Watchlist tracking
Reviewed for relevance and future tracking value.
MCP100 Assessment
Watchlist / Tracking
Why we’re tracking it
Follow-up value is specific to ServeLink publishing of local artifacts and live servers: Can agents distinguish a live local tunnel from a hosted copy before making an artifact public?
Reviewed · Documentation review; complete setup workflow not independently tested
Best fit
Publishing or tunneling local apps/files/directories behind shareable public HTTPS links.
What we know
Thin launcher/native client for ServeLink, which can create live public tunnels to local services or upload/publish static artifacts that remain hosted when the machine is offline.
Maintenance / activity evidence
- @servelink/serve 0.8.8 published 2026-09-07T15:52:45.789Z
Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.
Verification gaps / watch-outs
- Installation and comprehensive security have not been independently audited.
- Can read/share selected local services, files or directories and create externally reachable links. Writes: Create public links; Publish artifacts; Start/stop tunnels; Apply/remove share configuration/passwords.
- ServeLink account/browser login.
- Sensitive access: Local files/directories, Development servers, Potentially private preview content
- Incorrect scope can expose local content publicly; use explicit targets and password protection.
Full authority, access and evidence limits are available in Review context and Access & risk.
All limitations / Review context
Can agents distinguish a live local tunnel from a hosted copy before making an artifact public?
The bounded review of the publisher's documented ServeLink publishing of local artifacts and live servers and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.
- Incorrect scope can expose local content publicly; use explicit targets and password protection.
- Can read/share selected local services, files or directories and create externally reachable links.
- ServeLink account/browser login.
- Live mode relays local traffic; published mode uploads and stores a copy on ServeLink.
- Reviewed write actions: Create public links; Publish artifacts; Start/stop tunnels; Apply/remove share configuration/passwords
- Sensitive access: Local files/directories, Development servers, Potentially private preview content
- Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
- Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
- Documented tool authority and any remote data handling must be checked before installation or use.
- Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
- private implementation source
- control endpoint
- detailed retention/deletion
- full pricing/plan limits
- Requires account/browser login.
- Live mode exposes local service while machine is online; published mode copies data to hosted infrastructure.
- Public repo is a listing/configuration repo; implementation is private.
- Detailed retention/deletion and full pricing were not established.
- Public GitHub repo is not the private implementation repository.
Original activity observations
- @servelink/serve 0.8.8 published 2026-09-07T15:52:45.789Z
Technical identity
npm/@servelink/serve- Exact implementation source
- https://www.npmjs.com/package/@servelink/serve ↗
- Reviewed resource type
- Host
- Package identity
- npm:@servelink/serve
Evidence & Sources
- Evidence basis
- Recorded source evidence
- Setup runtime verification
- Not independently runtime-tested by MCP100 for this setup workflow.
Reviewed · Latest source observation
- Package registry ↗
@servelink/serve
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
- GitHub repository ↗
servelink-swyftlabs/serve-mcp
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.
- Evidence source ↗
servelink.cc/
Source material retained for this review.
Includes references whose attribution is not established.
Setup · Watchlist
Host / Desktop app setup
Publisher instructions.
Source evidence observed .
Additional setup details required — see the specific gaps below.
Install / launch application
Publisher instructionsThis is a host/tool that exposes a public HTTPS URL; registering it does not mean a third-party MCP is installed.
publisher documented install or connect · Publisher instructions
npx @servelink/servepublisher documented step or launch · Publisher instructions
npx -y @servelink/serveConfigure model / provider
MCP100 setup guideThis package can expose local files over public HTTPS. Verify only approved test content; do not expose private files as a smoke test.
Check connection
Suggested checkUser-side suggested check (not executed): inspect registered tools/connection and perform publisher-supported read-only status/list operations. Do not send, purchase, publish, delete, sign, trade or alter data as a smoke test.
Disconnect / uninstall / revoke
MCP100 setup guideGeneric client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Remove local stored keys/tokens and revoke or rotate corresponding provider authorization using documented provider account controls if available; exact procedure not verified for this package. Wallet private keys cannot be revoked.
Official Documentation & Sources
What it does
Thin launcher/native client for ServeLink, which can create live public tunnels to local services or upload/publish static artifacts that remain hosted when the machine is offline.
- Capability
- Cloud & DevOps
- Resource type
- Host
- Best fit
- Publishing or tunneling local apps/files/directories behind shareable public HTTPS links.
Representative uses
- Expose local HTTP/WebSocket dev server
- Publish static artifact copies
- Share demos/previews
- Apply password protection and manage link lifecycle
Limitations
- Requires account/browser login.
- Live mode exposes local service while machine is online; published mode copies data to hosted infrastructure.
- Public repo is a listing/configuration repo; implementation is private.
- Detailed retention/deletion and full pricing were not established.
- Public GitHub repo is not the private implementation repository.
Reviewed access
Access & risk
Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.
- Authentication
- ServeLink account/browser login.
- Permissions
- Can read/share selected local services, files or directories and create externally reachable links.
- Data handling
- Live mode relays local traffic; published mode uploads and stores a copy on ServeLink.
- Cost
- freemium
- Risk and cautions
- Incorrect scope can expose local content publicly; use explicit targets and password protection.
Access scope and cautions
- Write actions
- Create public links Publish artifacts Start/stop tunnels Apply/remove share configuration/passwords
- Sensitive access
- Local files/directories Development servers Potentially private preview content
- Risk level
- high
FAQ
Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.
Which implementation does this page cover?
What setup and authentication are documented?
Can it modify data or perform write operations?
What data-handling boundary should I consider?
What limitations and risks should I check before use?
Is this an official MCP?
ServeLink / swyftlabs is listed as First-party MCP in MCP100’s current evidence.