
Research
/Security News
Popular Rust Crates Compromised in Build-Time Supply Chain Attack
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.
mcp-google-crux
Advanced tools
MCP server for the Chrome UX Report (CrUX) API — real-user Core Web Vitals (LCP, INP, CLS, TTFB) and 40-week history for any origin or URL. For Claude, Cursor, Codex and other AI clients.
English | Русский
A1 Google CrUX MCP brings real-user Core Web Vitals data into an AI app. Check whether a public site or page passes LCP, INP and CLS, compare mobile with desktop, and see how the metrics changed over time.
It reads Google’s Chrome UX Report dataset — field data collected from Chrome users, not a synthetic speed test or a way to change your site.
no_data is a valid result.Start with a read-only question:
Does
https://example.compass Core Web Vitals on mobile?
Connect the server · Explore use cases · Open technical documentation
You: Does
https://example.com/pricingpass Core Web Vitals on mobile?Assistant: Shows p75 LCP, INP and CLS, their good/needs-improvement/poor ratings and the overall result. Nothing changes.
You: Compare this page with the site average and show how mobile differs from desktop.
Assistant: Compares the origin and URL, then device groups and their traffic shares. All six tools read the public CrUX dataset only.
You need Node.js 20+ and a Google Cloud API key with Chrome UX Report API enabled.
In Settings → Plugins → MCP servers, select Add server, then add npx -y mcp-google-crux@latest with CRUX_API_KEY.
codex mcp add google-crux --env CRUX_API_KEY=your_key -- npx -y mcp-google-crux@latest
codex mcp list
claude mcp add --env CRUX_API_KEY=your_key --transport stdio --scope user google-crux -- npx -y mcp-google-crux@latest
claude mcp list
Open Settings → Developer → Edit Config and add {"mcpServers":{"google-crux":{"command":"npx","args":["-y","mcp-google-crux@latest"],"env":{"CRUX_API_KEY":"your_key"}}}}.
If Edit Config is unavailable, edit ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows. Claude Desktop MCP documentation
Add {"mcpServers":{"google-crux":{"type":"stdio","command":"npx","args":["-y","mcp-google-crux@latest"],"env":{"CRUX_API_KEY":"your_key"}}}} to ~/.cursor/mcp.json on macOS/Linux or %USERPROFILE%\.cursor\mcp.json on Windows. Cursor MCP documentation
Run MCP: Open User Configuration and add:
{"servers":{"google-crux":{"type":"stdio","command":"npx","args":["-y","mcp-google-crux@latest"],"env":{"CRUX_API_KEY":"${input:crux_api_key}"}}},"inputs":[{"type":"promptString","id":"crux_api_key","description":"Google Cloud API key","password":true}]}
Check it with MCP: List Servers. VS Code MCP documentation
CrUX reports a rolling 28-day window, updated daily. Historical data is weekly and updates on Mondays. The key value is p75: 75% of observed visits are at or below it. get_core_web_vitals interprets metric thresholds for you; raw record tools expose full histograms and density fractions.
No data does not mean the site is broken. It means Google has no sufficiently large public Chrome-user sample for that origin, URL or device group. Tablets and individual URLs often have no data.
CRUX_API_KEY.The key is stored in the MCP client configuration and is sent in the API request URL, so treat it as a password.
| Variable | Required | Description |
|---|---|---|
CRUX_API_KEY | Yes | Google Cloud key with Chrome UX Report API enabled. |
CRUX_API_BASE | No | API base URL override. |
CRUX_TIMEOUT_MS | No | Per-request timeout; default 30000 ms. |
CRUX_MAX_RETRIES | No | Retries for 429, 5xx and network failures; default 3. |
429, 5xx and network errors with backoff. Keep compound comparisons in mind when budgeting the 150 queries per minute project quota.ASKADS_TELEMETRY=0 to opt out.Found a bug or need a scenario? Create an issue or write in Telegram.
You made it to the end!
FAQs
MCP server for the Chrome UX Report (CrUX) API — real-user Core Web Vitals (LCP, INP, CLS, TTFB) and 40-week history for any origin or URL. For Claude, Cursor, Codex and other AI clients.
We found that mcp-google-crux demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.