Gotify RMCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Rgotify notification and app-client management: Do token types and authenticated transports retain distinct message and administrative permissions?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Send Gotify push notifications and administer Gotify messages, clients and apps.

What we know

Gotify notifications and app, client, and message management over MCP and CLI. This profile is based on verified official documentation where listed; unresolved operational details are explicitly marked.

Maintenance / activity evidence

@dinglebear/rgotify 0.2.0 published 2026-08-05T17:11:22.664Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Token-scoped Gotify message and administration authority Writes: Send Gotify notification; Create/update/delete application or client entities where credential permits; Delete message with confirmation.
Gotify client token for read/manage and app token for send; HTTP auth separately configured
Sensitive access: Gotify tokens, Notification content, Client metadata

Potential high-impact side effects: Send Gotify notification, Create/update/delete application or client entities where credential permits, Delete message with confirmation.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do token types and authenticated transports retain distinct message and administrative permissions?

The bounded review of the publisher's documented Rgotify notification and app-client management and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Potential high-impact side effects: Send Gotify notification, Create/update/delete application or client entities where credential permits, Delete message with confirmation.
Token-scoped Gotify message and administration authority
Gotify client token for read/manage and app token for send; HTTP auth separately configured
Notification content passes to the configured Gotify server, self-hosted or external.
Reviewed write actions: Send Gotify notification; Create/update/delete application or client entities where credential permits; Delete message with confirmation
Sensitive access: Gotify tokens, Notification content, Client metadata
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
cost: plans, pay-per-call charges, and payment authorization details
The npm package installs the underlying Rust release binary
Remote/shared HTTP may require bearer or OAuth distinct from Gotify app/client tokens
Destructive deletion requires explicit confirmation
The npm package is a native-binary launcher; management and send tokens are separate trust roles.

Original activity observations

@dinglebear/rgotify 0.2.0 published 2026-08-05T17:11:22.664Z

Technical identity

npm/@dinglebear/rgotify

Exact implementation source: https://www.npmjs.com/package/@dinglebear/rgotify ↗
Reviewed resource type: Gateway
Repository identity: dinglebear-ai/rgotify
Package identity: npm:@dinglebear/rgotify

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@dinglebear/rgotify
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
dinglebear-ai/rgotify
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.

Setup · Watchlist

Gateway setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Gotify gateway. GOTIFY_CLIENT_TOKEN for read/manage and GOTIFY_APP_TOKEN for sending messages are distinct.
publisher install or stdio launch · Publisher instructions
npx -y @dinglebear/rgotify mcp
Configure / authenticate
MCP100 setup guide
Publisher: `npx -y @dinglebear/rgotify mcp` with GOTIFY_URL and appropriate token.
Previously reviewed client configuration / prerequisites: App token vs client token access varies; follow principle of least privilege.
Check connection
Suggested check
`npx -y @dinglebear/rgotify health --json` is safe read-only upstream check.
Remove / uninstall / revoke
MCP100 setup guide
For a Claude Code registration named `dinglebear-rgotify`, run `claude mcp remove dinglebear-rgotify`; otherwise remove the exact entry in the chosen MCP client settings and restart/reconnect. This client-host removal command is MCP100-composed from Claude Code lifecycle documentation, not a vendor-authored uninstall. With `npx`, a separate global package uninstall normally is unnecessary. Do not delete provider data or credentials by default.
Client unregister, package uninstall, data deletion, and OAuth/API token/wallet permissions are distinct.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove dinglebear-rgotify

Official Documentation & Sources

What it does

Gotify notifications and app, client, and message management over MCP and CLI. This profile is based on verified official documentation where listed; unresolved operational details are explicitly marked.

Capability: Communication
Resource type: Gateway
Best fit: Send Gotify push notifications and administer Gotify messages, clients and apps.

Representative uses

Send push alerts
Inspect existing messages and service health
Manage apps and clients
Delete messages with explicit confirmation

Limitations

The npm package installs the underlying Rust release binary
Remote/shared HTTP may require bearer or OAuth distinct from Gotify app/client tokens
Destructive deletion requires explicit confirmation
The npm package is a native-binary launcher; management and send tokens are separate trust roles.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Gotify client token for read/manage and app token for send; HTTP auth separately configured
Permissions: Token-scoped Gotify message and administration authority
Data handling: Notification content passes to the configured Gotify server, self-hosted or external.
Cost: Not documented in the reviewed sources
Risk and cautions: Potential high-impact side effects: Send Gotify notification, Create/update/delete application or client entities where credential permits, Delete message with confirmation.

Access scope and cautions

Write actions: Send Gotify notification Create/update/delete application or client entities where credential permits Delete message with confirmation
Sensitive access: Gotify tokens Notification content Client metadata
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Send push alerts; Inspect existing messages and service health; Manage apps and clients; Delete messages with explicit confirmation.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @dinglebear/rgotify mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: GOTIFY_URL; GOTIFY_CLIENT_TOKEN (management); GOTIFY_APP_TOKEN (send). No configuration values are supplied here. Prerequisites: MCP-capable client. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Gotify client token for read/manage and app token for send; HTTP auth separately configured

Can it modify data or perform write operations?

Documented write actions include: Send Gotify notification; Create/update/delete application or client entities where credential permits; Delete message with confirmation. Recorded permission boundary: Token-scoped Gotify message and administration authority

What data-handling boundary should I consider?

Notification content passes to the configured Gotify server, self-hosted or external. Recorded sensitive-access context: Gotify tokens; Notification content; Client metadata.

What limitations and risks should I check before use?

Potential high-impact side effects: Send Gotify notification, Create/update/delete application or client entities where credential permits, Delete message with confirmation. The npm package installs the underlying Rust release binary. Remote/shared HTTP may require bearer or OAuth distinct from Gotify app/client tokens. Destructive deletion requires explicit confirmation. The npm package is a native-binary launcher; management and send tokens are separate trust roles. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.