mcp-use — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow protocol-version and SDK changes that affect developers building on mcp-use

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Building and testing MCP servers, MCP Apps and agent integrations in TypeScript/Python ecosystems.

What we know

mcp-use provides framework primitives and tooling for building and testing MCP servers, MCP Apps, ChatGPT plugins and Claude connectors.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC)Revert "fix(create-mcp-use-app): don& 39;t leave an empty project directo…

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Framework-level; permissions are defined by the application built on top of it. Writes: Depends on implemented tools.
Authentication not yet verified.
Sensitive access: Depends on implemented tools and configured providers

The framework itself is infrastructure; effective risk is determined by the tools, secrets and endpoints developers expose.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

10,726 repository stars · 59.1k package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

All limitations / Review context

Does the framework still support the current MCP transports and client/server patterns?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

The framework itself is infrastructure; effective risk is determined by the tools, secrets and endpoints developers expose.
Framework-level; permissions are defined by the application built on top of it.
Depends on the developer's application and connected MCP servers.
Reviewed write actions: Depends on implemented tools
Sensitive access: Depends on implemented tools and configured providers
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Application security depends on the server and tools developers build with the framework.

Original activity observations

2026-10-05T03:38:37Z: Revert "fix(create-mcp-use-app): don& 39;t leave an empty project directo…

Technical identity

github.com/mcp-use/mcp-use

Exact implementation source: https://github.com/mcp-use/mcp-use ↗
Reviewed resource type: Framework
Repository identity: mcp-use/mcp-use
Package identity: pypi:mcp-use

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
mcp-use/mcp-use
Recorded repository material and project history.
Evidence source ↗
pypi.org/project/mcp-use/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Framework setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
**MCP application framework.** Scaffold a new project with publisher `npx -y create-mcp-use-app@latest`, run generated app `npm run dev`; its MCP endpoint and Inspector are served by the app. Do not register `mcp-use` as if it were a standalone ready-made server.
package install · Publisher instructions
npx -y create-mcp-use-app@latest
Configure / authenticate
Publisher instructions
mcp-use is an SDK/framework and scaffold: npx -y create-mcp-use-app@latest; use dev client to connect a created project. It is not a third-party MCP service to install into an existing host directly.
Check connection
Suggested check
Within the generated project, open `http://localhost:3000/mcp/inspector` (publisher example) and verify your generated tools.
Remove / uninstall / revoke
Suggested check
Stop the generated `mcp-use` app (`Ctrl+C` for dev server); remove its specific MCP URL from client settings. Generated project and dependency deletion are separate developer choices.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.

Official Documentation & Sources

What it does

mcp-use provides framework primitives and tooling for building and testing MCP servers, MCP Apps, ChatGPT plugins and Claude connectors.

Capability: Developer Tools
Resource type: Framework
Industry: Software & Technology
Best fit: Building and testing MCP servers, MCP Apps and agent integrations in TypeScript/Python ecosystems.

Representative uses

Scaffold MCP projects
Define typed tools
Build MCP Apps and views
Inspect and debug MCP servers

Limitations

Application security depends on the server and tools developers build with the framework.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Framework-level; permissions are defined by the application built on top of it.
Data handling: Depends on the developer's application and connected MCP servers.
Cost: free
Risk and cautions: The framework itself is infrastructure; effective risk is determined by the tools, secrets and endpoints developers expose.

Access scope and cautions

Write actions: Depends on implemented tools
Sensitive access: Depends on implemented tools and configured providers
Risk level: unknown

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Scaffold MCP projects; Define typed tools; Build MCP Apps and views; Inspect and debug MCP servers.

What setup information is documented?

Recorded installation/entrypoint step: npx -y create-mcp-use-app@latest. Recorded transport: streamable_http. Prerequisites: Node.js/npm for TypeScript workflows. These are the documented setup details, not a claim that installation or client compatibility was independently tested.

Can it modify data or perform write operations?

Documented write actions include: Depends on implemented tools. Recorded permission boundary: Framework-level; permissions are defined by the application built on top of it.

What data-handling boundary should I consider?

Depends on the developer's application and connected MCP servers. Recorded sensitive-access context: Depends on implemented tools and configured providers.

What limitations and risks should I check before use?

The framework itself is infrastructure; effective risk is determined by the tools, secrets and endpoints developers expose. Application security depends on the server and tools developers build with the framework. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

Manufact is listed as First-party MCP in MCP100’s current evidence.