
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
AAIF-verified modern MCP setup optimised to the 2026-07-28 model (BETTER textbook). npm shim downloads the native binary from GitHub Releases.
NONE | GOOD | [BETTER] | BEST
Textbook for AGENTS.md on that scale — honest modern MCP at the BETTER step.
(protocol 2026-07-28 — the modern MCP release)
the book is the app is the book
AAIF-verified modern MCP textbook that runs. Rust · rmcp 3.0.x (lock 3.0.1, Tier 1 assessed) · Discover · stamped list cache.
Book: textbook/ — what · why · how · doctrine.
App: this binary + smokes. Lesson after lesson, version after version — knowledge compounds.
BEST (persistent project DNA for agents — AGENTS.md / FAF at scale) lives at faf.one/agents — one hop up from this textbook.
Cargo stays first. Optional npm is only an on-ramp to the same native binary for npx-style hosts.
→ Why dual-package — positioning + FAQ
→ Full guide (how) — lockstep, publish order, OIDC, score + wire
One Agent Skill (mcp-better-lab) on the same process as tools:
→ docs/SKILLS-OVER-MCP.md — extension · skills/list · skills/get · digests
| Name | What it is |
|---|---|
| 7/28 | The era name — speakable, brandable. “Built for 7/28.” |
| 2026-07-28 | The protocol version — the date string on the wire / in SDKs. |
7/28 is a great name. 2026-07-28 is a date.
Humans say 7/28. Machines negotiate 2026-07-28.
rmcp 3.0.x / Tier-1 assessed cut).| Version | Lesson (the version is the lesson) |
|---|---|
| v0.1 | 7/28 over stdio — Discover, stamped ttlMs / cacheScope, stable order, health + echo |
| v0.2 | Same 7/28 era + Streamable HTTP road + routing headers (Mcp-Method / Mcp-Name) |
| v0.3 | Same era + deeper correctness — multi-list + restart-order smokes · mcp-worse contrast |
| v0.4 | Same era + dual package — cargo + npm shim · npx mcp-better with no Rust toolchain |
| v0.4.3 | Same era + confirm_echo MRTR (SEP-2322) + Agent Skills (mcp-better-lab) — see docs/MRTR-CONFIRM-ECHO.md · docs/SKILLS-OVER-MCP.md |
| v0.4.4 | Same era + book matches 0.4.3 wire — no new tool · catalogs named health → echo → confirm_echo |
| v0.5 | Same era + matching client completes MRTR — mrtr-client finishes confirm_echo |
2026-07-28 only for surfaces you implement and test.ClientLifecycleMode::Discover (or Auto → 7/28), not only legacy initialize.tools/list returns positive ttlMs and cacheScope (static catalog → public). SDK defaults are unstamped.--http) in the same 7/28 era.# No Rust toolchain required. Downloads the native binary from GitHub Releases.
npx mcp-better --help
npx mcp-better
# hosts: point stdio command at `npx` / `mcp-better` from the npm package
git clone https://github.com/Wolfe-Jam/mcp-better.git
cd mcp-better
cargo build --bins
cargo test
cargo run --example stdio-client
# louder 0.3 smokes (build --bins first; or: bash scripts/ci.sh)
MCP_BETTER_BIN="$(pwd)/target/debug/mcp-better" cargo run --example order-restart-smoke
MCP_BETTER_BIN="$(pwd)/target/debug/mcp-better" \
MCP_WORSE_BIN="$(pwd)/target/debug/mcp-worse" \
cargo run --example contrast-smoke
MCP_BETTER_BIN="$(pwd)/target/debug/mcp-better" cargo run --example http-smoke
# 0.5 matching client (completes confirm_echo)
MCP_BETTER_BIN="$(pwd)/target/debug/mcp-better" cargo run --example mrtr-client
stdio (default — Cursor / Claude Desktop):
cargo run --release
# or from crates.io:
cargo install mcp-better --version 0.4.3
mcp-better --help
# optional lying companion (teaching only — not for hosts):
# cargo install mcp-better --version 0.4.3 --bin mcp-worse
# this tree is 0.5.0 (matching client). Registries stay 0.4.3 until tagged.
First cargo install compiles the ecosystem once (not 100+ of our tools — just Rust deps). One-time wait; then you’re done.
Prefer no compile? Usenpx mcp-better(npm shim).
Streamable HTTP (local demo only — see SECURITY.md):
cargo run --release -- --http
# http://127.0.0.1:8787/mcp
# MCP_BETTER_HTTP_ADDR=127.0.0.1:9000 mcp-better --http
Transport selection (CLI wins over env):
| How | Value |
|---|---|
| CLI | mcp-better (stdio) · mcp-better --http · mcp-better --stdio |
| Bare args | http / stdio (same meaning as flags) |
| Env | MCP_TRANSPORT or MCP_BETTER_TRANSPORT → stdio | http (MCP_TRANSPORT first if both set) |
| HTTP bind | MCP_BETTER_HTTP_ADDR — default 127.0.0.1:8787. Do not use 0.0.0.0 unless you accept an unauthenticated open endpoint. |
| Tool | Purpose |
|---|---|
health | Liveness — status, version, protocol. No side effects. Not a k8s probe contract. |
echo | Pure demo — returns message unchanged. |
confirm_echo | Textbook MRTR (SEP-2322) — echo after mid-call confirm · sealed requestState. |
| Surface | Status |
|---|---|
| Era / protocol | 7/28 · negotiated 2026-07-28 (Discover preferred) |
| Transport | stdio (default) · Streamable HTTP (--http) |
| HTTP mode | Stateless for 7/28 · json_response · local Host guards |
| Routing headers | Streamable HTTP POSTs use Mcp-Method and Mcp-Name when naming a tool (SEP-2243); http-smoke asserts this happy path |
| Capabilities | tools · resources (skill docs) · experimental skills extension |
| List cache | ttlMs=60000, cacheScope=public, order health→echo→confirm_echo (restart-stable) |
| MRTR (optional) | confirm_echo — mid-call confirm · sealed requestState · matching client mrtr-client · docs/MRTR-CONFIRM-ECHO.md |
| Skills (optional) | mcp-better-lab · skills/list · digests · docs/SKILLS-OVER-MCP.md |
| Lying companion | mcp-worse — unstamped + reversed order (contrast-smoke only) |
| OAuth / tasks | out of hero |
The book is the app is the book — textbook/ (Season 1 · doctrine).
Start: textbook/README.md → lab Ch 09.
project.faf or any BEST tooling on this repo’s main branchmcp-name: io.github.Wolfe-Jam/mcp-betterregistryType: cargo · identifier: mcp-better · crates.ioregistryType: npm · identifier: mcp-better · registry.npmjs.orgserver.json is stdio only — by design.cargo install / npx mcp-better on stdio.--http) is an opt-in local demo in the same binary and the same 7/28 era; it is not a Registry remote package. Discover it in this README and --help.See server.json. Not one.faf/*.
Ship process: /pubbetter (skill) · short form docs/PUBBETTER.md · local ship bar:
export PATH="$HOME/.cargo/bin:$PATH"
bash scripts/ci.sh
For persistent, versionable AI project context beyond a protocol textbook:
serve vs Discover honestyMIT — see LICENSE.
FAQs
AAIF-verified modern MCP setup optimised to the 2026-07-28 model (BETTER textbook). npm shim downloads the native binary from GitHub Releases.
The npm package mcp-better receives a total of 257 weekly downloads. As such, mcp-better popularity was classified as not popular.
We found that mcp-better demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.