NorthCinder — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow catalog and shopping-action changes because product data and recommendations evolve

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Evidence-based product and seller research

What we know

Local-first shopping-research MCP that compares products/sellers and keeps purchase authorization behind a separate approval step.

Maintenance / activity evidence

Observed Aug 22, 2026 (UTC)release: publish NorthCinder 0.2.1

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Research access to product/seller web sources. Writes: Checkout only after exact-offer approval.
Signed checkout approval for purchase actions.
Sensitive access: Shopping preferences, Purchase details

The design intentionally separates recommendation from purchase authorization.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,208 repository stars

Stars observed Oct 6, 2026.

No canonical package metric applied.

All limitations / Review context

Does the current MCP surface remain research-oriented and clearly separate from checkout actions?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

The design intentionally separates recommendation from purchase authorization.
Research access to product/seller web sources.
Signed checkout approval for purchase actions.
Research data/source retention not fully documented.
Reviewed write actions: Checkout only after exact-offer approval
Sensitive access: Shopping preferences, Purchase details
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Exact checkout integrations
Remote endpoint/pricing
Project warns results are provisional.
No host/model combination was qualified for routine research at the reviewed time.

Original activity observations

2026-08-22T12:01:04Z: release: publish NorthCinder 0.2.1

Technical identity

github.com/cinderline/northcinder

Exact implementation source: https://github.com/cinderline/northcinder ↗
Reviewed resource type: MCP Server
Repository identity: cinderline/northcinder

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
cinderline/northcinder
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 13, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher-specific setup path. Follow prerequisites, then register or connect to your MCP host.
publisher documented install or connect · Publisher instructions
npx northcinder init
Configure / authenticate
Publisher instructions
Node.js >=20. `init` prints the MCP entry to add to your AI app. No NorthCinder account or hosted service.
Check connection
Suggested check
Restart your MCP client and discover NorthCinder tools; do not place purchases to test.
Remove / uninstall / revoke
MCP100 setup guide
Delete the NorthCinder MCP entry printed by `init` from your host; stop the local process.
MCP100 client-scope guidance: each CLI removal example targets only its named client and exact registered entry. Package names, Desktop/Cursor configuration keys and Codex/Claude registration names may differ; use the entry you actually registered. Client removal does not revoke provider credentials.
claude mcp remove northcinder

Official Documentation & Sources

What it does

Local-first shopping-research MCP that compares products/sellers and keeps purchase authorization behind a separate approval step.

Capability: Search & Web
Resource type: MCP Server
Industry: Retail & E-commerce
Best fit: Evidence-based product and seller research

Representative uses

Create research plans
Research products/sellers
Compare offers
Request explicit approval for an exact checkout offer

Limitations

Project warns results are provisional.
No host/model combination was qualified for routine research at the reviewed time.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Signed checkout approval for purchase actions.
Permissions: Research access to product/seller web sources.
Data handling: Research data/source retention not fully documented.
Cost: unknown
Risk and cautions: The design intentionally separates recommendation from purchase authorization.

Access scope and cautions

Write actions: Checkout only after exact-offer approval
Sensitive access: Shopping preferences Purchase details
Risk level: moderate

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Create research plans; Research products/sellers; Compare offers; Request explicit approval for an exact checkout offer.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx northcinder init. Recorded transport: other. Prerequisites: Node.js 20+; MCP client. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local mode keyless; checkout requires fresh signed approval. A demo or keyless description is not independently verified read-only authority. Check the documented tool permissions rather than inferring authority from that label.

Can it modify data or perform write operations?

Documented write actions include: Checkout only after exact-offer approval. Recorded permission boundary: Research access to product/seller web sources.

What data-handling boundary should I consider?

Research data/source retention not fully documented. Recorded sensitive-access context: Shopping preferences; Purchase details.

What limitations and risks should I check before use?

The design intentionally separates recommendation from purchase authorization. Project warns results are provisional. No host/model combination was qualified for routine research at the reviewed time. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

Cinderline is listed as First-party MCP in MCP100’s current evidence.