MCP Nest — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow NestJS and protocol compatibility as the module's APIs evolve

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

NestJS teams embedding MCP tools/resources into application services

What we know

NestJS-oriented MCP framework/integration layer for exposing application capabilities through Model Context Protocol.

Maintenance / activity evidence

Observed Oct 2, 2026 (UTC)chore(deps): bump the security group across 1 directory with 2 update…

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Application tool/service scope. Writes: Depends on implemented tools.
Application-defined.
Sensitive access: Application data exposed by tools

Framework risk depends on the capabilities developers expose and endpoint authentication.

Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

711 repository stars

Stars observed Sep 25, 2026.

Preserve any already-reviewed adoption metrics in MCP100. Batch 4 did not refresh package downloads because the package-stats provider had insufficient credits.

All limitations / Review context

Which NestJS versions and MCP server patterns remain supported?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

Framework risk depends on the capabilities developers expose and endpoint authentication.
Application tool/service scope.
Application-defined.
Depends on the host NestJS application and transport.
Reviewed write actions: Depends on implemented tools
Sensitive access: Application data exposed by tools
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
Canonical package/install command
Default transport/auth
Application-specific authorization and tool permissions remain developer-defined.

Original activity observations

2026-10-02T04:48:32Z: chore(deps): bump the security group across 1 directory with 2 update…

Technical identity

github.com/rekog-labs/mcp-nest

Exact implementation source: https://github.com/rekog-labs/mcp-nest ↗
Reviewed resource type: Framework
Repository identity: rekog-labs/mcp-nest

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
rekog-labs/mcp-nest
Recorded repository material and project history.

Setup · Watchlist

Framework setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
NestJS MCP server framework dependency, not directly launchable server; optional @rekog/mcp-nest-auth package for OAuth.
install library dependencies · Publisher instructions
npm install @rekog/mcp-nest @modelcontextprotocol/server @modelcontextprotocol/core @modelcontextprotocol/node zod@^4
Configure / authenticate
MCP100 setup guide
Implement @McpController() with tools/resources/prompts and register a NestJS transport strategy; it serves stdio or Streamable HTTP from your own app. Additional auth package is optional.
Check connection
Suggested check
Build and start the sample application, then inspect tools with an MCP client.
Remove / uninstall / revoke
MCP100 setup guide
Remove `@rekog/mcp-nest` from your Nest project with `npm uninstall @rekog/mcp-nest` (and `@rekog/mcp-nest-auth` only if no longer used), remove its module imports/controllers, redeploy your application. This is a NestJS library, not an independently registered MCP service.
Client unregistration, program uninstall, persistent-data deletion, and credential revocation must be treated separately.
Package / application uninstall · matching installation environment · MCP100 composed guide
npm uninstall @rekog/mcp-nest

Official Documentation & Sources

What it does

NestJS-oriented MCP framework/integration layer for exposing application capabilities through Model Context Protocol.

Capability: Developer Tools
Resource type: Framework
Industry: Software & Technology
Best fit: NestJS teams embedding MCP tools/resources into application services

Representative uses

Build MCP servers in NestJS
Register application tools/resources/prompts
Integrate MCP into existing service architecture

Limitations

Application-specific authorization and tool permissions remain developer-defined.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Application-defined.
Permissions: Application tool/service scope.
Data handling: Depends on the host NestJS application and transport.
Cost: unknown
Risk and cautions: Framework risk depends on the capabilities developers expose and endpoint authentication.

Access scope and cautions

Write actions: Depends on implemented tools
Sensitive access: Application data exposed by tools
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Build MCP servers in NestJS; Register application tools/resources/prompts; Integrate MCP into existing service architecture.

What authentication is documented?

Application-defined.

Can it modify data or perform write operations?

Documented write actions include: Depends on implemented tools. Recorded permission boundary: Application tool/service scope.

What data-handling boundary should I consider?

Depends on the host NestJS application and transport. Recorded sensitive-access context: Application data exposed by tools.

What limitations and risks should I check before use?

Framework risk depends on the capabilities developers expose and endpoint authentication. Application-specific authorization and tool permissions remain developer-defined. A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.

Is this an official MCP?

Rekog Labs is listed as Community implementation in MCP100’s current evidence.