Atlas / MCP servers / 0xrayai / 0xray

0xrayBLOCK

Name: 0xray
Author: 0xrayai

mcp/0xrayai/xray

MCP server by 0xrayai · 0xray · grok bot · hangar · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

Verdict

BLOCK

Grade

Trust score

54 /100

Exposed tools

200 197r · 33w · 3d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

4.0 — a suit that survives the context window

Not a catalog of agents. The product is the skeleton you wear.

Your AI Power Suit

Your AI Power ⚡️ Suit 🦾 — an exoskeleton that blocks AI slop from becoming real damage.

Bone — three-subsystem OS: Inference · External Governance (Dynamo / Codex) · Autonomous Engine (thinDispatch)
Always on — Codex 11 / 29 / 69, destructive shell, no new MCP/skill/handler surface
Temperament — frontier | guided | strict | auto — how loud the engine is, not whether governance exists
Wear — Grok, OpenCode, Hermes, OpenClaw, plus Cursor project hooks. One SSOT gate
Muscle — Repertoire is preferred. Vendored 0.2.9 ships on. Dest is named laws, not hangar repo-* or git slugs. Station is the compact-survival ticket — not a substitute for Repertoire.

npm install 0xray

Consumer npm install 0xray auto-wires four chat bridges, Cursor project hooks, and seven MCP servers. Repertoire is preferred — vendored 0.2.9 ships on: factory + stack laws, in-process routing, extra host MCP repertoire. Not an eighth xray-* server. Dest is a judgment index. Explicit opt-out only: "enabled": false, "provider": "repertoire". Do not pin 0.1.8.

Quick Start

npm install 0xray # postinstall: mill+inspect plant + 4 bridges + 7 MCPs + AGENTS.md + .mcp.json
npx 0xray status # verify install
npx 0xray setup # optional: symlinks, hook extras
npx @0xray/foundry inspect --skip-live # mill receipt (chat is not a receipt)

Manual per-platform install (idempotent, same result as postinstall):

npx 0xray opencode install
npx 0xray grok install # 7 MCPs servers + project .grok/plugins/0xray (not machine last-wins)
npx 0xray hermes install
npx 0xray openclaw install
npx 0xray skill:install # starter skills

Autonomy command (default operating model)

Read from source at commit 6b6b12053692OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add repertoire --env API_TOKEN=${API_TOKEN} --env DB_PASSWORD=${DB_PASSWORD} --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y @0xray/[email protected]

claude-desktop

{
  "mcpServers": {
    "repertoire": {
      "command": "npx",
      "args": [
        "-y",
        "@0xray/[email protected]"
      ],
      "env": {
        "API_TOKEN": "${API_TOKEN}",
        "DB_PASSWORD": "${DB_PASSWORD}",
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (200)

