@github/mcp-registry — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Monitor exact implementation activity, MCP interface, permission and setup changes.

Reviewed Oct 10, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

MCP Registry API SDK and allowlisting

What we know

TypeScript SDK for the MCP Registry API — includes types, a ready-to-use client, and deterministic fingerprint computation for enterprise allowlist enforcement. Public Radar listing describes capability; verify precise runtime setup and privilege boundaries upstream.

Maintenance / activity evidence

npm exact package downloads 238240 in 2026-09-09..2026-10-08

Tracking evidence observed Oct 10, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server. Complete write authority is not verified.
Refer to first-party setup documentation; do not infer authorization from package existence.
Sensitive access: registry metadata and possibly local allowlists

Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server.
Public tracking suitability is not an installation safety audit.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 238.2k package downloads / 30 days

Downloads observed Oct 10, 2026.

Exact npm package @github/mcp-registry; provider interval 2026-09-09–2026-10-08 (inclusive); observed 2026-10-10T03:38:00Z.

All limitations / Review context

Has @github/mcp-registry changed its documented MCP interface, authentication or privilege boundaries, and does it merit promotion?

Limited editorial listing; known permission implications disclosed, no independently established publication blocker.

Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server.
Public tracking suitability is not an installation safety audit.
Refer to first-party setup documentation; do not infer authorization from package existence.
registry metadata and possibly local allowlists
Sensitive access: registry metadata and possibly local allowlists
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Upstream credential and permission scopes must be validated before runtime use.
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Some integration/runtime instructions are not confirmed from a first-party install guide and therefore intentionally omitted.
Dated package download count is usage signal, not necessarily a current maintenance release.

Original activity observations

npm exact package downloads 238240 in 2026-09-09..2026-10-08

Technical identity

npm/@github/mcp-registry

Exact implementation source: https://www.npmjs.com/package/@github/mcp-registry ↗
Reviewed resource type: SDK
Package identity: npm:@github/mcp-registry

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 10, 2026 · Latest source observation Oct 10, 2026

Package registry ↗
@github/mcp-registry
Recorded package identity, distribution or download evidence.

Setup · Watchlist

SDK setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install SDK / application integration
Publisher instructions
Developer library/integration. Install in an application; not a plug-and-play MCP Server. Review publisher README. Not a standalone local MCP server; application integration required.
publisher documented install or connect · Publisher instructions
npm install @github/mcp-registry
Configure / authenticate
MCP100 setup guide
This npm item is a TypeScript SDK, not an MCP endpoint. Install in a Node project and call its registry APIs.
Check connection
Suggested check
SDK: import @github/mcp-registry into an application and enumerate registry installation choices. No standalone MCP process or client registration. SDK/plugin validation means app import/initialization or feature availability, not an MCP client tools/list test unless the consuming app actually exposes a server.
Remove / uninstall / revoke
MCP100 setup guide
This is the GitHub MCP Registry library/SDK, not the GitHub MCP Server. Remove the library from the consuming Node application with `npm uninstall @github/mcp-registry` and remove application imports. No `claude mcp remove` is applicable to the SDK itself.
MCP client unregister, stopping hosted processes, package uninstall, OAuth disconnect and token revocation are distinct actions.
A claude mcp remove command is only valid for Claude Code when the local registration actually has that name. Other MCP hosts require their own UI/config cleanup.
Separate credential guidance / limitations: Not applicable to the library itself. Credentials used by an integrating application must be managed by their separate issuer.
Package / application cleanup · matching installation environment · MCP100 composed guide
npm uninstall @github/mcp-registry

Official Documentation & Sources

What it does

TypeScript SDK for the MCP Registry API — includes types, a ready-to-use client, and deterministic fingerprint computation for enterprise allowlist enforcement. Public Radar listing describes capability; verify precise runtime setup and privilege boundaries upstream.

Capability: Developer Tools
Resource type: SDK
Best fit: MCP Registry API SDK and allowlisting

Representative uses

MCP Registry API SDK and allowlisting

Limitations

Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server.
Some integration/runtime instructions are not confirmed from a first-party install guide and therefore intentionally omitted.
Dated package download count is usage signal, not necessarily a current maintenance release.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Refer to first-party setup documentation; do not infer authorization from package existence.
Permissions: Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server.
Data handling: registry metadata and possibly local allowlists
Cost: Provider or usage fees possible; verify current pricing
Risk and cautions: Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server.

Access scope and cautions

Write actions: Not verified
Sensitive access: registry metadata and possibly local allowlists
Risk level: medium
Security notes: Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server. Public tracking suitability is not an installation safety audit.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-10T03:38:00Z. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: MCP Registry API SDK and allowlisting.

What setup and authentication are documented?

A complete connection procedure is not verified. Client notes: Installation command omitted unless verified or clearly package-specific; do not infer npx/uvx entrypoints. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Refer to first-party setup documentation; do not infer authorization from package existence.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. Recorded permission context: Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server.

What data-handling boundary should I consider?

registry metadata and possibly local allowlists Recorded sensitive-access context: registry metadata and possibly local allowlists.

What limitations and risks should I check before use?

Registry metadata and allowlists can affect software supply-chain choices; does not itself provide a general MCP Server. Some integration/runtime instructions are not confirmed from a first-party install guide and therefore intentionally omitted. Dated package download count is usage signal, not necessarily a current maintenance release. Public tracking suitability is not an installation safety audit. Upstream credential and permission scopes must be validated before runtime use.