Atlas / MCP servers / aayush9029 / mcp-server

mcp-serverSAFE

mcp/aayush9029/mcp-server

MCP server by aayush9029 · ai · ai agents · claude code · Audited 2026-10-11

⚑ Report / re-scan Source ↗

MCP server that sends your AI agents' tasks to iPhone, iPad, and Apple Watch

Verdict

SAFE

Grade

B

Trust score

83 /100

Exposed tools

—

Transport

streamable-http

License

MIT

Stars

48

01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[!NOTE] The new iOS app, Relaydeck, is on its way to the App Store. The download link goes here when it is live.

[](https://github.com/Aayush9029/mcp-server/actions/workflows/ci.yml)

Verified with

Task Management MCP Server

Bridge AI assistants with real-world task management

This MCP server connects Claude Code, Cursor, Codex, and other AI tools to your iPhone, iPad, and Apple Watch. Your agents create, update, and track tasks, and your devices show each change live.

What You Can Do

Ask Claude to create tasks during coding sessions
Let Cursor update task status as it completes work
Get notifications on your iPhone when AI assistants finish tasks
Follow work in progress with a Live Activity on the Lock Screen
Answer your agent's questions from the notification
Assign a task or send a message from your phone, and your agent picks it up
Track progress across multiple AI tools and automation scripts

Perfec

Read from source at commit c847ca0bace2OBSERVED · 2026-10-11

02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-client-server --env STUB_GOOD_KEYS=${STUB_GOOD_KEYS} -- uvx mcp-client-server

claude-desktop

{
  "mcpServers": {
    "mcp-client-server": {
      "command": "uvx",
      "args": [
        "mcp-client-server"
      ],
      "env": {
        "STUB_GOOD_KEYS": "${STUB_GOOD_KEYS}"
      }
    }
  }
}

03

Trust audit

SAFEgrade B · trust 83/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (6 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (25)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/load.py:229

parser.add_argument("--url", default="http://127.0.0.1:8000")

LOWInventory / provenance · inv.binary · CWE-1104

src/mcp_client_server/site/static/img/art-facets.avif

art-facets.avif

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

src/mcp_client_server/site/static/img/art-paper.avif

art-paper.avif

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

src/mcp_client_server/site/static/img/ipad-task-detail.avif

ipad-task-detail.avif

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

src/mcp_client_server/site/static/img/iphone-keys.avif

iphone-keys.avif

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

src/mcp_client_server/site/static/img/iphone-settings.avif

iphone-settings.avif

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_install.py:1003

link.symlink_to("../../dotfiles/cursor-mcp.json")

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/inbox_stub.py:118

return f"http://127.0.0.1:{self.server_address[1]}"

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/test_event_stream.py:50

yield f"http://127.0.0.1:{port}"

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/test_hooks.py:269

done = hook.run("claude", event, env={"RELAYDECK_URL": "http://127.0.0.1:9"})

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

tests/test_hooks.py:435

outputs.append(hook.run("claude", "start", env={"RELAYDECK_URL": "http://127.0.0.1:9"}))

LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

tests/data/apple_attestation_sample.json:7

"attestation_object": "o2NmbXRvYXBwbGUtYXBwYXR0ZXN0Z2F0dFN0bXSiY3g1Y4JZBCEwggQdMIIDo6ADAgECAgYBnbE/C04wCgYIKoZIzj0EAwIwTzEjMCEGA1UEAwwaQXBwbGUgQXBwIEF0dGVzdGF0aW9uIENBIDExEzARBgNVBAoMCkFwcGxlIEluYy4xE

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

src/mcp_client_server/models.py:57

return base64.b64decode(value, validate=True)

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

tests/test_integrity.py:218

attestation=base64.b64decode(SAMPLE["attestation_object"]),

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

tests/test_integrity.py:219

key_id=base64.b64decode(SAMPLE["key_id"]),

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

tests/test_integrity.py:233

assert hashlib.sha256(verified.public_key).digest() == base64.b64decode(SAMPLE["key_id"])

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

tests/test_site.py:477

assert json.loads(base64.b64decode(query["config"][0], validate=True)) == {

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

AGENTS.md:7

One Python service for the Relaydeck iOS app. AI agents reach it over MCP with an API key and report tasks. Apple devices reach it over REST and a server-sent event stream, and get pushes through APNs

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

docs/overview.md:58

- The MCP endpoint also accepts `?key=mck_<secret>`, for a client that cannot send headers. A URL can appear in logs, so use a header if you can.

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

src/mcp_client_server/site/templates/home.html:72

<p class="card-caption">No email. No password. An open source server.</p>

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

src/mcp_client_server/site/templates/privacy.html:29

<li><strong>Apple.</strong> To send a notification or to update a Live Activity, the server sends the push token and the content of the notification, for example a task title, a question, and a key la

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104

server.json

Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source

Fix. the page says so rather than showing an empty table

INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427

src/mcp_client_server/site/templates/docs_index.html:16

<li>Open the app and make an API key for your agent.</li>

Why it matters. asks the agent to read credentials

INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357

README.md:52

curl -fsSL https://relaydeck.onrender.com/install | sh

INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357

src/mcp_client_server/site/templates/partials/store.html:11

<code class="install-code" tabindex="0"><span class="install-prompt" aria-hidden="true">$ </span><span data-copy-source>curl -fsSL {{ base_url }}<wbr>/install | sh</span></code>

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha c847ca0bace2full audit observations/trust-audit/mcp-server/aayush9029__mcp-server.json · Report an issue / request a re-scan

04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-11	`c847ca0bace2`	SAFE	B	83	first audit

05

Questions

What is the mcp-server MCP server?

MCP server that sends your AI agents' tasks to iPhone, iPad, and Apple Watch

Is mcp-server safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (83/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does mcp-server need?

It reads STUB_GOOD_KEYS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does mcp-server run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as mcp-client-server.

How current is this page?

The grade is for one exact copy of the source (c847ca0bace2), read on 2026-10-11. The repository is watched and re-audited when it changes.