
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
starwell-mcp
Advanced tools
Statistics from 29 national and international agencies as MCP tools: FRED, Eurostat, ECB, World Bank, OECD, BLS, SEC EDGAR, Statistics Canada, ONS, INSEE and more. Every observation carries its source URL and retrieval time, and the answer tool computes r
Starwell is the verified data layer for AI: official statistics from Statistics Canada, FRED, the U.S. Bureau of Labor Statistics, the World Bank, SEC EDGAR, the U.S. Treasury, the European Central Bank, the UK Office for National Statistics, INSEE (France), the Australian Bureau of Statistics, the OECD, Eurostat, INE (Spain), the Czech National Bank, ILOSTAT, Statistics Netherlands, the CDC, Statistics Sweden, Statistics Norway, Statistics Finland, Statistics Austria, the Department of Statistics Malaysia, the U.S. Bureau of Economic Analysis, the Central Statistics Office of Ireland, Statistics Denmark, Statistics Poland, Statistics Estonia, Statistics Iceland, and the U.S. Bureau of Transportation Statistics, served as MCP tools. Every observation carries provenance, every series carries a verification status backed by golden-value checks against the live source, and the answer tool returns computed results cited to the official table.
This package is a thin stdio bridge to the Starwell remote MCP server. The tool surface always matches the server, so new sources and tools appear without a package update.
Tools (11): search_catalog, list_sources, list_datasets, get_series, get_series_stats, get_observations, answer, deep_analysis, create_monitor, list_monitors, delete_monitor. Reads are open; answer, deep_analysis, and the monitor tools need a free API key (STARWELL_API_KEY).
Remote-capable clients can skip this package and add the URL directly: https://starwell.dev/api/starwell/mcp (Streamable HTTP).
claude mcp add --transport http starwell https://starwell.dev/api/starwell/mcp
# or via stdio:
claude mcp add starwell -- npx -y starwell-mcp
Settings, Connectors, Add custom connector, URL https://starwell.dev/api/starwell/mcp. On plans without remote connectors, use the desktop config:
{
"mcpServers": {
"starwell": { "command": "npx", "args": ["-y", "starwell-mcp"] }
}
}
.cursor/mcp.json:
{
"mcpServers": {
"starwell": { "command": "npx", "args": ["-y", "starwell-mcp"] }
}
}
~/.codex/config.toml:
[mcp_servers.starwell]
command = "npx"
args = ["-y", "starwell-mcp"]
~/.gemini/settings.json:
{
"mcpServers": {
"starwell": { "httpUrl": "https://starwell.dev/api/starwell/mcp" }
}
}
Settings, Apps, enable developer mode, add connector with the remote URL above.
STARWELL_MCP_URL: override the endpoint (staging, self-hosted).STARWELL_API_KEY: Bearer key from https://starwell.dev/account (free). Data reads work without one; answer, deep_analysis, and monitors require it.Only openly licensed official sources are served, each with its license and attribution in every response. The set covers U.S. federal statistical works (public domain), the Statistics Canada Open Licence, World Bank CC BY-4.0, and the respective open licences of the ECB, OECD, ONS, INSEE, and ABS. This product uses the FRED API but is not endorsed or certified by the Federal Reserve Bank of St. Louis.
FAQs
Statistics from 29 national and international agencies as MCP tools: FRED, Eurostat, ECB, World Bank, OECD, BLS, SEC EDGAR, Statistics Canada, ONS, INSEE and more. Every observation carries its source URL and retrieval time, and the answer tool computes r
The npm package starwell-mcp receives a total of 56 weekly downloads. As such, starwell-mcp popularity was classified as not popular.
We found that starwell-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.