
Research
/Security News
Malicious npm Packages Target WhatsApp Developers with Remote Kill Switch
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
[](https://www.npmjs.com/package/rss-mcp)
This is a Model Context Protocol (MCP) server built with TypeScript. It provides a versatile tool to fetch and parse any standard RSS/Atom feed, and also includes special support for RSSHub feeds. With this server, language models or other MCP clients can easily retrieve structured content from various web sources.
The server comes with a built-in list of public RSSHub instances and supports a polling mechanism to automatically select an available instance, significantly improving the success rate and stability of data retrieval.
get_feed
to fetch any RSSHub-supported feed via MCP, with multi-instance support.rsshub://
protocol format.PRIORITY_RSSHUB_INSTANCE
environment variable.First, clone the project repository, then install the required dependencies.
git clone https://github.com/veithly/rss-mcp.git
cd rss-mcp
npm install
Before running, you need to compile the TypeScript code into JavaScript:
npm run build
After a successful build, start the MCP server:
npm start
The server will then communicate with the parent process (e.g., Cursor) via Stdio.
You can create a .env
file to specify a priority RSSHub instance. This is very useful for users who have a private, stable instance.
Create a .env
file in the project root directory and add the following content:
PRIORITY_RSSHUB_INSTANCE=https://my-rsshub.example.com
The server will automatically load this configuration on startup and place it at the top of the polling list.
To use this server with an MCP client like Cursor, you need to add it to your configuration file.
npx
(Recommended)This package is published on npm, so you can use npx
to run the server without a local installation. This is the easiest method.
Direct Invocation:
You can run the server directly from your terminal using npx
:
npx rss-mcp
MCP Client Configuration:
To integrate with an MCP client like Cursor, add the following to your configuration file (e.g., ~/.cursor/mcp_settings.json
):
{
"name": "rss",
"command": ["npx", "rss-mcp"],
"type": "stdio"
}
If you have cloned the repository locally, you can run it directly with node
.
Clone and build the project as described in the "Installation" and "Usage" sections.
Locate your MCP configuration file.
Add the following server entry, making sure to use the absolute path to the compiled index.js
file:
{
"name": "rss",
"command": ["node", "/path/to/your/rss-mcp/dist/index.js"],
"type": "stdio"
}
Important: Replace /path/to/your/rss-mcp/dist/index.js
with the correct absolute path on your system.
After adding the configuration, restart your MCP client (e.g., Cursor) for the changes to take effect. The rss
server will then be available, and you can call the get_feed
tool.
get_feed
Fetches and parses an RSS feed from a given URL. It supports both standard RSS/Atom feeds and RSSHub feeds.
url
(string, required): The URL of the RSS feed to fetch. Two formats are supported:
https://rsshub.app/bilibili/user/dynamic/208259
rsshub://
protocol: rsshub://bilibili/user/dynamic/208259
(the server will automatically match an available instance)count
(number, optional): The number of RSS feed items to retrieve.
1
0
Returns a JSON string containing the feed information, with the following structure:
{
"title": "bilibili User Dynamics",
"link": "https://space.bilibili.com/208259",
"description": "bilibili User Dynamics",
"items": [
{
"title": "[Dynamic Title]",
"description": "Plain text content of the dynamic...",
"link": "https://t.bilibili.com/1234567890",
"guid": "https://t.bilibili.com/1234567890",
"pubDate": "2024-05-20T12:30:00.000Z",
"author": "Author Name",
"category": ["Category1", "Category2"]
}
]
}
.env
file.This project is licensed under the Apache-2.0 License.
FAQs
[](https://www.npmjs.com/package/rss-mcp)
The npm package rss-mcp receives a total of 527 weekly downloads. As such, rss-mcp popularity was classified as not popular.
We found that rss-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.
Research
/Security News
Socket uncovered 11 malicious Go packages using obfuscated loaders to fetch and execute second-stage payloads via C2 domains.
Security News
TC39 advances 11 JavaScript proposals, with two moving to Stage 4, bringing better math, binary APIs, and more features one step closer to the ECMAScript spec.