Atlas / MCP servers / agentskit-io / doc-bridge

doc-bridgeCAUTION

Name: doc-bridge
Author: agentskit-io

mcp/agentskit-io/doc-bridge

MCP server by agentskit-io · ai agents · coding agents · developer experience · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Portable doc bridge for AI agents — OKF + Self-Describe + AgentHandoff. CLI, MCP, Fumadocs/Docusaurus adapters.

Verdict

CAUTION

Grade

Trust score

79 /100

Exposed tools

30 21r · 9w · 0d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/@agentskit/doc-bridge) [](https://github.com/AgentsKit-io/doc-bridge/actions/workflows/ci.yml) [](https://doc-bridge.agentskit.io/) [](https://www.bestpractices.dev/projects/13872) [](LICENSE) [](package.json) [](dist/index.d.ts)

npm: `@agentskit/doc-bridge` · CLI: ak-docs · Landing: agentskit-io.github.io/doc-bridge

Topics: ai-agents · documentation · developer-experience · mcp · llms-txt · typescript

Compatibility: node >=22 · TypeScript 5.8+ · pnpm, npm, or yarn consumers

Deterministic proof of documentation drift, with evidence-linked handoffs for coding agents.

Turn your docs into executable handoffs: doc-bridge reads your repo docs, ownership map, and human documentation site, then gives humans and agents the same evidence-linked starting point:

where to start reading
which files/packages it may edit
which checks prove the change
which human docs explain the feature

The core works without any LLM or API key; the documentation portal dogfoods AgentsKit Chat as an optional surface over that deterministic layer.

Built

Read from source at commit 2fba43664f01OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add doc-bridge-signature-fixture --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} -- npx -y doc-bridge-signature-fixture

claude-desktop

{
  "mcpServers": {
    "doc-bridge-signature-fixture": {
      "command": "npx",
      "args": [
        "-y",
        "doc-bridge-signature-fixture"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}",
        "OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}"
      }
    }
  }
}

Exposed tools (30)

21 read · 9 write · 0 destructive.

Tool	Risk	Description
`area`	read	One page per code area: purpose, modules, documents, related areas, checks and open findings
`change-digest`	read	Entities and documents whose content hash moved since the last scan, and the documents that should have moved with them
`content-fact-checker`	read	Fact Checker — typed output agent (draft spec).
`content-style-guide-enforcer`	read	Style Guide Enforcer — typed output agent (draft spec).
`doc.get`	read	Use after doc.search or handoff.resolve to read one cited document in full, by its indexed id or path. Fails for ids or paths that are not in the index.
`doc.search`	read	Use first for questions about how the repository works, its contracts, architecture, decisions or ownership, before broad grep. Returns ranked indexed documents and entities with their ids, types and paths.
`docbridge.diagnostics`	read	Read bounded diagnostics from the latest canonical reconciliation report.
`docbridge.proposals`	read	Prepare and revalidate region remediations; human approval and application use the local CLI.
`docbridge.relations`	read	Read bounded observed and declared relations from the latest canonical snapshot.
`docbridge.report`	write	Read the canonical reconciliation report from the latest workflow run.
`docbridge.run`	write	Read the latest resumable workflow state and artifact references.
`docbridge.snapshot`	write	Read the bounded canonical repository snapshot from the latest workflow run.
`ecosystem-doc-bridge-corpus-scanner`	read	Scans doc-bridge corpus listings into typed path/staleness report.
`gate.status`	read	Evaluate documentation gates without writing files.
`handoff.resolve`	read	Use when changing a package or handing off its ownership: returns the deterministic AgentHandoff for a package id or an ownership id, with start-here documents, edit roots and checks.
`knowledge.lookup`	read	Return an entity with its neighbours by relation kind, the documents about it, its handoff, its open diagnostics and its evidence, within a token budget.
`knowledge.search`	read	Rank every indexed entity for a query, optionally by kind, with an explanation and within a token budget.
`llms.txt`	write	The curated reading order for agents, as
`memory.classify`	read	Classify local memory candidates into agent, human, playbook, or discard routes.
`memory.promoteDraft`	read	Build a reviewable draft promotion body from local memory candidates without publishing it.
`overlay-review`	read	Pending agent proposals with their evidence, for a human to judge
`ownership`	write	One sidecar per ownership record: where to start, what to read, what to run
`registry.topology`	read	Return the static Doc Bridge curator and delegate topology.
`repo_list`	read	List public source paths, optionally containing a substring.
`repo_read`	write	Read a public source file with line numbers. Start at a one-based line; at most 100 lines.
`repo_search`	read	Find literal text in public sources. Optional path substring; returns at most 30 matching lines.
`retriever.query`	read	Return relevant local Doc Bridge index chunks for a query.
`submit_corpus_scanner`	write	Submit corpus scan report. Call exactly once.
`submit_fact_checker`	write	Submit result. Once.
`submit_guide_enforcer`	write	Submit result. Once.

Trust audit

CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (4 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

playwright.config.ts:4

const baseURL = `http://127.0.0.1:${port}`

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/smoke-ollama.mjs:23

const res = spawnSync('curl', ['-sf', 'http://127.0.0.1:11434/api/tags'], { encoding: 'utf8' })

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/smoke-ollama.mjs:47

if (!ollamaUp()) skip('Ollama not running at http://127.0.0.1:11434 — start with: ollama serve')

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/enrich/context-pack.ts:229

if (raw !== undefined && sha256NormalizedV1(raw.replace(/^/, '')) === entity.evidence[0].contentHash) {

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/render/generated.ts:69

const lines = content.replace(/^/, '').split(/\r?\n/)

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/retrieval/project.ts:319

if (raw !== undefined && (!hash || sha256NormalizedV1(raw.replace(/^/, '')) === hash || entity.metadata?.markdownSyntax === 'obsidian' && sha256NormalizedV1(raw) === hash)) bodyText = extractSearchBod

LOWInventory / provenance · inv.hidden_file · CWE-1104

.cross-platform-baseline.json

.cross-platform-baseline.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.impeccable.md

.impeccable.md

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

mcpb/.mcpbignore

.mcpbignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.suspicious_name · CWE-1104

docs/landing/assets/context-payload-reduction.svg

context-payload-reduction.svg

Why it matters. member named after an attack tool

Fix. remove or justify

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/html-report.test.ts:83

expect(() => new Function(script as string)).not.toThrow()

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table