@devframes/agentic — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Monitor exact implementation activity, MCP interface, permission and setup changes.

Reviewed Oct 10, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Devframes agentic adapter and MCP gateway

What we know

Agent-surface implementation for devframe: installing it next to devframe enables the MCP adapter (devframe/adapters/mcp) and the devframe connect gateway. Public Radar listing describes capability; verify precise runtime setup and privilege boundaries upstream.

Maintenance / activity evidence

npm exact package downloads 651838 in 2026-09-09..2026-10-08

Tracking evidence observed Oct 10, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Adapter/gateway executes under attached host credentials; separate permissions not verified. Reported action classes: workspace modification if host adapter supports. Complete write authority is not verified.
Refer to first-party setup documentation; do not infer authorization from package existence.
Sensitive access: developer project data and host credentials

Adapter/gateway executes under attached host credentials; separate permissions not verified.
Public tracking suitability is not an installation safety audit.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 651.8k package downloads / 30 days

Downloads observed Oct 10, 2026.

Exact npm package @devframes/agentic; provider interval 2026-09-09–2026-10-08 (inclusive); observed 2026-10-10T03:38:00Z.

All limitations / Review context

Has @devframes/agentic changed its documented MCP interface, authentication or privilege boundaries, and does it merit promotion?

Limited editorial listing; known permission implications disclosed, no independently established publication blocker.

Adapter/gateway executes under attached host credentials; separate permissions not verified.
Public tracking suitability is not an installation safety audit.
Refer to first-party setup documentation; do not infer authorization from package existence.
developer project data and host credentials
Reviewed write actions: workspace modification if host adapter supports
Sensitive access: developer project data and host credentials
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Upstream credential and permission scopes must be validated before runtime use.
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Some integration/runtime instructions are not confirmed from a first-party install guide and therefore intentionally omitted.
Dated package download count is usage signal, not necessarily a current maintenance release.

Original activity observations

npm exact package downloads 651838 in 2026-09-09..2026-10-08

Technical identity

npm/@devframes/agentic

Exact implementation source: https://www.npmjs.com/package/@devframes/agentic ↗
Reviewed resource type: SDK
Package identity: npm:@devframes/agentic

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 10, 2026 · Latest source observation Oct 10, 2026

Package registry ↗
@devframes/agentic
Recorded package identity, distribution or download evidence.

Setup · Watchlist

SDK setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

npm listing lacks README; publisher integration docs are separate, so previous blanket claim of no documented install is obsolete.
Not an independently executable MCP server; requires Devframe application adapter integration.
Install the optional Devframe MCP adapter dependency inside the application: npm install @devframes/agentic. Integrate via Devframe adapter API in the host application; not a standalone MCP executable.
No npm README; earlier conversation cites vendor adapter docs; direct current source not revalidated. Do not invent runnable MCP config.
Package install documented; SDK integration requires project code. Publisher-owned documentation at https://www.npmjs.com/package/@devframes/agentic; static documentation review, not live execution.
Prior reviewed safety note: Do not add this package directly to mcpServers; npm page itself has no README but cross-site publisher documentation exists.
Prior reviewed safety note: Do not invent a one-line reversal command.
Earlier review note retained for provenance; the V3 verified fields take precedence: Second-pass 2026-10-14 could not retrieve full current publisher npm README; preserve baseline, do not promote source-specific claims or run commands until documentation is rechecked.
Package install documented; SDK integration requires project code.
Publisher GitHub README or package registry bin metadata reviewed 2026-10-14.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.

Install / connect
Publisher instructions
Install the optional Devframe MCP adapter dependency inside the application: npm install @devframes/agentic. Integrate via Devframe adapter API in the host application; not a standalone MCP executable.
publisher documented install or registration · Publisher instructions
npm install @devframes/agentic
devframe peer sdk install · Publisher instructions
npm install devframe @devframes/agentic
Configure / authenticate
MCP100 setup guide
Publisher npm metadata: install `devframe` together with `@devframes/agentic` at compatible 1.2.5 versions in your application. Adapter exports `@devframes/agentic/mcp` and `/connect`; use app-side devframe/adapters/mcp integration per Devframe docs, not a fabricated CLI MCP server. No standalone `bin` is published.
Check connection
Suggested check
Verify the devframe app loads its MCP adapter and exposes its configured MCP tools. The npm package alone does not start a server.
Remove / uninstall / revoke
MCP100 setup guide
Remove `@devframes/agentic` MCP adapter imports and devframe route registrations from the consuming app, then `npm uninstall @devframes/agentic`. Do not unregister a non-existent standalone MCP client entry.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.
Package / application cleanup · matching installation environment · MCP100 composed guide
npm uninstall @devframes/agentic

Official Documentation & Sources

What it does

Agent-surface implementation for devframe: installing it next to devframe enables the MCP adapter (devframe/adapters/mcp) and the devframe connect gateway. Public Radar listing describes capability; verify precise runtime setup and privilege boundaries upstream.

Capability: Developer Tools
Resource type: SDK
Best fit: Devframes agentic adapter and MCP gateway

Representative uses

Devframes agentic adapter and MCP gateway

Limitations

Adapter/gateway executes under attached host credentials; separate permissions not verified.
Some integration/runtime instructions are not confirmed from a first-party install guide and therefore intentionally omitted.
Dated package download count is usage signal, not necessarily a current maintenance release.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Refer to first-party setup documentation; do not infer authorization from package existence.
Permissions: Adapter/gateway executes under attached host credentials; separate permissions not verified.
Data handling: developer project data and host credentials
Cost: Provider or usage fees possible; verify current pricing
Risk and cautions: Adapter/gateway executes under attached host credentials; separate permissions not verified.

Access scope and cautions

Write actions: Not verified workspace modification if host adapter supports
Sensitive access: developer project data and host credentials
Risk level: medium
Security notes: Adapter/gateway executes under attached host credentials; separate permissions not verified. Public tracking suitability is not an installation safety audit.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-10T03:38:00Z. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Devframes agentic adapter and MCP gateway.

What setup and authentication are documented?

A complete connection procedure is not verified. Client notes: Installation command omitted unless verified or clearly package-specific; do not infer npx/uvx entrypoints. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Refer to first-party setup documentation; do not infer authorization from package existence.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: workspace modification if host adapter supports. Recorded permission context: Adapter/gateway executes under attached host credentials; separate permissions not verified.

What data-handling boundary should I consider?

developer project data and host credentials Recorded sensitive-access context: developer project data and host credentials.

What limitations and risks should I check before use?

Adapter/gateway executes under attached host credentials; separate permissions not verified. Some integration/runtime instructions are not confirmed from a first-party install guide and therefore intentionally omitted. Dated package download count is usage signal, not necessarily a current maintenance release. Public tracking suitability is not an installation safety audit. Upstream credential and permission scopes must be validated before runtime use.