I
Idw Apps
@onereach/idw-apps · by onereach.user
IDW adapter around @modelcontextprotocol/ext-apps plus iframe-facing state/actions for MCP Apps and embedded IDW web apps.
1 open CVE
No license
Maintenance unknown
No commit data
Works with most clients
Transport: stdio
0 tools
Grade F
Idw Apps is an MCP server that IDW adapter around @modelcontextprotocol/ext-apps plus iframe-facing state/actions for MCP Apps and embedded IDW web apps. Its tool list has not been published yet over stdio, requires no API key, and scores 28/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"idw-apps": {
"command": "npx",
"args": [
"-y",
"@onereach/idw-apps"
]
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/idw-apps)
Read me
What Idw Apps does
IDW adapter around @modelcontextprotocol/ext-apps plus iframe-facing state/actions for MCP Apps and embedded IDW web apps.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@onereach/idw-apps' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
28/100across 5 weighted dimensions
0255075100
17
10
−72
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev1 open
MAL-2026-11601info
Malicious code in @onereach/idw-apps (npm)
npm/@onereach/idw-apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 (the "Shai-Hulud: Here We Go Again" wave) — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed version(s) were trojanized and republished by the worm after it reached an npm publish token belonging to a maintainer in this namespace; the payload enumerates every package a stolen token controls and republishes each with the same hook, so
Help improve this page
This server is missing a description. Tools and install config are also missing.If you've used it, help the community.
Add informationCommunity
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is Idw Apps safe to use?
- Idw Apps has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "@onereach/idw-apps". Review the Security section above for details before installing.
- How do I install Idw Apps?
- Install Idw Apps via npm: `npx @onereach/idw-apps`. Then add it to your MCP client config file.
- What AI clients work with Idw Apps?
- Idw Apps is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Related
Similar servers
Others in other
Headroom95Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.
67.3k 3
T
Transport Stdio95Transport for TMCP using STDIO
197 14
Flare95The graph based agentic IDE
139 3
A
app.fojin/fojin-mcp94Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.
330 8
MCP Security Weekly
Get CVE alerts and security updates for Idw Apps and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.