197 read · 33 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`a`	read	Tool A
`ai_search_content_optimization`	read	Optimize content specifically for AI search engines (ChatGPT, Perplexity, Grok)
`alert_on_issues`	read	Generate alerts based on log analysis thresholds
`analyze`	read	Analyze
`analyze-ai-search`	read	Optimize content for AI search engines (ChatGPT, Perplexity, Grok, Gemini, Claude). Analyze E-E-A-T signals, structure content for citation
`analyze-architecture`	read	Analyze current system architecture and identify patterns
`analyze-git-history`	write	Analyze git commit history and patterns
`analyze-memory`	read	Perform memory leak detection and heap analysis to identify memory issues
`analyze-project-health`	read	Provide comprehensive project health assessment including quality metrics and improvement recommendations
`analyze-project-structure`	read	Analyze complete project structure including file organization, directory hierarchy, and module distribution
`analyze-screenshot`	read	Extract UI elements from screenshots. Identifies components, layout structure, and provides detailed element analysis for code generation.
`analyze-test-coverage`	read	Analyze current test coverage and identify gaps
`analyze_ci_cd_pipeline`	read	Analyze CI/CD pipeline configuration and suggest optimizations
`analyze_code`	read	Perform comprehensive static analysis on source code files
`analyze_code_quality`	read	Mock code quality analysis
`analyze_codebase`	read	Analyze complete codebase structure and provide insights
`analyze_dependencies`	write	Analyze import/export dependencies and generate dependency graph
`analyze_documentation`	read	Analyze existing documentation for completeness, quality, and gaps
`analyze_logs`	read	Analyze log entries to identify patterns, errors, and anomalies
`analyze_performance`	read	Analyze code for performance bottlenecks and optimization opportunities
`analyze_proposal`	read	Analyze an inference proposal (pattern/bug/refactor) from a code-review perspective and return a structured governance decision
`analyze_schema`	read	Analyze database schema for optimization opportunities and best practices
`analyze_stack_trace`	read	Parse and analyze stack traces to identify the exact location and cause of errors
`analyze_technical_debt`	read	Analyze codebase for technical debt and refactoring opportunities
`analyze_test_coverage`	read	Analyze current test coverage and identify gaps
`analyze_ui_component`	read	Analyze UI component for accessibility, usability, and design best practices
`analyze_visual_hierarchy`	read	Analyze visual hierarchy and cognitive load following
`android_blueprint`	read	Generate Android project structure with Kotlin/Jetpack Compose
`app_store_metadata`	read	Generate app store listing metadata for iOS and Android
`architect`	read	System design & technical decisions
`architecture-assessment`	read	Evaluate overall architectural health with scores, issues, and improvement recommendations
`architecture_review`	read	Review architectural decisions against best practices, patterns, and trade-offs
`assess-project-complexity`	read	Assess overall project complexity including code metrics, maintainability, and technical debt indicators
`audit-technical-seo`	read	Perform deep technical SEO audit: schema markup, meta tags, heading structure, internal linking, performance, accessibility, mobile-friendliness
`audit_accessibility`	read	Perform comprehensive accessibility audit using WCAG guidelines
`audit_security`	read	Perform comprehensive security audit on codebase files
`auto-format`	read	Automated code formatting hook with Prettier and framework-specific formatters
`b`	read	Tool B
`backend-engineer`	read	API & backend development
`backup-state`	write	Create backup of current state or specific keys
`benchmark-code`	write	Execute and compare benchmark results for code performance measurement
`bottleneck-detection`	read	Identify performance bottlenecks in framework operations
`brand_positioning`	read	Develop brand positioning and messaging framework with unique value proposition
`bug-triage-specialist`	read	Error investigation & surgical fixes
`calculate_complexity`	read	Calculate cyclomatic complexity and other code metrics
`campaign_strategy`	read	Develop comprehensive marketing campaign strategy with channel mix, budget allocation, and KPIs
`cancel-orchestration`	read	Cancel active orchestration tasks with cleanup
`check_best_practices`	read	Check adherence to coding best practices and standards
