
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
reqeast-mcp
Advanced tools
MCP server for Reqeast API client. Gives AI tools read-only access to your API requests, responses, and session history.
Connect your AI tools directly to Reqeast. The MCP server lets AI assistants inspect your API requests, responses, and session history without manual copy-pasting.
When you're debugging an API request in Reqeast, instead of copying URLs, headers, and response bodies into your AI tool, the MCP server gives the AI direct read-only access to:
The AI sees your full debugging context in one call.
Reqeast exports session data snapshots to disk as you work. The MCP server reads those files when your AI tool requests information. Everything stays local. No data leaves your machine.
Reqeast App --> writes session data to disk --> MCP Server reads it
|
AI Tool (Claude, Cursor, etc.)
npm install -g reqeast-mcp
Open Reqeast, go to Settings > General, and make sure "Enable MCP Export" is turned on (enabled by default).
Claude Code (add to ~/.claude.json or project-level config):
{
"mcpServers": {
"reqeast": {
"command": "npx",
"args": ["-y", "reqeast-mcp"]
}
}
}
Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"reqeast": {
"command": "npx",
"args": ["-y", "reqeast-mcp"]
}
}
}
Cursor: Settings > MCP Servers > Add server with command npx and args ["-y", "reqeast-mcp"].
Other MCP-compatible tools (VS Code, Windsurf, Zed) follow similar patterns.
Open Reqeast, work with your requests as usual, then ask your AI tool:
8 read-only tools:
Returns the currently selected project and request, plus a summary of recent executions. This is the main entry point -- your AI tool calls this first to understand what you're working on.
Returns: Selected project, selected request config, recent executions (last 10) with method, URL, status code, and timing.
Full configuration of a specific request.
Parameters: requestId (string)
Returns: Method, URL, query parameters, headers, body type and content, auth type (credentials stripped), timeout, redirect settings, SSL verification, HTTP version.
The most recent HTTP response for a request, with full metadata.
Parameters: requestId (string), includeBody (boolean, default: true)
Returns:
Recent execution history for a request.
Parameters: requestId (string), limit (number, default: 10)
Returns: Array of past executions with method, URL, status code, elapsed time, body size, and timestamp.
All projects in Reqeast with request counts.
Returns: Array of projects with ID, name, emoji, and number of requests.
All requests in a specific project.
Parameters: projectId (string)
Returns: Array of requests with ID, name, protocol type (HTTP/TCP/UDP/WebSocket/SSE), and a summary (method + URL for HTTP, host + port for TCP/UDP).
Environment variables for a project.
Parameters: projectId (string)
Returns: Active environment name and variables. All environments listed with variable counts. Secret values replaced with [REDACTED].
The cookie jar contents.
Parameters: domain (string, optional) -- filter by domain
Returns: All stored cookies with name, value, domain, path, expiry, httpOnly, secure, and sameSite attributes.
| Data | Exposed | Details |
|---|---|---|
| Request URL | Yes | Full URL including query parameters |
| Request headers | Yes | All custom headers |
| Request body | Yes | Full body content (JSON, form data, raw, etc.) |
| Auth type | Yes | Which auth method is configured (Bearer, Basic, API Key, etc.) |
| Auth credentials | No | Tokens, passwords, API keys, and secrets are never exported |
| Response status | Yes | Status code and status text |
| Response headers | Yes | All response headers (Content-Type, Cache-Control, CORS, custom, etc.) |
| Response body | Yes | Up to 50KB of text; binary reports type and size |
| Timing breakdown | Yes | DNS lookup, connection, download, total (ms) |
| TLS certificate | Yes | Subject CN, issuer CN, expiry date |
| Size info | Yes | Request/response header and body sizes, compression |
| Redirect chain | Yes | Each hop URL and status code |
| Response metadata | Yes | Final URL, HTTP version, remote address |
| Cookies | Yes | Full cookie jar with all attributes |
| Environment variables | Yes | Key-value pairs for all environments |
| Secret env variables | Partial | Keys visible, values replaced with [REDACTED] |
| Keychain credentials | No | Never accessed or exported |
| Project/request names | Yes | Names and organizational structure |
| Request history | Yes | Last N executions with status codes and timing |
Works with any tool that supports MCP servers via stdio transport:
"Reqeast data not found. Make sure the app is running." Open Reqeast and interact with a project/request to trigger the initial export. Make sure "Enable MCP Export" is on in Settings.
"Data may be stale." Reqeast isn't running. Open the app and the data refreshes automatically.
Response headers or timing missing Make sure you're running Reqeast version 1.1 or later. Older versions don't export response metadata.
Tools return empty results Make sure you have at least one project with requests in Reqeast.
FAQs
MCP server for Reqeast API client. Gives AI tools read-only access to your API requests, responses, and session history.
The npm package reqeast-mcp receives a total of 0 weekly downloads. As such, reqeast-mcp popularity was classified as not popular.
We found that reqeast-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.