
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
Stdio MCP server for Qrblox — proxies Claude, Cursor, and other agents to the live Qrblox merchant MCP.
The Model Context Protocol server for Qrblox —
a local stdio package so Claude Desktop, Cursor, and other agents can
npx Qrblox the same way FlipLetters ships flipletters-mcp-server.
This package does not reimplement merchant tools. It is a thin stdio proxy to the live Streamable HTTP MCP:
https://api.qrblox.com/mcp/v1 (qrblox-mcp 0.1.0)
📚 Docs: docs.qrblox.com/mcp.html 🔑 Mint a key: app.qrblox.com/settings
Sign in at app.qrblox.com/settings
and create a merchant API key. Keys look like sk-qrblox-... and are
shown once.
Merchant tools/call requests send that key as
Authorization: Bearer sk-qrblox-....
QRBLOX_API_KEY=sk-qrblox-... npx -y qrblox-mcp
Without QRBLOX_API_KEY, the process starts and exits immediately with
a clear error pointing at the settings page.
~/Library/Application Support/Claude/claude_desktop_config.json
(macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"qrblox": {
"command": "npx",
"args": ["-y", "qrblox-mcp"],
"env": {
"QRBLOX_API_KEY": "sk-qrblox-..."
}
}
}
}
Restart Claude Desktop, then ask it to generate a QR code or look up a voice-agent number.
Add the same stdio server in Cursor MCP settings
(.cursor/mcp.json or the MCP panel):
{
"mcpServers": {
"qrblox": {
"command": "npx",
"args": ["-y", "qrblox-mcp"],
"env": {
"QRBLOX_API_KEY": "sk-qrblox-..."
}
}
}
}
Clients that already speak Streamable HTTP can skip this package and call the remote endpoint directly:
{
"mcpServers": {
"qrblox": {
"url": "https://api.qrblox.com/mcp/v1",
"headers": {
"Authorization": "Bearer sk-qrblox-..."
}
}
}
}
| Variable | Required | Description |
|---|---|---|
QRBLOX_API_KEY | Yes (for tools/call) | Merchant key sk-qrblox-... from app.qrblox.com/settings. Sent as Authorization: Bearer. |
QRBLOX_MCP_URL | No | Override the remote MCP URL. Defaults to https://api.qrblox.com/mcp/v1. |
tools/list and tools/call to
https://api.qrblox.com/mcp/v1 (Streamable HTTP / JSON-RPC).Authorization: Bearer $QRBLOX_API_KEY so merchant tools
run on the key owner's workspace.Tool schemas and behavior always come from the live server — this package is not a second implementation.
| Tool | Description |
|---|---|
qrblox.ping | Confirm reachability + identity for the authenticated merchant. |
qrblox.voice_agent.lookup | Look up a business in the Voice Agent Phone Book by domain. |
qrblox.voice_agent.register | Register a voice-agent number for a domain. |
qrblox.merchant.get_profile | Merchant workspace attached to the key. |
qrblox.qr.list / .create / .update / .get_analytics | List, create, re-point, and report on QR codes. |
qrblox.audio.create | Draft an audio code. |
qrblox.menu.create / .list / .add_item | Build and extend merchant menus. |
qrblox.challenge.create | Scan streaks, scan-count games, visit-window or loyalty campaigns. |
qrblox.analytics.scan_summary | Total scans + by-day series. |
Full reference: docs.qrblox.com/mcp.html.
npm install
npm test
npm test builds the package and runs a short check that the process
starts and fails clearly when QRBLOX_API_KEY is missing.
QRBLOX_API_KEY=sk-qrblox-... npm start
Do not commit tokens or keys. This package is not published from CI in this PR.
Confirm the unscoped name is still free: npm view qrblox-mcp
(it was unpublished / 404 when this package was added). If it is
taken, change package.json name to @qrblox/mcp and publish
that instead.
Sign in as the Qrblox npm user:
npm login
From a clean build:
npm publish
(prepublishOnly runs npm test first.)
Smoke-check: npx -y qrblox-mcp should print the missing-key error
until QRBLOX_API_KEY is set.
MIT © Qrblox / Terahertz Inc.
FAQs
Stdio MCP server for Qrblox — proxies Claude, Cursor, and other agents to the live Qrblox merchant MCP.
The npm package qrblox-mcp receives a total of 48 weekly downloads. As such, qrblox-mcp popularity was classified as not popular.
We found that qrblox-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.