@better-auth/cimd — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Recheck a specific changing behavior of npm/@better-auth/cimd: Does the metadataProfile="mcp-2026-07-28" pin preserve draft-00 client discovery semantics after CIMD changes?

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

OAuth implementers supporting MCP client metadata

What we know

Better Auth CIMD metadata plugin implementing client discovery used in MCP OAuth.

Maintenance / activity evidence

First-party npm package page lists @better-auth/cimd v1.7.4 as published in the reviewed October 2026 version series; absolute registry publication timestamp requires confirmation.

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Embedded developer library, not an end-user executable MCP server. Complete write authority is not verified.
Authentication not yet verified.
Client ID Metadata Documents OAuth integration used with Better Auth MCP; it does not itself expose MCP tools.

Client ID Metadata Documents OAuth integration used with Better Auth MCP; it does not itself expose MCP tools.
Advisory/security review not completed; no safety badge.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 1.2M package downloads / 30 days

Downloads observed Oct 9, 2026.

Exact npm package @better-auth/cimd; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

Does the metadataProfile="mcp-2026-07-28" pin preserve draft-00 client discovery semantics after CIMD changes?

No identified material blocker to an accurately qualified public tracking entry in the limited cited evidence. This is not an installation safety certification; product-specific cautions must remain visible.

Client ID Metadata Documents OAuth integration used with Better Auth MCP; it does not itself expose MCP tools.
Advisory/security review not completed; no safety badge.
Embedded developer library, not an end-user executable MCP server.
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Client discovery and trust depend on validated HTTPS metadata; this integration is not a stand-alone MCP transport/server.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.
Release evidence proves attributable activity, not entire installation or tool-level safety.
Current Discovery source binding and atomic apply must be generated using MCP100 existing pipeline.
exact authentication contract
first-party data processing and retention
data retention and permission scope
repository ownership unverified; keep null
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Standalone MCP Server identity cannot be inferred.
This is not a standalone general-purpose MCP server; use the resource-type-specific setup and expectations.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Original activity observations

First-party npm package page lists @better-auth/cimd v1.7.4 as published in the reviewed October 2026 version series; absolute registry publication timestamp requires confirmation.

Technical identity

npm/@better-auth/cimd

Exact implementation source: https://www.npmjs.com/package/@better-auth%2Fcimd ↗
Reviewed resource type: SDK
Package identity: npm:@better-auth/cimd

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Package registry ↗
@better-auth/cimd
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
better-auth/better-auth
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.

Setup · Watchlist

SDK setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-documented install or connect path; prerequisites and any extra host configuration remain required.
sdk dependency install · Publisher instructions
npm install @better-auth/cimd
Configure / authenticate
MCP100 setup guide
This is a Better Auth CIMD (client ID metadata documents) integration package, NOT a standalone MCP server. Install inside an existing Better Auth application and configure documented authentication integration.
Check connection
Suggested check
Verify your application auth configuration and CIMD document endpoint per Better Auth docs; no MCP tool discovery expected.
Remove / uninstall / revoke
MCP100 setup guide
For the application dependency, run `npm uninstall @better-auth/cimd` in the owning Node project, remove integration imports and rebuild/redeploy. No standalone MCP registration exists for this package.
Client removal, software uninstall, persistent-data deletion and credential revocation are separate actions.
Package / application cleanup · matching installation environment · MCP100 composed guide
npm uninstall @better-auth/cimd

Official Documentation & Sources

What it does

Better Auth CIMD metadata plugin implementing client discovery used in MCP OAuth.

Capability: Security & Testing
Resource type: SDK
Best fit: OAuth implementers supporting MCP client metadata

Representative uses

CIMD discovery
Better Auth integration

Limitations

Standalone MCP Server identity cannot be inferred.
This is not a standalone general-purpose MCP server; use the resource-type-specific setup and expectations.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Embedded developer library, not an end-user executable MCP server.
Data handling: Not documented in the reviewed sources
Cost: unknown
Risk and cautions: Client ID Metadata Documents OAuth integration used with Better Auth MCP; it does not itself expose MCP tools.

Access scope and cautions

Write actions: Not verified
Risk level: moderate
Security notes: Advisory/security review not completed; no safety badge.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: CIMD discovery; Better Auth integration.

What setup and authentication are documented?

A complete connection procedure is not verified. Client notes: Inspect client identity metadata discovery in a composed app. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Client ID metadata document integration; it does not itself implement a standalone MCP server.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. Recorded permission context: Embedded developer library, not an end-user executable MCP server.

What limitations and risks should I check before use?

Client ID Metadata Documents OAuth integration used with Better Auth MCP; it does not itself expose MCP tools. Standalone MCP Server identity cannot be inferred. This is not a standalone general-purpose MCP server; use the resource-type-specific setup and expectations. Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode. Advisory/security review not completed; no safety badge. Client discovery and trust depend on validated HTTPS metadata; this integration is not a stand-alone MCP transport/server. Unknown vulnerabilities and provider data handling are not certified by this public tracking review.