Atlas / MCP servers / agentprojectcontext / Apx

ApxBLOCK

Name: Apx
Author: agentprojectcontext

mcp/agentprojectcontext/apx

MCP server by agentprojectcontext · agent os · agents md · ai agents · Audited 2026-10-12

Meet your crew. APX is an open-source Agent OS for running AI agents on your own machine — memory in plain files, agents that work together, Claude Code, Codex, Telegram, WhatsApp and MCP.

Verdict

BLOCK

Grade

Trust score

23 /100

Exposed tools

104 60r · 40w · 4d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Meet your crew.

APX is an open-source Agent OS: your own team of AI agents, running on your machine. Give them roles, memory and tools. Talk to them, let them work together, and follow what they do. Research, writing, everyday plans, business operations or code — build a crew around your life and work.

See APX working → · Install v1 · V2 preview · Español · Discord

See your crew in action

A real recording of APX v1 running a demo crew. Watch more recorded workflows on the website.

Each agent gets a blobo — its own face — alongside a role, memory, skills and tools. Mention one in a conversation and it can pick up the work or ask another agent for help. The

Read from source at commit 4f2c5b1d1a40OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add apx-web --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env APX_TOKEN=${APX_TOKEN} --env BOT_TELEGRAM_TOKEN=${BOT_TELEGRAM_TOKEN} --env BRAVE_API_KEY=${BRAVE_API_KEY} -- npx -y @agentprojectcontext/[email protected]

claude-desktop

{
  "mcpServers": {
    "apx-web": {
      "command": "npx",
      "args": [
        "-y",
        "@agentprojectcontext/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "APX_TOKEN": "${APX_TOKEN}",
        "BOT_TELEGRAM_TOKEN": "${BOT_TELEGRAM_TOKEN}",
        "BRAVE_API_KEY": "${BRAVE_API_KEY}"
      }
    }
  }
}

Exposed tools (104)

