
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
MCP server for Tela — a self-hostable, markdown-native team wiki. Lets Claude, Cursor, and other agents search, read, and write your wiki pages. A stdio↔HTTP proxy to a Tela instance's built-in MCP server ({TELA_BASE_URL}/api/mcp) for hosts that can't spe
A thin stdio↔HTTP proxy to a Tela instance's built-in MCP server.
As of v0.7, the MCP server lives inside the Tela backend at
{TELA_BASE_URL}/api/mcp (Streamable HTTP, spec-compliant). This npm package no
longer implements any tools itself — it's a dumb pipe that forwards the entire
MCP protocol (tools, resources, prompts, notifications) over stdio to that
endpoint, injecting your personal access token as a bearer header. Because it
holds no tool knowledge, the backend's MCP surface can grow without this package
ever changing — there is no second implementation to drift.
Modern MCP hosts speak Streamable HTTP transport directly — point them at the endpoint and skip the proxy entirely:
# Claude Code
claude mcp add --transport http tela https://telawiki.com/api/mcp \
--header "Authorization: Bearer tela_pat_..."
Cursor, VS Code, Zed, and the Anthropic Messages API mcp_servers connector
likewise accept a URL + bearer header. Use this npm package only for stdio-only
hosts that can't speak HTTP transport.
Add to your .mcp.json:
{
"mcpServers": {
"tela": {
"command": "npx",
"args": ["-y", "tela-mcp@latest"],
"env": {
"TELA_BASE_URL": "https://telawiki.com",
"TELA_API_KEY": "tela_pat_..."
}
}
}
}
| Var | Purpose |
|---|---|
TELA_BASE_URL | Origin of the Tela instance (e.g. https://telawiki.com or http://localhost:8780). The proxy connects to {TELA_BASE_URL}/api/mcp. |
TELA_API_KEY | Personal access token (tela_pat_…), forwarded as Authorization: Bearer. Create one in Settings → API Keys. |
Both must be set at spawn time, or the process exits non-zero before the MCP handshake.
The tools (list_spaces, get_page, search, semantic_search,
create_page, move_page, add_comment, …), the tela://page/{id} /
tela://space/{id} resources, and the read/write/admin scope model are all
defined and documented in the backend, not here. Scope and per-space
restrictions are enforced server-side; failures arrive as the usual
{error, code, status} envelope in the tool result. See the project Showcase:
https://telawiki.com/spaces/1/pages/19.
This package authenticates with a static personal access token (PAT), which works with the Messages API connector and any host that accepts a bearer header. The OAuth "Connect" flow used by the Claude.ai / ChatGPT consumer apps is a separate, server-side capability (it does not involve this package).
cd mcp
npm install
npm run build # tsc → dist/server.js
npm run test:integration # live proxy↔backend E2E (needs a running backend; use `make test-mcp-integration` from the repo root)
The proxy is ~40 lines over the official @modelcontextprotocol/sdk transports.
Exhaustive per-tool coverage lives in the Go backend's e2e MCP tests
(backend/internal/api/mcp_test.go).
AGPL-3.0-only.
FAQs
MCP server for Tela — a self-hostable, markdown-native team wiki. Lets Claude, Cursor, and other agents search, read, and write your wiki pages. A stdio↔HTTP proxy to a Tela instance's built-in MCP server ({TELA_BASE_URL}/api/mcp) for hosts that can't spe
The npm package tela-mcp receives a total of 39 weekly downloads. As such, tela-mcp popularity was classified as not popular.
We found that tela-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.