OrangePro MCP Server — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Compatibility launcher for OrangePro local test-gap and mutation-verification tools: Does the launcher stay compatible with the main package while distinguishing local verification from optional model uploads?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Local behavior/test-gap analysis, grounded test generation and mutation-based proof.

What we know

Compatibility launcher for the OrangePro implementation; OrangePro maps code behavior/evidence, generates candidate tests into a separate directory and can perform mutation-based proof.

Maintenance / activity evidence

@orangepro/mcp-server 0.2.46 published 2026-10-03T08:31:15.203Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Reads target source/tests and writes OrangePro analysis artifacts and generated-test drafts. Writes: Write `.orangepro` analysis artifacts; Write candidate tests under `orangepro_generated/`.
Authentication not yet verified.
Sensitive access: Local source and tests, Optional model-provider credentials

Local-first and explicitly non-mutating toward existing source/tests; external model use is the main additional data boundary.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Does the launcher stay compatible with the main package while distinguishing local verification from optional model uploads?

The bounded review of the publisher's documented Compatibility launcher for OrangePro local test-gap and mutation-verification tools and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Local-first and explicitly non-mutating toward existing source/tests; external model use is the main additional data boundary.
Reads target source/tests and writes OrangePro analysis artifacts and generated-test drafts.
Core analysis is local; optional BYOK sends code context directly to the selected model provider.
Reviewed write actions: Write `.orangepro` analysis artifacts; Write candidate tests under `orangepro_generated/`
Sensitive access: Local source and tests, Optional model-provider credentials
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
commercial pricing/plan terms
This npm package is a compatibility launcher, not an independent implementation.
Repository dependencies must be installed.
Optional BYOK generation can send code context to a configured model provider.
Dynamic proof support is narrower than static mapping.
Launcher only; canonical implementation is @orangepro/orangepro-mcp.

Original activity observations

@orangepro/mcp-server 0.2.46 published 2026-10-03T08:31:15.203Z

Technical identity

npm/@orangepro/mcp-server

Exact implementation source: https://www.npmjs.com/package/@orangepro/mcp-server ↗
Reviewed resource type: Testing / Debugging
Repository identity: OrangeproAI/orangepro-mcp
Package identity: npm:@orangepro/mcp-server

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@orangepro/mcp-server
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
GitHub repository ↗
orangeproai/orangepro-mcp
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Testing / Debugging setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher also documents `start . --prompt-version v5` as different workflow, not stdio MCP.
publisher install or stdio launch · Publisher instructions
npx -y @orangepro/mcp-server@latest mcp
Configure / authenticate
MCP100 setup guide
Register `npx -y @orangepro/mcp-server@latest mcp` as stdio command. `start . --prompt-version v5` is an analysis operation, NOT a client installation step.
Check connection
Suggested check
Use MCP host tool discovery after registering the documented `mcp` subcommand. Publisher also offers `start . --prompt-version v5` but this analyzes a repo and is not a connection test.
Remove / uninstall / revoke
MCP100 setup guide
If you added this integration to Claude Code under the registration name `orangepro`, run `claude mcp remove orangepro` to unregister that client entry. In Claude Desktop, Cursor, VS Code or another host, delete/disable the corresponding named MCP registration in that host's settings and restart/reconnect. If you installed an npm package globally or operate a separate HTTP server, uninstall/stop it with its original deployment method. This does not delete user data or revoke service credentials.
MCP client unregister, stopping hosted processes, package uninstall, OAuth disconnect and token revocation are distinct actions.
A claude mcp remove command is only valid for Claude Code when the local registration actually has that name. Other MCP hosts require their own UI/config cleanup.
Separate credential guidance / limitations: No OrangePro-specific external credential documented in published 413-character launcher README; not applicable for the launcher.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove orangepro

Official Documentation & Sources

What it does

Compatibility launcher for the OrangePro implementation; OrangePro maps code behavior/evidence, generates candidate tests into a separate directory and can perform mutation-based proof.

Capability: Security & Testing
Resource type: Testing / Debugging
Best fit: Local behavior/test-gap analysis, grounded test generation and mutation-based proof.

Representative uses

Analyze repository behavior/test gaps
Render local behavior-coverage reports
Generate candidate tests without modifying existing tests
Run mutation-kill proof and evidence export

Limitations

This npm package is a compatibility launcher, not an independent implementation.
Repository dependencies must be installed.
Optional BYOK generation can send code context to a configured model provider.
Dynamic proof support is narrower than static mapping.
Launcher only; canonical implementation is @orangepro/orangepro-mcp.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Reads target source/tests and writes OrangePro analysis artifacts and generated-test drafts.
Data handling: Core analysis is local; optional BYOK sends code context directly to the selected model provider.
Cost: provider_dependent
Risk and cautions: Local-first and explicitly non-mutating toward existing source/tests; external model use is the main additional data boundary.

Access scope and cautions

Write actions: Write `.orangepro` analysis artifacts Write candidate tests under `orangepro_generated/`
Sensitive access: Local source and tests Optional model-provider credentials
Risk level: low

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which implementation does this page cover?

Compatibility launcher for the OrangePro implementation; OrangePro maps code behavior/evidence, generates candidate tests into a separate directory and can perform mutation-based proof.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @orangepro/mcp-server@latest mcp. Recorded transport: stdio. Recorded environment-variable notes: ANTHROPIC_API_KEY (optional); OPENAI_API_KEY (optional); OLLAMA_BASE_URL (optional). No configuration values are supplied here. Prerequisites: Node/npm; target repository dependencies installed. Client notes: The launcher delegates to `@orangepro/orangepro-mcp`; this launcher is not a separate implementation. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: No OrangePro credential is required for local analysis; optional BYOK uses the selected provider credential.

Can it modify data or perform write operations?

Documented write actions include: Write `.orangepro` analysis artifacts; Write candidate tests under `orangepro_generated/`. Recorded permission boundary: Reads target source/tests and writes OrangePro analysis artifacts and generated-test drafts.

What data-handling boundary should I consider?

Core analysis is local; optional BYOK sends code context directly to the selected model provider. Recorded sensitive-access context: Local source and tests; Optional model-provider credentials.

What limitations and risks should I check before use?

Local-first and explicitly non-mutating toward existing source/tests; external model use is the main additional data boundary. This npm package is a compatibility launcher, not an independent implementation. Repository dependencies must be installed. Optional BYOK generation can send code context to a configured model provider. Dynamic proof support is narrower than static mapping. Launcher only; canonical implementation is @orangepro/orangepro-mcp. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

Is this an official MCP?

OrangePro is listed as First-party MCP in MCP100’s current evidence.

Why we’re tracking it

Best fit

What we know

Maintenance / activity evidence

Verification gaps / watch-outs

Original activity observations

Evidence & Sources

Testing / Debugging setup

Install / connect

Configure / authenticate

Check connection

Remove / uninstall / revoke

Official Documentation & Sources

What it does

Representative uses

Limitations

Access & risk

Access scope and cautions

FAQ