Mcp Handler

Vercel MCP Adapter for Next.js and other frameworks

CommunityActiveNot testedUpdated 4/3/2026

Cloud

★ 577↓ 192.9k/wknpm

Edit this page

MCPpedia
Score

No CVEsActivestdio

How we score →

Should you use this server?

Vercel MCP Adapter for Next.js and other frameworks

✓

Is it safe?

No known CVEs for mcp-handler. 1 previously resolved.

No authentication — any process on your machine can connect to this server.

License not specified.

Last scanned 0 days ago.

✓

Is it maintained?

Last commit 10 days ago. 577 GitHub stars. 192,875 weekly downloads.

Will it work with my client?

Transport: stdio. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.

How much context will it use?

0 tools. Token cost not measured.

What if it doesn't work?

Common issues: JSON syntax errors in config, wrong Node.js version, npx cache. Setup guide covers troubleshooting. Or check GitHub issues for known problems.

Quick Install

{
  "mcpServers": {
    "mcp-handler": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-handler"
      ]
    }
  }
}

Setup guide

Auto-generated from package name. Add to your client's MCP config file.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y mcp-handler 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Score Breakdown

MCPpedia Score

Click each category to see evidence

77B

Scored 1h ago

How we score →

Security

27/30

Last scanned 1h ago

No open vulnerabilities. 1 fixed CVE.

✓

CVEs — 1 fixed CVE — update to 1.1.0check OSV.dev \u2192

○

Authentication — None required — easy to connect

✗

License — Not specified

✓

Repository — Activeview repo \u2192

✗

MCPpedia review — Not yet reviewed by MCPpedia

Advisories (0 open, 1 fixed)

lowCVSS 3.1GHSA-w2fm-25vw-vh7fFixed

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

`mcp-handler` versions prior to 1.1.0 accepted `@modelcontextprotocol/sdk` < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [[CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536)] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a `StreamableHTTPServerTransport` instance is reused across requests. **Note:** This is _not_ a vulnerability in `mcp-handler` itself. T

Affected: >= 0Fixed in 1.1.0Published Apr 1, 2026source \u2192

CVEs checked daily via OSV.dev. Score algorithm is open source.

Embed this score in your READMEPreview badge

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-handler)](https://mcppedia.org/s/mcp-handler)