`check_vulnerability`	read	Check specific security vulnerability patterns in a file
`cleanup_expired_sessions`	read	Clean up all expired sessions
`code-analyzer`	read	Deep code analysis & pattern detection
`code-reviewer`	read	Quality assessment & standards validation
`codebase-structure`	read	Analyze file organization, module distribution, and directory hierarchy with optional metrics
`codex-enforcement`	read	Enforce all Universal Development Codex terms with comprehensive compliance validation and actionable remediation
`codex-validation`	read	Validate compliance with Universal Development Codex v1.2.0
`compare-designs`	read	Compare two designs for consistency. Identifies differences in colors, layout, typography, and components.
`complete-tracking`	read	Complete tracking for a task
`content-creator`	read	Marketing copy & content writing
`context-analysis`	read	Perform comprehensive codebase intelligence gathering including structure analysis, dependency mapping, and architectural pattern recognition
`context-analysis-validation`	read	Validate proper integration of contextual analysis components and architectural patterns
`conversion_optimization`	read	Analyze and optimize conversion paths with A/B testing recommendations
`correlate_events`	read	Correlate log entries across multiple sources to find related events
`create_session`	write	Create a new session with optional data and expiration
`database-engineer`	read	Database design & optimization
`delete-state`	destructive	Delete state value by key with cleanup and validation
`delete_session`	destructive	Delete a session
`dependency-analysis`	read	Map component dependencies, identify coupling patterns, and assess architectural relationships
`dependency-audit`	read	Audit third-party dependencies for security vulnerabilities
`describe-diagram`	read	Parse architecture and flow diagrams. Extracts nodes, edges, relationships for understanding system design.
`design-api-endpoints`	read	Design RESTful API endpoints with proper resource modeling
`design-test-strategy`	read	Design comprehensive testing strategy for the project
`design_component`	read	Design a UI component with proper accessibility and UX patterns
`design_data_model`	read	Design optimal data model for given requirements
`design_deployment_strategy`	read	Design optimal deployment strategy for application requirements
`design_test_strategy`	read	Design comprehensive testing strategy for a project
`detect_code_smells`	read	Detect code smells, anti-patterns, and potential issues
`detect_patterns`	read	Detect specific patterns in logs using regex or predefined patterns
`devops-engineer`	read	DevOps & infrastructure automation
`execute-boot-sequence`	write	Execute the complete 0xRay boot sequence with dependency resolution
`execute-post-processors`	write	Run post-execution processors on results with compliance monitoring
`execute-pre-processors`	write	Run pre-execution processors on content with codex validation
`explore_codebase`	read	Explore codebase structure and find files matching patterns. Fast file search.
`extract-visual-specs`	read	Convert visual content to design specifications. Extracts colors, spacing, typography, and other design tokens.
`extract_metrics`	read	Extract detailed code metrics (lines, functions, classes, etc.)
`find_duplicates`	read	Find duplicate or similar code patterns in the codebase
`find_function`	read	Locate specific function definitions across the codebase
`find_implementation`	read	Find implementation examples for a specific pattern or feature
`find_patterns`	read	Find code patterns, functions, classes, or specific text across the codebase
`find_related_issues`	read	Find related or duplicate bugs based on error patterns and symptoms
`flutter_boilerplate`	read	Generate Flutter project with best practices
`format`	read	Format
`format-check`	read	Check if code is properly formatted without making changes
`framework-compliance-audit`	read	Comprehensive validation of all framework components and Universal Development Codex compliance
`framework-compliance-check`	read	Check framework compliance and generate enforcement actions
`frontend-engineer`	read	Frontend development & UI engineering
`frontend-ui-ux-engineer`	read	UI/UX design & visual engineering
`generate-schema-markup`	read	Generate JSON-LD schema markup for: Organization, Product, Article, FAQPage, BreadcrumbList, LocalBusiness, WebSite, HowTo, Recipe, Video, Audio, Course, Event, Person, Book, SoftwareApplication
