Watchlist tracking
Reviewed for relevance and future tracking value.
MCP100 Assessment
Watchlist / Tracking
Why we’re tracking it
Follow-up value is specific to Stratum resumable workflows with MCP planning, step completion and audit tools: Does the TypeScript MCP server enforce postconditions and approval gates consistently during migration from retired Python tooling?
Reviewed · Documentation review; complete setup workflow not independently tested
Best fit
Running auditable, gated multi-step agent workflows with typed state and postconditions.
What we know
TypeScript workflow/state-machine engine and MCP service for typed YAML specs, gates, retries, postconditions and auditable agent execution.
Maintenance / activity evidence
- @smartmemory/stratum 0.7.3 published 2026-09-29T04:14:39.268Z
Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.
Verification gaps / watch-outs
- Installation and comprehensive security have not been independently audited.
- Workflow-defined/downstream-agent authority. Writes: Workflow state changes; Downstream agent/tool actions; Human-approved transitions.
- Authentication not yet verified.
- Sensitive access: Workflow specs, Agent artifacts, State
- Stratum is a governance/orchestration layer, but downstream actions can still be high authority.
Full authority, access and evidence limits are available in Review context and Access & risk.
All limitations / Review context
Does the TypeScript MCP server enforce postconditions and approval gates consistently during migration from retired Python tooling?
The bounded review of the publisher's documented Stratum resumable workflows with MCP planning, step completion and audit tools and release notices identified no disclosed material condition preventing an accurately scoped public tracking entry. The resource's operational permissions remain uncertainty; this assessment does not certify installation safety.
- Stratum is a governance/orchestration layer, but downstream actions can still be high authority.
- Workflow-defined/downstream-agent authority.
- Flow state persists locally under ~/.stratum; optional receipt egress is off by default.
- Reviewed write actions: Workflow state changes; Downstream agent/tool actions; Human-approved transitions
- Sensitive access: Workflow specs, Agent artifacts, State
- Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
- Runtime behavior, dependencies and undisclosed vulnerabilities were not independently audited.
- Documented tool authority and any remote data handling must be checked before installation or use.
- Tool inventory, client matrix and permissions completeness were not requirements for this Radar tracking review.
- Current repository/source mapping should be rechecked before automatic identity merge
- Current TypeScript engine supersedes a retired Python implementation.
- Workflow actions can invoke powerful downstream agents/tools.
- License is BSL 1.1 for current releases, not simple MIT/Apache.
Original activity observations
- @smartmemory/stratum 0.7.3 published 2026-09-29T04:14:39.268Z
Technical identity
npm/@smartmemory/stratum- Exact implementation source
- https://www.npmjs.com/package/@smartmemory/stratum ↗
- Reviewed resource type
- Framework
- Package identity
- npm:@smartmemory/stratum
Evidence & Sources
- Evidence basis
- Recorded source evidence
- Setup runtime verification
- Not independently runtime-tested by MCP100 for this setup workflow.
Reviewed · Latest source observation
- Package registry ↗
@smartmemory/stratum
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
- GitHub repository ↗
smartmemory/stratum
Recorded repository material and project history.
Includes references whose attribution is not established.
Setup · Watchlist
Framework setup
Publisher instructions.
Source evidence observed .
Additional setup details required — see the specific gaps below.
Install framework / library
Publisher instructionsNode 22+ required. Register official stratum-mcp executable from @smartmemory/stratum; restart client.
Publisher: Node >= 22, `npm install -g @smartmemory/stratum` or MCP config command npx with args ['-y','-p','@smartmemory/stratum','stratum-mcp']; Python engine retired.
install cli and mcp binary · Publisher instructions
npm install -g @smartmemory/stratumpublisher documented install or registration · Publisher instructions
npm install @smartmemory/stratumConfigure / authenticate
MCP100 setup guideNode.js >=22. In Claude Code .mcp.json register {"mcpServers":{"stratum":{"command":"npx","args":["-y","-p","@smartmemory/stratum","stratum-mcp"]}}}. Avoid retired Python server and old v0.x specs.
{ "mcpServers": { "stratum": { "args": [ "-y", "-p", "@smartmemory/stratum", "stratum-mcp" ], "command": "npx" } } }Check connection
Suggested checkCheck that `stratum_plan` and `stratum_audit` tools are discoverable; validate a non-mutating sample v1 spec before any real flow execution.
Remove / uninstall / revoke
MCP100 setup guideGeneric client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Local-only Stratum MCP server does not require account tokens in documented setup; provider credential revocation not applicable.
What it does
TypeScript workflow/state-machine engine and MCP service for typed YAML specs, gates, retries, postconditions and auditable agent execution.
- Capability
- Developer Tools
- Resource type
- Framework
- Best fit
- Running auditable, gated multi-step agent workflows with typed state and postconditions.
Representative uses
- Run gated workflow specs
- Persist flow state
- Require human approve/reject/revise gates
- Coordinate Claude/Codex-style execution
Limitations
- Current TypeScript engine supersedes a retired Python implementation.
- Workflow actions can invoke powerful downstream agents/tools.
- License is BSL 1.1 for current releases, not simple MIT/Apache.
Reviewed access
Access & risk
Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.
- Authentication
- Not documented in the reviewed sources
- Permissions
- Workflow-defined/downstream-agent authority.
- Data handling
- Flow state persists locally under ~/.stratum; optional receipt egress is off by default.
- Cost
- unknown
- Risk and cautions
- Stratum is a governance/orchestration layer, but downstream actions can still be high authority.
Access scope and cautions
- Write actions
- Workflow state changes Downstream agent/tool actions Human-approved transitions
- Sensitive access
- Workflow specs Agent artifacts State
- Risk level
- moderate
FAQ
Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.
Which tasks are documented for this implementation?
What authentication is documented?
Can it modify data or perform write operations?
What data-handling boundary should I consider?
What limitations and risks should I check before use?
Is this an official MCP?
SmartMemory is listed as First-party MCP in MCP100’s current evidence.