
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
中文版 | English

一个基于Model Context Protocol (MCP)的服务器,用于将文件上传到阿里云OSS。此服务器使大型语言模型能够直接将文件上传到阿里云对象存储服务。
OSS MCP服务器能够与其他MCP工具无缝集成,为您提供强大的工作流程:
您可以通过npm或从源码安装:
# 使用npm全局安装
npm install -g oss-mcp
# 或使用pnpm全局安装
pnpm add -g oss-mcp
# 直接启动 (stdio模式)
oss-mcp --oss-config='{\"default\":{\"region\":\"oss-cn-shenzhen\",\"accessKeyId\":\"YOUR_KEY\",\"accessKeySecret\":\"YOUR_SECRET\",\"bucket\":\"i18n-bucket\",\"endpoint\":\"oss-cn-shenzhen.aliyuncs.com\"}}'
# 使用Inspector调试
oss-mcp --oss-config='{ "region": "oss-cn-shenzhen", "accessKeyId": "YOUR_KEY", "accessKeySecret": "YOUR_SECRET", "bucket": "BUCKET_NAME", "endpoint": "oss-cn-shenzhen.aliyuncs.com" }' --inspect
# 克隆仓库
git clone https://github.com/1yhy/oss-mcp.git
cd oss-mcp
# 安装依赖
pnpm install
# 构建项目
pnpm build
您可以通过以下方式配置阿里云OSS参数:
在项目根目录创建.env文件,参考.env.example模板。您可以配置多个阿里云OSS服务:
# 默认OSS配置
OSS_CONFIG_DEFAULT={"region":"oss-cn-hangzhou","accessKeyId":"your-access-key-id","accessKeySecret":"your-access-key-secret","bucket":"your-bucket-name","endpoint":"oss-cn-hangzhou.aliyuncs.com"}
# 其他OSS配置
OSS_CONFIG_TEST={"region":"oss-cn-beijing","accessKeyId":"your-access-key-id-2","accessKeySecret":"your-access-key-secret-2","bucket":"your-bucket-name-2","endpoint":"oss-cn-beijing.aliyuncs.com"}
您也可以直接在系统中或启动命令中设置环境变量:
# 设置环境变量并启动
pnpm dev --oss-config='{ "default": { "region": "oss-cn-shenzhen", "accessKeyId": "YOUR_KEY", "accessKeySecret": "YOUR_SECRET", "bucket": "BUCKET_NAME", "endpoint": "oss-cn-shenzhen.aliyuncs.com" }, "test": { "region": "oss-cn-beijing", "accessKeyId": "YOUR_KEY", "accessKeySecret": "YOUR_SECRET", "bucket": "BUCKET_NAME", "endpoint": "oss-cn-beijing.aliyuncs.com" } }'
region: 阿里云OSS区域accessKeyId: 阿里云访问密钥IDaccessKeySecret: 阿里云访问密钥Secretbucket: OSS存储桶名称endpoint: OSS终端节点选项:
-s, --stdio 使用stdio传输启动服务器
-h, --http 使用HTTP传输启动服务器
-p, --port HTTP服务器端口 (默认: 3000)
-i, --inspect 使用Inspector工具启动
-?, --help 显示帮助信息
# 开发模式
pnpm dev
# 启动服务 (stdio模式)
pnpm start
# 启动HTTP服务
pnpm start:http
# 使用Inspector调试
pnpm inspect
{
"mcp.servers": {
"oss-mcp": {
"command": "npx",
"args": [
"oss-mcp",
"--oss-config='{\"default\":{\"region\":\"oss-cn-shenzhen\",\"accessKeyId\":\"YOUR_KEY\",\"accessKeySecret\":\"YOUR_SECRET\",\"bucket\":\"i18n-bucket\",\"endpoint\":\"oss-cn-shenzhen.aliyuncs.com\"}}'",
"--stdio"
]
}
}
}
使用环境变量方式可以轻松配置多个OSS账号:
{
"mcp.servers": {
"oss-mcp": {
"command": "npx",
"args": [
"oss-mcp",
"--oss-config='{\"default\":{\"region\":\"oss-cn-shenzhen\",\"accessKeyId\":\"YOUR_KEY\",\"accessKeySecret\":\"YOUR_SECRET\",\"bucket\":\"i18n-bucket\",\"endpoint\":\"oss-cn-shenzhen.aliyuncs.com\"}, \"test\":{\"region\":\"oss-cn-shenzhen\",\"accessKeyId\":\"YOUR_KEY\",\"accessKeySecret\":\"YOUR_SECRET\",\"bucket\":\"i18n-bucket\",\"endpoint\":\"oss-cn-shenzhen.aliyuncs.com\"}}'",
"--stdio"
]
}
}
}
服务器提供以下工具:
upload_to_oss)参数:
filePath: 本地文件路径(必需)targetDir: 目标目录路径(可选)fileName: 文件名(可选,默认使用原文件名)configName: OSS配置名称(可选,默认使用'default')list_oss_configs)无参数,返回所有可用的OSS配置名称。
# 发布到npm
pnpm pub:release
# 本地打包测试
pnpm publish:local
FAQs
本地MCP服务器,用于将文件上传到阿里云OSS,支持多配置和目录指定
The npm package oss-mcp receives a total of 6 weekly downloads. As such, oss-mcp popularity was classified as not popular.
We found that oss-mcp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.