CrossPaste — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow desktop-platform support and clipboard integration changes

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Local-first cross-device clipboard synchronization with optional AI/MCP access to pasteboard history.

What we know

CrossPaste is a Mac/Windows/Linux pasteboard application with LAN-only synchronization, end-to-end encryption, local OCR and an MCP surface that can expose pasteboard history to AI assistants.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC):bug: refresh companion flavors when editing a paste from the UI ( 5104)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Reads and synchronizes clipboard/pasteboard content. Writes: Copy/paste and synchronize clipboard content.
Device trust/pairing is documented; MCP-specific authentication is not established.
Sensitive access: Clipboard history, Files/images/screenshots copied by the user

Clipboard history frequently contains secrets and personal data; MCP exposure should be tightly scoped even with local-first encrypted sync.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

2,610 repository stars

Stars observed Oct 6, 2026.

All limitations / Review context

Does the documented MCP pasteboard interface still work across supported systems?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Clipboard history frequently contains secrets and personal data; MCP exposure should be tightly scoped even with local-first encrypted sync.
Reads and synchronizes clipboard/pasteboard content.
Device trust/pairing is documented; MCP-specific authentication is not established.
The project documents local storage, LAN-only sync and local OCR.
Reviewed write actions: Copy/paste and synchronize clipboard content
Sensitive access: Clipboard history, Files/images/screenshots copied by the user
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Exact MCP authentication/transport
MCP access can expose highly sensitive clipboard history.
Cross-device use requires trusted device pairing.
MCP-specific endpoint permissions were not fully documented in the reviewed source.

Original activity observations

2026-10-05T13:32:14Z: :bug: refresh companion flavors when editing a paste from the UI ( 5104)

Technical identity

github.com/crosspaste/crosspaste-desktop

Exact implementation source: https://github.com/crosspaste/crosspaste-desktop ↗
Reviewed resource type: Host
Repository identity: CrossPaste/crosspaste-desktop

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
crosspaste/crosspaste-desktop
Recorded repository material and project history.
Includes references whose attribution is not established.
Evidence source ↗
crosspaste.com/en/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Host / Desktop app setup

Publisher instructions.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Warning

MCP service is local-only but unauthenticated: any local process can read clipboard history while enabled.
Disable MCP in app Settings when not needed; a client remove command alone does not disable the exposed service.
This local-only service has no authentication and may expose clipboard history to any same-machine process. Prefer trusted machine; exclude sensitive clipboard sources.
Not a typical standalone MCP server installation; the product documentation does not establish a universal MCP host setup. Do not infer one.
Publisher UI / connection instruction, not a shell command.
MCP100 client-scope note: this Claude Code CLI example applies only to that client and the exact registered name in the command. Desktop, Cursor and other clients use their own configuration; do not run it for a differently named entry.

Download / install
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
Connection / UI instruction · Publisher instructions
Install CrossPaste desktop application from https://crosspaste.com; open its Extensions > MCP settings.
Configure application / integrations
Publisher instructions
Enable built-in MCP server via the UI toggle and choose a port (default fallback 13130). Copy the application-generated `claude mcp add` command rather than guessing endpoint format.
Check connection
Suggested check
Use configured MCP client tool discovery for read-only clipboard `get_clipboard_stats` or `list_tags`.
Disconnect / uninstall / revoke
MCP100 setup guide
Disable MCP server in CrossPaste Extensions > MCP settings; remove the saved MCP registration in your AI client. Do not delete clipboard history.
MCP100 client-scope guidance: each CLI removal example targets only its named client and exact registered entry. Package names, Desktop/Cursor configuration keys and Codex/Claude registration names may differ; use the entry you actually registered. Client removal does not revoke provider credentials.
claude mcp remove crosspaste

Official Documentation & Sources

What it does

CrossPaste is a Mac/Windows/Linux pasteboard application with LAN-only synchronization, end-to-end encryption, local OCR and an MCP surface that can expose pasteboard history to AI assistants.

Capability: Productivity & Collaboration
Resource type: Host
Best fit: Local-first cross-device clipboard synchronization with optional AI/MCP access to pasteboard history.

Representative uses

Sync clipboard content across devices
Search pasteboard history
Expose clipboard history to AI assistants
Run OCR locally

Limitations

MCP access can expose highly sensitive clipboard history.
Cross-device use requires trusted device pairing.
MCP-specific endpoint permissions were not fully documented in the reviewed source.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Device trust/pairing is documented; MCP-specific authentication is not established.
Permissions: Reads and synchronizes clipboard/pasteboard content.
Data handling: The project documents local storage, LAN-only sync and local OCR.
Cost: free
Risk and cautions: Clipboard history frequently contains secrets and personal data; MCP exposure should be tightly scoped even with local-first encrypted sync.

Access scope and cautions

Write actions: Copy/paste and synchronize clipboard content
Sensitive access: Clipboard history Files/images/screenshots copied by the user
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Sync clipboard content across devices; Search pasteboard history; Expose clipboard history to AI assistants; Run OCR locally.

What authentication is documented?

Device pairing/trust is documented; MCP-specific auth is unresolved.

Can it modify data or perform write operations?

Documented write actions include: Copy/paste and synchronize clipboard content. Recorded permission boundary: Reads and synchronizes clipboard/pasteboard content.

What data-handling boundary should I consider?

The project documents local storage, LAN-only sync and local OCR. Recorded sensitive-access context: Clipboard history; Files/images/screenshots copied by the user.

What limitations and risks should I check before use?

Clipboard history frequently contains secrets and personal data; MCP exposure should be tightly scoped even with local-first encrypted sync. MCP access can expose highly sensitive clipboard history. Cross-device use requires trusted device pairing. MCP-specific endpoint permissions were not fully documented in the reviewed source. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

CrossPaste is listed as First-party MCP in MCP100’s current evidence.