
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
citable-mcp
Advanced tools
MCP server for Citable — SEO and AI-visibility data agents can buy. Tools pay for themselves in USDC on Solana via x402. No API key, nothing stored about you.
MCP server for Citable — SEO and AI-visibility data agents can buy. Each tool pays for itself in USDC on Solana over x402 from a keypair on your machine. No account, no API key, no subscription. $0.005–0.30 per call; failed calls are never charged.
Claude Code
claude mcp add citable -- npx -y citable-mcp
# or the plugin, which adds nine skills on top:
/plugin marketplace add zaialamm/Citable
/plugin install citable@citable
Codex
codex mcp add citable -- npx -y citable-mcp
Cursor / Claude Desktop / any MCP client — mcp.json:
{
"mcpServers": {
"citable": {
"command": "npx",
"args": ["-y", "citable-mcp"],
"env": { "CITABLE_MAX_PRICE": "0.30" }
}
}
}
Requires Node ≥ 20.18. Bun works too: bunx citable-mcp.
Two ways, and the server explains both to the agent on install (citable_prices reports walletMode, balanceUsdc, funded, and setup when empty):
citable_connect and gives you a link: sign in at citable.run with Google or email, add a few dollars, click Connect. The agent then pays from that wallet. The session lives at ~/.config/citable/para-session.json; Para's SDK installs to ~/.config/citable/para on first connect (about 200 MB, once).~/.config/citable/agent.json when first needed. citable_prices shows the address; send it USDC on the Solana network (no SOL needed — the x402 facilitator pays fees), or point CITABLE_WALLET at a funded keypair.Walkthrough: https://citable.run/docs/wallet
| Env | Default | Meaning |
|---|---|---|
CITABLE_WALLET | ~/.config/citable/agent.json | Solana keypair JSON path (or the JSON byte array itself) holding USDC on mainnet; created when first needed if missing |
CITABLE_MAX_PRICE | 0.30 | refuse any single call priced above this many USD; nothing is signed |
CITABLE_API | https://citable.run | base URL (http://localhost:3000 for a local Citable) |
No SOL is needed — the x402 facilitator pays the network fee. Fund the keypair with mainnet USDC.
| Tool | Price | Returns |
|---|---|---|
citable_prices | free | endpoints, prices, this wallet, network, spend cap — call first |
citable_keyword_suggest | $0.005 | autocomplete expansions and questions from Google, YouTube, Bing |
citable_onpage_audit | $0.01 | citability score, 20 checks, ordered topFixes[] |
citable_rank_check | $0.012 | Google position of a domain for a keyword + top 10 |
citable_keyword_research | $0.06 | one seed → keywords + questions with volume, CPC, difficulty, intent |
citable_keyword_ideas | $0.05 | seed → related keywords with volume, CPC, difficulty, intent |
citable_keyword_metrics | $0.03 | volume, CPC, difficulty, intent for 1–20 keywords |
citable_ai_visibility | $0.05/engine | which AI engines cite a domain for a prompt, and who they cite instead |
citable_top_cited_pages | $0.22 | the domain's pages AI answers cite most, with AI search volume |
citable_citability_report | $0.30 | audit + AI visibility + top cited pages in one call |
Every paid result carries _payment.transaction (the on-chain settlement). Calls above the cap or without funds return a structured error and pay nothing.
402 with the price, USDC mint and pay-to address.CITABLE_MAX_PRICE) and retries with the payment header.200 with JSON.The keypair is read from disk and used only to sign these transfers. Nothing else leaves your machine.
https://github.com/zaialamm/Citable — mcp/server.ts. MIT.
FAQs
MCP server for Citable — SEO and AI-visibility data agents can buy. Tools pay for themselves in USDC on Solana via x402. No API key, nothing stored about you.
The npm package citable-mcp receives a total of 42 weekly downloads. As such, citable-mcp popularity was classified as not popular.
We found that citable-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.