Is io.github.WYRE-AI/sherweb-mcp safe to use?

io.github.WYRE-AI/sherweb-mcp has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under Apache-2.0.

How do I install io.github.WYRE-AI/sherweb-mcp?

io.github.WYRE-AI/sherweb-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with io.github.WYRE-AI/sherweb-mcp?

io.github.WYRE-AI/sherweb-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.WYRE-AI/sherweb-mcp actively maintained?

io.github.WYRE-AI/sherweb-mcp is actively maintained - last commit was 1 day ago.

io.github.WYRE-AI/sherweb-mcp

@wyre-ai/sherweb-mcp

MCP server for Sherweb — billing, subscriptions, customers, and product catalog.

GitHub npm

No known CVEs

Apache-2.0 license

Actively maintained

Last commit 1d ago

Works with most clients

Transport: stdio

0 tools

Grade F

MCPpedia last refreshed this data 1d ago

Edit this pageView history

io.github.WYRE-AI/sherweb-mcp is an MCP server that MCP server for Sherweb — billing, subscriptions, customers, and product catalog. Its tool list has not been published yet over stdio, requires no API key, and scores 59/100 on MCPpedia's security, maintenance and efficiency rubric.

Finance E-Commerce

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-wyre-ai-sherweb-mcp": {
      "args": [
        "-y",
        "@wyre-ai/sherweb-mcp"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-wyre-ai-sherweb-mcp)](https://mcppedia.org/s/io-github-wyre-ai-sherweb-mcp)

Read me

What io.github.WYRE-AI/sherweb-mcp does

MCP server for Sherweb — billing, subscriptions, customers, and product catalog.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.

npx -y '@wyre-ai/sherweb-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

59/100across 5 weighted dimensions

How we score →

0255075100

−41

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked @wyre-ai/sherweb-mcp against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.WYRE-AI/sherweb-mcp safe to use?: io.github.WYRE-AI/sherweb-mcp has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under Apache-2.0.
How do I install io.github.WYRE-AI/sherweb-mcp?: io.github.WYRE-AI/sherweb-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.WYRE-AI/sherweb-mcp?: io.github.WYRE-AI/sherweb-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.WYRE-AI/sherweb-mcp actively maintained?: io.github.WYRE-AI/sherweb-mcp is actively maintained - last commit was 1 day ago.

Similar servers

Others in finance / ecommerce

View all →

Agent Trade Kit94

OKX trading MCP server — connect AI agents to spot, swap, futures, options & grid bots via the Model Context Protocol.

509 3

AiSOC92

Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.

7.5k 3

io.github.seekdaseek/agentfeed92

Crypto briefs and data, Solana pre-trade checks, sanctions, papers, NLP. 102 tools, USDC, 20 chains.

io.github.LuxAlgo/luxalgo-mcp-server92

LuxAlgo for AI agents: the Library, prop firms, Market Trackers, Edge Stats, and your Trade Journal

110 7

MCP Security Weekly

Get CVE alerts and security updates for io.github.WYRE-AI/sherweb-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Finance E-Commerce

Step 1

Install in your client

Config is the same across clients - only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-wyre-ai-sherweb-mcp": {
      "args": [
        "-y",
        "@wyre-ai/sherweb-mcp"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-wyre-ai-sherweb-mcp)](https://mcppedia.org/s/io-github-wyre-ai-sherweb-mcp)

Read me

What io.github.WYRE-AI/sherweb-mcp does

MCP server for Sherweb — billing, subscriptions, customers, and product catalog.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.

npx -y '@wyre-ai/sherweb-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Sherweb MCP Server

A Model Context Protocol (MCP) server for Sherweb cloud marketplace and partner portal. Enables AI assistants to manage customer subscriptions, browse the product catalog, and handle billing operations.

This is a Model Context Protocol (MCP) server that connects Claude (or any MCP-compatible AI) to your Sherweb environment.

Part of the MSP Claude Plugins ecosystem — a growing suite of AI integrations for the MSP stack. Built by MSPs, for MSPs.

Installation

npm install @wyre-ai/sherweb-mcp

Configuration

Copy .env.example and set the variables below.

