
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
chatgenius-mcp
Advanced tools
MCP server for ChatGenius: give Claude, Cursor, Gemini CLI or any MCP client tools over your Instagram, Facebook, WhatsApp and SMS inbox, contacts, appointments, flows, posts and knowledge base.
An MCP server for ChatGenius. Add it to Claude Desktop, Claude Code, Cursor, Zed, Gemini CLI or any client that speaks the Model Context Protocol, and your assistant can read and act on your Instagram, Facebook, WhatsApp and SMS inbox, contacts, appointments, flows, comment automation, Content Studio posts and knowledge base.
It is a thin wrapper over the ChatGenius REST API. Every tool is one API call. Nothing is stored, nothing runs on our side, and your API key never leaves your machine.
Prefer not to run anything? The same tools are hosted at https://sumgenius.ai/api/mcp with a Connect button (OAuth): paste that URL into claude.ai, ChatGPT, Cursor or any client that takes a remote MCP server. Docs: https://sumgenius.ai/docs/mcp
You need Node 18 or newer and a ChatGenius API key. Create the key in the portal under Webhook + Send API, Credentials (the Webhook & API add-on is required).
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"chatgenius": {
"command": "npx",
"args": ["-y", "chatgenius-mcp"],
"env": { "CHATGENIUS_API_KEY": "sgwh_..." }
}
}
}
Claude Code (plugin, prompts for the key):
claude plugin marketplace add SumCodeAI/chatgenius-claude-plugin
claude plugin install chatgenius@sumgenius
Cursor, Zed, Windsurf and the rest take the same command, args and env in their own MCP settings.
| Variable | Required | Meaning |
|---|---|---|
CHATGENIUS_API_KEY | yes | Your API key. Its scope (read, write, admin) caps what the tools can do. |
CHATGENIUS_MAX_SCOPE | no | read, write or admin. Hides every tool above that scope, so a write key with CHATGENIUS_MAX_SCOPE=read gives a read-only assistant. |
CHATGENIUS_API_URL | no | Base URL. Defaults to https://sumgenius.ai/api/v1. |
61 tools in nine groups. Read tools are safe to run freely. Write tools create or edit records. Destructive tools reach a real person, publish content or change what runs live, and are marked so the client asks you first.
| Group | Tools |
|---|---|
| Account | get_account, get_overview |
| Contacts | list_contacts, get_contact, upsert_contact, update_contact, list_tags, create_tag, tag_contact, untag_contact |
| Inbox | list_conversations, get_conversation, list_messages, update_conversation, send_message |
| Appointments | list_appointments, get_availability, book_appointment, reschedule_appointment, cancel_appointment |
| Flows | list_flows, get_flow, get_flow_definition, get_flow_node_catalogue, validate_flow, create_flow, update_flow, publish_flow, activate_flow, pause_flow, get_flow_analytics, list_flow_sessions |
| Comments | list_comment_triggers, get_comment_trigger_stats, list_recent_posts, list_handled_comments, approve_comment_reply, reject_comment_reply |
| Content Studio | list_posts, get_post, get_posting_capabilities, create_post, update_post, schedule_post, publish_post |
| Market Intel | list_competitors, get_competitor, get_competitor_leaderboard, get_follower_history, get_wins_and_opportunities, get_audience_demographics, get_top_posts, get_account_insights, add_competitor, remove_competitor, refresh_market_intel |
| Knowledge base | list_faqs, create_faq, update_faq, list_services, list_knowledge_gaps |
Things to try:
Building a flow works the way a developer would do it: the assistant reads the node catalogue, writes a definition, validates it until the errors list is empty, saves a draft, and publishes when you say so. Open the flow in the portal and it is laid out on the canvas.
Idempotency-Key, so a retried tool call cannot double-send.CHATGENIUS_MAX_SCOPE is a second, local cap.npm install
npm run build:tools # regenerate tools.json from the live OpenAPI spec
npm run check # fail if tools.json drifted from the spec
CHATGENIUS_API_KEY=... npm run smoke
src/tools.js is the curated tool table. tools.json is generated from it plus https://sumgenius.ai/api/v1/openapi.json and is what ships. Add a tool to the table, run build:tools, commit both.
MIT. Made by SumGeniusAI LLC, Las Vegas.
FAQs
MCP server for ChatGenius: give Claude, Cursor, Gemini CLI or any MCP client tools over your Instagram, Facebook, WhatsApp and SMS inbox, contacts, appointments, flows, posts and knowledge base.
We found that chatgenius-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.