MCPorter — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Discovery, calls and generated CLIs for configured MCP servers: Do generated CLIs and record/replay preserve the tool signatures and results of current servers?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Developers and coding agents that need a CLI/runtime for discovering and calling MCP servers.

What we know

A TypeScript runtime and CLI for MCP server discovery, tool calls, resources, OAuth and config import across stdio, HTTP and SSE.

Maintenance / activity evidence

mcporter 0.14.2 published 2026-10-01T18:28:07.882Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Capabilities of configured MCP servers plus tool filters. Writes: Invoke downstream write tools; Modify auth/config state.
Server-specific OAuth/credentials
Sensitive access: OAuth tokens, Server secrets, Downstream MCP data

As a general MCP gateway, MCPorter can expose whatever authority configured servers provide; config and secret hygiene are critical.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

5,050 repository stars · 1.8M package downloads / 30 days

Stars observed Oct 6, 2026. Downloads observed Oct 6, 2026.

All limitations / Review context

Do generated CLIs and record/replay preserve the tool signatures and results of current servers?

The bounded review of the publisher's documented Discovery, calls and generated CLIs for configured MCP servers and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

As a general MCP gateway, MCPorter can expose whatever authority configured servers provide; config and secret hygiene are critical.
Capabilities of configured MCP servers plus tool filters.
Server-specific OAuth/credentials
Reads/imports MCP configs and handles downstream results and credentials.
Reviewed write actions: Invoke downstream write tools; Modify auth/config state
Sensitive access: OAuth tokens, Server secrets, Downstream MCP data
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
Risk is inherited from connected servers.
Imported configs may contain credentials or secrets.
Interactive and daemon auth behavior differs.

Original activity observations

mcporter 0.14.2 published 2026-10-01T18:28:07.882Z

Technical identity

npm/mcporter

Exact implementation source: https://www.npmjs.com/package/mcporter ↗
Reviewed resource type: Gateway
Repository identity: openclaw/mcporter
Package identity: npm:mcporter

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

Package registry ↗
mcporter
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
openclaw/mcporter
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.
Evidence source ↗
mcporter.sh/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Gateway setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

No runtime server process, Docker setup, OAuth or credentials were executed during this research.
Conditional by design: no tools exist without a chosen upstream; do not mark as independently connectable.
Install documentation is not a guarantee of current package/runtime compatibility.
CLI/runtime for discovering and calling EXISTING MCP servers; not an independent business-tool MCP server. Official npm requires Node.js 24+.
2026-10-13 targeted publisher npm README plus official repository/docs where specified; static research, not runtime test.
Do not assume Context7 example is the user’s desired upstream. (Documentation review only, not runtime verified.)
Never paste real credentials into a documentation example.
No live install, OAuth, paid calls, third-party mutation or credential revocation executed.
Some host removal commands are MCP100-composed based on chosen registration name, not publisher-authored.

Install / configure gateway or CLI
Publisher instructions
Publisher installation/integration method, not a generic MCP server.
Publisher setup example · Publisher instructions
npm install -g mcporter
Configure / authenticate
MCP100 setup guide
MCP manager CLI/TypeScript runtime; use mcporter list or call against an existing MCP endpoint, not a separate MCP server registration. Node >=24.
Use correct transport and published host config. Never paste secrets in chat; server registration is separate from software installation.
Previously reviewed configuration / prerequisites: Choose and trust an upstream MCP server, then use mcporter list/call or configured mcpServers entries. OAuth flows may require mcporter auth.
Check connection
Suggested check
npx mcporter --version; npx mcporter list https://mcp.context7.com/mcp --brief (example public endpoint).
Remove / uninstall / revoke
MCP100 setup guide
This is a sdk / integration component, not a standalone server. Remove the app SDK/package or gateway config using the matching package manager; stop deployed processes separately. For the method installed globally, use `npm uninstall -g mcporter`.
Conditional host / package cleanup · MCP100 composed guide
npm uninstall -g mcporter

Official Documentation & Sources

What it does

A TypeScript runtime and CLI for MCP server discovery, tool calls, resources, OAuth and config import across stdio, HTTP and SSE.

Capability: Developer Tools
Resource type: Gateway
Industry: Software & Technology
Best fit: Developers and coding agents that need a CLI/runtime for discovering and calling MCP servers.

Representative uses

List servers and tools
Call tools or resources from terminal
Connect ad-hoc HTTP or stdio servers
Use auth/vault and TypeScript runtime APIs

Limitations

Risk is inherited from connected servers.
Imported configs may contain credentials or secrets.
Interactive and daemon auth behavior differs.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Server-specific OAuth/credentials
Permissions: Capabilities of configured MCP servers plus tool filters.
Data handling: Reads/imports MCP configs and handles downstream results and credentials.
Cost: free
Risk and cautions: As a general MCP gateway, MCPorter can expose whatever authority configured servers provide; config and secret hygiene are critical.

Access scope and cautions

Write actions: Invoke downstream write tools Modify auth/config state
Sensitive access: OAuth tokens Server secrets Downstream MCP data
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: List servers and tools; Call tools or resources from terminal; Connect ad-hoc HTTP or stdio servers; Use auth/vault and TypeScript runtime APIs.

What authentication is documented?

Server-specific OAuth and credentials managed through auth/vault/config.

Can it modify data or perform write operations?

Documented write actions include: Invoke downstream write tools; Modify auth/config state. Recorded permission boundary: Capabilities of configured MCP servers plus tool filters.

What data-handling boundary should I consider?

Reads/imports MCP configs and handles downstream results and credentials. Recorded sensitive-access context: OAuth tokens; Server secrets; Downstream MCP data.

What limitations and risks should I check before use?

As a general MCP gateway, MCPorter can expose whatever authority configured servers provide; config and secret hygiene are critical. Risk is inherited from connected servers. Imported configs may contain credentials or secrets. Interactive and daemon auth behavior differs. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

Is this an official MCP?

OpenClaw is listed as First-party MCP in MCP100’s current evidence.