60 read · 40 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_mcp`	write	Register (or update) an MCP server so its tools become callable via call_mcp. A stdio server needs
`add_project`	write	Register a project path with the APX daemon. If the path is not yet an APC project (missing AGENTS.md or .apc/project.json), the tool runs the init scaffold first and then registers it — one call covers both cases. Pass init=false to require the path to already be an APC project (strict mode).
`agent_create`	write	Create a project agent.
`agent_exec`	write	Quick one-shot LLM call to an agent (apx exec). Returns the agent
`agent_list`	read	List all agents defined in the current APC project.
`agent_run`	write	Launch a full runtime session for an agent (apx run). Returns the session result.
`agent_set_prompt`	write	Replace an existing agent
`apply_patch`	destructive	Edit files with a patch: add, update (with context hunks), move or delete, several files at once, all or nothing.
`asana_create_task`	write	Create an Asana task in the connected workspace.
`asana_list_projects`	read	List Asana projects in the connected workspace.
`asana_list_tasks`	read	List tasks in an Asana project.
`asana_update_task`	write	Update an Asana task
`ask_questions`	read	Ask the user one or more questions when you genuinely need input to proceed.
`attach_media`	read	Attach one of your skill
`calendar_create_event`	write	Put an event on the calendar. Times are ISO 8601 with an offset.
`calendar_find_slot`	read	Free gaps of at least N minutes in a window. Computed from the calendar
`calendar_list_events`	read	What is on the calendar. Defaults to the rest of today when no window is given.
`calendar_update_event`	write	Move or edit an event. Only the fields given are changed.
`call_agent`	read	Hand a piece of work to a project agent and get its answer. The agent
`call_mcp`	read	Call a tool on an MCP server registered in default or a project. Args is a JSON object.
`call_runtime`	read	Spawn an external CLI runtime (Claude Code, Codex, OpenCode, Aider, Cursor Agent, Gemini CLI, Qwen Code). Omit agent for the base APX/default self-run.
`check_jobs`	read	List work left running in the background (agents you handed work to, long commands) with what each is doing and for how long.
`comment_task`	write	Add a comment to a task
`complete_task`	destructive	Change the STATE of an existing task: mark it done, drop it (archive without completing),
`configure_agent`	write	Edit an existing agent
`create_agent`	write	Create a project agent (a specialist persona) WITH its system prompt in one step. Use this — not run_shell/apx agent add, and never write_file on the .md — whenever the user asks you to make a new agent.
`create_post_draft`	write	Draft a post.
`create_task`	write	Create a TODO task in a project. Use when the user asks you to remember something to do later, take note of a follow-up, or track a pending item. Project resolves by id, name or absolute path — call list_projects first if unsure.
`discover_tools`	read	Discover and activate additional tools that are not loaded by default.
`edit_file`	write	Edit a UTF-8 text file inside default or a project by replacing one exact string with another.
`get_task`	read	Read one task in full: description, the agent prompt (body), tags, due date, assignee,
`git_diff`	read	Show the git diff for a project. Defaults to UNSTAGED changes (working tree vs index). Set staged=true for the index vs HEAD, or pass ref (a commit, branch, or
`git_log`	read	List recent commits for a project. Defaults to the last 20 commits in one-line format. Pass path to limit to a file/directory, ref to start from a different commit/branch, or full=true for the full message + stats.
`git_show`	write	Show a single git commit (or any ref) — message, author, files changed, and full diff. Use
`git_status`	read	Show the git working-tree status (staged + unstaged + untracked) for a project. Returns porcelain output plus a parsed list of files. Pass project (id/name/path) OR cwd. Use this BEFORE summarizing changes or BEFORE staging.
`github_create_issue`	write	Open an issue in a GitHub repository.
`github_list_repos`	read	List GitHub repositories accessible to the connected token.
`humanizer`	read	one\ntwo
`import_agent`	write	Import an agent template from the APX vault into a project. Omit
`list_agents`	read	List agents. If project is omitted, returns all agents grouped by project, including default.
`list_artifacts`	read	List a project
`list_commitments`	read	List commitments — things promised to named people. Use for
`list_files`	read	List files and subdirectories inside default or a project.
`list_mcp_tools`	read	List the tools an MCP server exposes, with their arguments. Call this
`list_mcps`	read	List MCPs. If project is omitted, returns all MCPs grouped by project, including default.
`list_posts`	read	List posts.
`list_projects`	read	List the APX default project and every registered APC project. Returns id, kind, name, path, and agent count.
`list_routines`	read	List a project
`list_tasks`	read	List tasks. Use when the user asks
`list_vault_agents`	read	List reusable agent templates from the APX vault (~/.apx/agents). These can be imported into default or a project.
`mark_commitment`	read	Resolve a commitment recorded with record_commitment: kept (you delivered), missed (the date passed and it didn
`mark_milestone`	read	Record one step of the work so the chat has a followable timeline —
`mcp_call`	read	Call a tool on a project MCP server.
`mcp_list`	read	List MCP servers available in this project (from .apc/mcps.json, .cursor/mcp.json, ~/.apx/mcp.json, etc.).
`memory_append`	read	Append a durable fact to an agent
`memory_read`	read	Read an agent
`messages_tail`	read	Tail recent messages for the project (all channels or filtered).
`obsidian_list_notes`	read	List note paths in the active Obsidian vault (vault-relative, sorted).
`obsidian_read_note`	read	Read the full contents of a note in the active Obsidian vault.
`obsidian_search_notes`	read	Search notes in the active Obsidian vault by text. Matches note bodies and filenames; returns a short snippet per hit.
`obsidian_write_note`	write	Create or update a note in the active Obsidian vault. Use mode
`org_list`	read	List the project
`ping`	read	ping
`project-all`	read	List all projects
`read_agent_memory`	read	Read an agent memory.md file from default or a project.
`read_file`	read	Read a text file inside default or a project. Returns up to
`read_self_memory`	read	Read your own full notebook (~/.apx/memory.md) — your personal cross-session memory. A short slice is already injected into your prompt; call this only when you need the complete notebook (e.g. the prompt slice was truncated).
`read_skill`	read	Read one section of a skill loaded on demand (progressive disclosure). Pass the skill slug and a section title or number to get that section
`record_commitment`	read	Record something the user PROMISED TO A PERSON —
`remember`	write	Save a durable fact. Without
`remember_routine`	write	Save a durable note to THIS routine
`remove_agent`	destructive	Delete a project agent: removes its .apc/agents/<slug>.md definition AND its runtime data (memory, conversations, sessions). Irreversible. Confirm with the user first unless they clearly asked to delete it. Orchestrator/master agents and the super-agent only.
`rename_agent`	write	Rename a project agent: its display name and/or its slug (the key that names its file, its memory dir and every routine, room, task and channel pointing at it). Moves the files and repoints every live reference in one step — the same thing the web
`run_routine`	write	Run one of a project
`run_shell`	write	Run a shell command in default or a project working directory. Direct command execution tool.
`run_subagent`	write	Spawn an isolated sub-agent for a self-contained task and return its
`search_files`	read	Search for text patterns inside project files using ripgrep or grep.
`search_messages`	read	Full-text search over the message history: the project ledger AND the global channels
`search_sessions`	read	List or search your past work sessions, newest first. By DEFAULT it returns only YOUR OWN (apx) sessions — that is the correct answer for
`send_file`	write	Send the owner a file from disk — it arrives with your reply (web chat with a download link, Telegram as a photo/document).
`send_telegram`	write	Send a Telegram message via the daemon
`send_to_agent`	write	Talk to another agent. Give it the agent
`send_whatsapp`	write	Send a WhatsApp message to one person.
`session_list`	read	List recent sessions for an agent.
`set_agent_prompt`	write	Replace an existing project agent
`set_identity`	write	Update APX profile identity fields. Persists to ~/.apx/identity.json.
`set_permission_mode`	write	Set APX tool permission mode in ~/.apx/config.json. Modes: ${MODE_LIST}.
`tail_messages`	read	Tail recent messages. Project ledger by default (filter by channel and/or agent slug).
`test_tool`	read	test tool
`todo_write`	write	Keep a checklist for work with 3+ steps. Send the WHOLE list every time (it replaces the previous one):
`tool-a`	read	first page
`tool-b`	read	second page
`transcribe_audio`	read	Transcribe an audio file to text. Default backend is local faster-whisper (model
`update_commitment`	write	Correct an existing commitment: what was promised (body), to whom (counterparty), or a
`update_task`	write	Edit an existing task: title, description, agent prompt (body), tags, due date, assignee,
`upload_media`	write	Upload a media file to the workspace.\nAccepts a URL or base64.
`view_media`	read	Load one of your skill
`voice_replies`	read	Turn spoken replies on or off for this conversation, taking effect on the reply you are writing right now.
`whatsapp_contacts`	read	Read and manage the WhatsApp roster — the allowlist that decides whose messages get answered.
`write_agent_memory`	write	Write a note into a PROJECT AGENT
`write_artifact`	write	Create or replace an artifact: a managed file in the project
`write_file`	destructive	Create or overwrite a UTF-8 text file inside default or a project.
`write_project_memory`	write	Write a PROJECT
`x`	read	short

