
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
MCP Server for Slima - AI Writing IDE for Novel Authors. Connect your books with Claude, ChatGPT, Gemini, Cursor, and any MCP-compatible AI tool.
MCP (Model Context Protocol) Server for Slima - AI Writing IDE for Novel Authors.
Connect your Slima books to any MCP-compatible AI tool - one server, all platforms.
| Platform | Status | Notes |
|---|---|---|
| Claude Desktop | ✅ | Native MCP support |
| ChatGPT Desktop | ✅ | Developer Mode (2025.10+) |
| Gemini CLI | ✅ | Native MCP support |
| Cursor | ✅ | Native MCP support |
| VS Code | ✅ | Via MCP extensions |
| Platform | Status | Notes |
|---|---|---|
| Claude.ai | ✅ | OAuth login, no token needed |
| ChatGPT Web | ✅ | OAuth login, no token needed |
MCP became the industry standard in December 2025 when Anthropic, OpenAI, and Block co-founded the Agentic AI Foundation under the Linux Foundation.
Pick the path that matches how you use AI:
npxIf you chat with Claude or ChatGPT in a browser, this is the easiest and most future-proof option. Configure once and you will automatically get every Slima MCP update — no upgrade commands, no config edits.
MCP URL: https://mcp.slima.ai/mcp
Slimahttps://mcp.slima.ai/mcpSlimahttps://mcp.slima.ai/mcpAfter setup, Slima features roll out automatically on your next conversation. No restarts, no reinstalls.
Use this if you want offline-friendly operation, faster startup, or you need to run MCP alongside other stdio servers.
Recommended config — pinned to the major version so you pick up new features automatically but never break on a 1.0 release:
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"slima": {
"command": "npx",
"args": ["-y", "slima-mcp@0"],
"env": {
"SLIMA_API_TOKEN": "slima_your_token_here"
}
}
}
}
Get your token from Slima Settings or run npx slima-mcp@0 auth once to save it to disk.
{
"mcpServers": {
"slima": {
"command": "npx",
"args": ["-y", "slima-mcp@0"],
"env": {
"SLIMA_API_TOKEN": "slima_your_token_here"
}
}
}
}
gemini mcp add slima --command "npx -y slima-mcp@0"
Why
slima-mcp@0instead ofslima-mcp/slima-mcp@latest? Using@0pins to the current major version — npx still fetches new0.x.yreleases automatically (so you get features + bug fixes), but when we ship1.0.0with breaking changes you won't silently pick it up without updating your config. We'll announce the@1switch in the release notes.
If you already installed globally with npm install -g slima-mcp:
# Remove the old global install (optional but cleaner)
npm uninstall -g slima-mcp
# Change your config `command` from "slima-mcp" to the npx form above, and restart the client.
Or, if you want to stay on a global install, remember to periodically run:
npm install -g slima-mcp@latest
Otherwise your local client will drift from the MCP tools/schema the Slima backend exposes.
You can also clone this repo and deploy the Cloudflare Worker yourself. See wrangler.toml + npm run deploy:worker. Not required for normal use.
The hosted Remote MCP Server at https://mcp.slima.ai/mcp uses:
Slima books come in two flavors, distinguished by the book_type field. MCP behaves slightly differently for each:
📖 Writing Studio (book_type: "book") | 📝 Script Studio (book_type: "script") | |
|---|---|---|
| Creation via MCP | ✅ create_book works | ❌ use the Slima app UI |
| Read (any file) | ✅ | ✅ |
| Write / Edit / Delete | ✅ any path | ✅ only under .script_studio/planning/**/* |
Structured files (series.json, *.character, *.scene, *.storyline, *.note, *.location, season.json, episode.json) | n/a | ❌ read-only via MCP — edits must go through the Script Studio UI |
analyze_chapter (AI Beta Reader) | ✅ | ❌ not yet supported on structured scenes |
search_content | all files | structured files excluded by default; pass include_structured: true to include them |
For per-book details, ask your AI client to read the resource slima://books/{book_token}/schema — it returns a JSON spec of exactly which paths are writable/read-only for that specific book.
list_books tags every book with its studio icon (📝 / 📖) so you (and the AI) can tell them apart at a glance.