`generate-sitemap`	read	Generate XML sitemap for SEO with proper structure, priorities, and changefreq
`generate-test-file`	read	Generate test file for a source file with exports
`generate_api_docs`	read	Generate comprehensive API documentation from code analysis
`generate_code_documentation`	read	Generate inline code documentation and improve existing docs
`generate_design_system`	read	Generate a comprehensive design system with colors, typography, and components
`generate_infrastructure_code`	read	Generate infrastructure as code for deployment
`generate_readme`	read	Generate or improve project README documentation
`generate_refactoring_plan`	read	Generate a comprehensive refactoring plan with prioritization
`generate_report`	read	Generate a comprehensive log analysis report
`generate_security_report`	read	Generate comprehensive security report with remediation steps
`get-accuracy-report`	read	Get estimation accuracy report
`get-boot-status`	read	Get comprehensive boot orchestrator status and health
`get-enforcement-status`	read	Get comprehensive enforcement statistics and rule compliance metrics
`get-orchestration-status`	read	Get comprehensive status of active orchestrations and agent utilization
`get-state`	read	Get state value by key with type safety and validation
`get_active_codex`	read	Get the currently active Codex (SSOT) — returns metadata about the loaded codex terms,
`get_documentation`	read	Get documentation for a specific module, class, or function
`get_file_structure`	read	Get directory structure and file tree for a given path
`get_high_confidence_signals`	read	List curated signals at or above a confidence threshold, optionally filtered by tags
`get_session`	read	Retrieve session data by session ID
`get_task_confidence`	read	Evaluate confidence context for a task description (trap detection, complexity boost, matched signals)
`govern-and-apply`	write	Govern inference proposals through weighted voting, then apply approved ones via agent delegation
`govern_health`	read	Health check for the governance MCP server.
`govern_proposals`	write	Run proposals through the governance system.
`govern_reflection`	write	Parse a reflection (or reflection file) and run its extracted proposals through the full governance system.
`govern_sessions`	read	List active governance sessions.
`greet`	read	Say hello
`growth-strategist`	read	Marketing strategy & growth
`headline_analyzer`	read	Analyze and optimize headlines for SEO and conversion
`identify-project-patterns`	read	Identify architectural patterns, code patterns, and structural patterns in the project
`identify-test-gaps`	read	Identify untested code and recommend test cases
`implement_tdd_workflow`	read	Implement Test-Driven Development workflow and practices
`ingest_feedback`	read	Record orchestrator routing outcome for meta-inference feedback loop
`initialize-component`	read	Initialize a specific framework component
`install-skill`	write	Install skills from the registry or any git repo
`invalid`	read	Missing schema
`invoke-skill`	write	Generic skill invocation tool for calling any MCP skill server
`ios_blueprint`	read	Generate iOS project structure with Swift/SwiftUI or UIKit
`keyword_optimization`	read	Optimize existing content with relevant keywords and semantic variations
`landing_page_audit`	read	Audit landing page using
`lint`	read	Comprehensive ESLint validation and automated code quality checking
`lint-check`	read	Check code quality without making changes
`list-skills`	read	List all available skills with descriptions
`list-state`	read	List all state keys with filtering and metadata
`list_sessions`	read	List all active sessions
`log-monitor`	read	Log analysis & pattern detection
`look`	read	Kind 0 is quiet on a match. It checks the six outer names. One outer is a reading. digest and triage return a card.
`market_analysis`	read	Conduct market analysis including competitor positioning, market size, and opportunities
`measure-core-web-vitals`	read	Analyze Core Web Vitals metrics (LCP, INP, CLS) for web application performance
`meta_description_generator`	read	Generate compelling meta descriptions that improve CTR
`migrate_schema`	read	Generate migration scripts for schema changes
`mobile-developer`	read	Mobile app development
`mobile_performance_profile`	read	Analyze mobile app performance and provide optimization recommendations
`model-health-check`	read	Advanced model compatibility validation and dynamic health assessment
