
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
portable-mcp
Advanced tools
A CLI tool to manage MCP configurations across different environments (Cursor, Claude Desktop)
A CLI tool to manage MCP (Model Context Protocol) configurations across different environments like Cursor and Claude Desktop.
npm install -g portable-mcp
Or run directly with npx:
npx portable-mcp --help
Simply run the command without arguments to enter interactive mode:
portable-mcp
or
portable-mcp prompt
Replace your Cursor configuration from a GitHub Gist:
portable-mcp replace --type cursor --gist 50007c6cd60db13cf8477b3b5caa96f0
Replace from a direct URL:
portable-mcp replace --type cursor --json-url https://gist.githubusercontent.com/niradler/50007c6cd60db13cf8477b3b5caa96f0/raw/1c4229a9ac141f2a5530d98540ae67845b08a3be/cursor.json
Merge new settings with your existing configuration:
portable-mcp merge --type claude --gist abc123def456
Upload your current configuration to a new public Gist:
portable-mcp store --type cursor
Upload to a private Gist:
portable-mcp store --type cursor --private
Update an existing Gist:
portable-mcp store --type cursor --gist abc123def456
Check where your configuration files should be located:
portable-mcp path --type cursor
portable-mcp path --type claude
replaceReplace the entire configuration file.
Options:
--type <type> - Target application (cursor | claude)--json-url <url> - Direct URL to JSON configuration--gist <gist> - GitHub Gist ID or ID/filename for multi-file Gists--destination <path> - Custom destination pathmergeMerge configuration with existing file (deep merge).
Options: Same as replace
storeUpload configuration to GitHub Gist.
Options:
--type <type> - Source application (cursor | claude)--gist <gist> - Existing Gist ID to update (optional)--private - Create private Gist (default: public)--source <path> - Custom source pathpathShow default configuration path for a type.
Options:
--type <type> - Application type (default: cursor)promptInteractive mode - asks questions to guide you through the process.
PORTABLE_MCP_TMP - Custom temporary directory for cache (default: ~/.tmp/portable-mcp)GITHUB_TOKEN - GitHub personal access token (required for private Gists and API uploads)C:\\Users\\<username>\\.cursor\\mcp.json~/Library/Application Support/Cursor/User/mcp.jsonC:\\Users\\<username>\\.claude\\claude_desktop_config.json~/Library/Application Support/Claude/claude_desktop_config.jsonIf you have GitHub CLI installed and authenticated, the tool will automatically use it for Gist operations. This provides the best experience and doesn't require additional tokens.
If GitHub CLI is not available, you can use the GitHub API directly by setting the GITHUB_TOKEN environment variable:
export GITHUB_TOKEN=ghp_your_personal_access_token_here
Get a token from: https://github.com/settings/tokens
Required scopes: gist
# Check current configuration location
portable-mcp path --type cursor
# Replace with a configuration from Gist
portable-mcp replace --type cursor --gist abc123def456
# Upload your modified configuration back
portable-mcp store --type cursor --private
# Download specific file from multi-file Gist
portable-mcp replace --type cursor --gist abc123def456/cursor-config.json
# Use custom source and destination
portable-mcp replace --json-url https://example.com/config.json --destination ./my-config.json
# Merge remote config with local (useful for partial updates)
portable-mcp merge --type cursor --gist abc123def456
Downloaded configurations are cached in the temp directory for 1 hour to speed up repeated operations. Cache location:
~/.tmp/portable-mcp/PORTABLE_MCP_TMP environment variableMIT License - see LICENSE file for details.
FAQs
A CLI tool to manage MCP configurations across different environments (Cursor, Claude Desktop)
We found that portable-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.