
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
tru8-mcp
Advanced tools
MCP server for Tru8 Evidence Research — structured evidence research tools for AI agents.
Submit a claim or URL, get back source-traced evidence organized by tier (primary/reporting/commentary) and type (data/official/news/analysis/opinion/academic), with element decomposition and relationship mapping.
pip install tru8-mcp
Or run without installing:
uvx tru8-mcp
Set your API key:
export TRU8_API_KEY=tru8_sk_...
Create an API key at your Tru8 dashboard under Settings > Developer.
Add to claude_desktop_config.json:
{
"mcpServers": {
"tru8": {
"command": "tru8-mcp",
"env": {
"TRU8_API_KEY": "tru8_sk_..."
}
}
}
}
Add to your MCP settings:
{
"mcpServers": {
"tru8": {
"command": "uvx",
"args": ["tru8-mcp"],
"env": {
"TRU8_API_KEY": "tru8_sk_..."
}
}
}
}
git clone https://github.com/SamYatesSmith/tru8-mcp.git
cd tru8-mcp
pip install -e .
tru8-mcp
| Tool | Description | Typical time |
|---|---|---|
tru8_check | Evidence research for a claim or article URL | 15-120s |
tru8_get_result | Retrieve completed check with computed analytics | <1s |
tru8_get_result_raw | Retrieve raw check data without computed analytics | <1s |
| Variable | Required | Description |
|---|---|---|
TRU8_API_KEY | Yes | API key (tru8_sk_...). Create at dashboard > Settings > Developer. |
TRU8_API_URL | No | API base URL. Default: https://api.trueight.com |
Store API keys in environment variables or a secrets manager. Never hardcode keys in source code. If a key is compromised, revoke it immediately at your dashboard.
FAQs
Tru8 Evidence Research MCP server — structured evidence research tools for AI agents
We found that tru8-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.