`modernize_codebase`	read	Suggest modernization strategies for outdated code and dependencies
`multimodal-looker`	read	Visual content analysis for images, diagrams, PDFs, and screenshots
`optimize-core-web-vitals`	read	Analyze and provide optimization recommendations for LCP (Largest Contentful Paint), INP (Interaction to Next Paint), CLS (Cumulative Layout Shift)
`optimize-orchestration`	read	Analyze and optimize orchestration patterns for better performance
`optimize-robots-txt`	read	Optimize robots.txt for SEO best practices, AI crawler optimization, and proper directive structure
`optimize-test-coverage`	read	Analyze and optimize test coverage patterns
`optimize_deployment_performance`	read	Analyze and optimize deployment performance and reliability
`optimize_query`	read	Analyze and optimize SQL queries for better performance
`optimize_test_performance`	read	Analyze and optimize test execution performance
`orchestrate-task`	write	Execute complex multi-step tasks with intelligent agent delegation and progress tracking
`performance-analysis`	read	Comprehensive metrics analysis for framework integration and optimization
`performance-engineer`	read	Performance optimization & profiling
`prioritize_issues`	read	Prioritize bug fixes based on severity, impact, and effort
`profile-application`	write	Run comprehensive performance profiling on the codebase to identify bottlenecks and hot paths
`quality-gate-check`	read	Perform comprehensive quality gate validation before commits with automated fixes and blocking decisions
`react_native_boilerplate`	read	Generate React Native project with Expo or CLI setup
`recommend-branching-strategy`	read	Recommend branching strategy based on team size and project type
`recommend-patterns`	read	Recommend architectural patterns for specific use cases
`recommend_images`	read	Recommend appropriate image libraries, styles, and optimization strategies for the design context
`refactorer`	read	Technical debt elimination & code consolidation
`researcher`	read	Codebase exploration & documentation search
`restore-state`	read	Restore state from backup
`review-ui-mockup`	read	Evaluate UI mockups against best practices. Checks consistency, accessibility, and provides improvement suggestions.
`review_pull_request`	read	Mock PR review
`risk_assessment`	read	Analyze technical decisions for potential risks, vulnerabilities, and failure modes
`rule-validation`	read	Validate operations against the comprehensive rule hierarchy including duplicate code prevention, test requirements, and architectural constraints
`run-pre-commit-validation`	write	Execute comprehensive pre-commit validation with all enforcer tools and automated remediation
`scan_vulnerabilities`	read	Scan code for security vulnerabilities and compliance issues
`search_codebase`	read	Search the codebase for specific patterns, functions, or implementations
`search_primitives`	read	Search curated primitives by text using registry observation_stats confidence
`security-auditor`	read	Vulnerability detection & compliance
`security-scan`	write	Run security scan using npm audit, Trivy, ESLint security, and OWASP dependency check
`seo-consultant`	read	SEO analysis & optimization
`seo_content_generation`	read	Generate SEO-optimized content for blogs, product pages, landing pages
`session_exists`	read	Check if a session exists and is valid
`set-state`	write	Set state value by key with conflict resolution and persistence
`setup_ci_cd_testing`	write	Set up comprehensive CI/CD testing pipeline
`shared-tool`	read	Server 1 version
`shutdown-framework`	read	Gracefully shutdown framework components
`skill-api-design`	write	Invoke API design skill for REST/GraphQL endpoints
`skill-code-review`	write	Invoke code review skill for comprehensive code analysis
`skill-database-design`	write	Invoke database design skill for schema design and query optimization
`skill-devops-deployment`	write	Invoke DevOps deployment skill for CI/CD and infrastructure
`skill-documentation-generation`	write	Invoke documentation skill for API docs and README
`skill-performance-optimization`	write	Invoke performance optimization skill for bottleneck analysis
`skill-project-analysis`	write	Invoke project analysis skill for codebase insights
`skill-registry-add`	write	Add a new source to the skills registry
`skill-registry-list`	read	List all available skill registry sources
`skill-registry-remove`	destructive	Remove a source from the skills registry

