
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
mcp-identification
Advanced tools
A library to identify and parse MCP (Model Context Protocol) server configurations
A TypeScript library to identify and parse MCP (Model Context Protocol) server configurations from various sources including npm packages, Docker images, Python packages, and SSE endpoints.
npm install mcp-identification
import { determineMcpSource, parseMcpJson } from 'mcp-identification';
import type { McpServerSource, ParsedMcpConfig } from 'mcp-identification';
// Example 1: Using determineMcpSource with a complete server config
const serverConfig: McpServerSource = {
sourceId: 'my-server',
name: 'example-server',
type: 'npx',
isRemote: true,
analysisStatus: 'PENDING',
category: 'development',
rawConfig: JSON.stringify({
command: 'npx',
args: ['-y', 'mcp-server@1.2.3']
})
};
const result = determineMcpSource(serverConfig);
console.log(result);
// Output: Server object with parsed sourceId, version info, etc.
// Example 2: Using parseMcpJson directly
const mcpConfig: ParsedMcpConfig = {
command: 'docker',
args: ['run', 'ghcr.io/some-org/mcp-server:latest']
};
const parsedInfo = parseMcpJson(mcpConfig);
console.log(parsedInfo);
// Output: { id: 'ghcr.io/some-org/mcp-server', version: 'latest', type: 'docker' }
The library can parse and identify MCP servers from:
const npxConfig = {
command: 'npx',
args: ['-y', 'mcp-server@1.2.3']
};
// Identifies: { id: 'mcp-server', version: '1.2.3' }
const dockerConfig = {
command: 'docker',
args: ['run', 'ghcr.io/org/mcp-server:v2.0']
};
// Identifies: { id: 'ghcr.io/org/mcp-server', version: 'v2.0' }
const uvxConfig = {
command: 'uvx',
args: ['run', 'my-python-mcp@1.0.0']
};
// Identifies: { id: 'my-python-mcp', version: '1.0.0' }
const sseConfig = {
url: 'https://api.example.com/mcp?token=abc123'
};
// Identifies: { id: 'https://api.example.com/mcp', config: 'full-url-with-token' }
determineMcpSource(server: McpServerSource)Main function to determine the source of an MCP server configuration.
Parameters:
server: Complete MCP server configuration objectReturns: Enhanced server object with parsed source information
parseMcpJson(configJson: ParsedMcpConfig, gitUrl?: string)Parse a raw MCP configuration to extract source information.
Parameters:
configJson: Raw MCP configuration objectgitUrl: Optional Git URL for repository-based MCPsReturns: McpSourceInfo object with parsed details
export type ParsedMcpConfig = {
command?: string;
args?: string[];
url?: string;
};
export type McpSourceInfo = {
id?: string;
version?: string;
type?: McpServerType;
config?: string;
};
export enum McpServerType {
COMMAND = 'command',
SSE = 'sse',
DOCKER = 'docker',
UVX = 'uvx',
UNKNOWN = 'unknown',
NPX = 'npx',
NODE = 'node',
PIP = 'pip',
PYTHON = 'python',
GENERIC = 'generic',
}
# Install dependencies
npm install
# Run tests
npm test
# Build the package
npm run build
# Watch mode for tests
npm run test:watch
# Run the example
npm run example
# Test what files will be included in the package
npm run pack-test
To publish this package to npm:
npm loginnpm publishThe prepublishOnly script will automatically build the package before publishing.
When published, the package will include:
dist/ - Compiled JavaScript and TypeScript definitionsREADME.md - Documentationpackage.json - Package metadataSource files, tests, and development configurations are excluded via .npmignore.
ISC
FAQs
A library to identify and parse MCP (Model Context Protocol) server configurations
We found that mcp-identification demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.