
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
helldivers2-mcp
Advanced tools
A stateless Model Context Protocol (MCP) server that exposes live Helldivers 2 galactic war data to LLMs.
Data is sourced from the community API at api.helldivers2.dev.
| Tool | Description |
|---|---|
get_war_status | Aggregated war statistics and a list of active planets with player counts, events, and attacking vectors |
get_assignments | Active Major Orders — tasks, rewards, progress, and deadlines |
get_all_planets | Full planet list with IDs, names, and sectors |
get_planet_details | Detailed per-planet info: biome, hazards, factions, active events, and statistics (up to 5 planets per call) |
get_dispatches | In-game dispatch feed (High Command broadcasts) |
get_steam_news | Recent Steam news articles for Helldivers 2 |
get_space_station_details | Democracy Space Station status, orbital cannon health, and active tactical actions |
X-Super-Contact header (required by the upstream API)cp .env.example .env # set X_SUPER_CONTACT=your@email.com
pnpm install
pnpm dev # hot-reload via tsx watch on :3000
pnpm build # tsc → dist/
pnpm start
docker build -t helldivers2-mcp .
docker run -p 3000:3000 -e X_SUPER_CONTACT=your@email.com helldivers2-mcp
All configuration is via environment variables.
| Variable | Default | Description |
|---|---|---|
X_SUPER_CONTACT | (required) | Forwarded as X-Super-Contact to the upstream API per their usage guidelines |
PORT | 3000 | HTTP port to listen on |
BIND_HOST | 127.0.0.1 | Interface to bind (0.0.0.0 for Docker/containers) |
MCP_ALLOWED_ORIGINS | (unset) | Comma-separated list of allowed browser Origin headers. Unset means browser-originated requests are blocked; server-to-server calls (no Origin header) are always allowed |
MCP_RATE_LIMIT_PER_MIN | 60 | Sustained request rate limit (requests per minute) |
MCP_RATE_LIMIT_BURST | = MCP_RATE_LIMIT_PER_MIN | Burst capacity for the token-bucket rate limiter |
| Method | Path | Description |
|---|---|---|
POST | /mcp | MCP Streamable HTTP transport endpoint |
GET | /health | Liveness check — returns { "ok": true } |
The server uses the stateless Streamable HTTP transport. Each POST /mcp request creates a fresh McpServer + transport pair, handles the request, then tears them down. There is no session state.
Add the server to your claude_desktop_config.json:
{
"mcpServers": {
"helldivers2": {
"command": "node",
"args": ["/path/to/helldivers2-mcp/dist/index.js"],
"env": {
"X_SUPER_CONTACT": "your@email.com"
}
}
}
}
Or, if running as an HTTP server, use the remote URL form (requires an MCP client that supports Streamable HTTP):
{
"mcpServers": {
"helldivers2": {
"url": "http://localhost:3000/mcp"
}
}
}
pnpm test # Jest (ESM mode)
pnpm test:watch
pnpm test:coverage
pnpm lint # ESLint
Run a single test file:
pnpm test src/__tests__/tools.war.test.ts
src/tools/your-tool.ts and export a Tool object with .definition and .handler.TOOLS array in src/index.ts.textResponse(...) on success or errorResponse(...) on failure — never throw from a handler.hd2Fetch (in-memory 2-minute cache + rate-limit-aware queue).FAQs
MCP server exposing live Helldivers 2 galactic war data.
The npm package helldivers2-mcp receives a total of 42 weekly downloads. As such, helldivers2-mcp popularity was classified as not popular.
We found that helldivers2-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.