gopher-mcp-js
mcp
Basarisiz
Health Uyari
- License — License: Apache-2.0
- Description — Repository has a description
- Active repo — Last push 0 days ago
- Low visibility — Only 7 GitHub stars
Code Basarisiz
- fs module — File system access in .github/workflows/publish-packages.yml
- rm -rf — Recursive force deletion command in build.sh
- rm -rf — Recursive force deletion command in examples/auth/package.json
Permissions Gecti
- Permissions — No dangerous permissions requested
Purpose
This tool provides a TypeScript SDK for orchestrating AI agents using the Model Context Protocol (MCP). It allows developers to connect to multiple LLM providers (like Anthropic, OpenAI, and Google) and execute tools across various MCP servers.
Security Assessment
Risk Rating: Medium. The tool inherently makes external network requests, as it connects to third-party LLM providers and remote MCP servers. It handles sensitive data, specifically API keys (`GOPHER_API_KEY`), which are securely loaded via environment variables. However, the automated rule-based scan raised two critical failures. Recursive force deletion commands (`rm -rf`) were detected in `build.sh` and an example `package.json`. While this is common in build scripts to clean directories, it remains a risky practice if paths are ever manipulated. Additionally, file system access was flagged in the CI/CD GitHub workflow. No hardcoded secrets or overly broad permissions were found.
Quality Assessment
The project is very new and currently suffers from extremely low community visibility, having only 7 GitHub stars. However, it appears to be actively maintained, with the most recent code pushed just today. It benefits from a standard, permissive open-source license (Apache-2.0), making it legally safe for integration.
Verdict
Use with caution—the code is active and licensed properly, but the low community adoption and presence of aggressive `rm -rf` commands in build scripts warrant a manual code review before implementation.
This tool provides a TypeScript SDK for orchestrating AI agents using the Model Context Protocol (MCP). It allows developers to connect to multiple LLM providers (like Anthropic, OpenAI, and Google) and execute tools across various MCP servers.
Security Assessment
Risk Rating: Medium. The tool inherently makes external network requests, as it connects to third-party LLM providers and remote MCP servers. It handles sensitive data, specifically API keys (`GOPHER_API_KEY`), which are securely loaded via environment variables. However, the automated rule-based scan raised two critical failures. Recursive force deletion commands (`rm -rf`) were detected in `build.sh` and an example `package.json`. While this is common in build scripts to clean directories, it remains a risky practice if paths are ever manipulated. Additionally, file system access was flagged in the CI/CD GitHub workflow. No hardcoded secrets or overly broad permissions were found.
Quality Assessment
The project is very new and currently suffers from extremely low community visibility, having only 7 GitHub stars. However, it appears to be actively maintained, with the most recent code pushed just today. It benefits from a standard, permissive open-source license (Apache-2.0), making it legally safe for integration.
Verdict
Use with caution—the code is active and licensed properly, but the low community adoption and presence of aggressive `rm -rf` commands in build scripts warrant a manual code review before implementation.
JS bindings for Cross-Language MCP Orchestrator, think of LangChain + Vercel AI kit but for MCP
README.md
@gopher.security/gopher-mcp-js
TypeScript SDK for AI Agent orchestration with MCP (Model Context Protocol) support.
Features
- Multi-Provider LLM Support - Anthropic, OpenAI, Google, Azure, and more
- MCP Protocol - Full Model Context Protocol client support
- Native Performance - Powered by C++ core with TypeScript bindings
- Tool Orchestration - Execute tools across multiple MCP servers
- Type Safety - Full TypeScript support with strict mode
Supported LLM Providers
| Provider | Models |
|---|---|
| Anthropic | Claude 3.5 Sonnet, Claude 3 Haiku, Claude 3 Opus |
| OpenAI | GPT-4o, GPT-4o-mini, GPT-4 Turbo |
| Gemini 2.5 Flash, Gemini 2.0 Pro | |
| Azure OpenAI | GPT-4o, GPT-4 (via Azure deployment) |
Installation
npm install @gopher.security/gopher-mcp-js
The package automatically installs the correct native library for your platform:
- macOS (ARM64, x64)
- Linux (ARM64, x64)
- Windows (ARM64, x64)
Quick Start
Using Gopher API Key (Recommended)
import { GopherAgent } from '@gopher.security/gopher-mcp-js';
// Create agent with Gopher API key (fetches MCP config automatically)
const agent = GopherAgent.createWithApiKey(
'AnthropicProvider',
'claude-3-haiku-20240307',
process.env.GOPHER_API_KEY!
