Atlas / MCP servers / 8b-is / Smart Tree

Smart TreeBLOCK

Name: Smart Tree
Author: 8b-is

mcp/8b-is/smart-tree

MCP server by 8b-is · ai · analysis · anthropic · Audited 2026-10-06

Smart Tree: not just a tree, a philosophy. A context-aware, AI-crafted replacement for 20+ tools with MEM8 quantum compression, semantic search, AST-smart editing, and partnership memory. Crafted with care by human + AI—accept no knock-offs.

Verdict

BLOCK

Grade

Trust score

32 /100

Exposed tools

7 7r · 0w · 0d

Transport

—

License

MIT

Stars

270

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/8b-is/smart-tree) [](LICENSE) [](TERMINALEXAMPLES.md) [](https://archestra.ai/mcp-catalog/8b-issmart-tree) [](docs/spicy-tui.md) [](https://archestra.ai/mcp-catalog/8b-is_smart-tree) [](https://github.com/8b-is/smart-tree#-windows-specific-notes)

Smart Tree is a blazingly fast, AI-friendly directory visualization tool that's 10-24x faster than traditional tree. Now with Security Scanner for supply chain attack detection, Aye Consciousness preservation, Spicy TUI mode, and 30+ MCP tools! Built with Rust for maximum performance.

⚡ Quick Install

# Linux/macOS/WSL - One line install
curl -fsSL https://i1.is/tools/smart-tree | sh

# Choose explicitly for automation
curl -fsSL https://i1.is/tools/smart-tree | sh -s -- --precompiled
curl -fsSL https://i1.is/tools/smart-tree | sh -s -- --compile

# Or with cargo (now on crates.io!)
cargo install smart-tree

# Verify installation
st --version

After install, run st --cleanup to scan for and remove any malicious AI integrations.

Repository hub

8s.is hosts Git archives, opt-in semantic recall with source citations, and Smart Tree feedback. i1.is remains the quick universal installer. The hub keeps exact text in compressed token records and semantic memory in native MEM8, with persistent indexes across restarts. See the public API a

Read from source at commit 9ad046a532caOBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add smart-tree-test-suite --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "smart-tree-test-suite": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}"
      }
    }
  }
}

Exposed tools (7)

7 read · 0 write · 0 destructive.

Tool	Risk	Description
`extract_strings`	read	Extract runs of printable ASCII characters from data
`extract_urls`	read	Extract URLs (http, https, ftp, www) from text data
`from_base64`	read	Decode base64-encoded data (standard or URL-safe alphabet)
`from_hex`	read	Decode hex-encoded data, stripping whitespace and common delimiters
`refactor`	read	Automated refactoring tool
`symbol_search`	read	Find symbol definitions
`xor`	read	XOR data with a repeating key, with optional null-preserving mode

Trust audit

BLOCKgrade F · trust 32/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (11 observation(s))
Network: declared (8 observation(s))
Shell: declared (7 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

scripts/package_i1_release.py:57

if b"-----BEGIN PRIVATE KEY-----" in data or b"-----BEGIN OPENSSH PRIVATE KEY-----" in data:

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

st-protocol/src/payload.rs

payload.rs

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/m8_self_maintaining.rs:928

assert!(system.is_obfuscated("eval(base64_decode('...')"));

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/magiscanner/analyzers/suspicious_patterns.rs:352

name: "eval() call",

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/magiscanner/analyzers/suspicious_patterns.rs:353

pattern: b"eval(",

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/magiscanner/analyzers/suspicious_patterns.rs:358

name: "exec() call",

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/magiscanner/analyzers/suspicious_patterns.rs:359

pattern: b"exec(",

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/hub/indexing.rs:667

"id_rsa",