Popdot MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Popdot local bridge for subdomain discovery and rental: Do free discovery and trial tools remain separate from wallet-authorized domain rental?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Rent verified subdomains for agents over x402 and bring them online quickly without taking ownership of the root domain.

What we know

Popdot's machine-facing marketplace lets agents rent subdomains by hour/day/month, authenticate with Ed25519 and pay via x402 USDC on Base. Domain owners retain the root domain and can pause/unlist it.

Maintenance / activity evidence

popdot-mcp 2.0.0 published 2026-08-26T20:54:43.702Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Domain-rental/provisioning and payment authority. Reported action classes: Rent/provision subdomain; Pay USDC rental. Complete write authority is not verified.
Agent signing/payment credentials.
Sensitive access: Signing key, Wallet/payment data, Published subdomain content

Creates public DNS/web surface and spends funds; rental content can affect domain reputation.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Do free discovery and trial tools remain separate from wallet-authorized domain rental?

The bounded review of the publisher's documented Popdot local bridge for subdomain discovery and rental and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Creates public DNS/web surface and spends funds; rental content can affect domain reputation.
Domain-rental/provisioning and payment authority.
Agent signing/payment credentials.
Agent identity, rental metadata and public subdomain usage are processed by Popdot.
Reviewed write actions: Rent/provision subdomain; Pay USDC rental
Sensitive access: Signing key, Wallet/payment data, Published subdomain content
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
exact MCP env vars
full tool inventory
retention/privacy
Rentals cost real USDC beyond free trials.
Subdomain use creates public internet surface and reputational/security risk.
Exact agent key storage and lifecycle commands were not fully recovered.
Root-domain owners retain control and can pause/unlist.

Original activity observations

popdot-mcp 2.0.0 published 2026-08-26T20:54:43.702Z

Technical identity

npm/popdot-mcp

Exact implementation source: https://www.npmjs.com/package/popdot-mcp ↗
Reviewed resource type: Gateway
Package identity: npm:popdot-mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry metadata ↗
popdot-mcp
Recorded package identity, distribution or download evidence.
Evidence source ↗
popdot.ai/
Source material retained for this review.
Includes references whose attribution is not established.
Registry source ↗
registry.modelcontextprotocol.io/
Source material retained for this review.
Includes references whose attribution is not established.

Setup · Watchlist

Gateway setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / configure gateway or CLI
Publisher instructions
Publisher-documented package/connection route; replace placeholders and verify host-specific syntax.
Publisher setup example · Publisher instructions
npx -y popdot-mcp
Configure / authenticate
MCP100 setup guide
Follow publisher mcpServers JSON with npx transport; no extra local command documented beyond package launcher.
Use correct transport and published host config. Never paste secrets in chat; server registration is separate from software installation.
Previously reviewed paid-rental prerequisites; not required for registration: Ed25519 agent signature plus x402 payment on Base.
Previously reviewed paid-rental prerequisites; not required for registration: Base/USDC payment capability for paid rentals
Check connection
Suggested check
Verify tool list in MCP client; package README provides limited operational checks.
Remove / uninstall / revoke
MCP100 setup guide
If registered as `popdot-mcp` in Claude Code, remove its exact client entry with `claude mcp remove popdot-mcp`; for Cursor/Claude Desktop/Codex, remove the matching MCP entry in that host settings. This client removal is MCP100-composed, not a vendor uninstall instruction. Npx does not imply a global install; do not delete user data or revoke credentials implicitly.
Conditional host / package cleanup · Claude Code only · MCP100 composed guide
claude mcp remove popdot-mcp

Official Documentation & Sources

What it does

Popdot's machine-facing marketplace lets agents rent subdomains by hour/day/month, authenticate with Ed25519 and pay via x402 USDC on Base. Domain owners retain the root domain and can pause/unlist it.

Capability: Cloud & DevOps
Resource type: Gateway
Best fit: Rent verified subdomains for agents over x402 and bring them online quickly without taking ownership of the root domain.

Representative uses

Discover/rent subdomains
Provision temporary agent web address
Pay rental via x402
Manage rental lifecycle

Limitations

Rentals cost real USDC beyond free trials.
Subdomain use creates public internet surface and reputational/security risk.
Exact agent key storage and lifecycle commands were not fully recovered.
Root-domain owners retain control and can pause/unlist.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Agent signing/payment credentials.
Permissions: Domain-rental/provisioning and payment authority.
Data handling: Agent identity, rental metadata and public subdomain usage are processed by Popdot.
Cost: transactional_x402
Risk and cautions: Creates public DNS/web surface and spends funds; rental content can affect domain reputation.

Access scope and cautions

Write actions: Not verified Rent/provision subdomain Pay USDC rental
Sensitive access: Signing key Wallet/payment data Published subdomain content
Risk level: high

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Discover/rent subdomains; Provision temporary agent web address; Pay rental via x402; Manage rental lifecycle.

What authentication is documented?

Ed25519 agent signature plus x402 payment on Base.

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: Rent/provision subdomain; Pay USDC rental. Recorded permission context: Domain-rental/provisioning and payment authority.

What data-handling boundary should I consider?

Agent identity, rental metadata and public subdomain usage are processed by Popdot. Recorded sensitive-access context: Signing key; Wallet/payment data; Published subdomain content.

What limitations and risks should I check before use?

Creates public DNS/web surface and spends funds; rental content can affect domain reputation. Rentals cost real USDC beyond free trials. Subdomain use creates public internet surface and reputational/security risk. Exact agent key storage and lifecycle commands were not fully recovered. Root-domain owners retain control and can pause/unlist. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

What cost model is recorded?

The reviewed cost model is transactional x402. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.