
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
mcp-executor
Advanced tools
Run a FastMCP proxy that lists and invokes every MCP tool from the CLI or an HTTP server.
mcp-executor is a lightweight FastMCP driver that discovers every MCP tool
exposed by your configured backends, prints Python-like signatures, and lets you
invoke them either from the command line or through a minimal FastMCP server.
uv-first workflow for building,
testing, and publishing to PyPI.pip install mcp-executor
or, if you prefer the uv toolchain:
uv tool install mcp-executor
Point the CLI at an MCP client definition. Copy mcp.json.example into your
workspace, adjust the upstream server definitions, and pass the path with
-c/--config.
cp mcp.json.example ~/.config/mcp-executor/mcp.json
List available tools and inspect their signatures:
mcp-executor list -c ~/.config/mcp-executor/mcp.json
Call a tool directly:
mcp-executor call -c ~/.config/mcp-executor/mcp.json weather --arg city="Lisbon"
Run the FastMCP server (HTTP by default):
mcp-executor serve -c ~/.config/mcp-executor/mcp.json --transport http --host 0.0.0.0 --port 23456
Every command shares the --config option so you can point at different MCP
client definitions per invocation.
uv venv --seed
uv sync
uv run mcp-executor list -c mcp.json.example
The repository still ships main.py so you can run ./main.py list ... directly
with uv run if you prefer scripting locally.
uvversion inside pyproject.toml.uv build
uv run python -m mcp_executor.cli --help
export PYPI_API_TOKEN="pypi-xxxxxxxxxxxxxxxxxxxxxxxx"
uv publish --token "$PYPI_API_TOKEN"
git tag v0.1.1 && git push --tags).The repository includes .github/workflows/publish.yml, which builds the wheel
and sdist via uv build and calls uv publish --token $PYPI_API_TOKEN. Add a
PYPI_API_TOKEN secret (scoped to “Publish to PyPI”) in your repository settings
and trigger the workflow from the Actions tab or by creating a GitHub Release.
FAQs
Run a FastMCP proxy that lists and invokes every MCP tool from the CLI or an HTTP server.
We found that mcp-executor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.