
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A Model Context Protocol (MCP) server that exposes Dart SDK commands to Cline and Windsurf (Codium IDE). This tool bridges the gap between AI-powered coding assistants and Dart/Flutter development workflows.
This MCP server wraps the Dart SDK command-line tools and exposes them as MCP tools that can be used by any MCP client, including Cline and Windsurf. It supports the following Dart commands:
dart analyze - Analyze Dart code for errors, warnings, and lintsdart compile - Compile Dart to various formats (exe, AOT/JIT snapshots, JavaScript)dart create - Create new Dart projects from templatesdart doc - Generate API documentation for Dart projectsdart fix - Apply automated fixes to Dart source codedart format - Format Dart source code according to style guidelinesdart info - Show diagnostic information about the installed Dart toolingdart pub - Work with packages (get, add, upgrade, outdated, etc.)dart run - Run Dart programs with support for passing argumentsdart test - Run tests with support for filtering and reporting optionsThis MCP server automatically converts relative paths to absolute paths, ensuring that commands work correctly regardless of the current working directory. The server:
# Using npm
npm install dart_mcp --save-dev
# Using pnpm (recommended)
pnpm add dart_mcp -D
# Clone the repository
git clone https://github.com/yourusername/dart_mcp.git
cd dart_mcp
# Install dependencies using pnpm
pnpm install
# Build the project
pnpm run build
Run the MCP server directly:
pnpm start
This starts the server in stdio mode, which can be used with MCP clients that support stdio transport.
Add the following to your mcp_config.json:
{
"mcpServers": {
"dart": {
"command": "npx",
"args": [
"-y",
"dart_mcp"
]
}
}
}
For developers working on the MCP server:
{
"mcpServers": {
"dart": {
"command": "node",
"args": [
"/path/to/dart_mcp/dist/index.js"
]
}
}
}
Analyze Dart code in a directory or file.
{
path?: string; // Directory or file to analyze
options?: string[]; // Additional options for the dart analyze command
}
Example:
{
path: "lib",
options: ["--fatal-infos", "--fatal-warnings"]
}
Compile Dart to various formats.
{
format: 'exe' | 'aot-snapshot' | 'jit-snapshot' | 'kernel' | 'js'; // Output format
path: string; // Path to the Dart file to compile
output?: string; // Output file path
options?: string[]; // Additional compilation options
}
Example:
{
format: "exe",
path: "bin/main.dart",
output: "bin/app"
}
Create a new Dart project.
{
template: 'console' | 'package' | 'server-shelf' | 'web'; // Project template
projectName: string; // Name of the project to create
output?: string; // Directory where to create the project
options?: string[]; // Additional project creation options
}
Example:
{
template: "package",
projectName: "my_dart_library",
output: "projects"
}
Generate API documentation for Dart projects.
{
path?: string; // Directory containing the Dart package to document
output?: string; // Output directory for the generated documentation
options?: string[]; // Additional documentation options
}
Example:
{
path: ".",
output: "doc/api"
}
Apply automated fixes to Dart source code.
{
path?: string; // Directory or file to apply fixes to
apply?: boolean; // Whether to apply the suggested fixes (default: true)
options?: string[]; // Additional fix options
}
Example:
{
path: "lib",
apply: true,
options: ["--pedantic"]
}
Idiomatically format Dart source code.
{
paths: string[]; // Files or directories to format
setExitIfChanged?: boolean; // Return exit code 1 if there are formatting changes (default: false)
options?: string[]; // Additional format options
}
Example:
{
paths: ["lib", "test"],
setExitIfChanged: true,
options: ["--line-length=80"]
}
Show diagnostic information about the installed tooling.
{
options?: string[]; // Additional info options
}
Example:
{
options: ["--verbose"]
}
Work with packages (pub commands).
{
command: 'get' | 'upgrade' | 'outdated' | 'add' | 'remove' | 'publish' | 'deps' | 'downgrade' | 'cache' | 'run' | 'global'; // Pub subcommand
args?: string[]; // Arguments for the pub subcommand
workingDir?: string; // Working directory for the command
}
Examples:
// Add a package
{
command: "add",
args: ["rxdart"],
workingDir: "my_project"
}
// Get dependencies
{
command: "get",
workingDir: "my_project"
}
Run a Dart program.
{
script: string; // Path to the Dart script to run
args?: string[]; // Arguments to pass to the script
workingDir?: string; // Working directory for the command
}
Example:
{
script: "bin/main.dart",
args: ["--verbose"],
workingDir: "my_project"
}
Run tests for a project.
{
path?: string; // Path to the test file or directory
options?: string[]; // Additional test options
workingDir?: string; // Working directory for the command
}
Example:
{
path: "test",
options: ["--coverage", "--name=auth"],
workingDir: "my_project"
}
# Watch mode for development
pnpm run dev
# Build for production
pnpm run build
The server implements comprehensive error handling:
Please see CONTRIBUTING.md for detailed contribution guidelines.
Our commit format follows:
<type>[optional scope]: [JIRA-123(optional)] <description>
Example:
feat(tools): [DART-456] add support for dart test tags
MIT
FAQs
MCP server for Dart SDK commands
We found that dart_mcp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.