dibsBLOCK
Keeps your agents in the loop about each other. See what the fleet is doing, then message, sync and send files between agents. Dibs reports; it never acts.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/agenxy/dibs/actions/workflows/ci.yml) [](https://github.com/agenxy/dibs/releases/latest) [](https://pkg.go.dev/github.com/agenxy/dibs) [](LICENSE)
Keeps your agents in the loop about each other.
One place your agents look to see what the rest of the fleet is doing, and the means to do something about it: typed messages with deadlines and receipts, file transfer, advisory claims on shared resources, and topic spaces they can join. Dibs reports, and it never decides what an agent should do next. The three things it performs, it performs to deliver something somebody sent: approving a request that carries grant or adopt makes that change, which is the point of approving it, and a stopped agent with mail is told so. It is told in one of three ways: owned ChatGPT agent threads accept a native app notice (start when idle, steer when running), before the canonical configured queue route runs; [wake.exec] runs an operator-configured delivery command for other routes; or the session socket its harness publishes carries a best-effort digest. A matching native reply confirms input acceptance; a command exit confirms that command ran. Neither confirms mail consumption. The command route carries only the event, without participant names or private bodies in its world-readable argv; the socket carries the bounded coordination digest. Neither carries an imperative. Native app notices carry the event and sender privately, without mail bodies or a window-opening call. Cold ChatGPT threads retain the queue/open fallback, which can navigate the app; queue admission is never claimed
0266659a8800OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add dibs-panel-e2e --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} --env PI_API_KEY=${PI_API_KEY} -- npx -y dibs-panel-e2e{
"mcpServers": {
"dibs-panel-e2e": {
"command": "npx",
"args": [
"-y",
"dibs-panel-e2e"
],
"env": {
"OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}",
"PI_API_KEY": "${PI_API_KEY}"
}
}
}
}Exposed tools (21)
21 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
asker | read | wake e2e |
builder | read | on the web board |
cc-agent | read | wake e2e |
checker | read | peer |
clone-worker | read | on a third machine |
curious | read | asks and leaves |
ghost | read | was refactoring auth |
hub-worker | read | on the hub machine |
intruder | read | guard e2e |
misbound | read | guard e2e |
nothread | read | wake e2e |
oracle | read | answers |
own-session | read | wake e2e |
panel-inspect | read | Looking at the board panel: an instrument, not a worker |
peer | read | sends mail |
remote-sleeper | read | asleep on the joining machine |
remote-worker | read | on the joining machine |
reviewer | read | reviewing the panel |
sleeper | read | wake e2e |
socket-sleeper | read | wake e2e |
worker | read | doing the work |
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
func (e *Engine) exec(op *core.Op, now time.Time) (core.Result, error) {const secret = "THE-BODY-OF-THE-POST"
const secret = "SENSITIVE-BODY-NOBODY-ELSE-MAY-READ"
const secret = "SENSITIVE-BODY-NOBODY-ELSE-MAY-READ"
const secret = "SECRET-BODY-THE-PANEL-MUST-NOT-GET"
const secret = "NESTED-BODY-MUST-NOT-ESCAPE"
.golangci.yml
.goreleaser.yml
cmd := exec.CommandContext(ctx, "xcrun", "swiftc", "-j1", "../../internal/notify/app/notify_darwin.swift", "-o", executable) // #nosec G204 -- exact production source and private test bundle
for _, root := range []string{"../../cmd", "../../internal"} {"hub.example:4777/../../escaped",
for _, nasty := range []string{"../../escape:4777", "a/b:4777", `a\b:4777`} {if out, err := exec.Command("go", "build", "-o", queueBinary, "../../internal/wakeexec/testdata/codexqueue").CombinedOutput(); err != nil {the scheme. `http://10.0.0.9:4777` served TLS to clients speaking plaintext;
`https://127.0.0.1:4777` served plaintext to clients speaking TLS. The scheme
started with `-addr https://127.0.0.1:4777` registered the bare listener,
"https://127.0.0.1:4777"` passed the loader and produced a confident HTTPS
replacement inherits. A board launched with `DIBS_ADDR=http://10.0.0.9:4777`
const r = await fetch(`${URL}/api/hosts`, { headers: { "X-Dibs-Local": secret }, tls: { rejectUnauthorized: false } } as any)for i, n := range []string{"seedа", "seedb", "seedc"} {"QRST",
@modelcontextprotocol/ext-apps, @modelcontextprotocol/sdk, playwright
trust context from endpoint TLS; never share pools or credential transports.
## If you are an admin
`ProcessType` as `dibd` read the login keychain and ran a complete
Gates applied: no_behavioural_pass.
0266659a8800full audit observations/trust-audit/mcp-server/agenxy__dibs.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 0266659a8800 | BLOCK | D | 62 | first audit |
Questions
What is the dibs MCP server?
Keeps your agents in the loop about each other. See what the fleet is doing, then message, sync and send files between agents. Dibs reports; it never acts.
What tools does dibs expose?
21 in total: 21 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is dibs safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does dibs need?
It reads OPENROUTER_API_KEY and PI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does dibs run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as dibs-panel-e2e.
How current is this page?
The grade is for one exact copy of the source (0266659a8800), read on 2026-10-11. The repository is watched and re-audited when it changes.