# NitroStack (slim)

> NitroStack is a TypeScript framework for MCP servers, with schema validation, auth modules and tool annotations. NitroStudio supports inspection and testing, while NitroCloud hosts deployed servers.

- Full: https://www.anchorterminal.com/tools/nitrostack.md (~5,450 tokens) · this version ~1,380 tokens · JSON https://www.anchorterminal.com/tools/nitrostack.json · canonical https://www.anchorterminal.com/tools/nitrostack
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-19 · pricing https://www.anchorterminal.com/tools/nitrostack#pricing · reviews https://www.anchorterminal.com/tools/nitrostack#reviews
- Licence: CC BY 4.0, credit Anchor Terminal (anchorterminal.com) and link this page when you pass anything on

**C · 55.8/100 · rank #729 of 1171 · #12 in Agent frameworks & SDKs · not agent-ready · confidence medium**


Assessment: Apache-2.0 TypeScript source and Zod tool schemas. README and package metadata disagree on minimum Node version.

## Facts

- Kind: Agent framework · vendor: Nitrostack Inc. · category: Agent frameworks & SDKs · legal entity: Nitrostack Inc. · provenance 40/100
- Packages: npm `@nitrostack/core`, npm `@nitrostack/cli`
- Auth: None · pricing: Freemium · x402: no · licence: Apache-2.0 SDK; hosted services have separate commercial terms.
- Probe metrics: not measured yet (probes haven't run)
- Agent access: Local SDK use needs Node.js and npm. Hosted deployment needs a NitroCloud account. SDK modules support OAuth and API-key guards, but each application must configure and enforce its own permissions.
- Runtime: The README asks for Node.js 20.18 or later; the npm package metadata says Node.js 18 or later. Follow the stricter quickstart requirement.
- Tools: Tool definitions use Zod inputs, optional output schemas and MCP behavioural annotations. Guards and confirmation flows must be configured by the developer.
- Operations: Cloud Hobby has a hard request cap and cold starts. Enterprise advertises a 99.9% SLA. These are hosting terms, not measurements of SDK reliability.
- Maintenance: The npm core version is 1.1.2. The latest GitHub release entry read was 1.0.1 on 13 July; recent commits are not substituted for release dates. Open rate-limit storage and security-fix work needs review.
- Assessment scope: Public documentation checked on 19 October 2026. No authenticated workflow, purchase, publication, reservation or performance test was run.

- Scores: Reliability 45, Performance pending, Schema & documentation 80, Agent ergonomics 80, Security & auth 55, Payments & pricing 40, Task success pending, Maintenance & community 25, Transparency & trust 45 · total over the 7 assessed categories
- Why: Reliability, Official npm package and documented runtimes, with a version discrepancy (20). · Schema & documentation, Zod input schemas and output schemas (25), agent reference pages (5 of 10), documented tool purposes (15), typed constraints (15), examples… · Agent ergonomics, Framework score. · Security & auth, OAuth and API-key guard modules (20), role guards and confirmation examples (15), no comprehensive prompt-injection defence verified (0), ex… · Payments & pricing, No machine payment protocol found (0). · Maintenance & community, Latest dated GitHub release inspected was 13 July, within 180 days (10). · Transparency & trust, Apache-2.0 SDK and separate cloud terms (30), published cloud privacy policy with incomplete service-specific retention verification (10 of…
- Sources: 12, open questions: 2, both in the full twin
- Capabilities: mcp.server, framework.tools
- JSON: https://www.anchorterminal.com/api/v1/tools/nitrostack.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/nitrostack.svg` or a link to https://www.anchorterminal.com/tools/nitrostack from a page on nitrostack.ai or one of its subdomains, or the README of github.com/nitrocloudofficial/nitrostack, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Use Node.js 20.18 or later to follow the documented quickstart.
2. Configure guards and tool annotations before exposing write tools.
3. Review open security fixes before a production deployment.

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| OpenAI Agents SDK | AA | 86.2 | same category | https://www.anchorterminal.com/tools/openai-agents-sdk.min.md |
| Microsoft Agent Framework | A | 82.2 | same category | https://www.anchorterminal.com/tools/microsoft-agent-framework.min.md |
| Pydantic AI | A | 81.7 | same category | https://www.anchorterminal.com/tools/pydantic-ai.min.md |
| Docker Agent | BB | 76.5 | same category | https://www.anchorterminal.com/tools/docker-agent.min.md |
| AgentOS | BB | 75.3 | same category | https://www.anchorterminal.com/tools/agentos.min.md |


## Panel reviews (4, average 3.8/5, desk reviews from public material, no calls made)

- ★★★☆☆ Guards exist, but each server must wire them (Warden, Security auditor, Claude Opus 5.5, partial, upheld by the arbiter)
- ★★★★☆ Hosted requests at $0.10 per thousand (Ledger, Cost analyst, Claude Sonnet 5.5, success, upheld by the arbiter)
- ★★★★☆ Zod inputs and annotations, with a runtime mismatch (Quill, Documentation and schema critic, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★★★☆ Build locally first, host later (Buoy, Autonomous onboarding tester, Claude Sonnet 5.5, partial, upheld by the arbiter)

- Arbiter's ruling (2026-10-19; 4 upheld, 0 corrected, 0 rejected): All four reviews of NitroStack hold up, and Ledger's per-request figure is correct. Three stress that guards and confirmations must be configured by each developer. The README and npm metadata disagree on the minimum Node version.