Blaxel TypeScript SDK — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Blaxel SDK retrieval of hosted MCP tools for agent frameworks: Does workspace authentication still bind retrieved MCP tool definitions to the intended Blaxel deployment?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Creating and managing Blaxel sandboxes/resources from TypeScript

What we know

TypeScript SDK for Blaxel sandbox and resource lifecycle operations.

Maintenance / activity evidence

@blaxel/core 0.3.25 published 2026-09-30T20:54:13.013Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Cloud resources within authorized workspace. Writes: Create/delete/configure sandboxes.
BL_API_KEY + workspace.
Sensitive access: Cloud workspace, Sandbox contents

The SDK can create/delete cloud execution environments; API-key scope and workspace isolation matter.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 753.1k package downloads / 30 days

Downloads observed Sep 25, 2026.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

All limitations / Review context

Does workspace authentication still bind retrieved MCP tool definitions to the intended Blaxel deployment?

The bounded review of the publisher's documented Blaxel SDK retrieval of hosted MCP tools for agent frameworks and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

The SDK can create/delete cloud execution environments; API-key scope and workspace isolation matter.
Cloud resources within authorized workspace.
BL_API_KEY + workspace.
Cloud sandbox/resource requests go to Blaxel.
Reviewed write actions: Create/delete/configure sandboxes
Sensitive access: Cloud workspace, Sandbox contents
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
Repository identity
Pricing
This is an SDK, not a standalone MCP server.
Full pricing/data-retention details are external to the package page.

Original activity observations

@blaxel/core 0.3.25 published 2026-09-30T20:54:13.013Z

Technical identity

npm/@blaxel/core

Exact implementation source: https://www.npmjs.com/package/@blaxel/core ↗
Reviewed resource type: SDK
Package identity: @blaxel/core

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

Package registry ↗
@blaxel/core
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
Repository document ↗
blaxel-ai/sdk-typescript
Recorded repository material and project history.

Setup · Watchlist

SDK setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

SDK library for Blaxel sandboxes and remote model/MCP integrations. Install as a dependency in an application; no standalone MCP client registration.
Use SDK authentication and sandbox scope appropriate to your application.
Earlier review note retained for provenance; the V3 verified fields take precedence: Targeted 2026-10-13 re-research: Blaxel core SDK package; BL_WORKSPACE and BL_API_KEY may be needed by the host application. Not direct MCP server.
Supported in publisher npm README; confirm local platform/prerequisites and never paste credentials as literals.
Prior reviewed safety note: Do not register this package as a stdio MCP server.
Prior reviewed safety note: Do not place orders, spend tokens, modify infrastructure or upload confidential files as a test.
Prior reviewed safety note: Do not invent a one-line reversal command.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.

Install / connect
Publisher instructions
SDK library for Blaxel sandboxes and remote model/MCP integrations. Install as a dependency in an application; no standalone MCP client registration.
publisher sdk or product install · Publisher instructions
npm install @blaxel/core
Configure / authenticate
MCP100 setup guide
`npm install @blaxel/core` is a TypeScript SDK install in the consuming project, not a standalone MCP server. Set `BL_WORKSPACE` and `BL_API_KEY` as required for the SDK.
Check connection
Suggested check
Verify SDK import and a read-only workspace API operation in the application; no MCP server is registered by the SDK alone.
Remove / uninstall / revoke
MCP100 setup guide
Remove the SDK/import or integration from the consuming application, then uninstall only its exact package if installed; stop any app server separately. This product does not by itself create an MCP host registration.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.
Package / application cleanup · matching installation environment · MCP100 composed guide
npm uninstall @blaxel/core

Official Documentation & Sources

What it does

TypeScript SDK for Blaxel sandbox and resource lifecycle operations.

Capability: Cloud & DevOps
Resource type: SDK
Industry: Software & Technology
Best fit: Creating and managing Blaxel sandboxes/resources from TypeScript

Representative uses

Create/get/delete sandboxes
Configure images and ports
Manage Blaxel resources

Limitations

This is an SDK, not a standalone MCP server.
Full pricing/data-retention details are external to the package page.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: BL_API_KEY + workspace.
Permissions: Cloud resources within authorized workspace.
Data handling: Cloud sandbox/resource requests go to Blaxel.
Cost: unknown
Risk and cautions: The SDK can create/delete cloud execution environments; API-key scope and workspace isolation matter.

Access scope and cautions

Write actions: Create/delete/configure sandboxes
Sensitive access: Cloud workspace Sandbox contents
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Create/get/delete sandboxes; Configure images and ports; Manage Blaxel resources.

What authentication is documented?

Blaxel workspace/API key.

Can it modify data or perform write operations?

Documented write actions include: Create/delete/configure sandboxes. Recorded permission boundary: Cloud resources within authorized workspace.

What data-handling boundary should I consider?

Cloud sandbox/resource requests go to Blaxel. Recorded sensitive-access context: Cloud workspace; Sandbox contents.

What limitations and risks should I check before use?

The SDK can create/delete cloud execution environments; API-key scope and workspace isolation matter. This is an SDK, not a standalone MCP server. Full pricing/data-retention details are external to the package page. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

Is this an official MCP?

Blaxel is listed as First-party MCP in MCP100’s current evidence.