
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
byterover-mcp
Advanced tools
Model Context Protocol server for ByteRover - a sharing memory layer for your vibe coding agent
Give Cursor, Windsurf, Cline, and other AI-powered coding agents the shared long term memory so that they can perform the task well together with the relevant context with this Model Context Protocol server.
When Cursor has the knowledge about the codebase; experiences in the past about how it has solved the project's issues with human it's way better and cost effective than re-entering the reasoning loop again.
Many code editors and other AI clients use a configuration file to manage MCP servers.
The byterover-mcp server can be configured by adding the following to your configuration file.
NOTE: You can either provide your Byterover API key and user ID in the configuration or start the server without credentials and configure it later via the API endpoints. Instructions on how to create a Byterover API access token can be found here.
{
"mcpServers": {
"Byterover Memory MCP": {
"command": "npx",
"args": [
"-y",
"byterover-mcp",
"--byterover-public-api-key=YOUR-PUBLIC-KEY",
"--user-id=YOUR-NAME",
"--llm-key-name=YOUR-LLM-KEY-NAME",
"--model=YOUR-LLM-MODEL-NAME"
]
}
}
}
{
"mcpServers": {
"Byterover Memory MCP": {
"command": "cmd",
"args": [
"/c",
"npx",
"-y",
"byterover-mcp",
"--byterover-public-api-key=YOUR-PUBLIC-KEY",
"--user-id=YOUR-NAME",
"--llm-key-name=YOUR-LLM-KEY-NAME",
"--model=YOUR-LLM-MODEL-NAME"
]
}
}
}
If you need more information about Byterover see the Byterover docs.
You can now start the Byterover MCP server without providing the API key and user ID upfront:
# Install the package
npm install -g byterover-mcp
# Start the server without credentials
byterover-mcp
# Start the server on a custom port
byterover-mcp --port 3334
The server will start with limited functionality and provide instructions on how to configure it. By default, the server runs on port 3333, but you can specify a custom port using the --port option as shown above.
Once the server is running, you can configure it using the following API endpoints:
curl -X POST http://localhost:3333/config \
-H "Content-Type: application/json" \
-d '{"byteroverPublicApiKey":"YOUR_API_KEY","userId":"YOUR_USER_ID"}'
curl http://localhost:3333/config/status
If you're running the server directly with Node.js:
# Build the project
npm run build
# Start without credentials
node dist/cli.js
# Start on a custom port
node dist/cli.js --port 3334
# Or start with credentials
node dist/cli.js --byterover-public-api-key=YOUR_API_KEY --user-id=YOUR_USER_ID
# Start with credentials on a custom port
node dist/cli.js --byterover-public-api-key=YOUR_API_KEY --user-id=YOUR_USER_ID --port 3334
# You can also set the port using an environment variable
PORT=3334 node dist/cli.js
FAQs
Model Context Protocol server for ByteRover - a sharing memory layer for your vibe coding agent
We found that byterover-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.