Compose MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Compose launcher for typed roadmap, changelog and artifact tools: Does transitive runtime resolution preserve the embedded server contract for initialized projects?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Gated, evidence-backed software build/fix workflows with project artifacts and review.

What we know

Slim launcher that delegates to the Compose runtime, which manages typed development lifecycle artifacts, postconditions, evidence, reviews, trackers and optional remote integrations.

Maintenance / activity evidence

@smartmemory/compose-mcp 0.7.2 published 2026-09-29T04:16:56.943Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Project artifact write authority; optional GitHub/remote/memory integrations. Writes: Modify roadmap/changelog/feature/journal artifacts; Write GitHub Issues/Projects/Contents; Write SmartMemory events/knowledge.
Local process or optional remote/GitHub/SmartMemory credentials.
Sensitive access: Source-adjacent planning/evidence, GitHub project data, Optional memory data

Governed local workflow by default, but intentional project writes and optional remote integrations can be consequential.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Does transitive runtime resolution preserve the embedded server contract for initialized projects?

The bounded review of the publisher's documented Compose launcher for typed roadmap, changelog and artifact tools and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Governed local workflow by default, but intentional project writes and optional remote integrations can be consequential.
Project artifact write authority; optional GitHub/remote/memory integrations.
Local process or optional remote/GitHub/SmartMemory credentials.
Project artifacts remain local unless optional integrations are enabled.
Reviewed write actions: Modify roadmap/changelog/feature/journal artifacts; Write GitHub Issues/Projects/Contents; Write SmartMemory events/knowledge
Sensitive access: Source-adjacent planning/evidence, GitHub project data, Optional memory data
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
remote-provider retention
model/provider pricing
Wrapper is not an independent implementation.
Tools intentionally mutate canonical project artifacts.
GitHub tracker can write remote issues/projects/files.
Remote access and SmartMemory sync add additional data boundaries.
Launcher only; underlying @smartmemory/compose runtime is the implementation.

Original activity observations

@smartmemory/compose-mcp 0.7.2 published 2026-09-29T04:16:56.943Z

Technical identity

npm/@smartmemory/compose-mcp

Exact implementation source: https://www.npmjs.com/package/@smartmemory/compose-mcp ↗
Reviewed resource type: Framework
Repository identity: smartmemory/compose
Package identity: npm:@smartmemory/compose-mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@smartmemory/compose-mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
smartmemory/compose
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.

Setup · Watchlist

Framework setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install framework / library
Publisher instructions
Framework wrapper requires project layout/config; follow documented Claude Code wiring, not generic bare install.
publisher documented install or connect · Publisher instructions
npx -y @smartmemory/compose-mcp
Configure / authenticate
MCP100 setup guide
Published launcher transitively installs @smartmemory/compose runtime. Do not misclassify this as only an SDK.
{ "mcpServers": { "compose": { "args": [ "-y", "@smartmemory/compose-mcp" ], "command": "npx" } } }
Check connection
Suggested check
User-side suggested check (not executed): inspect registered tools/connection and perform publisher-supported read-only status/list operations. Do not send, purchase, publish, delete, sign, trade or alter data as a smoke test.
Remove / uninstall / revoke
MCP100 setup guide
Generic client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Remove local stored keys/tokens and revoke or rotate corresponding provider authorization using documented provider account controls if available; exact procedure not verified for this package. Wallet private keys cannot be revoked.

Official Documentation & Sources

What it does

Slim launcher that delegates to the Compose runtime, which manages typed development lifecycle artifacts, postconditions, evidence, reviews, trackers and optional remote integrations.

Capability: Developer Tools
Resource type: Framework
Best fit: Gated, evidence-backed software build/fix workflows with project artifacts and review.

Representative uses

Run build/fix lifecycle through MCP
Gate design decisions and verify postconditions
Update roadmap/changelog/feature/journal artifacts
Sync tracker state to GitHub when configured

Limitations

Wrapper is not an independent implementation.
Tools intentionally mutate canonical project artifacts.
GitHub tracker can write remote issues/projects/files.
Remote access and SmartMemory sync add additional data boundaries.
Launcher only; underlying @smartmemory/compose runtime is the implementation.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Local process or optional remote/GitHub/SmartMemory credentials.
Permissions: Project artifact write authority; optional GitHub/remote/memory integrations.
Data handling: Project artifacts remain local unless optional integrations are enabled.
Cost: unknown
Risk and cautions: Governed local workflow by default, but intentional project writes and optional remote integrations can be consequential.

Access scope and cautions

Write actions: Modify roadmap/changelog/feature/journal artifacts Write GitHub Issues/Projects/Contents Write SmartMemory events/knowledge
Sensitive access: Source-adjacent planning/evidence GitHub project data Optional memory data
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which implementation does this page cover?

Slim launcher that delegates to the Compose runtime, which manages typed development lifecycle artifacts, postconditions, evidence, reviews, trackers and optional remote integrations.

What setup and authentication are documented?

Recorded installation/entrypoint step: npm install -g @smartmemory/compose-mcp. Recorded transport: stdio. Recorded environment-variable notes: GITHUB_TOKEN (optional); SMARTMEMORY_API_KEY (optional); COMPOSE_REMOTE_AUTH=enabled (optional). No configuration values are supplied here. Prerequisites: Node/npm; Compose-initialized project. Client notes: Run inside a Compose project; local tracker is the zero-config path. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local filesystem by default; optional GitHub token, SmartMemory API key and paired-device auth.

Can it modify data or perform write operations?

Documented write actions include: Modify roadmap/changelog/feature/journal artifacts; Write GitHub Issues/Projects/Contents; Write SmartMemory events/knowledge. Recorded permission boundary: Project artifact write authority; optional GitHub/remote/memory integrations.

What data-handling boundary should I consider?

Project artifacts remain local unless optional integrations are enabled. Recorded sensitive-access context: Source-adjacent planning/evidence; GitHub project data; Optional memory data.

What limitations and risks should I check before use?

Governed local workflow by default, but intentional project writes and optional remote integrations can be consequential. Wrapper is not an independent implementation. Tools intentionally mutate canonical project artifacts. GitHub tracker can write remote issues/projects/files. Remote access and SmartMemory sync add additional data boundaries. Launcher only; underlying @smartmemory/compose runtime is the implementation. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

Is this an official MCP?

SmartMemory is listed as First-party MCP in MCP100’s current evidence.

Why we’re tracking it

Best fit

What we know

Maintenance / activity evidence

Verification gaps / watch-outs

Original activity observations

Evidence & Sources

Framework setup

Install framework / library

Configure / authenticate

Check connection

Remove / uninstall / revoke

Official Documentation & Sources

What it does

Representative uses

Limitations

Access & risk

Access scope and cautions

FAQ