
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
IMCP is a Node.js SDK for MCP servers, offering a streamlined, powerful experience of managing MCP servers to your agents (e.g. code agents such as Cline/Github Copilot/Roo), through a unified interface – currently we support coding, browser and Bing tools but can expand more. Let’s use it to weapon your agents
IMCP allows you to:
npx -y imcp@latest serve
npm install -g imcp
imcp serve
--verbose: Show detailed logs for all commandsStarts a local web interface for managing MCP servers.
npx -y imcp@latest serve [options]
Options:
-p, --port <port>: Port to run the server on (default: 3000)-f, --feed-file <filepath>: Path to a custom feed configuration file-s, --schemas-directory <path>: Path to a directory containing adhoc schema files-r, --repo <repository>: Git repository URL to sync feeds from-b, --branch <branch>: Git branch to sync feeds from (defaults to main)Example:
# Start the web interface on port 3000
npx -y imcp@latest serve --port 3000
# Start with a custom feed configuration file
npx -y imcp@latest serve --feed-file ./custom-feed.json
# Start with a custom feed configuration file and adhoc schema files.
npx -y imcp@latest serve --feed-file ./custom-feed.json --schemas-directory ./feeds/schemas/ai-coder-tools
# Start with feed from custom repo and branch
npx -y imcp@latest serve --repo https://github.com/ai-microsoft/imcp-feed --branch main
Launch an interactive terminal UI for browsing, searching, and installing/uninstalling MCP servers.
imcp tui
Features:
Tab to switch between modesControls:
↑↓ — Navigate servers/clientsSpace — Toggle selectionTab — Switch between Install/Uninstall mode (step 1) or focus areasEnter — Proceed to next step / ExecuteEsc — Go back / Clear searchq — QuitInstall MCP servers directly from the CLI, either by specifying a single server or by providing a JSON payload that mirrors the web API.
# Install using defaults (all supported clients)
imcp install --name github-tools --clients "MSRooCode"
# Install with explicit client targets and env vars
imcp install --name github-tools \
--clients "MSRooCode;GithubCopilot" \
--envs "GITHUB_TOKEN=abc123;API_KEY=xyz789"
# Reinstall (remove existing configuration first)
imcp install --name github-tools --clients "MSRooCode" --reinstall
Options:
--name <name>: Server name (required unless using a payload)--clients <clients>: Semicolon-delimited list of clients (required unless using a payload)--envs <envs>: Semicolon-delimited KEY=VALUE pairs applied to single-server installs--payload <json>: Inline JSON payload (either a serverList object or a direct { "serverName": { ... } } map)--payload-file <path>: Path to a JSON payload file matching the web API structure-r, --reinstall: Removes existing client configuration and forces requirement packages to reinstall before applying the new configCLI installs block until requirement checks, requirement reinstalls (when requested), and client installers complete, so you always see success/failure inline in the terminal. The web UI continues to track these steps asynchronously via the install operation log.
Supported client keys: MSRooCode, RooCode, Cline, GithubCopilot, ClaudeCode, and (on Windows) VisualStudio.
The CLI automatically resolves each server's category based on the name defined in your feeds, so no --category flag is needed. Run imcp pull if a server name cannot be found locally. When using payloads, ensure each server entry includes a non-empty targetClients array using the keys above.
For details on how to install and publish MCP servers, please refer to the following documents:
MIT
FAQs
Node.js SDK for Model Context Protocol (MCP)
We found that imcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.