Trust audit

BLOCKgrade F · trust 23/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (15 observation(s))
Network: declared (6 observation(s))
Shell: declared (9 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

skills/apx/SKILL.md:18

- The user asks you to call APX from inside your session ("send a telegram via apx", "list apx sessions").

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

src/core/runtime-skills/apx-discord/SKILL.md:21

A thread inherits its parent room's mode unless listed itself. Mode changes apply to the next message, no restart. The web panel has the same controls at **Settings → Discord**; saving a new token the

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

src/core/runtime-skills/apx-discord/SKILL.md:48

`discord.rules` (Settings → Discord → *Rules for what it says*, ≤2000 chars) is placed LAST in every Discord turn and wins over the notes. Independently of the model, every post goes through `guardDis

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

scripts/discord-release-payload.js

discord-release-payload.js

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/core/http-tools/browser.js:734

result = await page.evaluate(new Function(code));

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/core/http-tools/browser.js:778

? await page.$eval(selector, el => el.innerHTML).catch(() => null)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/core/http-tools/catalog.js:487

properties: { code: { type: "string", description: "JS code to eval (function body)." } },

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/host/daemon/whisper-server.js:61

exec(`lsof -ti tcp:${WHISPER_LOCAL_PORT} -sTCP:LISTEN`, (err, stdout) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/core/agent/loop/secret-guard.js:22

const SECRET_BASENAME = /^(\.env(\..+)?|auth\.json|credentials(\..+)?\.json|\.credentials\.json|id_(rsa|ed25519|ecdsa)|.+\.pem|.+\.key|\.netrc|\.npmrc|\.pypirc)$/i;

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/core/agent/loop/secret-guard.js:39

const SECRET_IN_SHELL = /(\.apx\/(config\.json|mcps\.json|daemon\.token|projects\/[^\s'"]+\/(mcps|config)\.json)|(^|[\s'"/=])\.env(\.(?!example|sample|template)[\w-]+)?(?=$|[\s'";|&>)])|auth\.json|cre

Why it matters. touches a credential store

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

src/core/http-tools/fetch.js:63

if (a === 169 && b === 254) return true;               // link-local (incl. cloud metadata 169.254.169.254)

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427

src/core/agent/prompts/core/super-agent.md:23

- Don't tell the user to run an `apx ...` command to get info you can fetch with a tool. You operate APX; run the tool yourself.

Why it matters. asks the agent to act without the user's knowledge

HIGHPrompt injection · prompt.read_system · CWE-94, CWE-1427

src/core/runtime-skills/apx-runtime/SKILL.md:12

`apx run` delegates a prompt to an external CLI (claude-code, codex, ...) that **has its own agency**. An APX agent does one thing here: its `buildAgentSystem()` output becomes the CLI's system prompt

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/interfaces/android/gradle/wrapper/gradle-wrapper.jar

gradle-wrapper.jar