Shipeasy MCP — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Shipeasy combined experimentation and localization tools: Does migration from the old package preserve flags and translation-publish authority in one tool catalog?

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Feature flags/experimentation, runtime configuration and i18n/string-management workflows.

What we know

Unified Shipeasy MCP combining experimentation (gates/configs/experiments/metrics/events) with string/i18n management (labels, keys, drafts, translations, publish, codemods).

Maintenance / activity evidence

@shipeasy/mcp 2.8.0 published 2026-07-27T20:24:14.937Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Experiment/config/i18n project read-write authority. Writes: Create/update/delete experiments/config/resources; Publish translations/content; Potential codemod/project changes.
Local persisted Shipeasy token.
Sensitive access: Product configuration, Experiment data, Localization content, Auth token

Changes can affect production experiments/configuration and shipped copy; preserve approval boundaries.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Does migration from the old package preserve flags and translation-publish authority in one tool catalog?

The bounded review of the publisher's documented Shipeasy combined experimentation and localization tools and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

Changes can affect production experiments/configuration and shipped copy; preserve approval boundaries.
Experiment/config/i18n project read-write authority.
Local persisted Shipeasy token.
Project experiment/config/string data is processed by Shipeasy; token stored locally.
Reviewed write actions: Create/update/delete experiments/config/resources; Publish translations/content; Potential codemod/project changes
Sensitive access: Product configuration, Experiment data, Localization content, Auth token
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
Documented tool authority and any remote data handling must be checked before installation or use.
Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
Mutating tools require browser-authenticated session.
Server includes destructive/write operations; list-before-create guard reduces duplicate creation but is not authorization.
Token is stored locally in config with restrictive filesystem permissions.

Original activity observations

@shipeasy/mcp 2.8.0 published 2026-07-27T20:24:14.937Z

Technical identity

npm/@shipeasy/mcp

Exact implementation source: https://www.npmjs.com/package/@shipeasy/mcp ↗
Reviewed resource type: MCP Server
Repository identity: shipeasy-ai/mcp
Package identity: npm:@shipeasy/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

Package registry ↗
@shipeasy/mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Publisher documents stdio MCP registration and SDK/admin token scopes; inspect migration and user credentials.
1) Register npx @shipeasy/mcp in the client; 2) run publisher `shipeasy-mcp install` in a terminal to complete browser PKCE authentication. Registration alone does not authorize write tools.
publisher documented step or launch · Publisher instructions
npx -y @shipeasy/mcp
Configure / authenticate
MCP100 setup guide
Register npx-based MCP first, then perform publisher-required `shipeasy-mcp install` browser PKCE authentication; token stored at ~/.config/shipeasy/config.json. Registration without login does not authorize mutations.
Check connection
Suggested check
Check read-only tools after PKCE sign-in. Do not test mutating tools because publisher requires a fresh listToken before create.
Remove / uninstall / revoke
MCP100 setup guide
Generic client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Publisher documents `shipeasy-mcp logout` deleting ~/.config/shipeasy/config.json; local logout is not verified server-side revocation.

Official Documentation & Sources

What it does

Unified Shipeasy MCP combining experimentation (gates/configs/experiments/metrics/events) with string/i18n management (labels, keys, drafts, translations, publish, codemods).

Capability: Developer Tools
Resource type: MCP Server
Best fit: Feature flags/experimentation, runtime configuration and i18n/string-management workflows.

Representative uses

Manage feature flags/config/experiments
Inspect metrics/events
Manage i18n keys/drafts/translations
Publish localization changes
Use codemod/string tooling

Limitations

Mutating tools require browser-authenticated session.
Server includes destructive/write operations; list-before-create guard reduces duplicate creation but is not authorization.
Token is stored locally in config with restrictive filesystem permissions.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Local persisted Shipeasy token.
Permissions: Experiment/config/i18n project read-write authority.
Data handling: Project experiment/config/string data is processed by Shipeasy; token stored locally.
Cost: plan_based
Risk and cautions: Changes can affect production experiments/configuration and shipped copy; preserve approval boundaries.

Access scope and cautions

Write actions: Create/update/delete experiments/config/resources Publish translations/content Potential codemod/project changes
Sensitive access: Product configuration Experiment data Localization content Auth token
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Manage feature flags/config/experiments; Inspect metrics/events; Manage i18n keys/drafts/translations; Publish localization changes; Use codemod/string tooling.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @shipeasy/mcp@latest. Recorded transport: stdio. Recorded environment-variable notes: SHIPEASY_MCP_LIST_GUARD (optional); SHIPEASY_MCP_LIST_GUARD_WINDOW_MINUTES (optional); XDG_CONFIG_HOME (optional). No configuration values are supplied here. Prerequisites: Node >=20; Shipeasy account. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Browser-based PKCE device flow via `shipeasy-mcp install`; token written to local config chmod 600.

Can it modify data or perform write operations?

Documented write actions include: Create/update/delete experiments/config/resources; Publish translations/content; Potential codemod/project changes. Recorded permission boundary: Experiment/config/i18n project read-write authority.

What data-handling boundary should I consider?

Project experiment/config/string data is processed by Shipeasy; token stored locally. Recorded sensitive-access context: Product configuration; Experiment data; Localization content; Auth token.

What limitations and risks should I check before use?

Changes can affect production experiments/configuration and shipped copy; preserve approval boundaries. Mutating tools require browser-authenticated session. Server includes destructive/write operations; list-before-create guard reduces duplicate creation but is not authorization. Token is stored locally in config with restrictive filesystem permissions. Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited. Documented tool authority and any remote data handling must be checked before installation or use.

What cost model is recorded?

The reviewed cost model is plan based. This classification does not establish current prices, quotas or the cost of every downstream operation. Check the applicable service terms before authorizing paid actions.