
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
mcp-node-red
Advanced tools
MCP server for Node-RED workflow management. Provides AI assistants with 17 tools to manage flows, node modules, context stores, and runtime settings through the Node-RED Admin API v2.
Standalone Node-RED:
claude mcp add node-red -e NODE_RED_URL=http://localhost:1880 -e NODE_RED_TOKEN=your-api-token -- npx mcp-node-red
Home Assistant Add-on (Basic Auth):
claude mcp add node-red -e NODE_RED_URL=http://username:password@homeassistant.local:1880 -- npx mcp-node-red
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or ~/.config/claude/claude_desktop_config.json (Linux):
{
"mcpServers": {
"node-red": {
"command": "npx",
"args": ["mcp-node-red"],
"env": {
"NODE_RED_URL": "http://localhost:1880",
"NODE_RED_TOKEN": "your-api-token"
}
}
}
}
Restart Claude Desktop to load the server.
NODE_RED_URL (required): Your Node-RED instance URLNODE_RED_TOKEN (optional): API token for authenticationThe server loads environment variables from .env and .env.local files in the working directory:
.env -- Base defaults (tracked in version control if desired).env.local -- Local overrides (gitignored, never committed)Precedence (highest to lowest):
.env.local.envCopy .env.example as a starting template:
cp .env.example .env
settings.js:adminAuth: {
type: "credentials",
users: [{
username: "admin",
password: "$2a$08$...", // bcrypt hash
permissions: "*"
}]
}
curl -X POST http://localhost:1880/auth/token \
-H "Content-Type: application/json" \
-d '{"client_id":"node-red-admin","grant_type":"password","scope":"*","username":"admin","password":"your-password"}'
The Home Assistant Node-RED add-on uses Basic Auth with your Home Assistant credentials:
# Test connection
curl http://USERNAME:PASSWORD@homeassistant.local:1880/flows
Configuration:
{
"mcpServers": {
"node-red": {
"command": "npx",
"args": ["mcp-node-red"],
"env": {
"NODE_RED_URL": "http://admin:your-ha-password@homeassistant.local:1880"
}
}
}
}
Note: No NODE_RED_TOKEN needed - credentials are in the URL.
Once configured, ask your AI assistant natural language questions:
Get all flows from my Node-RED instance
Create a new flow with label "Temperature Monitor"
Update flow "flow1" to change its label to "New Name"
Delete the flow with ID "flow1"
What node modules are installed?
Install the node-red-contrib-mqtt module
Trigger the inject node to test my flow
Show me the global context data
Get the Node-RED runtime settings and version
See docs/development.md for development setup, testing, and contribution guidelines.
MIT
FAQs
MCP server for Node-RED workflow management
We found that mcp-node-red demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.