
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
wagtail-mcp
Advanced tools
This project implements a Model Context Protocol (MCP) server that provides read-only access to a Wagtail CMS instance using its V2 API.
It is built on FastMCP.
Add the following JSON to the MCP configuration file for your environment (e.g. claude_desktop_config.json for Claude Desktop):
{
"mcpServers": {
"wagtail-mcp": {
"command": "npx",
"args": [
"-y",
"wagtail-mcp"
],
"env": {
"WAGTAIL_BASE_URL": "https://api.example.com"
}
}
}
}
Make sure to set WAGTAIL_BASE_URL to the base URL of your Wagtail API instance.
search_pages: Searches pages from the Wagtail CMS API.
query (string): The term to search for in page content.type (string, optional): Filters results to a specific page type (e.g., blog.BlogPage, myapp.StandardPage).locale (string, optional, default: en): Filters pages by a specific locale code (e.g., en for English, es for Spanish).search_operator (string, optional, values: and, or): Determines how multiple terms in the query are combined. Defaults based on the Wagtail search backend configuration.limit (integer, optional, default: 50): The maximum number of page results to return.offset (integer, optional): The starting point for paginated results (e.g., an offset of 10 skips the first 10 results).fields (string, optional): A comma-separated list to control which fields are returned in the response for each page. Examples: title,body (returns only title and body), *,-summary (returns all fields except summary), _,custom_field_name (returns default fields plus a specific custom field). Refer to Wagtail API documentation for more on field selection syntax.get_page_details: Retrieves the full details of a specific Wagtail page.
id, slug, or url is required; priority is id > slug > url):
id (integer, optional): The unique numeric ID of the page.slug (string, optional): The slug (URL path component) of the page (e.g., about-us/team).url (string, optional): The full public URL of the page.fields (string, optional): A comma-separated list to control which fields are returned in the response. This allows for fetching specific data points or excluding others.
body,feed_image: Returns only the body and feed_image fields.*,-title: Returns all fields except title._,my_custom_field: Returns default fields plus my_custom_field. (Refer to Wagtail API documentation for more on field selection syntax).search_pages or other means. Returns the full page object.search_documents: Searches for Wagtail documents (e.g., PDFs, images uploaded to the media library).
query (string, required): The search term to use for finding documents by their title or other indexed metadata.search_operator (string, optional, values: and, or, default: and): Specifies how multiple terms in the query are combined (and requires all terms to match, or requires at least one).get_document_details: Retrieves detailed information for a specific Wagtail document.
id (integer, required): The unique numeric ID of the document.search_documents), use this to get its specific details, primarily its ID, title and download URL.Environment variables can be passed in via the MCP configuration file for your environment (e.g. claude_desktop_config.json):
WAGTAIL_BASE_URL: Required. The base URL of your Wagtail API instance (e.g., https://api.example.com).WAGTAIL_API_PATH: (Optional) Path to the API endpoint. Defaults to /api/v2.WAGTAIL_API_KEY: (Optional) An API key if your Wagtail API requires bearer token authentication.FAQs
Read-only access to a Wagtail CMS using the MCP protocol
We found that wagtail-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.