MCP100 IndexSDK
WatchlistFirst-party MCP

@lovable.dev/mcp-js

by Lovable

Reviewed October 5, 2026

SDKSoftware & Technology

Watchlist tracking

Reviewed for relevance and future tracking value.

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Build-time MCP route generation from declarative Lovable tool definitions: Does manifest extraction remain separate from runtime tool counts while strict schemas reject undeclared arguments?

Reviewed · Documentation review; complete setup workflow not independently tested

Best fit

Building typed MCP endpoints inside Lovable/Vite applications

What we know

TypeScript SDK for declaring MCP tools, emitting application routes and optionally enforcing OAuth 2.1 resource-server auth.

Maintenance / activity evidence

  • @lovable.dev/mcp-js 3.0.4 published 2026-09-25T09:09:47.142Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

  • Installation and comprehensive security have not been independently audited.
  • Application handler authorization. Writes: Depends on authored tools.
  • Optional JWT validation against configured issuer/JWKS.
  • Sensitive access: Application/downstream API data
  • Secure by configuration: omitted auth leaves endpoints unauthenticated, so authorization must be explicit.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 872k package downloads / 30 days

Downloads observed Sep 25, 2026.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

All limitations / Review context

Does manifest extraction remain separate from runtime tool counts while strict schemas reject undeclared arguments?

The bounded review of the publisher's documented Build-time MCP route generation from declarative Lovable tool definitions and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

  • Secure by configuration: omitted auth leaves endpoints unauthenticated, so authorization must be explicit.
  • Application handler authorization.
  • Optional JWT validation against configured issuer/JWKS.
  • Passes verified claims/token to app handlers.
  • Reviewed write actions: Depends on authored tools
  • Sensitive access: Application/downstream API data
  • Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
  • Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
  • Documented tool authority and any remote data handling must be checked before installation or use.
  • Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
  • Repository identity/shared star metric
  • Does not implement authorization server/consent flows.
  • If auth is omitted, handlers are unauthenticated.

Original activity observations

  • @lovable.dev/mcp-js 3.0.4 published 2026-09-25T09:09:47.142Z
Technical identity
npm/@lovable.dev/mcp-js
Reviewed resource type
SDK
Package identity
@lovable.dev/mcp-js
Service endpoint
/mcp

Evidence & Sources

Evidence basis
Recorded source evidence
Setup runtime verification
Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed · Latest source observation

  • Package registry ↗

    @lovable.dev/mcp-js

    Recorded package identity, distribution or download evidence.

    Includes references whose attribution is not established.