MCP-B Browser Transports — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track this specific sdk implementation and its adoption, setup drift, privilege model, and source activity.

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Build MCP transport integrations inside web pages and extensions

What we know

Browser-native MCP transports for tab, iframe and browser-extension messaging, intended for developers building MCP-enabled web applications.

Maintenance / activity evidence

391125 npm downloads during 2026-09-08 through 2026-10-07 for @mcp-b/transports

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Application-defined transport messages may reach connected tools Complete write authority is not verified.
Host application security and extension/browser permissions
Sensitive access: Browser messages, Web app context

Validate origins and permissions at integration boundary
Browser permission/origin checking is host-dependent; do not confuse SDK transportation libraries with standalone server.
Browser-side transport SDK with origin checks and extension permissions; NOT a standalone installable MCP Server; do not imply an independent hosted endpoint.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

· 391.1k package downloads / 30 days

Downloads observed Oct 9, 2026.

Exact npm package @mcp-b/transports; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

What changed in documented permissions, distribution and MCP integration of MCP-B Browser Transports before the next review?

No substantiated blocker to accurately qualified PUBLIC RADAR TRACKING observed in the scoped cited documentation; material caveats are required on the public page.

Validate origins and permissions at integration boundary
Browser permission/origin checking is host-dependent; do not confuse SDK transportation libraries with standalone server.
Browser-side transport SDK with origin checks and extension permissions; NOT a standalone installable MCP Server; do not imply an independent hosted endpoint.
Application-defined transport messages may reach connected tools
Host application security and extension/browser permissions
Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Sensitive access: Browser messages, Web app context
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.
Exact dated attributable activity evidence
full exact tool inventory or deployment-specific access configuration
metrics, runtime/compatibility details for specific version
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
SDK library, not a runnable standalone MCP server
Web origin/security controls are application responsibilities
MCP transport SDK, not a standalone server; integrate it into a browser page or extension.
No independent release lifecycle audit; do not claim precise activity date.

Original activity observations

391125 npm downloads during 2026-09-08 through 2026-10-07 for @mcp-b/transports

Technical identity

npm/@mcp-b/transports

Exact implementation source: https://www.npmjs.com/package/@mcp-b%2Ftransports ↗
Reviewed resource type: SDK
Package identity: npm:@mcp-b/transports

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Package registry ↗
@mcp-b/transports
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

SDK setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install SDK / application integration
Publisher instructions
Developer library/integration. Install in an application; not a plug-and-play MCP Server. Review publisher README. Not a standalone local MCP server; application integration required.
publisher documented install or connect · Publisher instructions
npm install @mcp-b/transports @modelcontextprotocol/client @modelcontextprotocol/server zod
Configure / authenticate
MCP100 setup guide
Browser MCP transport library with peer dependencies; not a standalone MCP process.
Check connection
Suggested check
Run application transport unit/integration test (iframe ready handshake/transport connect). Not a server with stand-alone npx start. SDK/plugin validation means app import/initialization or feature availability, not an MCP client tools/list test unless the consuming app actually exposes a server.
Remove / uninstall / revoke
MCP100 setup guide
Remove `@mcp-b/transports` from the consuming app via `npm uninstall @mcp-b/transports`, then remove transport adapters and connection lifecycle code. Do not automatically uninstall MCP peers still needed by the project.
MCP client unregister, stopping hosted processes, package uninstall, OAuth disconnect and token revocation are distinct actions.
A claude mcp remove command is only valid for Claude Code when the local registration actually has that name. Other MCP hosts require their own UI/config cleanup.
Separate credential guidance / limitations: Transport library itself uses no vendor account credential; not applicable.
Package / application cleanup · matching installation environment · MCP100 composed guide
npm uninstall @mcp-b/transports

Official Documentation & Sources

What it does

Browser-native MCP transports for tab, iframe and browser-extension messaging, intended for developers building MCP-enabled web applications.

Capability: Developer Tools
Resource type: SDK
Best fit: Build MCP transport integrations inside web pages and extensions

Representative uses

Build tab transport
Connect iframe agent
Integrate extension messaging
Control origin boundaries

Limitations

SDK library, not a runnable standalone MCP server
Web origin/security controls are application responsibilities
MCP transport SDK, not a standalone server; integrate it into a browser page or extension.
Validate origins and permissions at integration boundary
No independent release lifecycle audit; do not claim precise activity date.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Host application security and extension/browser permissions
Permissions: Application-defined transport messages may reach connected tools
Data handling: Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component.
Cost: unknown
Risk and cautions: Validate origins and permissions at integration boundary

Access scope and cautions

Write actions: Not verified
Sensitive access: Browser messages Web app context
Risk level: moderate
Security notes: Browser permission/origin checking is host-dependent; do not confuse SDK transportation libraries with standalone server. Browser-side transport SDK with origin checks and extension permissions; NOT a standalone installable MCP Server; do not imply an independent hosted endpoint.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Build tab transport; Connect iframe agent; Integrate extension messaging; Control origin boundaries.

What setup and authentication are documented?

Recorded installation/entrypoint step: npm install @mcp-b/transports. Recorded transport: library. Prerequisites: Follow framework/SDK documentation. Client notes: Source docs and package may evolve; install according to confirmed release. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Host application security and extension/browser permissions

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. Recorded permission context: Application-defined transport messages may reach connected tools

What data-handling boundary should I consider?

Depends on configured local process, connected account and remote APIs; review first-party privacy terms for any hosted component. Recorded sensitive-access context: Browser messages; Web app context.

What limitations and risks should I check before use?

Validate origins and permissions at integration boundary. SDK library, not a runnable standalone MCP server. Web origin/security controls are application responsibilities. MCP transport SDK, not a standalone server; integrate it into a browser page or extension. No independent release lifecycle audit; do not claim precise activity date. Browser permission/origin checking is host-dependent; do not confuse SDK transportation libraries with standalone server. Browser-side transport SDK with origin checks and extension permissions; NOT a standalone installable MCP Server; do not imply an independent hosted endpoint. Unknown vulnerabilities, deployment environment and client privileges not exhaustively reviewed.