npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2026 – Pkg Stats / Ryan Hefner

@wyattjoh/forgejo-mcp

v0.2.2

Published

Unofficial Forgejo MCP server over Streamable HTTP with per-user Forgejo OAuth login.

Vulnerabilities

Powered byPowered by Snyk
  • 0High
  • 0Medium
  • 0Low

Links

Git

Maintainers

wyattjohwyattjoh

Keywords

codebergforgejomcpmodel-context-protocol

Readme

Forgejo HTTP MCP

Run bun run mcp at the workspace root after configuring .env.example. The server exposes stateless Streamable HTTP with JSON responses at /mcp and a minimal /healthz endpoint. It uses the MCP TypeScript SDK's Web Standard HTTP transport on Bun.

The OAuth broker exposes protected-resource metadata and authorization-server metadata, /oauth/register, /oauth/authorize, /oauth/consent, /oauth/callback, /oauth/token, and /oauth/revoke. Forgejo provides the native user login and account authorization. The broker provides MCP resource tokens and manages Forgejo token refresh server-side.

MCP access tokens expire after one hour. Refresh tokens rotate on every exchange and expire after 30 days. Reusing a consumed refresh token invalidates its entire grant. Authorization codes expire after one minute and are consumed atomically. Pending browser login state expires after five minutes. All persisted OAuth state is encrypted with AES-256-GCM; presented MCP tokens and codes are indexed by their hashes. Revoking a token removes the associated grant and invalidates its other access and refresh tokens.

The SDK transport is stateless, but authorization needs persistent storage. This implementation supports one server process with its SQLite volume. Run one replica. Multiple replicas require a shared store and a distributed lock around Forgejo's rotating refresh-token exchange.

Read tools are always available to authorized clients. Writes require MCP_READ_ONLY=false and the client's forgejo:write scope. Schemas derive from the core catalog; strict HTTP schemas exclude local filesystem and host-selector fields. Full catalog refinements still run in core. Tool responses include both JSON text and structuredContent with the shared CommandOutcome.

For a mutation, inspect effects and the approve step in next_steps. Repeat the identical tool arguments with the returned grant in _approval. _dry_run previews mutation effects. OAuth consent and command execution approval are separate decisions.

The server uses a dedicated encrypted database and rejects opening it with a different encryption key, Forgejo host, OAuth application ID, or public issuer URL. Use a fresh database for a different deployment. Keep the key with your deployment secrets and back it up alongside the database.

See deployment and proxy setup. Browser clients may require their origin to be added to MCP_ALLOWED_ORIGINS. CLI and desktop MCP clients normally omit Origin.