Trust audit

BLOCKgrade F · trust 54/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (12 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/node/basic-security-audit.cjs:27

(line.includes("Function(") && line.includes("=>")) ||

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/integrations/hermes-agent/__pycache__/__init__.cpython-313.pyc

__init__.cpython-313.pyc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/integrations/hermes-agent/__pycache__/schemas.cpython-313.pyc

schemas.cpython-313.pyc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/integrations/hermes-agent/__pycache__/tools.cpython-313.pyc

tools.cpython-313.pyc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

scripts/node/setup-xai-oauth.mjs:143

console.log(`\n✅ Token saved to ${HERMES_AUTH_PATH}`);

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/mjs/verify-temperament-live.mjs:236

const code = execSync('curl -sS -m 12 -o /dev/null -w %{http_code} http://127.0.0.1:18789/', {

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/node/setup-xai-oauth.mjs:25

const REDIRECT_URI = `http://127.0.0.1:${PORT}/callback`;

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/node/setup-xai-oauth.mjs:66

const url = new URL(req.url, `http://127.0.0.1:${PORT}`);

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/integrations/openclaw/api-server.ts:161

if (origin && ['http://localhost', 'http://127.0.0.1', 'http://localhost:3000',

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/integrations/openclaw/api-server.ts:162

'http://127.0.0.1:3000', 'http://localhost:5173', 'http://127.0.0.1:5173'].includes(origin)) {

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

docs-site/static/live/live.js:138

var MARK = { w: 112, h: 44, rle: '061401140v1701170z0g/041601160t1701190z0e/031701170s17011b0z0c/021801180r17011c0z0b/011901190q17011c0z0b/011901190q17041a0z0a/1805170q1706180z0a/1707170p1707170z0a/17

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

house/live-mesh/test_fetch_feed.py:22

ENV_TOKEN = "ghp_ENV_FALLBACK_SHOULD_NEVER_BE_USED"

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete-state, delete_session, skill-registry-remove

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

tests/python/__pycache__/__init__.cpython-313.pyc

__init__.cpython-313.pyc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

tests/python/__pycache__/test_base_agent.cpython-313-pytest-9.0.2.pyc

test_base_agent.cpython-313-pytest-9.0.2.pyc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitignore.default

.gitignore.default

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.vercelignore

.vercelignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

docs-site/static/.nojekyll

.nojekyll

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

logs/.framework-log-2026-03-06.md

.framework-log-2026-03-06.md

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.suspicious_name · CWE-1104

docs-site/docs/plates/payload-heat.md

payload-heat.md

Why it matters. member named after an attack tool

Fix. remove or justify

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/ben-proof/suited/lib/governance/gates/term-029.mjs:7

const hit = text.toLowerCase().includes(evalLike) || text.includes('Function(');

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/test/test-grok-cli-e2e.mjs:595

new_string: 'const x: any = eval(userInput); console.log(x);',

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/__tests__/pipeline/test-processor-mcp-server.mjs:425

test('should warn about eval() usage', () => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/__tests__/pipeline/test-processor-mcp-server.mjs:428

if (!content.includes('eval(')) {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/archive/scripts/v2-refactor/validation/activity-log-audit.sh:39

PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../../../" && pwd)"

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 6b6b12053692full audit observations/trust-audit/mcp-server/0xrayai__xray.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-11	`6b6b12053692`	BLOCK	F	54	first audit

Questions

What is the 0xray MCP server?

Multi-agent orchestration and Codex governance for OpenCode, Hermes, Grok Build, and OpenClaw

What tools does 0xray expose?

200 in total: 197 read-only, 33 that write, and 3 that can delete or overwrite (delete-state, delete_session, skill-registry-remove). Every one is listed on this page with its risk.

Is 0xray safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (54/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does 0xray need?

It reads API_TOKEN, DB_PASSWORD, GH_TOKEN, GITHUB_TOKEN, GOVERNANCE_API_KEY, HERMES_API_KEY, OPENCLAW_API_KEY, OPENCLAW_AUTH_TOKEN, WEBHOOK_API_KEY, WEBHOOK_SECRET, XAI_API_KEY and XRAY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does 0xray run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @0xray/repertoire at 0.2.9.

How current is this page?

The grade is for one exact copy of the source (6b6b12053692), read on 2026-10-11. The repository is watched and re-audited when it changes.

Source	0xRayAI/xray
npm	`@0xray/repertoire@0.2.9`
Transports	stdio · streamable-http
Credentials it reads	`API_TOKENDB_PASSWORDGH_TOKENGITHUB_TOKENGOVERNANCE_API_KEYHERMES_API_KEYOPENCLAW_API_KEYOPENCLAW_AUTH_TOKENWEBHOOK_API_KEYWEBHOOK_SECRETXAI_API_KEYXRAY_API_KEY`
License	MIT
Activity	pushed 0d ago