Deco Studio MCP Gateway — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track this specific gateway implementation and its adoption, setup drift, privilege model, and source activity.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Self-host MCP connections with policy and operational control

What we know

Self-hostable Studio backend/API combining MCP proxying, workspace RBAC, OAuth, secrets storage and automation runners.

Maintenance / activity evidence

155850 npm downloads during 2026-09-08 through 2026-10-07 for decocms

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Proxy downstream writes, manage connection and workflow state Reported action classes: Proxy downstream writes, manage connection and workflow state. Complete write authority is not verified.
Studio OAuth/API keys; app credentials and RBAC
Sensitive access: Integration credentials, Organization data, Execution logs

Central gateway is a high-value credential and trust boundary
Gateway is a trust boundary for upstream tools and credentials; independent access control and auditing may be needed.
Deco Studio hosts authenticated multi-tenant MCP proxy and persistent control plane; credentials/permissions and network exposure require careful admin setup.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 155.9k package downloads / 30 days

Downloads observed Oct 9, 2026.

Exact npm package decocms; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

What changed in documented permissions, distribution and MCP integration of Deco Studio MCP Gateway before the next review?

No substantiated blocker to accurately qualified PUBLIC RADAR TRACKING observed in the scoped cited documentation; material caveats are required on the public page.

Central gateway is a high-value credential and trust boundary
Gateway is a trust boundary for upstream tools and credentials; independent access control and auditing may be needed.
Deco Studio hosts authenticated multi-tenant MCP proxy and persistent control plane; credentials/permissions and network exposure require careful admin setup.
Proxy downstream writes, manage connection and workflow state
Studio OAuth/API keys; app credentials and RBAC
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Reviewed write actions: Proxy downstream writes, manage connection and workflow state
Sensitive access: Integration credentials, Organization data, Execution logs
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.
Exact dated attributable activity evidence
full exact tool inventory or deployment-specific access configuration
production authorization and network isolation depend on deployment
metrics, runtime/compatibility details for specific version
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Not an individual domain MCP server
Requires infrastructure and careful OAuth/key/RBAC setup
Gateway has authority over downstream tools
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

155850 npm downloads during 2026-09-08 through 2026-10-07 for decocms

Technical identity

npm/decocms

Exact implementation source: https://www.npmjs.com/package/decocms ↗
Reviewed resource type: Gateway
Package identity: npm:decocms

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Package registry ↗
decocms
Recorded package identity, distribution or download evidence.

Setup · Watchlist

Gateway setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Not runtime tested, no third-party installation, network authorization, paid calls, or mutation executed.
Do not claim production service is available based on README alone.
Full Studio platform/gateway with Bun/Postgres/auth/migrations; npm package not a standalone generic MCP client launcher
Targeted 2026-10-13 re-research: Full-stack Studio/API platform serving MCP routes; host deployment/auth/database necessary, npm name alone not a direct MCP client entry.
Full-stack Studio/API platform serving MCP routes; host deployment/auth/database necessary, npm name alone not a direct MCP client entry.
Avoid write, payment, token transfer, publishing, sending, booking and remote account changes as tests.
DecoCMS studio platform: Bun/Postgres, auth and database migrations; no justified standalone npm MCP registration path for this identity.
Replace credential, action and registration placeholders; follow the matching publisher/client prerequisites. No execution performed.

Install / configure gateway service
Publisher instructions
Full Studio platform/gateway with Bun/Postgres/auth/migrations; npm package not a standalone generic MCP client launcher | Publisher npm README revisited on 2026-10-14; exact identity retained. Service command is not proof of usable MCP endpoint; requires configured Studio server and exposed authenticated MCP URL.
Reviewed setup example · Publisher instructions
npx -y decocms
Configure / authenticate
MCP100 setup guide
DeCo Studio gateway platform, not necessarily a ready-made stdio MCP server. Follow publisher Studio service install and configure its separate exposed HTTP MCP endpoint.
Check connection
Suggested check
Check running Studio health and actual exposed MCP endpoint; not package installation alone.
Remove / uninstall / revoke
MCP100 setup guide
Stop the hosted Deco Studio deployment/service through its deployment manager and remove its MCP HTTP connector from each client. Removing a client connector does not delete Studio database or secrets.

Official Documentation & Sources

What it does

Self-hostable Studio backend/API combining MCP proxying, workspace RBAC, OAuth, secrets storage and automation runners.

Capability: Developer Tools
Resource type: Gateway
Best fit: Self-host MCP connections with policy and operational control

Representative uses

Manage MCP connections
Proxy tool traffic
Configure workspace permissions
Execute durable workflows

Limitations

Not an individual domain MCP server
Requires infrastructure and careful OAuth/key/RBAC setup
Gateway has authority over downstream tools
Central gateway is a high-value credential and trust boundary
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Studio OAuth/API keys; app credentials and RBAC
Permissions: Proxy downstream writes, manage connection and workflow state
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: Central gateway is a high-value credential and trust boundary

Access scope and cautions

Write actions: Not verified Proxy downstream writes, manage connection and workflow state
Sensitive access: Integration credentials Organization data Execution logs
Risk level: high
Security notes: Gateway is a trust boundary for upstream tools and credentials; independent access control and auditing may be needed. Deco Studio hosts authenticated multi-tenant MCP proxy and persistent control plane; credentials/permissions and network exposure require careful admin setup.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which implementation does this page cover?

Self-hostable Studio backend/API combining MCP proxying, workspace RBAC, OAuth, secrets storage and automation runners.

What setup and authentication are documented?

A complete connection procedure is not verified. Recorded transport: self_hosted, streamable_http. Client notes: Source docs and package may evolve; install according to confirmed release. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Studio OAuth/API keys; app credentials and RBAC

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Proxy downstream writes, manage connection and workflow state. Recorded permission context: Proxy downstream writes, manage connection and workflow state

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Integration credentials; Organization data; Execution logs.

What limitations and risks should I check before use?

Central gateway is a high-value credential and trust boundary. Not an individual domain MCP server. Requires infrastructure and careful OAuth/key/RBAC setup. Gateway has authority over downstream tools. No independent release lifecycle audit; do not claim precise activity date. Gateway is a trust boundary for upstream tools and credentials; independent access control and auditing may be needed. Deco Studio hosts authenticated multi-tenant MCP proxy and persistent control plane; credentials/permissions and network exposure require careful admin setup. Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.

Why we’re tracking it

Best fit

What we know

Maintenance / activity evidence

Verification gaps / watch-outs

Popularity

Original activity observations

Evidence & Sources

Gateway setup

Install / configure gateway service

Configure / authenticate

Check connection

Remove / uninstall / revoke

Official Documentation & Sources

What it does

Representative uses

Limitations

Access & risk

Access scope and cautions

FAQ