
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
MCP server for negbit — discover and read curated knowledge bundles (verified provenance, security-reviewed) agents can buy with their own x402 wallet. Read-only: never holds a wallet or moves money.
An MCP server that lets an AI agent discover and read negbit's curated knowledge bundles, then buy them with its own x402 wallet.
negbit is a marketplace where the customers are agents: it sells curated knowledge bundles with verified provenance — each is selected, structured in the Open Knowledge Format, security-reviewed, priced by a published negentropy formula, and paid agent-natively over x402 (HTTP 402 + USDC on Base).
This server never holds a wallet, never signs, never moves money. Every tool only reads negbit's public machine surfaces. The actual purchase is performed by your agent's own x402-capable client against negbit's 402 endpoint — negbit takes no custody; your wallet pays the seller directly on Base. how_to_buy returns the exact live payment contract so your client can execute it.
| Tool | What it does |
|---|---|
search_bundles({ query?, domain? }) | Search the live catalog. No args → browse all. query matches id/title/pitch; domain is an extra keyword (negbit's catalog has no formal domain field). Returns title, id@version, price (USD + micro-USDC), one-line pitch, short sha256, preview URL, security verdict. |
get_bundle({ id }) | Full live catalog record for one bundle (price, sha256, concept/token/file counts, half-life, security scan, URLs, authorization brief). 404-safe. |
get_preview({ id }) | The free preview text — the anti-lemon look-inside (index/README, concept list) so you can judge fit before paying. |
how_to_buy({ id }) | The exact x402 purchase contract, read live from negbit's 402: endpoint, network (eip155:8453, Base mainnet), USDC asset, exact micro-USDC amount, seller pay-to address, plus the verify-sha256 + 90-day-receipt steps. |
negbit://catalog.json — the full live machine catalog.negbit://llms.txt — negbit's agent-facing site guide.Requires Node.js ≥ 18. The server runs over stdio.
{
"mcpServers": {
"negbit": {
"command": "npx",
"args": ["-y", "negbit-mcp"]
}
}
}
Claude Code CLI:
claude mcp add negbit -- npx -y negbit-mcp
git clone https://github.com/ag3ntlab-ai/negbit.git
cd negbit/mcp # (this package)
npm install
npm run build
# then point your client at the built entry:
# "command": "node", "args": ["/absolute/path/to/negbit/mcp/dist/index.js"]
| Env var | Default | Purpose |
|---|---|---|
NEGBIT_BASE_URL | https://negbit.com | Override the base URL (local/staging testing only). |
search_bundles / get_preview to find and vet a bundle (every SKU has a free preview and a sha256).how_to_buy({ id }) returns the live x402 terms.x402-fetch wired to your wallet) GETs https://negbit.com/api/market/{id} → receives 402 with the exact USDC micro-amount → pays on Base mainnet → re-requests → receives the bundle zip.sha256(zip) equals the catalog sha256 for that SKU.X-Negbit-Receipt response header — free re-download of that SKU for 90 days.Each SKU is immutable (id@version pinned to a sha256). The price is computed by negbit's published formula P* = B · min[dEVSI, C_avoided] · 2^(-age/halflife); full terms at negbit.com/market/policy.
npm install
npm run build # tsc -> dist/
node scripts/smoke.mjs # stdio JSON-RPC smoke test (boots the server, drives real calls)
The registry name is io.github.ag3ntlab-ai/negbit (GitHub-namespace verification via the ag3ntlab-ai org). package.json carries the required mcpName, and server.json is the registry manifest. See server.json.
MIT.
FAQs
MCP server for negbit — discover and read curated knowledge bundles (verified provenance, security-reviewed) agents can buy with their own x402 wallet. Read-only: never holds a wallet or moves money.
The npm package negbit-mcp receives a total of 36 weekly downloads. As such, negbit-mcp popularity was classified as not popular.
We found that negbit-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.