@transcend-io/mcp — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Recheck a specific changing behavior of npm/@transcend-io/mcp: Has unified server permissions/tool inventory diverged from its four separately published domain variants?

Reviewed Oct 9, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Cross-domain privacy operations

What we know

Unified Transcend MCP aggregates several privacy domain MCP tools.

Maintenance / activity evidence

Transcend npm maintainer listing identifies unified @transcend-io/mcp version 0.16.2 in an active published package series; exact release date requires confirmation.

Tracking evidence observed Oct 9, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Unified Transcend privacy platform MCP with wide-ranging view/manage permissions; needs Transcend OAuth/API access; family variant of four subset packages below. Writes: Update privacy operations, inventory, consent or workflows when corresponding modules/permissions are enabled.
Authentication not yet verified.
Unified privacy administration may reach users, consent, inventory and workflow management with organization-wide consequences.

Unified privacy administration may reach users, consent, inventory and workflow management with organization-wide consequences.
Advisory/security review not completed; no safety badge.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

4 shared-repository stars · 294.3k package downloads / 30 days

Stars observed Oct 9, 2026. Downloads observed Oct 9, 2026.

Repository total for transcend-io/tools; not package-specific.

Exact npm package @transcend-io/mcp; provider interval 2026-09-08–2026-10-07 (inclusive); observed 2026-10-09.

All limitations / Review context

Has unified server permissions/tool inventory diverged from its four separately published domain variants?

No identified material blocker to an accurately qualified public tracking entry in the limited cited evidence. This is not an installation safety certification; product-specific cautions must remain visible.

Unified privacy administration may reach users, consent, inventory and workflow management with organization-wide consequences.
Advisory/security review not completed; no safety badge.
Unified Transcend privacy platform MCP with wide-ranging view/manage permissions; needs Transcend OAuth/API access; family variant of four subset packages below.
Reviewed write actions: Update privacy operations, inventory, consent or workflows when corresponding modules/permissions are enabled
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Unified server can span organization admin, consent, inventory and workflow data; request least-privilege OAuth scopes and avoid accidental account-management writes.
Unknown vulnerabilities and provider data handling are not certified by this public tracking review.
Release evidence proves attributable activity, not entire installation or tool-level safety.
Current Discovery source binding and atomic apply must be generated using MCP100 existing pipeline.
exact authentication contract
first-party data processing and retention
data retention and permission scope
Treat sub-packages as alternative narrower deployment surfaces rather than five independent products.
Part of product group transcend-mcp; check overlap before adding separate pages.
Admin, inventory, consent and workflow subsets overlap with this unified server; avoid duplicate product cards without grouping.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Original activity observations

Transcend npm maintainer listing identifies unified @transcend-io/mcp version 0.16.2 in an active published package series; exact release date requires confirmation.

Technical identity

npm/@transcend-io/mcp

Exact implementation source: https://www.npmjs.com/package/@transcend-io%2Fmcp ↗
Reviewed resource type: MCP Server
Repository identity: transcend-io/tools
Package identity: npm:@transcend-io/mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 9, 2026 · Latest source observation Oct 9, 2026

Evidence source ↗
www.npmjs.com/~htunnicliff?page=1
Source material retained for this review.
Evidence source ↗
docs.transcend.io/docs/articles/artificial-intelligence/mcp/mcp-guide
Source material retained for this review.
Includes references whose attribution is not established.
GitHub repository ↗
transcend-io/tools
Repository reference; implementation attribution is not established for every document.
Includes references whose attribution is not established.
Package registry ↗
@transcend-io/mcp-server-workflows
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.
Package registry ↗
@transcend-io/mcp
Recorded package identity, distribution or download evidence.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
OAuth stdio requires org-admin-created client and 127.0.0.1 callback exact port/path; API-key alternative.
publisher documented install or connect · Publisher instructions
npm install -g @transcend-io/mcp
Configure / authenticate
MCP100 setup guide
Transcend supports stdio or own Streamable HTTP deployment; HTTP example uses TRANSCEND_OAUTH_CLIENT_ID, TRANSCEND_OAUTH_CLIENT_SECRET, TRANSCEND_OAUTH_REDIRECT_PORT and TRANSCEND_API_KEY, and /health applies to launched local HTTP server only.
Environment variables referenced by this route (respect the alternatives above): TRANSCEND_OAUTH_CLIENT_ID, TRANSCEND_OAUTH_CLIENT_SECRET, TRANSCEND_OAUTH_REDIRECT_PORT
Check connection
Suggested check
User-side suggested check (not executed): inspect registered tools/connection and perform publisher-supported read-only status/list operations. Do not send, purchase, publish, delete, sign, trade or alter data as a smoke test.
Remove / uninstall / revoke
MCP100 setup guide
Generic client guidance (not publisher-specific uninstall): unregister MCP entry in the chosen client. If installed globally, remove the npm package separately. Revoke provider access separately through account controls, where supported. This does not erase local data or revoke funds/credentials automatically.
Unregister the named MCP entry from the actual host separately from removing a global npm install; no claim that either revokes remote credentials.
Remove local stored keys/tokens and revoke or rotate corresponding provider authorization using documented provider account controls if available; exact procedure not verified for this package. Wallet private keys cannot be revoked.