);
try {
const answer = agent.run('List all my Gmail drafts');
console.log(answer);
} finally {
agent.dispose();
}
Using Custom Server Configuration
import { GopherAgent } from '@gopher.security/gopher-mcp-js';
const serverConfig = JSON.stringify({
succeeded: true,
code: 200000000,
message: 'success',
data: {
servers: [
{
version: '2025-01-09',
serverId: '1',
name: 'my-server',
transport: 'http_sse',
config: { url: 'http://localhost:3001/mcp', headers: {} },
connectTimeout: 5000,
requestTimeout: 30000,
},
],
},
});
const agent = GopherAgent.createWithServerConfig(
'OpenAIProvider',
'gpt-4o-mini',
serverConfig
);
try {
const answer = agent.run('What tools are available?');
console.log(answer);
} finally {
agent.dispose();
}
Using Configuration Builder
import { GopherAgent, GopherAgentConfig } from '@gopher.security/gopher-mcp-js';
const config = GopherAgentConfig.builder()
.provider('AnthropicProvider')
.model('claude-3-haiku-20240307')
.apiKey(process.env.GOPHER_API_KEY!)
.build();
const agent = GopherAgent.create(config);
try {
const answer = agent.run('Hello, what can you do?');
console.log(answer);
} finally {
agent.dispose();
}
API Reference
GopherAgent
// Create agent with Gopher API key
GopherAgent.createWithApiKey(provider, model, apiKey): GopherAgent
// Create agent with server configuration JSON
GopherAgent.createWithServerConfig(provider, model, serverConfigJson): GopherAgent
// Create agent with config object
GopherAgent.create(config): GopherAgent
// Run a query
agent.run(query, timeoutMs?): string
// Run with detailed result
agent.runDetailed(query, timeoutMs?): AgentResult
// Release resources (must be called when done)
agent.dispose(): void
Error Handling
import {
GopherAgent,
AgentError,
ApiKeyError,
ConnectionError,
TimeoutError
} from '@gopher.security/gopher-mcp-js';
try {
const agent = GopherAgent.createWithApiKey(provider, model, apiKey);
const result = agent.run('query');
agent.dispose();
} catch (e) {
if (e instanceof ApiKeyError) {
console.error('Invalid API key:', e.message);
} else if (e instanceof ConnectionError) {
console.error('Connection failed:', e.message);
} else if (e instanceof TimeoutError) {
console.error('Operation timed out:', e.message);
} else if (e instanceof AgentError) {
console.error('Agent error:', e.message);
}
}
Environment Variables
| Variable | Description |
|---|---|
GOPHER_API_KEY |
Your Gopher API key (get one at https://gopher.security) |
ANTHROPIC_API_KEY |
Required when using AnthropicProvider |
OPENAI_API_KEY |
Required when using OpenAIProvider |
GOOGLE_API_KEY |
Required when using GoogleProvider |
AZURE_OPENAI_API_KEY |
Required when using AzureProvider |
GOPHER_DEBUG=1 |
Enable debug logging |
Platform Packages
The SDK uses platform-specific packages for native binaries:
| Platform | Package |
|---|---|
| macOS ARM64 | @gopher.security/gopher-orch-darwin-arm64 |
| macOS x64 | @gopher.security/gopher-orch-darwin-x64 |
| Linux ARM64 | @gopher.security/gopher-orch-linux-arm64 |
| Linux x64 | @gopher.security/gopher-orch-linux-x64 |
| Windows ARM64 | @gopher.security/gopher-orch-win32-arm64 |
| Windows x64 | @gopher.security/gopher-orch-win32-x64 |
These are installed automatically as optional dependencies.
Requirements
- Node.js 18+
- Supported platforms: macOS, Linux, Windows (ARM64 or x64)
Troubleshooting
Native library not found
If you see "Failed to load gopher-mcp native library":
- Ensure you're on a supported platform
- Try reinstalling:
npm install @gopher.security/gopher-mcp-js --force - Enable debug logging:
GOPHER_DEBUG=1 node your-app.js
Permission errors on macOS
xattr -d com.apple.quarantine node_modules/@gopher.security/gopher-orch-darwin-*/lib/*.dylib
Links
License
Apache License 2.0 - See LICENSE for details.
Yorumlar (0)
Yorum birakmak icin giris yap.
Yorum birakSonuc bulunamadi