brainCloud MCP Helper — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to brainCloud local filesystem sync using short-lived hosted tickets: Do app-scoped tickets remain required for Builder API calls without storing a long-lived cloud credential locally?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Safe local filesystem side of brainCloud Cloud Code sync, paired with short-lived tickets from the hosted brainCloud MCP.

What we know

Local stdio helper that syncs Cloud Code scripts between a local folder and brainCloud. It stores no brainCloud credential itself; every operation uses a short-lived app-scoped read/write ticket minted by the hosted brainCloud MCP.

Maintenance / activity evidence

@braincloud/mcp-helper 6.0.0 published 2026-07-10T18:34:54.088Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Filesystem and brainCloud Cloud Code read/write authority scoped by ticket. Writes: Pull files locally; Push Cloud Code remotely; Two-way merge; Optional deletes.
Short-lived read/write sync ticket.
Sensitive access: Source/cloud scripts, Local project files, Short-lived sync tickets

Write tickets can change production cloud code; separation of read/write tickets is a strong boundary.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do app-scoped tickets remain required for Builder API calls without storing a long-lived cloud credential locally?

The bounded review of the publisher's documented brainCloud local filesystem sync using short-lived hosted tickets and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Write tickets can change production cloud code; separation of read/write tickets is a strong boundary.
Filesystem and brainCloud Cloud Code read/write authority scoped by ticket.
Short-lived read/write sync ticket.
Bulk script data flows directly helper ↔ brainCloud Builder API, not through model context.
Reviewed write actions: Pull files locally; Push Cloud Code remotely; Two-way merge; Optional deletes
Sensitive access: Source/cloud scripts, Local project files, Short-lived sync tickets
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
Requires the hosted brainCloud MCP for ticket issuance.
`sync` can write both locally and remotely and can create conflict markers.
Deletes only happen when explicitly allowed, but they remain destructive.

Original activity observations

@braincloud/mcp-helper 6.0.0 published 2026-07-10T18:34:54.088Z

Technical identity

npm/@braincloud/mcp-helper

Exact implementation source: https://www.npmjs.com/package/@braincloud/mcp-helper ↗
Reviewed resource type: MCP Server
Repository identity: getbraincloud/braincloud-mcp-helper
Package identity: npm:@braincloud/mcp-helper

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@braincloud/mcp-helper
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
Evidence source ↗
help.getbraincloud.com/en/articles/15695153-syncing-cloud-code-to-local-files-with-the-braincloud-mcp-helper
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Trustless brainCloud inspection/helper MCP; README contains mcpServers JSON. It does not itself authenticate to brainCloud. Avoid misrepresenting as fully managed brainCloud access.
Pair with hosted brainCloud API only if needed; no token assumed.
Earlier review note retained for provenance; the V3 verified fields take precedence: Targeted 2026-10-13 re-research: Publisher README provides an npx-based mcpServers example; confirm required CloudSync core before use.
Prior reviewed safety note: Do not place orders, spend tokens, modify infrastructure or upload confidential files as a test.
Prior reviewed safety note: Do not invent a one-line reversal command.
Direct npm README reviewed 2026-10-14; client registration still required.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.

Install / connect
Publisher instructions
Trustless brainCloud inspection/helper MCP; README contains mcpServers JSON. It does not itself authenticate to brainCloud. Avoid misrepresenting as fully managed brainCloud access.
publisher documented mcp stdio launch · Publisher instructions
npx -y @braincloud/mcp-helper
Configure / authenticate
MCP100 setup guide
Register stdio helper with `npx -y @braincloud/mcp-helper`, as shown in publisher MCP JSON; helper is intended to be paired with hosted brainCloud.
Previously reviewed client configuration / prerequisites: Publisher states it does not authenticate to brainCloud by itself and stores no brainCloud secret; pair with separately managed hosted connection as needed. Never require a brainCloud API key just to run this helper.
Check connection
Suggested check
Confirm tool discovery and supported hosted pairing; process start alone does not prove upstream auth.
Remove / uninstall / revoke
MCP100 setup guide
For a Claude Code registration named `braincloud-mcp-helper`, run `claude mcp remove braincloud-mcp-helper`; otherwise remove the exact entry in the chosen MCP client settings and restart/reconnect. This client-host removal command is MCP100-composed from Claude Code lifecycle documentation, not a vendor-authored uninstall. With `npx`, a separate global package uninstall normally is unnecessary. Do not delete provider data or credentials by default.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove braincloud-mcp-helper

Official Documentation & Sources

What it does

Local stdio helper that syncs Cloud Code scripts between a local folder and brainCloud. It stores no brainCloud credential itself; every operation uses a short-lived app-scoped read/write ticket minted by the hosted brainCloud MCP.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Safe local filesystem side of brainCloud Cloud Code sync, paired with short-lived tickets from the hosted brainCloud MCP.

Representative uses

Dry-run sync status
Pull cloud code to local files
Push local scripts to brainCloud
Two-way merge with conflict markers
Use optional deletes only when explicitly enabled

Limitations

Requires the hosted brainCloud MCP for ticket issuance.
`sync` can write both locally and remotely and can create conflict markers.
Deletes only happen when explicitly allowed, but they remain destructive.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Short-lived read/write sync ticket.
Permissions: Filesystem and brainCloud Cloud Code read/write authority scoped by ticket.
Data handling: Bulk script data flows directly helper ↔ brainCloud Builder API, not through model context.
Cost: service_plan
Risk and cautions: Write tickets can change production cloud code; separation of read/write tickets is a strong boundary.

Access scope and cautions

Write actions: Pull files locally Push Cloud Code remotely Two-way merge Optional deletes
Sensitive access: Source/cloud scripts Local project files Short-lived sync tickets
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Dry-run sync status; Pull cloud code to local files; Push local scripts to brainCloud; Two-way merge with conflict markers; Use optional deletes only when explicitly enabled.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @braincloud/mcp-helper@latest. Recorded transport: stdio. Prerequisites: brainCloud hosted MCP connection; local sync directory. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: No login/credential of its own; each call receives a short-lived app-scoped ticket from hosted brainCloud MCP.

Can it modify data or perform write operations?

Documented write actions include: Pull files locally; Push Cloud Code remotely; Two-way merge; Optional deletes. Recorded permission boundary: Filesystem and brainCloud Cloud Code read/write authority scoped by ticket.

What data-handling boundary should I consider?

Bulk script data flows directly helper ↔ brainCloud Builder API, not through model context. Recorded sensitive-access context: Source/cloud scripts; Local project files; Short-lived sync tickets.

What limitations and risks should I check before use?

Write tickets can change production cloud code; separation of read/write tickets is a strong boundary. Requires the hosted brainCloud MCP for ticket issuance. `sync` can write both locally and remotely and can create conflict markers. Deletes only happen when explicitly allowed, but they remain destructive. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

What cost model is recorded?

The reviewed cost model is service plan. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.