
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
goldbean-mcp
Advanced tools
GoldBean MCP Server v2 — Stateless, Edge-Ready. 48 Baidu AI tools (OCR/NLP/Vision/Speech/Translation/Face/Body/Creation/Search/LLM) via HTTP MCP. Zero handshake, zero session, zero SDK dependency. Compatible with MCP 2026-07-28. Deploy to Cloudflare Worke
The first stateless MCP server for Chinese AI APIs. 48 tools across OCR, NLP, Vision, Speech, Translation, Face, Body, LLM (ERNIE/DeepSeek), and more — with zero handshake, zero session management, and zero SDK dependency.
MCP Protocol: 2026-07-28 (v2)
Transport: HTTP POST /mcp (stateless)
Deployment: npx, Cloudflare Workers, Bun, Deno, Node.js 18+
# STDIO mode (for Claude Desktop / Cline / Roo Code)
npx goldbean-mcp
# HTTP mode (for serverless / edge deployment)
npx goldbean-mcp --http --port=9878
# With custom endpoint
GOLDBEAN_API_URL=https://your-goldbean-instance.com npx goldbean-mcp
| Feature | v1 (legacy) | v2 (this) |
|---|---|---|
| Handshake | Required initialize | None — every request is self-contained |
| Session | Server-side state | Stateless — no session ID, no cleanup |
| SDK Dependency | @modelcontextprotocol/sdk | Zero — native fetch only |
| Deploy Target | Node.js daemon | Cloudflare Workers / Deno / Bun |
| Protocol | 2024-11-05 | 2026-07-28 |
| Category | Tools | Pricing |
|---|---|---|
| OCR | 12 types (ID card, business license, handwriting, QR code, table, etc.) | $0.001/call |
| NLP | Sentiment, NER, text similarity, keywords, topic, correction, summary, couplet | $0.001/call |
| Vision | Super-resolution, dehaze, panorama stitching, colorization | $0.001/call |
| Speech | ASR (voice-to-text), TTS (text-to-voice), voice conversion, voice cloning | $0.001/call |
| Translation | General, professional, document (DOCX/PDF/TXT) | $0.001-$0.003/call |
| Face | Detection, verification, search | $0.001/call |
| Body | Pose analysis, segmentation | $0.001/call |
| LLM | ERNIE-Bot-4, ERNIE-Speed, Yi-34B, DeepSeek-V3 chat | $0.001-0.002/1K tokens |
| Search | Web search, knowledge graph | $0.001/call |
| Variable | Default | Description |
|---|---|---|
GOLDBEAN_API_URL | https://goldbean-api.xyz | GoldBean API base URL |
GOLDBEAN_FREE_LIMIT | 50 | Daily free call limit |
See goldbean-workers-template for one-click deployment.
# Using Wrangler
npx wrangler deploy src/index.js
Every request is a standalone JSON-RPC 2.0 POST:
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/list",
"params": {}
}
Response headers include MCP-Protocol-Version: 2026-07-28.
No initialize, no Mcp-Session-Id, no state — just like calling any REST API.
MIT
FAQs
GoldBean MCP Server v2 — Stateless, Edge-Ready. 48 Baidu AI tools (OCR/NLP/Vision/Speech/Translation/Face/Body/Creation/Search/LLM) via HTTP MCP. Zero handshake, zero session, zero SDK dependency. Compatible with MCP 2026-07-28. Deploy to Cloudflare Worke
The npm package goldbean-mcp receives a total of 97 weekly downloads. As such, goldbean-mcp popularity was classified as not popular.
We found that goldbean-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.