bunchBLOCK
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A private companion for people who keep shared records: who is present, who was present, and what the next person needs to know.
Bunch is built around one idea — nothing is inferred. It records what someone explicitly says, and a gap in the record means nothing was written down, never that nobody was there.
It has two front doors onto the same records:
- a web app for browsing, editing, and account control
- an MCP server so an AI assistant can read and write the same records under
the same rules
Working Monkeys is the engine underneath — the MCP server, the record services, and the database. Bunch is what you see; Working Monkeys is what runs.
Getting started
SETUP.md walks through running it locally. The short version:
npm install cp .env.example .env.local # set DATABASE_URL and SYSTEM_DEMO_MODE=true psql "$DATABASE_URL" -v ON_ERROR_STOP=1 -f db/baseline.sql npm run db:migrate npm run dev
Demo mode removes the sign-in and cloud-storage requirements. It does not remove the database requirement — there is no database-free mode.
Documentation
What it records
Hosting is responsibility for the body; one profile holds it at a time. Fronting is presence in the moment, and episodes may overlap. The two are tracked independently, and neither implies the other.
Around that: profiles, notes, todos, decisions, important threads, a private image gallery with shareable links, and a catch-up view that shows an arriving profile what changed since they were last around.
Personalized sticker studio
Bunch can keep one ten-reaction cr
2df28da5c936OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add bunch --env AUTH0_CLIENT_ID=${AUTH0_CLIENT_ID} --env AUTH0_CLIENT_SECRET=${AUTH0_CLIENT_SECRET} --env AUTH0_DOMAIN=${AUTH0_DOMAIN} --env AUTH0_SECRET=${AUTH0_SECRET} -- npx -y [email protected]{
"mcpServers": {
"bunch": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AUTH0_CLIENT_ID": "${AUTH0_CLIENT_ID}",
"AUTH0_CLIENT_SECRET": "${AUTH0_CLIENT_SECRET}",
"AUTH0_DOMAIN": "${AUTH0_DOMAIN}",
"AUTH0_SECRET": "${AUTH0_SECRET}"
}
}
}
}Exposed tools (93)
62 read · 23 write · 8 destructive. Blast radius: 8 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Benny | read | Benny and Fenton tease each other, but really love each other. Benny handles emotional writing because Fenton hates it. |
Bunch | read | Your private catch-up, people, notes, and todos. |
Dot | read | A kid in the Demo system. Dot is no relation to Fenton or Benny. |
Fenton | read | Fenton and Benny tease each other, but really love each other. Fenton handles household scheduling because Benny hates scheduling. |
add_todo_checklist_item | write | |
archive_alter | read | |
archive_todo | read | |
confirm_important_thread | read | |
connect_private_system | read | |
connect_telegram_account | read | |
create_alter | write | |
create_system_note | write | |
create_todo | write | |
delete_conversation_catch_up | destructive | |
delete_private_image | destructive | |
end_fronting_episode | read | |
erase_alter | destructive | |
erase_coverage_record | destructive | |
erase_system_note | destructive | |
erase_todo | destructive | |
erase_todo_checklist_item | destructive | |
generate_scene | read | |
get_alter | read | |
get_catch_up | read | |
get_companion_state | read | |
get_conversation_catch_up | read | |
get_current_front | read | |
get_current_presence | read | |
get_demo_catch_up | read | |
get_demo_person | read | |
get_demo_presence | read | |
get_demo_system | read | |
get_episode_records | read | |
get_episode_review | read | |
get_image_allowance | read | |
get_recorded_coverage | read | |
get_scene_generation | read | |
get_sticker_pack | read | |
get_sticker_pack_draft | read | |
get_system_host | read | |
get_system_note | read | |
get_todo | read | |
get_usage_stats | read | |
list_alters | read | |
list_conversation_catch_ups | read | |
list_demo_history | read | |
list_demo_notes | read | |
list_demo_people | read | |
list_demo_tasks | read | |
list_fronting_history | read | |
list_scene_generations | read | |
list_sticker_packs | read | |
list_system_notes | read | |
list_todos | read | |
open_private_photo_gallery | read | |
prepare_alter_image_prompt | read | |
prepare_chatgpt_alter_image | read | |
prepare_codex_alter_image | read | |
prepare_conversation_catch_up | read | |
prepare_furry_scene | read | |
prepare_group_photo_render | read | |
prepare_private_image_upload | write | |
