Agent 007BLOCK
From web terminals for your coding agents to a self-running agent company: Claude Code and Codex in parallel git worktrees, a job board they pick work from, and one agent that runs the board from a goal.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/bill10/agent-007/actions/workflows/test-ubuntu.yml) [](https://github.com/bill10/agent-007/actions/workflows/test-windows.yml)
Manage your coding agents by talking to them, from your phone.
The operations layer for Claude Code and Codex: agents take work from a board, one manager agent reviews and merges what they ship, and you hear about it on a call.
A Talk to Billion call, from the request to the merged PR: [watch the 38s video with sound](https://github.com/bill10/agent-007/releases/download/v0.54.1.0/phone-call.mp4). Scripted demo with stand-in agents, sped up; voices are text-to-speech (`scripts/demo/phone-call.mjs`).
- A job board your agents work from. Each card gets its own git worktree, a Claude Code or Codex worker and a real terminal you can type into, and ends as a pull request (or a summary, for work that isn't code).
- One manager agent, Billion. Give it a goal: it posts the cards, reviews the diffs, merges the PRs, and brings you only what needs a person (money, access, security, anything irreversible) in a briefing twice a day.
- Agents that find the right skill. Claude Code fits every installed skill's description into about 1% of its context window; past a hundred or so skills most show as a bare name and get missed. Agent 007 groups them into skill families: its agents see one line per family, and eac
9c29711fe472OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agent-007 --env CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN} --env GH_TOKEN=${GH_TOKEN} -- npx -y @bill10/[email protected]{
"mcpServers": {
"agent-007": {
"command": "npx",
"args": [
"-y",
"@bill10/[email protected]"
],
"env": {
"CLAUDE_CODE_OAUTH_TOKEN": "${CLAUDE_CODE_OAUTH_TOKEN}",
"GH_TOKEN": "${GH_TOKEN}"
}
}
}
}Exposed tools (28)
17 read · 10 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_repo | write | Add a git repository to the Agent 007 board, so job cards can be posted in it |
answer_permission | read | Answer a worker\ |
billion_ready | read | Open your inbox: until you call this, messages from agents and job board |
close_job | read | Close one of your own cards, finished one way or the other. On a card in |
dataviz | read | Charts. |
drop_queued | destructive | Take a queued question out of the briefing queue before the owner sees it. Name it by number (3 for Q3) or id. |
edit_job | write | Change a card that is still in To do: its title, detail, repository, |
finish_job | read | Report that the job-board job you were dispatched to do is finished, which |
list_agents | read | List the other agents running in Agent 007 that you can message with |
list_jobs | read | List the cards on the Agent 007 job board — To do, In progress and Review, |
list_round_queue | read | List the questions you queued with notify_owner that the owner has not seen yet, by project, in the order the |
marketing | read | ${DEFAULT_MAP.summaries.marketing} A family of 2 skills; read this for the catalog. |
merge_check | write | Before you merge a pull request, check whether the merge deploys something. Reads the repo\ |
notify_owner | read | Queue a question or a decision for the owner. The owner is come to in briefings, twice a day (by default 08:30 and |
post_job | write | Post a job card to the Agent 007 job board, in the To do column. Use this when |
read_agent_screen | read | Read the last lines of a worker\ |
read_approval | read | Read a waiting permission request in full: tool, whole input, worker, card |
read_job | read | Read one card on the Agent 007 job board in full, including the detail the |
reopen_question | write | Put an answered question in the Billion tab back to open, when the answer it |
resolve_question | read | Close a question in the Billion tab that the owner answered somewhere else, such as |
respawn_agent | read | Bring back an orphaned worker on one of your cards: it resumes its own |
send_message | write | Send a message to another agent running in Agent 007, whether it runs on |
set_next_wake | write | Say when the server should next wake you for an operating cycle, in minutes |
set_round_brief | write | Set the brief shown at the top of a briefing in the owner |
set_status | write | Say in one line (up to ${MAX_STATUS_CHARS} characters) what you are doing now, e.g. |
tell_owner | write | Send the owner a reply or status update that needs no answer ( |
withdraw_message | read | Take back a message you sent with send_message that is still queued, by the id |
x | read | a b |
Trust audit
BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const r = await exec(file, ['auth', 'status', '--json'], { CLAUDE_CONFIG_DIR: folder === join(home, '.claude') ? undefined : folder });const r = await exec(file, ['login', 'status'], { CODEX_HOME: folder });exec(path, ['--version']),
'.env' ... WebSocket
console.log(`\n Login token (shown once — copy it now):\n`);
console.log(` ${token}\n`);http://127.0.0.1:<port>; docs/REMOTE.md. With --all, takes
const url = `http://127.0.0.1:${port}`;keychain.get(DEFAULT_SERVICE).secret = 'latest-refreshed-old-token';
const token = 'usertoken-abcdefghijklmnop';
drop_queued
exec(file, args, options, callback);
const hash = createHash('md5').update(repoPath).digest('hex').slice(0, 4);const hash = createHash('md5').update(stdout).digest('hex');export const root = fileURLToPath(new URL('../../', import.meta.url));fix: `git mv .claude/skills/${name} .agents/skills/${name} && ln -s ../../.agents/skills/${name} .claude/skills/${name}, then commit both` });: `ln -s ../../${sub}/${name} .claude/skills/${name}, then commit the link` });const out = await getDiff({ worktreePath: wt }, '../../../../../../etc/hosts', '?');attachments: [{ name: 'shot.png', data: png }, { name: '../evil/../../x.txt', data: png }],'.env' ... fetch(
Any proxy that terminates https and forwards to `http://127.0.0.1:7007` works,
service: http://127.0.0.1:7007
proxy_pass http://127.0.0.1:7007;
const bytes = Uint8Array.from(atob(msg.data), c => c.charCodeAt(0));
if (/^image\//.test(entry.type) && URL.createObjectURL) entry.url = URL.createObjectURL(new Blob([Uint8Array.from(atob(f.data), c => c.charCodeAt(0))], { type: entry.type }));Gates applied: no_behavioural_pass.
9c29711fe472full audit observations/trust-audit/mcp-server/bill10__agent-007.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 9c29711fe472 | BLOCK | F | 46 | first audit |
Questions
What is the @bill10/agent-007 MCP server?
From web terminals for your coding agents to a self-running agent company: Claude Code and Codex in parallel git worktrees, a job board they pick work from, and one agent that runs the board from a goal.
What tools does @bill10/agent-007 expose?
28 in total: 17 read-only, 10 that write, and 1 that can delete or overwrite (drop_queued). Every one is listed on this page with its risk.
Is @bill10/agent-007 safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (46/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @bill10/agent-007 need?
It reads CLAUDE_CODE_OAUTH_TOKEN and GH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (9c29711fe472), read on 2026-10-11. The repository is watched and re-audited when it changes.