Node Runtime

io.github.mcp-protocolPublished by GitHub account mcp-protocolv1.0.2Updated Nov 3, 2026

This package is intended for demonstration only. Maintained by JFrog Security.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A demonstration-only MCP runtime package from a JFrog security research project, used to simulate supply-chain scenarios rather than to provide real tools.

What you can do
  • The package is described as a functional implementation of an MCP runtime.
  • It is used to simulate supply-chain security scenarios in AI-driven environments.
  • No tools are listed in the manifest, and no server instructions are provided.
  • It is explicitly marked as a demonstration and research artifact, not a general-purpose runtime.
When to use it
Only if you are studying or reproducing the JFrog supply-chain security simulation it belongs to. It is not meant for production use or everyday assistant workflows.
Requirements
Runs as a local process over stdio, installed from the npm package @mcp-protocol/node-runtime, so a Node.js environment is needed. Desktop only; no authentication, environment variables or headers are declared.
Before you install
The publisher states it is for demonstration only, part of a security research simulation, and not intended for production or general-purpose use. Treat it as untrusted test material rather than a tool to rely on, and do not point it at real data or credentials.

Installation

In SourceWeft

  1. Open Node Runtime in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@mcp-protocol/node-runtime (Simulation)

Note: This package is part of a security research demonstration by JFrog.

Overview

This repository contains a functional implementation of an MCP (Model Context Protocol) runtime used to simulate supply-chain security scenarios in AI-driven environments.

Important Information

This repository and the associated package are part of a security simulation and research project. It is not intended for production environments or general-purpose use.

Source: README.md at commit e2d00af

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.2LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.