Official Documentation & Sources

What it does

Unified Transcend MCP aggregates several privacy domain MCP tools.

Capability: Security & Testing
Resource type: MCP Server
Industry: Legal & Compliance
Best fit: Cross-domain privacy operations

Representative uses

Unified privacy operations across Transcend domain MCP modules
OAuth-authenticated organization access
Choose narrower domain packages when least privilege is needed

Limitations

Treat sub-packages as alternative narrower deployment surfaces rather than five independent products.
Part of product group transcend-mcp; check overlap before adding separate pages.
Admin, inventory, consent and workflow subsets overlap with this unified server; avoid duplicate product cards without grouping.
Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode and do not invent unresolved facts.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Not documented in the reviewed sources
Permissions: Unified Transcend privacy platform MCP with wide-ranging view/manage permissions; needs Transcend OAuth/API access; family variant of four subset packages below.
Data handling: Not documented in the reviewed sources
Cost: unknown
Risk and cautions: Unified privacy administration may reach users, consent, inventory and workflow management with organization-wide consequences.

Access scope and cautions

Write actions: Update privacy operations, inventory, consent or workflows when corresponding modules/permissions are enabled
Risk level: high
Security notes: Advisory/security review not completed; no safety badge.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Unified privacy operations across Transcend domain MCP modules; OAuth-authenticated organization access; Choose narrower domain packages when least privilege is needed.

What setup and authentication are documented?

Recorded installation/entrypoint step: npx -y @transcend-io/mcp. Recorded transport: stdio. Recorded environment-variable notes: TRANSCEND_OAUTH_CLIENT_ID; TRANSCEND_OAUTH_CLIENT_SECRET; TRANSCEND_OAUTH_REDIRECT_PORT; SOMBRA_URL (optional for non-primary instance); SOMBRA_CUSTOMER_KEY (for self-hosted / single-tenant Sombra as applicable). No configuration values are supplied here. Prerequisites: Node.js >=22.12; Transcend organization; Transcend OAuth client. Client notes: Inspect server tools; expect aggregate domain scope; consult current guide for updated tool totals. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Official guide documents a Transcend OAuth client and configured OAuth client credentials; do not assume a standalone API-key-only mode for this unified CLI.

Can it modify data or perform write operations?

Documented write actions include: Update privacy operations, inventory, consent or workflows when corresponding modules/permissions are enabled. Recorded permission boundary: Unified Transcend privacy platform MCP with wide-ranging view/manage permissions; needs Transcend OAuth/API access; family variant of four subset packages below.

What limitations and risks should I check before use?

Unified privacy administration may reach users, consent, inventory and workflow management with organization-wide consequences. Sub-packages are alternative narrower deployment surfaces rather than five independent products. Part of product group transcend-mcp. Admin, inventory, consent and workflow subsets overlap with this unified server. Radar public tracking editorial review completed in limited scope; not a security or installation certification. Verify setup according to deployment mode. Advisory/security review not completed; no safety badge. Unified server can span organization admin, consent, inventory and workflow data; request least-privilege OAuth scopes and avoid accidental account-management writes. Unknown vulnerabilities and provider data handling are not certified by this public tracking review.