Clarx MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Clarx local manifest scoring and optional hosted findings: Do local scoring rules remain attributable and clearly distinct from token-authenticated remote scan results?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Scoring/validating agent instruction manifests and generating CI/readiness workflows.

What we know

Local MCP for scoring CLAUDE.md/AGENTS.md, validating clarx-manifest.json, generating CI workflows and optionally using Clarx Cloud/Anthropic for hosted AI or repository-scan functions.

Maintenance / activity evidence

@clarxai/mcp 0.2.2 published 2026-08-19T16:17:21.278Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Local analysis plus optional org-scoped hosted findings/AI. Writes: Returns generated workflow/manifest text; no direct local file-write tool established.
Optional Clarx token or Anthropic key.
Sensitive access: Internal agent instructions, Repository findings, Cloud tokens

Primarily analysis, but optional cloud/BYOK paths move repository instructions/data outside local boundary.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do local scoring rules remain attributable and clearly distinct from token-authenticated remote scan results?

The bounded review of the publisher's documented Clarx local manifest scoring and optional hosted findings and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Primarily analysis, but optional cloud/BYOK paths move repository instructions/data outside local boundary.
Local analysis plus optional org-scoped hosted findings/AI.
Optional Clarx token or Anthropic key.
Core can remain local; hosted features send manifest/repository content to configured services.
Reviewed write actions: Returns generated workflow/manifest text; no direct local file-write tool established
Sensitive access: Internal agent instructions, Repository findings, Cloud tokens
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
public repository identity
Core scores are heuristics/ergonomics signals, not security/correctness guarantees.
Hosted features are plan/scope limited.
Repository content may be sent to Clarx or Anthropic when optional hosted/BYOK features are used.
No public repo was proven.

Original activity observations

@clarxai/mcp 0.2.2 published 2026-08-19T16:17:21.278Z

Technical identity

npm/@clarxai/mcp

Exact implementation source: https://www.npmjs.com/package/@clarxai/mcp ↗
Reviewed resource type: MCP Server
Package identity: npm:@clarxai/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@clarxai/mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
Evidence source ↗
clarx.ai/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Core local checks versus hosted Clarx AI functions. CLARX_MCP_TOKEN unlocks cloud features; ANTHROPIC_API_KEY is an alternative BYOK for AI drafting.
publisher install or stdio launch · Claude Code only · Publisher instructions
claude mcp add clarx -- npx -y @clarxai/mcp@latest
Configure / authenticate
MCP100 setup guide
Publisher `claude mcp add clarx -- npx -y @clarxai/mcp@latest`; CLARX_MCP_TOKEN is used for hosted AI/repository features and ANTHROPIC_API_KEY is optional BYOK alternative.
Previously reviewed client configuration / prerequisites: Distinguish keyless local manifest checks from hosted AI/data tools.
Check connection
Suggested check
Use read-only manifest or repo listing; avoid AI quota-consuming draft generation as validation.
Remove / uninstall / revoke
MCP100 setup guide
For a Claude Code registration named `clarxai-mcp`, run `claude mcp remove clarxai-mcp`; otherwise remove the exact entry in the chosen MCP client settings and restart/reconnect. This client-host removal command is MCP100-composed from Claude Code lifecycle documentation, not a vendor-authored uninstall. With `npx`, a separate global package uninstall normally is unnecessary. Do not delete provider data or credentials by default.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove clarxai-mcp

Official Documentation & Sources

What it does

Local MCP for scoring CLAUDE.md/AGENTS.md, validating clarx-manifest.json, generating CI workflows and optionally using Clarx Cloud/Anthropic for hosted AI or repository-scan functions.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Scoring/validating agent instruction manifests and generating CI/readiness workflows.

Representative uses

Score/validate agent manifests
Generate GitHub Actions score gate
Suggest/draft manifest improvements
Inspect Clarx-hosted repository findings when authenticated

Limitations

Core scores are heuristics/ergonomics signals, not security/correctness guarantees.
Hosted features are plan/scope limited.
Repository content may be sent to Clarx or Anthropic when optional hosted/BYOK features are used.
No public repo was proven.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Optional Clarx token or Anthropic key.
Permissions: Local analysis plus optional org-scoped hosted findings/AI.
Data handling: Core can remain local; hosted features send manifest/repository content to configured services.
Cost: plan_or_provider_based
Risk and cautions: Primarily analysis, but optional cloud/BYOK paths move repository instructions/data outside local boundary.

Access scope and cautions

Write actions: Returns generated workflow/manifest text; no direct local file-write tool established
Sensitive access: Internal agent instructions Repository findings Cloud tokens
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Score/validate agent manifests; Generate GitHub Actions score gate; Suggest/draft manifest improvements; Inspect Clarx-hosted repository findings when authenticated.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @clarxai/mcp@latest. Recorded transport: stdio. Recorded environment-variable notes: CLARX_MCP_TOKEN (optional); CLARX_API_URL (optional); ANTHROPIC_API_KEY (optional BYOK). No configuration values are supplied here. Prerequisites: MCP client; local manifest/README files. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: No auth for local core tools; Clarx token for cloud features; optional Anthropic BYOK.

Can it modify data or perform write operations?

Documented write actions include: Returns generated workflow/manifest text; no direct local file-write tool established. Recorded permission boundary: Local analysis plus optional org-scoped hosted findings/AI.

What data-handling boundary should I consider?

Core can remain local; hosted features send manifest/repository content to configured services. Recorded sensitive-access context: Internal agent instructions; Repository findings; Cloud tokens.

What limitations and risks should I check before use?

Primarily analysis, but optional cloud/BYOK paths move repository instructions/data outside local boundary. Core scores are heuristics/ergonomics signals, not security/correctness guarantees. Hosted features are plan/scope limited. Repository content may be sent to Clarx or Anthropic when optional hosted/BYOK features are used. No public repo was proven. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

What cost model is recorded?

The reviewed cost model is plan or provider based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.

Is this an official MCP?

Clarx AI is listed as First-party MCP in MCP100’s current evidence.