
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@appsignal/mcp
Advanced tools
This is the official AppSignal MCP server. It allows AI agents to access AppSignal's monitoring data, metrics, and tools and is currently in beta.
Join our Discord community to help test and shape this MCP implementation.
Pull the Docker image:
docker pull appsignal/mcp:latest
Configure Claude to use the AppSignal MCP server by editing the ~/Library/Application Support/Claude/claude_desktop_config.json file:
{
"mcpServers": {
"appsignal": {
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "APPSIGNAL_API_KEY", "appsignal/mcp"],
"env": {
"APPSIGNAL_API_KEY": "your_api_key_here"
}
}
}
}
To enable AppSignal MCP in Claude Code, run the following command:
claude mcp add appsignal -e APPSIGNAL_API_KEY=your_api_key_here -- docker run -i --rm -e APPSIGNAL_API_KEY appsignal/mcp
To enable AppSignal MCP in Cursor or Windsurf, edit your configuration file.
For Cursor use ~/.cursor/mcp.json
For Windsurf use ~/.codeium/windsurf/mcp_config.json
Add the following configuration:
{
"mcpServers": {
"appsignal": {
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "APPSIGNAL_API_KEY", "appsignal/mcp"],
"env": {
"APPSIGNAL_API_KEY": "your-mcp-token"
}
}
}
}
Open your Zed settings file and add the context_servers section:
{
"context_servers": {
"appsignal": {
"source": "custom",
"command": "docker",
"args": ["run", "-i", "--rm", "-e", "APPSIGNAL_API_KEY", "appsignal/mcp"],
"env": {
"APPSIGNAL_API_KEY": "your-mcp-token"
}
}
}
If you are running GitHub Copilot, and are signed in under a company account, make sure to set "MCP servers in Copilot" to "Enabled" under your organization settings > Copilot > Policies.

Then add this config to your .vscode/mcp.json settings:
{
"inputs": [
{
"type": "promptString",
"id": "appsignal_mcp_token",
"description": "AppSignal MCP Token",
"password": true
}
],
"servers": {
"appsignal": {
"command": "docker"
"args": [
"run",
"-i",
"--rm",
"-e",
"APPSIGNAL_API_KEY",
"appsignal/mcp"
],
"env": {
"APPSIGNAL_API_KEY": "${input:appsignal_mcp_token}"
}
}
}
}
To work on the MCP server:
Start the TypeScript compiler in watch mode:
npm run watch
Run tests:
npm test
Use the MCP inspector for debugging:
npm run inspector
Every change that will results in a new version to be released, requires a changeset. Changesets are small Markdown file that describe the change for the end-user. The changeset's frontmatter describes the type of change (new feature, bug fix, etc.) and the version bump (major, minor, or patch).
Use Mono's changeset CLI to generate a new changeset file. Commit the changeset file and include it in your Pull Requests.
mono changeset add
Install Mono, the tool used for release management.
git pull # Ensure you have the latest version
mono publish # Publish a new version
Thinking of contributing to our project? Awesome! 🚀
Please follow our Contributing guide in our documentation and follow our Code of Conduct.
Also, we would be very happy to send you Stroopwafles. Have look at everyone we send a package to so far on our Stroopwafles page.
This project is licensed under the MIT License - see the LICENSE file for details.
AppSignal provides real-time performance monitoring for your web applications. Track errors, monitor performance, measure client-side metrics, and receive alerts when things go wrong.
FAQs
The official AppSignal MCP server
We found that @appsignal/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.