MCP100 IndexFramework
WatchlistFirst-party MCP

Stratum

by SmartMemory

Reviewed October 5, 2026

Framework

Watchlist tracking

Reviewed for relevance and future tracking value.

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow-up value is specific to Stratum resumable workflows with MCP planning, step completion and audit tools: Does the TypeScript MCP server enforce postconditions and approval gates consistently during migration from retired Python tooling?

Reviewed · Documentation review; complete setup workflow not independently tested

Best fit

Running auditable, gated multi-step agent workflows with typed state and postconditions.

What we know

TypeScript workflow/state-machine engine and MCP service for typed YAML specs, gates, retries, postconditions and auditable agent execution.

Maintenance / activity evidence

  • @smartmemory/stratum 0.7.3 published 2026-09-29T04:14:39.268Z

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

  • Installation and comprehensive security have not been independently audited.
  • Workflow-defined/downstream-agent authority. Writes: Workflow state changes; Downstream agent/tool actions; Human-approved transitions.
  • Authentication not yet verified.
  • Sensitive access: Workflow specs, Agent artifacts, State
  • Stratum is a governance/orchestration layer, but downstream actions can still be high authority.

Full authority, access and evidence limits are available in Review context and Access & risk.

All limitations / Review context

Does the TypeScript MCP server enforce postconditions and approval gates consistently during migration from retired Python tooling?

The bounded review of the publisher's documented Stratum resumable workflows with MCP planning, step completion and audit tools and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.

  • Stratum is a governance/orchestration layer, but downstream actions can still be high authority.
  • Workflow-defined/downstream-agent authority.
  • Flow state persists locally under ~/.stratum; optional receipt egress is off by default.
  • Reviewed write actions: Workflow state changes; Downstream agent/tool actions; Human-approved transitions
  • Sensitive access: Workflow specs, Agent artifacts, State
  • Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
  • Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
  • Documented tool authority and any remote data handling must be checked before installation or use.
  • Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
  • Current repository/source mapping should be rechecked before automatic identity merge
  • Current TypeScript engine supersedes a retired Python implementation.
  • Workflow actions can invoke powerful downstream agents/tools.
  • License is BSL 1.1 for current releases, not simple MIT/Apache.

Original activity observations

  • @smartmemory/stratum 0.7.3 published 2026-09-29T04:14:39.268Z
Technical identity
npm/@smartmemory/stratum
Reviewed resource type
Framework
Package identity
npm:@smartmemory/stratum

Evidence & Sources

Evidence basis
Recorded source evidence
Setup runtime verification
Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed · Latest source observation

  • Package registry ↗

    @smartmemory/stratum

    Recorded package identity, distribution or download evidence.

    Includes references whose attribution is not established.

  • GitHub repository ↗

    smartmemory/stratum

    Recorded repository material and project history.

    Includes references whose attribution is not established.