MCP100 IndexHost
WatchlistFirst-party MCP

thClaws

by thClaws

Reviewed October 5, 2026

HostSoftware & Technology

Watchlist tracking

Reviewed for relevance and future tracking value.

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track agent-host integrations and local automation boundaries as thClaws develops

Reviewed · Documentation review; complete setup workflow not independently tested

Best fit

Running extensible local agents with MCP, project knowledge and automation

What we know

An all-in-one agent host with multi-provider models, skills/plugins, MCP servers, knowledge bases, scheduling and browser automation.

Maintenance / activity evidence

  • Observed (UTC)Release v0.138.0

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

  • Installation and comprehensive security have not been independently audited.
  • Can access configured tools, files, knowledge and browser/shell features. Writes: Shell/tool calls; File edits; Scheduled jobs; MCP actions.
  • Provider-specific; downstream MCP OAuth as configured.
  • Sensitive access: Project files, Credentials, Browser sessions, Prompts
  • The host aggregates powerful local and remote tools; approvals and sandbox controls should be used.
Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

1,236 repository stars

Stars observed Oct 6, 2026.

No canonical package metric applied.

No canonical package metric applied.

No canonical package metric applied.

All limitations / Review context

Which MCP tools and local actions does the current harness expose?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

  • The host aggregates powerful local and remote tools; approvals and sandbox controls should be used.
  • Can access configured tools, files, knowledge and browser/shell features.
  • Provider-specific; downstream MCP OAuth as configured.
  • Stores sessions/memory/KMS locally; provider flows vary.
  • Reviewed write actions: Shell/tool calls; File edits; Scheduled jobs; MCP actions
  • Sensitive access: Project files, Credentials, Browser sessions, Prompts
  • Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
  • No independent runtime, installation, or comprehensive security audit was performed.
  • No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
  • Published-package install path
  • Provider pricing
  • Requires Rust, Node.js and pnpm for source builds.
  • Cloud credentials vary by model provider.

Original activity observations

  • 2026-09-25T10:30:12Z: Release v0.138.0
Technical identity
github.com/thclaws/thclaws
Exact implementation source
https://github.com/thclaws/thclaws ↗
Reviewed resource type
Host
Repository identity
thClaws/thClaws

Evidence & Sources

Evidence basis
Recorded source evidence
Setup runtime verification
Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed · Latest source observation

  • GitHub repository ↗

    thclaws/thclaws

    Recorded repository material and project history.

    Includes references whose attribution is not established.