@apier-no/mcp

Hardened thin npm proxy that connects local MCP clients (Claude Desktop, Cursor, Zed, Codex) to Apier's hosted Norwegian compliance MCP server at https://www.apier.no/api/mcp.

Published as @apier-no/mcp. The @apier scope was unavailable, so this package ships under the @apier-no scope.

What this is

A small wrapper around mcp-remote that:

• Reads APIER_API_KEY from your environment.
• Scrubs it from the spawned child process environment before invoking mcp-remote.
• Forwards the key only via --header "Authorization: Bearer …" argv.
• Refuses non-https endpoints.
• Redacts any Bearer …, apier_(live|test)_…, ghp_…, or Authorization: substring from stderr before writing.

All tool semantics live server-side at https://www.apier.no/api/mcp.

Install

npm install -g @apier-no/mcp

or invoke ephemerally via npx: npx -y @apier-no/mcp

Get an API key

https://www.apier.no/dashboard/keys

Claude Desktop / Cursor config

{
  "mcpServers": {
    "apier": {
      "command": "npx",
      "args": ["-y", "@apier-no/mcp"],
      "env": { "APIER_API_KEY": "apier_live_<your_key_here>" }
    }
  }
}

Configuration

Variable	Required	Default
APIER_API_KEY	yes	—
--endpoint <url>	no	https://www.apier.no/api/mcp
MCP_REMOTE_CONFIG_DIR	no	~/.mcp-auth

Security

See SECURITY.md for the full threat model and disclosure policy.

License

MIT