
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
routebase-mcp
Advanced tools
Routebase MCP server CLI — connect AI agents (Claude Code, Cursor, VS Code) to your Routebase APIs over stdio. Downloads the platform binary from releases.routebase.dev on first run.
Connect your AI agent to your Routebase APIs. This is the Model Context Protocol server for Routebase — it lets agents like Claude Code, Cursor, and VS Code read and work with your API specs, endpoints, schemas, tests, and mock servers over stdio.
You don't need to install anything globally — npx runs it on demand:
ROUTEBASE_API_KEY=rb_… npx routebase-mcp
Generate an API key in Routebase under Settings → API Keys.
The interactive setup writes the right config for you:
npx routebase-mcp init
Or add it manually. All clients use the same shape:
Claude Code (~/.claude.json or project .mcp.json):
{
"mcpServers": {
"routebase": {
"command": "npx",
"args": ["-y", "routebase-mcp", "--stdio"],
"env": {
"ROUTEBASE_API_KEY": "rb_…"
}
}
}
}
Cursor (~/.cursor/mcp.json or .cursor/mcp.json) and VS Code (.vscode/mcp.json) use the identical block.
| Environment variable | Required | Description |
|---|---|---|
ROUTEBASE_API_KEY | ✅ | API key for authentication. Create one under Settings → API Keys. |
ROUTEBASE_REGION | US accounts | Home region of your account: us or eu (default: eu). Without it, a US key fails as if it were invalid. npx routebase-mcp init asks for the region (or takes --region us) and writes it into the config for you. |
ROUTEBASE_LOG_LEVEL | – | verbose · debug · info · warning · error · fatal (default: warning). Logs go to stderr — stdout is reserved for the MCP protocol. |
This npm package is a tiny shim. On first run it downloads the self-contained CLI binary for your platform from releases.routebase.dev, verifies it against a SHA-256 checksum baked into this package at publish time (it refuses to run on mismatch — fail-closed), and caches it under ~/.routebase/bin/<version>/. Subsequent runs use the cached binary.
Supported platforms: macOS (arm64, x64), Windows (x64), Linux (x64). Requires Node.js ≥ 18.
The npm shim in this package is MIT. The downloaded Routebase CLI binary is governed by the Routebase Terms.
FAQs
Routebase MCP server CLI — connect AI agents (Claude Code, Cursor, VS Code) to your Routebase APIs over stdio. Downloads the platform binary from releases.routebase.dev on first run.
The npm package routebase-mcp receives a total of 64 weekly downloads. As such, routebase-mcp popularity was classified as not popular.
We found that routebase-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.