Watchlist tracking
Reviewed for relevance and future tracking value.
MCP100 Assessment
Watchlist / Tracking
Why we’re tracking it
Follow-up value is specific to Grantor bounded capability delegation and wrapped-server enforcement: Do signing and chain verification continue to narrow delegated tools, use budgets and expiry across wrapped servers?
Reviewed · Documentation review; complete setup workflow not independently tested
Best fit
Bounded, revocable least-privilege capability delegation for sub-agents and wrapped MCP servers.
What we know
Authorization broker/proxy that can grant named tools with use/expiry bounds, delegate narrower capability, verify/revoke authority, and wrap another stdio MCP so unauthorized tools are filtered and denied before reaching it.
Maintenance / activity evidence
- @grantor/mcp 0.2.0 published 2026-09-01T16:49:01.949Z
Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.
Verification gaps / watch-outs
- Installation and comprehensive security have not been independently audited.
- Authorization/delegation and proxy-enforcement authority; revoke may write on-chain. Writes: Create capability grants; Delegate authority; Revoke authority/on-chain epoch; Proxy/deny wrapped MCP calls.
- Public sandbox demo credential or own tenant cryptographic keys.
- Sensitive access: Principal/admin private keys, Delegation state
- Security control itself is high authority; key handling and single-state-file assumptions matter.
Full authority, access and evidence limits are available in Review context and Access & risk.
All limitations / Review context
Do signing and chain verification continue to narrow delegated tools, use budgets and expiry across wrapped servers?
The bounded review of the publisher's documented Grantor bounded capability delegation and wrapped-server enforcement and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.
- Security control itself is high authority; key handling and single-state-file assumptions matter.
- Authorization/delegation and proxy-enforcement authority; revoke may write on-chain.
- Public sandbox demo credential or own tenant cryptographic keys.
- Broker stores local child/use state; verification consults on-chain registry/billing/revocation state.
- Reviewed write actions: Create capability grants; Delegate authority; Revoke authority/on-chain epoch; Proxy/deny wrapped MCP calls
- Sensitive access: Principal/admin private keys, Delegation state
- Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
- Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
- Documented tool authority and any remote data handling must be checked before installation or use.
- Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
- Sandbox credential is public demo identity and must never be funded/reused.
- Use metering is broker-local rather than globally atomic across multiple broker processes.
- Own-tenant revoke requires admin authority/on-chain transactions.
- Presented-deed mode has separate relying-party caveats.
Original activity observations
- @grantor/mcp 0.2.0 published 2026-09-01T16:49:01.949Z
Technical identity
npm/@grantor/mcp- Exact implementation source
- https://www.npmjs.com/package/@grantor/mcp ↗
- Reviewed resource type
- Gateway
- Package identity
- npm:@grantor/mcp
Evidence & Sources
- Evidence basis
- Recorded source evidence
- Setup runtime verification
- Not independently runtime-tested by MCP100 for this setup workflow.
Reviewed · Latest source observation
- Package registry ↗
@grantor/mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
Setup · Watchlist
Gateway setup
Publisher instructions.
Source evidence observed .
Additional setup details required — see the specific gaps below.
Install / connect
Publisher instructionsMCP authorization broker; demo and tool grants, name-heuristic read suggestions require review.
publisher documented install or connect · Claude Code only · Publisher instructions
claude mcp add grantor-mcp -- npx -y @grantor/mcp serveConfigure / authenticate
MCP100 setup guideRegister `npx -y @grantor/mcp serve` as local broker MCP server. Demo and `tools -- <server>` paths are separate. Review every tool grant; name-heuristic read suggestions are not authority proof.
Check connection
Suggested checkPublisher offers `npx -y @grantor/mcp demo` for demonstration. Inspect local demo outputs; do not execute the wrapped child MCP or grant production permissions.
Remove / uninstall / revoke
MCP100 setup guideIf you added this integration to Claude Code under the registration name `grantor-mcp`, run `claude mcp remove grantor-mcp` to unregister that client entry. In Claude Desktop, Cursor, VS Code or another host, delete/disable the corresponding named MCP registration in that host's settings and restart/reconnect. If you installed an npm package globally or operate a separate HTTP server, uninstall/stop it with its original deployment method. This does not delete user data or revoke service credentials.
MCP client unregister, stopping hosted processes, package uninstall, OAuth disconnect and token revocation are distinct actions.
A claude mcp remove command is only valid for Claude Code when the local registration actually has that name. Other MCP hosts require their own UI/config cleanup.
Separate credential guidance / limitations: Grantor uses no external API key for sandbox demo. `revoke` revokes a child authorization/delegation, not an API credential. In a real tenant it can trigger on-chain bumpEpoch requiring GRANTOR_MCP_ADMIN_KEY; do not run as an uninstall step.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove grantor-mcp
Official Documentation & Sources
What it does
Authorization broker/proxy that can grant named tools with use/expiry bounds, delegate narrower capability, verify/revoke authority, and wrap another stdio MCP so unauthorized tools are filtered and denied before reaching it.
- Capability
- Security & Testing
- Resource type
- Gateway
- Best fit
- Bounded, revocable least-privilege capability delegation for sub-agents and wrapped MCP servers.
Representative uses
- Grant bounded child capabilities
- Check one action against live authority
- Delegate narrower capabilities
- Revoke child authority
- Wrap another MCP with enforcement
Limitations
- Sandbox credential is public demo identity and must never be funded/reused.
- Use metering is broker-local rather than globally atomic across multiple broker processes.
- Own-tenant revoke requires admin authority/on-chain transactions.
- Presented-deed mode has separate relying-party caveats.
Reviewed access
Access & risk
Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.
- Authentication
- Public sandbox demo credential or own tenant cryptographic keys.
- Permissions
- Authorization/delegation and proxy-enforcement authority; revoke may write on-chain.
- Data handling
- Broker stores local child/use state; verification consults on-chain registry/billing/revocation state.
- Cost
- on_chain_tenant_billing
- Risk and cautions
- Security control itself is high authority; key handling and single-state-file assumptions matter.
Access scope and cautions
- Write actions
- Create capability grants Delegate authority Revoke authority/on-chain epoch Proxy/deny wrapped MCP calls
- Sensitive access
- Principal/admin private keys Delegation state
- Risk level
- high
FAQ
Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.