
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
why-note-mcp
Advanced tools
A zero-dependency, read-only Model Context Protocol server for searching and reading the notes in one WhyNote account.
Generate a read-only token in WhyNote settings, then configure your MCP client
to run npx -y why-note-mcp with NOTE_URL and NOTE_TOKEN.
Generic project configuration:
{
"mcpServers": {
"note": {
"command": "npx",
"args": ["-y", "why-note-mcp"],
"env": {
"NOTE_URL": "https://note.example.com",
"NOTE_TOKEN": "<read-only-token>"
}
}
}
}
Claude Code:
claude mcp add --scope user note \
-e NOTE_URL=https://note.example.com \
-e NOTE_TOKEN='<read-only-token>' \
-- npx -y why-note-mcp
Codex CLI:
codex mcp add note \
--env NOTE_URL=https://note.example.com \
--env NOTE_TOKEN='<read-only-token>' \
-- npx -y why-note-mcp
Values written directly in a command may be retained in shell history. Edit the client configuration instead if that is a concern.
Node.js 18 or newer is required.
search: search note lines by case-insensitive substringtodos: list incomplete or all todo itemsread_day: read one date's complete note and etagrecent_days: read existing note days around an anchor dateThe server reads NOTE_URL and NOTE_TOKEN only from its environment. It sends
the token only as a Bearer credential to the configured WhyNote URL. It never
receives the account password and exposes no write tool.
Changing the WhyNote account password revokes its read-only tokens. Generate a new token in WhyNote settings when a token expires or is revoked.
npm ci
npm test
npm run pack:check
The test suite uses a local fake HTTP service; it does not require a WhyNote account, network access, or third-party dependencies.
FAQs
Read-only MCP server for searching and reading a WhyNote account
We found that why-note-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.