
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
low-code-mcp-stdio
Advanced tools
这是一个基于 Model Context Protocol (MCP) 的服务器项目,支持与 Cursor 等 AI 编辑器进行流式通信。
项目使用 StreamableHTTPServerTransport 来实现流式通信:
const transport = new StreamableHTTPServerTransport({
sessionIdGenerator: () => randomUUID(),
onsessioninitialized: (sessionId) => {
transports[sessionId] = transport;
},
});
每个 Cursor 连接都有唯一的 sessionId,通过会话管理确保流式通信的连续性:
const transports: { [sessionId: string]: StreamableHTTPServerTransport } = {};
工具通过标准的 MCP 接口返回内容,流式传输由传输层自动处理:
server.registerTool(
"tool-name",
{
description: "工具描述",
inputSchema: {
// 输入参数定义
}
},
async (args, { signal }) => {
// 工具逻辑实现
return {
content: [
{
type: "text",
text: "返回的内容"
}
]
};
}
);
MCP 协议本身支持流式传输,当使用 StreamableHTTPServerTransport 时:
// 支持取消操作
async ({ message }, { signal }) => {
if (signal?.aborted) {
// 处理取消逻辑
return;
}
// 工具逻辑
return {
content: [
{
type: "text",
text: "处理结果"
}
]
};
}
# 安装依赖
pnpm install
# 开发模式运行
pnpm dev
# 生产模式运行
pnpm start
# 测试服务器
pnpm test
服务器将在 http://localhost:8000/low-code-mcp 启动。
{
"mcpServers": {
"low-code-mcp": {
"command": "node",
"args": ["/path/to/your/project/dist/index.js"],
"env": {
"NODE_ENV": "production"
}
},
"low-code-mcp-streamable": {
"transport": "http",
"url": "http://localhost:8000/low-code-mcp?name=1",
"name": "low-code-mcp",
"version": "1.0.0"
},
}
}
hello-world: 获取一个打招呼的方式stream-demo: 演示流式返回结果的工具advanced-stream: 高级流式工具,演示长时间任务和进度更新real-time-data: 实时数据流工具,模拟数据采集要添加新工具,只需:
src/tools/ 目录下创建新的工具文件src/index.ts 中注册工具FAQs
low-code-mcp-stdio
We found that low-code-mcp-stdio demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.