
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
MCP aggregator - aggregate multiple MCPs behind a single interface to reduce context pollution for AI agents.
Instead of exposing 20+ MCP tools directly to your AI agent, mcpcute provides a two-level hierarchy with just 7 tools:
npm install -g mcpcute
# or
bun add -g mcpcute
# or
npx mcpcute
Create a mcpcute.config.json file in your working directory (or set MCPCUTE_CONFIG env var to point to your config file):
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp"]
},
"fetch": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-fetch"]
}
}
}
Add to your claude_desktop_config.json:
{
"mcpServers": {
"mcpcute": {
"command": "npx",
"args": ["-y", "mcpcute"],
"env": {
"MCPCUTE_CONFIG": "/path/to/your/mcpcute.config.json"
}
}
}
}
Add to your Claude Code MCP settings:
{
"mcpServers": {
"mcpcute": {
"command": "npx",
"args": ["-y", "mcpcute"],
"env": {
"MCPCUTE_CONFIG": "/path/to/your/mcpcute.config.json"
}
}
}
}
# With global install
mcpcute
# Or with npx
npx mcpcute
# With custom config path
MCPCUTE_CONFIG=/path/to/config.json npx mcpcute
list_mcps or search_mcps to discover available MCPs (no connections needed)get_mcp_details or list_tools to explore an MCP's capabilities (connects on-demand)search_tools to find tools across all MCPs or scoped to oneget_tool_details to get the full schema for a toolexecute_tool (with mcp_name, tool_name, and arguments) to run the toolThis reduces the initial context from potentially hundreds of tool schemas to just 7 simple tools, and startup is instant regardless of how many MCPs you configure.
mcpcute persists the discovered tool list for each MCP to disk so future runs can answer tool discovery requests without reconnecting to every server. The cache lives in:
${XDG_CACHE_HOME:-~/.cache}/mcpcute%LOCALAPPDATA%/mcpcute/cacheOverride the location with MCPCUTE_CACHE_DIR. Cached entries are automatically invalidated whenever the command, arguments, or environment for a server change in mcpcute.config.json.
1. search_mcps("file") → finds "filesystem" MCP
2. list_tools("filesystem") → shows all filesystem tools
3. get_tool_details("read_file") → see how to use it
4. execute_tool({ mcp_name: "filesystem", tool_name: "read_file", arguments: { path: "/tmp/example.txt" } }) → run it
1. list_mcps() → see all configured MCPs
2. get_mcp_details("fetch") → learn about this MCP
3. list_tools("fetch") → see what it can do
MIT
FAQs
MCP aggregator - aggregate multiple MCPs behind a single interface
We found that mcpcute demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.