
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
topolift-mcp
Advanced tools
MCP server exposing TopoLift's atom-grounded negotiation reasoning to any MCP-compatible agent (Claude Code, Cursor, OpenAI Agents SDK, etc).
MCP server exposing TopoLift's atom-grounded negotiation reasoning to any MCP-capable agent — Claude Code, Cursor, OpenAI Agents SDK, etc.
Listed on the official MCP Registry as
io.github.TopoLift/topolift-mcp.mcp-name: io.github.TopoLift/topolift-mcp
Two tools:
topolift_dialect — fetches TopoLift's published vocabulary (regimes, canonical strategies, signal keys, citation grammar). Call this once at session start; no auth required.topolift_negotiate — sends a negotiation context to TopoLift's reasoning engine and returns a bilingual response:
topology slot (regime, load_bearing_strategies[], bridge_pivots[], topology_signals{}) drawn from a closed vocabulary[Cluster_X#strategy1,strategy2] citation tokens anchoring every claim to the cluster + load-bearing atoms that drove itAtoms stay on the TopoLift server. What travels is the grammar of the dialect — the vocabulary your agent uses to read structural reasoning.
pip install topolift-mcp
Set your API key (get one at https://topolift.ai):
export TOPOLIFT_API_KEY=tl-...
claude mcp add topolift-negotiation -- topolift-mcp
…or, with the API key inline:
claude mcp add topolift-negotiation -e TOPOLIFT_API_KEY=tl-... -- topolift-mcp
Add to your MCP config (~/.cursor/mcp.json or equivalent):
{
"mcpServers": {
"topolift-negotiation": {
"command": "topolift-mcp",
"env": {
"TOPOLIFT_API_KEY": "tl-..."
}
}
}
}
TOPOLIFT_API_KEY=tl-... python -m topolift_mcp.server
Environment variables:
| Var | Default | Purpose |
|---|---|---|
TOPOLIFT_API_KEY | (required for negotiate) | Bearer key; get one at https://topolift.ai |
TOPOLIFT_API_URL | https://api.topolift.ai | API base URL |
TOPOLIFT_TIMEOUT | 600 | Negotiate-call timeout in seconds |
TOPOLIFT_LOG_LEVEL | INFO | Python logging level |
The dialect tool works without TOPOLIFT_API_KEY — only topolift_negotiate requires it.
https://api.topolift.ai/v1/negotiate with no API key — see the API's 402 challenge for details.topolift_dialect once and learns the vocabulary.topolift_negotiate with a scenario.topology for machine-readable structure and reads the prose fields with citation-traceable evidence.The atoms — the structural primitives — never leave TopoLift's servers. The dialect — the names and the grammar — is published openly so any agent can read structural reasoning fluently.
MIT
FAQs
MCP server exposing TopoLift's atom-grounded negotiation reasoning to any MCP-compatible agent (Claude Code, Cursor, OpenAI Agents SDK, etc).
We found that topolift-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.