in Claude Code to get a checkout URL and complete payment.
On startup, the client performs an initial sync:
The client watches ~/.claude/CLAUDE.md for changes:
If both local and remote files have been modified since last sync:
⚠️ SYNC CONFLICT DETECTED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Both local and remote CLAUDE.md have been modified.
Local file: ~/.claude/CLAUDE.md
Remote backup: ~/.claude/CLAUDE.md.conflict
Please resolve manually by choosing one version or merging them.
Delete the .conflict file once resolved.
Resolution Steps:
~/.claude/CLAUDE.md (local) with ~/.claude/CLAUDE.md.conflict (remote).conflict file when doneOnce configured, these tools are available in Claude Code:
Your OAuth token has expired. Re-run the client and follow the authentication flow again.
# Manually trigger re-auth by clearing tokens
node dist/index.js
.conflict file exists at ~/.claude/CLAUDE.md.conflict.conflict file to clear the conflict state~/.claude/CLAUDE.md path existsThe client automatically retries with exponential backoff:
If network is down, edits are queued and will sync once connection is restored.
OAuth tokens are stored using platform-specific secure credential managers:
Tokens are never written to disk in plain text.
npm run dev
npm run build
npm test
┌─────────────────┐
│ Claude Code │
└────────┬────────┘
│ stdio MCP
│
┌────────▼────────┐
│ Borg MCP │◄──┐
│ Client │ │ File Watcher
└────────┬────────┘ │ (chokidar)
│ │
│ ┌──▼──────────────┐
│ │ ~/.claude/ │
│ │ CLAUDE.md │
│ └─────────────────┘
│ HTTPS + Auth
│
┌────────▼────────┐
│ api.borgmcp.ai │
│ (Remote Server) │
└─────────────────┘
MIT
FAQs
Centralized context storage for Claude - install once, sync everywhere
The npm package borgmcp receives a total of 14 weekly downloads. As such, borgmcp popularity was classified as not popular.
We found that borgmcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.