Variable	Required	Description
`SHERWEB_CLIENT_ID`	For stdio and `AUTH_MODE=env`	Sherweb API client ID
`SHERWEB_CLIENT_SECRET`	For stdio and `AUTH_MODE=env`	Sherweb API client secret
`SHERWEB_SUBSCRIPTION_KEY`	For stdio and `AUTH_MODE=env`	Sherweb API subscription key
`MCP_TRANSPORT`	No	`stdio` (default) or `http`
`AUTH_MODE`	No	`gateway` (Docker image and Compose default) or `env`. Gateway mode requires `X-Sherweb-Client-ID`, `X-Sherweb-Client-Secret`, and `X-Sherweb-Subscription-Key` on each `/mcp` request and never falls back to `SHERWEB_*`. `env` uses those variables only after S2S auth succeeds.
`CONDUIT_S2S_SECRET`	Yes for HTTP	Service-to-service secret. The HTTP server logs an error and exits non-zero when this is empty or a known placeholder (`changeme`, `your-s2s-secret`, `placeholder`, `secret`, and similar copied examples). Compose will not start without it. Never commit a real value. Generate one with `openssl rand -hex 32`.
`MCP_ALLOW_INSECURE_DEV`	No	Set to `1` only for local development to start HTTP without `CONDUIT_S2S_SECRET`. The process logs a warning, does not enforce `X-Gateway-S2S`, and binds `127.0.0.1` only. A non-loopback `MCP_HTTP_HOST` (including `0.0.0.0`) is ignored and the override is logged. A placeholder secret is still refused.
`MCP_HTTP_HOST`	No	Bind address when `MCP_TRANSPORT=http` and `CONDUIT_S2S_SECRET` is set. Defaults to `127.0.0.1`. The container image sets `0.0.0.0`. Without a real secret the listener is `127.0.0.1`.
`MCP_HTTP_PORT`	No	HTTP port. Defaults to `8080`.

/health and /healthz stay unauthenticated and do not read credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

HTTP authentication

With MCP_TRANSPORT=http and CONDUIT_S2S_SECRET set, every /mcp request must include X-Gateway-S2S. A missing or invalid header returns 401, before vendor credentials are read. The secret is never written to logs.

The header value is t=<unix seconds>,v1=<hex hmac-sha256>. v1 is HMAC-SHA256 over the exact ASCII string t=<unix seconds>, keyed with CONDUIT_S2S_SECRET, hex-encoded (64 lowercase hex characters). The timestamp must be within 300 seconds of the server clock.

t=1710000000,v1=<hmac-sha256("t=1710000000", CONDUIT_S2S_SECRET) as hex>

In AUTH_MODE=gateway, /mcp also requires X-Sherweb-Client-ID, X-Sherweb-Client-Secret, and X-Sherweb-Subscription-Key. Those headers are the only credential source for that request. A request missing any of them returns 401 and does not fall back to SHERWEB_* in the process environment.

Usage

Running with Claude Desktop

Add to your Claude Desktop claude_desktop_config.json:

{
  "mcpServers": {
    "sherweb-mcp": {
      "command": "npx",
      "args": ["@wyre-ai/sherweb-mcp"],
      "env": {
        "SHERWEB_CLIENT_ID": "your-sherweb-client-id",
        "SHERWEB_CLIENT_SECRET": "your-sherweb-client-secret",
        "SHERWEB_SUBSCRIPTION_KEY": "your-sherweb-subscription-ke

... [View full README on GitHub](https://github.com/wyre-ai/sherweb-mcp#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories - click any category to see the underlying evidence.

Score breakdown

59/100across 5 weighted dimensions

How we score →

0255075100

−41

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked @wyre-ai/sherweb-mcp against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience - it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.WYRE-AI/sherweb-mcp safe to use?: io.github.WYRE-AI/sherweb-mcp has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under Apache-2.0.
How do I install io.github.WYRE-AI/sherweb-mcp?: io.github.WYRE-AI/sherweb-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.WYRE-AI/sherweb-mcp?: io.github.WYRE-AI/sherweb-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.WYRE-AI/sherweb-mcp actively maintained?: io.github.WYRE-AI/sherweb-mcp is actively maintained - last commit was 1 day ago.