Atlas / MCP servers / agentworkforce / ai-hist

ai-histBLOCK

Name: ai-hist
Author: agentworkforce

mcp/agentworkforce/relayhistory

MCP server by agentworkforce · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Sync & search Claude Code + Codex CLI conversation history in SQLite. Zero dependencies.

Verdict

BLOCK

Grade

Trust score

55 /100

Exposed tools

37 32r · 4w · 1d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Search, resume, and hand off every coding-agent session — across every harness on your machine.

Local memory for Claude Code, Codex, Cursor, Grok, Muse Code, OpenCode, and Devin CLI. Your agent sessions are indexed into one local SQLite database. Search them all at once, jump back into a session with its harness's native resume command, and hand a compact context pack to another agent — or to a teammate's agent — to continue the work.

ai-hist search "auth rewrite"
# → matches across every codex/claude/cursor session on this machine

ai-hist resume "auth rewrite"
# → prints `codex resume 29284179-c09f-44f2-b9ec-16f678dc1832`

ai-hist pack "auth rewrite" --tokens 1500
# → a token-budgeted context pack, ready to paste into another agent

Use Cases

Never search for an old chat session again. One local index across every harness. ai-hist search "the thing I was working on" finds it, whichever CLI you used.
Hand off work between agents without losing context. ai-hist pack "the feature" produces a compact context pack; ai-hist resume "the feature" prints the native resume command. Great for switching from Claude to Codex mid-work, or picking up a teammate's session.
Give your agent access to its own memory via MCP. Wire ai-hist-mcp into Claude Code / Cursor / Codex and the agent can query its own past sessions while it's running — search, session events, tool calls, file edits.
The sourcing layer for [burn](https://github.com/AgentWorkforce/burn). burn prices and analyzes agent sessions. Today it still ships its own Claude Code, Codex and OpenCode readers; from burn 5.0.0 (burn #562) it drops them and reads usage, tool calls, file edits and session topology from the same ai-history.db through the ai-hist crate, so the two tools share one ingest and agree on what a session is. Pricing and cost stay in burn. See

Read from source at commit 448d02803d82OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add ai-hist --env NODE_AUTH_TOKEN=${NODE_AUTH_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "ai-hist": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "NODE_AUTH_TOKEN": "${NODE_AUTH_TOKEN}"
      }
    }
  }
}

Exposed tools (37)

32 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`ai-hist`	read	Report local history readiness and list the catalogue.
`count`	read	How many to show.
`create_handoff`	write	Create a Relaycast handoff pointer for the caller\
`discover_sessions`	read	Explicit shallow provider discovery. Updates only the session catalog.
`events`	read	Page through one session\
`export`	read	Export selected history as NDJSON.
`get_session`	read	Get indexed prompts for one session.
`get_session_events`	read	Get one bounded page of normalized events.
`get_session_file_edits`	read	Get one bounded page of recorded file edits for one session.
`get_session_markers`	read	Get one bounded page of a session\
`get_session_relationships`	read	Direct relationships for one session: delegation in both directions (as parent and as child), plus the continuity edges (resume, fork, continuation) that connect it to the conversation it came from.
`get_session_requests`	read	Get one bounded page of a session\
`get_session_tool_calls`	read	Get one bounded page of recorded tool calls for one session.
`get_session_tree`	read	Complete descendant tree for one session, with cycle protection and deterministic ordering. Follows delegation edges by default; pass relationship_kinds to also include resumed, continued, or forked descendants of the root. Child events are not flattened into the parent.
`get_session_usage`	read	Provider-neutral token usage rollup for one session. Null usage means no usage evidence, never an assumed zero; cost appears only when the source data carried one.
`get_source_capabilities`	read	What one provider\
`history_stats`	read	Statistics for already-indexed RelayHistory data.
`hydrate_session`	write	Index one cataloged session as fully as its provider allows, without global sync.
`join_relay`	write	Put the local session hosting this MCP server on Agent Relay so teammates and agents can reach it. Uses only the local Agent Relay desktop socket; optional name and description are public relay metadata.
`leave_relay`	destructive	Remove the local session hosting this MCP server from Agent Relay. Uses only the local Agent Relay desktop socket.
`list_relay_agents`	read	List live participants currently on Agent Relay, not session history. Reads only the local Agent Relay desktop socket; it uses no cloud client or credential.
`list_sessions`	read	Cache-only indexed session catalog listing. This never discovers or syncs.
`pack`	read	Pack matching history into a context block.
`query`	read	Search terms.
`recent`	read	Show the most recent prompts.
`recent_history`	read	List recent already-indexed prompts, newest first by (timestampMs, id).
`relay_status`	read	Report whether the local session hosting this MCP server is registered and reachable on Agent Relay. Reads only the local Agent Relay desktop socket.
`resume`	read	Print the command that resumes the best-matching session.
`resume_handoff`	read	Auto-resume a same-workspace handoff in one call: acquire the session and compose prompts, normalized events, tool calls, and file edits. Cross-workspace and cross-organization handoffs are rejected.
`review-bot`	read	Reviews releases.
`search`	read	Search indexed prompts and session events.
`search_history`	read	Full-text search of already-indexed user prompts and session events (assistant text, tool calls and results),
`session`	read	Show one session.
`session-id`	read	Session identifier.
`source`	read	Coding-agent source, e.g. claude or codex.
`stats`	read	Summarize what the history store holds.
`sync`	write	Index new sessions from every configured source.

Trust audit

BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (7 observation(s))
Network: declared (3 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

<tool:relay_status>:1

Report whether the local session hosting this MCP server is registered and reachable on Agent Relay. Reads only the local Agent Relay desktop socket.

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/verify-e2e.sh:26

process.stdout.write(String(eval(process.argv[1])));

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/verify-e2e.sh:36

process.stdout.write(String(eval(process.argv[1])));

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

plugins/provider-sources/rust/src/remote/tests.rs:318

assert!(require_https_or_loopback("http://127.0.0.1:8787").is_ok());

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

plugins/provider-sources/rust/src/remote/tests.rs:324

assert!(require_https_or_loopback("http://[email protected]").is_err());

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

leave_relay

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

sdk-ts/fixtures/offline-history.db.gz

offline-history.db.gz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

sdk-ts/src/delivery.test.ts:352

exec(sql: string): void; prepare(sql: string): { get(): unknown }; close(): void } }

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

sdk-ts/src/delivery.test.ts:402

exec(sql: string): void; prepare(sql: string): { get(): unknown }; close(): void } }

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table