| Tool | Description |
|---|---|
create_book | Create a new book in your library |
list_books | List all books in your Slima library |
get_book | Get details of a specific book |
get_book_structure | Get the file/folder structure of a book |
get_writing_stats | Get writing statistics for a book |
| Tool | Description |
|---|---|
read_file | Read content of any file by path |
edit_file | Edit specific text using search & replace |
write_file | Replace entire content of a file |
create_file | Create a new file in a book |
delete_file | Delete a file from a book |
append_to_file | Append content to end of a file |
search_content | Search for text across all files |
| Tool | Description |
|---|---|
list_personas | List available beta reader personas |
analyze_chapter | Get AI beta reader feedback on a chapter |
Once configured, you can ask your AI:
Book & Content:
File Operations:
AI Feedback:
slima-mcp auth # Authenticate with browser (recommended)
slima-mcp status # Check authentication status
slima-mcp logout # Remove saved credentials
slima-mcp --help # Show help
slima-mcp --version # Show version
Token is stored in ~/.slima/credentials.json with secure permissions.
| Variable | Required | Default | Description |
|---|---|---|---|
SLIMA_API_TOKEN | No* | - | Your Slima API token |
SLIMA_API_URL | No | https://api.slima.ai | API endpoint (for development) |
DEBUG | No | false | Enable debug logging |
*Not required if you used slima-mcp auth
# Clone the repository
git clone https://github.com/slima-ai/slima-mcp.git
cd slima-mcp
# Install dependencies
npm install
# Build CLI
npm run build
# Run tests
npm test
# Run in development mode
npm run dev
# Build the Worker
npm run build:worker
# Run Worker locally
npm run dev:worker
# Deploy to Cloudflare
npm run deploy:worker
# Deploy to preview environment
npm run deploy:worker:preview
slima-mcp/
├── src/
│ ├── core/ # Shared core modules
│ │ ├── api/ # Slima API Client
│ │ ├── tools/ # MCP Tool implementations
│ │ └── utils/ # Utilities and errors
│ ├── cli/ # CLI entry point (stdio transport)
│ │ ├── index.ts # CLI main
│ │ ├── auth.ts # Authentication commands
│ │ └── server.ts # MCP Server for CLI
│ └── worker/ # Cloudflare Worker (HTTP transport)
│ ├── index.ts # Worker entry point
│ └── oauth.ts # OAuth 2.0 + PKCE client
├── wrangler.toml # Cloudflare Worker config
├── tsup.config.ts # CLI build config
└── tsup.worker.config.ts # Worker build config
Merge to main with a version bump in package.json triggers automatic npm publish via GitHub Actions.
# 1. Bump version on dev branch
npm version patch # 0.1.10 → 0.1.11
# 2. Merge to main
git checkout main && git merge dev && git push
# 3. CI runs tests → publish.yml publishes to npm + creates git tag
Worker deployment is separate from npm. Deploy after code changes:
npm run deploy:worker # Production (mcp.slima.ai)
npm run deploy:worker:preview # Staging
To publish/update the server listing on the MCP Registry:
mcp-publisher login github
mcp-publisher publish
Requires mcpName in package.json and server.json in repo root.
When troubleshooting claude.ai or ChatGPT connector issues:
# Live logs from production Worker
wrangler tail slima-mcp
All OAuth endpoints log key parameters (client_id, redirect_uri, token prefix, etc.) to help trace the flow.
Client POST /mcp → 401 + WWW-Authenticate header
→ Client GET /.well-known/oauth-protected-resource
→ Client GET /.well-known/oauth-authorization-server
→ Client POST /register (DCR)
→ Client redirects user to GET /authorize
→ Worker redirects to Rails OAuth
→ User authorizes → Rails redirects to Worker /callback
→ Worker issues auth code → redirects to client callback
→ Client POST /token (exchange code for access_token)
→ Client POST /mcp (Authorization: Bearer {access_token})
slima_ prefix) to support OAuth-issued tokens. Rails API performs actual validation.getTokenFromSession() checks Authorization header first, then falls back to cookie session.npx @modelcontextprotocol/inspector) is useful for testing the full OAuth flow independently.MIT
FAQs
MCP Server for Slima - AI Writing IDE for Novel Authors. Connect your books with Claude, ChatGPT, Gemini, Cursor, and any MCP-compatible AI tool.
The npm package slima-mcp receives a total of 47 weekly downloads. As such, slima-mcp popularity was classified as not popular.
We found that slima-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.