
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
public-api-toolkit
Advanced tools
Structured public data for AI agents through one cross-platform MCP server.
Structured public data for AI agents.
Public API Toolkit is a cross-platform MCP server that turns public APIs into clean, agent-ready tools.
It packages 41 grouped public_api_<group> tools behind one local MCP server, so agents can ask for weather, countries, crypto prices, holidays, Wikipedia summaries, open data, transport lookups, and dozens of other structured API results without scraping web pages first.
The repository includes a static GitHub Pages-style landing page in site/ for launch storytelling, product screenshots, and direct install links.
site/index.html locally for a no-build preview| Area | Status |
|---|---|
| Package | public-api-toolkit@1.0.1 |
| Tool groups | 10 |
| Tools | 41 |
| npm | public-api-toolkit |
| GitHub | nikhilreddy3888/public-api-toolkit |
Repository health references:
Public API Toolkit is for the part of agent work that should be deterministic:
The product story is simple:
Public API Toolkit is strongest on structured lookup tasks, where web search tends to waste tokens and return noisy HTML:
It is less differentiated for open-ended research, editorial comparisons, or tasks where the model still needs to browse multiple human-written sources.
For a current snapshot of known-good areas versus fragile providers, see STATUS.md.
This project does not try to expose every upstream as its own standalone MCP tool.
Instead, it groups related capabilities into one tool per domain so the surface stays practical for agents:
public_api_weather instead of many weather-specific toolspublic_api_currency_exchange instead of many FX providerspublic_api_wikipedia instead of separate search, summary, and content toolsThat tradeoff favors:
It does mean the tool surface is broader than a single-purpose MCP server. That is an intentional convenience tradeoff, not something the repo tries to hide.
| Client | Status | Notes |
|---|---|---|
| Codex | Direct | Local stdio MCP server via ~/.codex/config.toml |
| Claude Code | Direct | Local stdio MCP server via .mcp.json or claude mcp add-json |
| Cursor | Direct | Local stdio MCP server via mcp.json |
| OpenCode | Direct | Local MCP server via opencode.jsonc |
| Gemini CLI | Direct | Local settings.json MCP or extension install from this repo |
| GitHub Copilot CLI | Direct after publish | Direct repo plugin install via .claude-plugin and .mcp.json |
| Generic MCP clients | Direct | Use the same stdio command shape if the client supports local MCP processes |
| ChatGPT Apps / remote MCP | Partial | Requires a remote MCP transport; this repo currently ships stdio only |
npm install
npm test
npm run build
node dist/index.js
npx -y public-api-toolkit
Public API Toolkit exposes 41 tools across these categories:
The full catalog lives in docs/configuration/tool-groups.md.
Most tools work without authentication. Optional premium-compatible providers are activated through PUBLIC_APIS_<NAME> environment variables such as:
PUBLIC_APIS_FINNHUBPUBLIC_APIS_ALPHAVANTAGEPUBLIC_APIS_FREDPUBLIC_APIS_OMDBPUBLIC_APIS_TMDBPUBLIC_APIS_CARBON_INTERFACEPUBLIC_APIS_MAILCHECKPUBLIC_APIS_KICKBOXPUBLIC_APIS_OPEN_CHARGE_MAPPUBLIC_APIS_FOODDATA_CENTRALDetails:
This repo includes:
plugins/public-api-toolkit/.mcp.json for Codex-compatible MCP packagingplugins/public-api-toolkit/.codex-plugin/plugin.json for Codex plugin metadata.claude-plugin/plugin.json and root .mcp.json for direct GitHub Copilot CLI plugin installgemini-extension.json and GEMINI.md for Gemini CLI extension install.codex/INSTALL.md and .opencode/INSTALL.md for fetch-and-follow setup flowsskills/public-api-toolkit/SKILL.md for agent routing guidanceexamples/ with ready-to-copy config snippetspublic-api-toolkit/1.0The highest-value next steps are:
FAQs
43 agent skills for real-time public data. Free. No keys. Token-efficient.
The npm package public-api-toolkit receives a total of 6 weekly downloads. As such, public-api-toolkit popularity was classified as not popular.
We found that public-api-toolkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.