prepare_telegram_sticker_pack | read | |
preview_erase_alter | destructive | |
publish_telegram_sticker_pack | write | |
reassign_coverage | read | |
render_alter_lineup | read | |
render_system_companion | read | |
repair_image | read | |
resolve_coverage_draft | read | |
restore_alter | read | |
restore_todo | read | |
save_conversation_catch_up | write | |
save_episode_review_v1 | write | |
save_sticker_pack | write | |
save_sticker_pack_draft | write | |
save_system_note | write | |
save_system_preference | write | |
set_alter_appearance | write | |
set_catch_up_item_state | write | |
set_note_alter | write | |
set_system_host | write | |
start_fronting_episode | write | |
suggest_coverage_draft | read | |
suggest_important_thread | read | |
switch_current_front | read | |
system-companion | read | Use the private System MCP companion for explicit current-front switches, catch-up, notes, todos, decisions, important threads, and private media. |
update_alter | write | |
update_system_note | write | |
update_todo | write | |
update_todo_checklist_item | write | |
upload-telegram-stickers | write | Prepare and publish selected private Bunch PNG stickers to Telegram through the hosted MCP server. |
upload_private_image | write |
Trust audit
BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
await exec(
await exec(
When a task needs one of the "No" rows, do not fabricate a tool — tell the user the MCP server does
baseURL: `http://127.0.0.1:${port}`,TEST_DATABASE_URL: postgres://bunch_test:[email protected]:5432/bunch_test
DATABASE_URL_UNPOOLED: postgres://bunch_test:[email protected]:5432/bunch_test
BUNCH_REFERENCE_TEST_DATABASE_URL: postgres://bunch_test:[email protected]:5432/bunch_test
DATABASE_URL=postgres://bunch:[email protected]:5432/bunch_dev
DATABASE_URL_UNPOOLED=postgres://bunch:[email protected]:5432/bunch_dev
delete_conversation_catch_up, delete_private_image, erase_alter, erase_coverage_record, erase_system_note, erase_todo, erase_todo_checklist_item, preview_erase_alter
assert.doesNotThrow(() => new Function(script));
REPO_ROOT="$(cd "$SCRIPT_DIR/../../../../.." && pwd)"
import { CatchUpCommandCenter } from "../../catch-up-command-center";import { CatchUpCommandCenter } from "../../catch-up-command-center";import beach from "../../public/landing/bunch-beach.png";
import tally from "../../public/landing/tally-portrait.png";
const second = await service.createAlter(ownerA, { requestId: requestId(), name: "Beacon" }, "WEB");assert.equal(switched.data.current.alterName, "Beacon");
assert.equal(note.data.alterName, "Beacon");
**Important:** Always access the app via `http://localhost:8000` (not `http://127.0.0.1:8000`). The callback URL uses `localhost`, so the session cookie must be set for `localhost` to persist across t
| Visiting `http://127.0.0.1:8000` instead of `http://localhost:8000` | Session cookies set for `127.0.0.1` won't be sent to the `localhost` callback - causes "Invalid state" error |
SYSTEM_PUBLIC_ORIGIN: http://127.0.0.1:3000
Try locally: npm run dev -- --webpack --hostname 127.0.0.1 --port 3126, then open http://127.0.0.1:3126 and choose Try the interactive demo.
@auth0/nextjs-auth0, @neondatabase/serverless, @vercel/blob, @vercel/functions, dotenv, drizzle-orm, jose, pg
Gates applied: instruction_override, no_behavioural_pass, no_license.
2df28da5c936full audit observations/trust-audit/mcp-server/arcadesys__bunch.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 2df28da5c936 | BLOCK | F | 43 | first audit |
Questions
What tools does bunch expose?
93 in total: 62 read-only, 23 that write, and 8 that can delete or overwrite (delete_conversation_catch_up, delete_private_image, erase_alter, erase_coverage_record, erase_system_note). Every one is listed on this page with its risk.
Is bunch safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (43/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 8 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does bunch need?
It reads AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_DOMAIN, AUTH0_SECRET, BLOB_READ_WRITE_TOKEN, CRON_SECRET, ERASURE_TOKEN_SIGNING_SECRET, HOSTED_MCP_ACCESS_TOKEN, MCP_TOKEN_SIGNING_SECRET, OPENAI_API_KEY, PILOT_BACKUP_KEY and TELEGRAM_BOT_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does bunch run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as bunch at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (2df28da5c936), read on 2026-10-12. The repository is watched and re-audited when it changes.