
Research
Security News
Malicious npm Packages Use Telegram to Exfiltrate BullX Credentials
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Official MiniMax Model Context Protocol (MCP) server that enables interaction with powerful Text to Speech and video/image generation APIs. This server allows MCP clients like Claude Desktop, Cursor, Windsurf, OpenAI Agents and others to generate speech, clone voices, generate video, generate image and more.
uv
(Python package manager), install with curl -LsSf https://astral.sh/uv/install.sh | sh
or see the uv
repo for additional install methods.Invalid API key
error.Region | Global | Mainland |
---|---|---|
MINIMAX_API_KEY | go get from MiniMax Global | go get from MiniMax |
MINIMAX_API_HOST | https://api.minimaxi.chat (note the extra "i") | https://api.minimax.chat |
Go to Claude > Settings > Developer > Edit Config > claude_desktop_config.json
to include the following:
{
"mcpServers": {
"MiniMax": {
"command": "uvx",
"args": [
"minimax-mcp",
"-y"
],
"env": {
"MINIMAX_API_KEY": "insert-your-api-key-here",
"MINIMAX_MCP_BASE_PATH": "local-output-dir-path, such as /User/xxx/Desktop",
"MINIMAX_API_HOST": "api host, https://api.minimaxi.chat|https://api.minimax.chat",
"MINIMAX_API_RESOURCE_MODE": "optional, [url|local], url is default, audio/image/video are downloaded locally or provided in URL format"
}
}
}
}
⚠️ Warning: The API key needs to match the host. If an error "API Error: invalid api key" occurs, please check your api host:
https://api.minimaxi.chat
(note the extra "i")https://api.minimax.chat
If you're using Windows, you will have to enable "Developer Mode" in Claude Desktop to use the MCP server. Click "Help" in the hamburger menu in the top left and select "Enable Developer Mode".
Go to Cursor -> Preferences -> Cursor Settings -> MCP -> Add new global MCP Server
to add above config.
That's it. Your MCP client can now interact with MiniMax through these tools:
We support two transport types: stdio and sse.
stdio | SSE |
---|---|
Run locally | Can be deployed locally or in the cloud |
Communication through stdout | Communication through network |
Input: Supports processing local files or valid URL resources | Input: When deployed in the cloud, it is recommended to use URL for input |
tool | description |
---|---|
text_to_audio | Convert text to audio with a given voice |
list_voices | List all voices available |
voice_clone | Clone a voice using provided audio files |
generate_video | Generate a video from a prompt |
text_to_image | Generate a image from a prompt |
query_video_generation | Query the result of video generation task |
Please ensure your API key and API host are regionally aligned
Region | Global | Mainland |
---|---|---|
MINIMAX_API_KEY | go get from MiniMax Global | go get from MiniMax |
MINIMAX_API_HOST | https://api.minimaxi.chat (note the extra "i") | https://api.minimax.chat |
Please confirm its absolute path by running this command in your terminal:
which uvx
Once you obtain the absolute path (e.g., /usr/local/bin/uvx), update your configuration to use that path (e.g., "command": "/usr/local/bin/uvx").
generate_video
in async-modeDefine completion rules before starting:
Alternatively, these rules can be configured in your IDE settings (e.g., Cursor):
⚠️ Warning: Using these tools may incur costs.
FAQs
Minimax MCP Server
We found that minimax-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket uncovers an npm Trojan stealing crypto wallets and BullX credentials via obfuscated code and Telegram exfiltration.
Research
Security News
Malicious npm packages posing as developer tools target macOS Cursor IDE users, stealing credentials and modifying files to gain persistent backdoor access.
Security News
AI-generated slop reports are making bug bounty triage harder, wasting maintainer time, and straining trust in vulnerability disclosure programs.