
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
petstoreewew
Advanced tools
Model Context Protocol (MCP) Server for the petstoreewew API.
[!IMPORTANT] This MCP Server is not yet ready for production use. To complete setup please follow the steps outlined in your workspace. Delete this notice before publishing to a package manager.
Petstore - OpenAPI 3.1: This is a sample Pet Store Server based on the OpenAPI 3.1 specification.
Some useful links:
For more information about the API: Find out more about Swagger
[!TIP] To finish publishing your MCP Server to npm and others you must run your first generation action.
Install the MCP server as a Desktop Extension using the pre-built mcp-server.dxt file:
Simply drag and drop the mcp-server.dxt file onto Claude Desktop to install the extension.
The DXT package includes the MCP server and all necessary configuration. Once installed, the server will be available without additional setup.
[!NOTE] DXT (Desktop Extensions) provide a streamlined way to package and distribute MCP servers. Learn more about Desktop Extensions.
Or manually:
{
"mcpServers": {
"Petstore": {
"type": "mcp",
"url": "https://example-cloudflare-worker.com/mcp",
"headers": {
"api_key": "${PETSTOREEWEW_API_KEY}"
}
}
}
}
claude mcp add --transport sse Petstore undefined/sse --header "api_key: ..."
Refer to Official Windsurf documentation for latest information
Manage MCPs. (To Manage MCPs you should be signed in with a Windsurf Account)View raw config to open up the mcp configuration file.{
"mcpServers": {
"Petstore": {
"command": "npx",
"args": [
"petstoreewew",
"start",
"--api-key",
"..."
]
}
}
}
Refer to Official VS Code documentation for latest information
MCP: Open User Configuration. This should open mcp.json file{
"mcpServers": {
"Petstore": {
"command": "npx",
"args": [
"petstoreewew",
"start",
"--api-key",
"..."
]
}
}
}
npx petstoreewew start --api-key ...
For a full list of server arguments, run:
npx petstoreewew --help
Run locally without a published npm package:
npm installnpm run buildnode ./bin/mcp-server.js start --api-key ...
To use this local version with Cursor, Claude or other MCP Clients, you'll need to add the following config:{
"mcpServers": {
"Petstore": {
"command": "node",
"args": [
"./bin/mcp-server.js",
"start",
"--api-key",
"..."
]
}
}
}
Or to debug the MCP server locally, use the official MCP Inspector:
npx @modelcontextprotocol/inspector node ./bin/mcp-server.js start --api-key ...
To deploy to Cloudflare Workers:
npm install
npm run deploy
To run the cloudflare deployment locally:
npm install
npm run dev
The local development server will be available at http://localhost:8787
Then install with Claude Code CLI:
claude mcp add --transport sse Petstore http://localhost:8787/sse --header "api_key: ..."
While we value contributions to this MCP Server, the code is generated programmatically. Any manual changes added to internal files will be overwritten on the next generation. We look forward to hearing your feedback. Feel free to open a PR or an issue with a proof of concept and we'll do our best to include it in a future release.
FAQs
Model Context Protocol (MCP) Server for the *petstoreewew* API.
We found that petstoreewew demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.