MCP100 IndexHost
WatchlistFirst-party MCP

mcpc

by Apify

Reviewed October 5, 2026

HostSoftware & Technology

Watchlist tracking

Reviewed for relevance and future tracking value.

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow CLI transports, package releases, and client configuration changes

Reviewed · Documentation review; complete setup workflow not independently tested

Best fit

Shell-based inspection, scripting and proxying of MCP servers

What we know

Universal MCP CLI client mapping MCP operations to shell commands, sessions, OAuth, proxying and JSON output.

Maintenance / activity evidence

  • Observed (UTC)Pin @napi-rs/keyring to an exact version ( 441)

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

  • Installation and comprehensive security have not been independently audited.
  • Depends on connected servers. Writes: Downstream writes; Credential/session management.
  • OAuth 2.1 for supported remote servers.
  • Sensitive access: MCP credentials, Server-returned data
  • A universal client can invoke any connected server's authority; credential storage and proxy scope matter.
Security source · repository notice ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

980 repository stars

Stars observed Oct 6, 2026.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

30-day package downloads intentionally left null because the package-stats provider ran out of credits during Batch 3 QA.

All limitations / Review context

Which MCP transports and CLI workflows remain supported by mcpc?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

  • A universal client can invoke any connected server's authority; credential storage and proxy scope matter.
  • Depends on connected servers.
  • OAuth 2.1 for supported remote servers.
  • Calls MCP operations and can proxy connections.
  • Reviewed write actions: Downstream writes; Credential/session management
  • Sensitive access: MCP credentials, Server-returned data
  • Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
  • A project-specific SECURITY.md policy was not available at the fetched official path; the review remains limited to published repository notices.
  • No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
  • The fetched official SECURITY.md path returned HTTP 404; it was not treated as positive evidence.
  • It is a client/host rather than a server.
  • x402 payments are experimental.

Original activity observations

  • 2026-10-05T08:08:29Z: Pin @napi-rs/keyring to an exact version ( 441)
Technical identity
github.com/apify/mcpc
Exact implementation source
https://github.com/apify/mcpc ↗
Reviewed resource type
Host
Repository identity
apify/mcpc
Package identity
npm:@apify/mcpc

Evidence & Sources

Evidence basis
Recorded source evidence
Setup runtime verification
Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed · Latest source observation