
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
kvc-mcp
Advanced tools
MCP server for Krystal Voice Caller — let AI agents manage your voice tenant, drive scripts, place test calls, and harvest captures.
MCP access is included with every Krystal Voice Caller tier. Use this package to manage a tenant from Claude, Cursor, or any MCP-aware agent.
mcp-name: io.github.KrystalUnity/kvc-mcp
pip install kvc-mcp
Create or rotate an API token in the Krystal Voice Caller dashboard, then set:
export KVC_API_TOKEN="kvc_token_..."
export KVC_BASE_URL="https://krystalunity.com/api/admin/kvc"
Cursor example:
{
"mcpServers": {
"krystal-voice-caller": {
"command": "kvc-mcp",
"env": {
"KVC_API_TOKEN": "kvc_token_..."
}
}
}
}
The server exposes tenant config, DNC, call history, reception captures, digest send-now, Script Author draft chat, contact upload, outbound captures, and test-call tools. Product availability is enforced by the Krystal Voice Caller API, so Reception-only tenants get inbound/reception tools and Bundle/Premium tenants get outbound Email Hunter tools.
Script approval is not exposed through MCP. Approval stays admin-only in the web UI.
Operator-only steps:
cd packages/kvc-mcp && uv builduv publish --username __token__ --password "$PYPI_TOKEN"io.github.KrystalUnity/kvc-mcp pointing at the PyPI package.pip install kvc-mcp && kvc-mcp --help.FAQs
MCP server for Krystal Voice Caller — let AI agents manage your voice tenant, drive scripts, place test calls, and harvest captures.
We found that kvc-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.