x.comthreadJan Curn (@jancurn) on X
Announcement of mcpc v0.7.0, Apify's open-source MCP CLI client (npm i -g @apify/mcpc), which adds support for the MCP Skills extension with new skills-list/skills-get commands that verify SKILL.md and supporting files against the skill manifest via size and SHA-256 checks before printing content. The release also ships security hardening: repo-local .mcp.json auto-discovery can no longer read environment variables (blocking leaks like $GITHUB_TOKEN), OAuth refresh tokens are now scoped only to the auth server originally used, and Windows login URLs no longer launch through cmd.exe.
TL;DR mcpc v0.7.0 adds MCP Skills file-integrity verification plus OAuth/env-var security hardening for its MCP CLI client.
Also seen from another angle🧠 AI →
Technologies named here
- mcpc
- mcpc version 0.7.0
- Windows
- Model Context Protocol
- OAuth
- npm
Techniques named here
- Opening Windows login URLs through cmd.exe
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle