Atlas / MCP servers / bill10 / Agent 007

Agent 007BLOCK

mcp/bill10/agent-007

From web terminals for your coding agents to a self-running agent company: Claude Code and Codex in parallel git worktrees, a job board they pick work from, and one agent that runs the board from a goal.

Verdict
BLOCK
Grade
F
Trust score
46 /100
Exposed tools
28 17r · 10w · 1d
Transport
—
License
MIT
Stars
4
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/bill10/agent-007/actions/workflows/test-ubuntu.yml) [](https://github.com/bill10/agent-007/actions/workflows/test-windows.yml)

Manage your coding agents by talking to them, from your phone.

The operations layer for Claude Code and Codex: agents take work from a board, one manager agent reviews and merges what they ship, and you hear about it on a call.

A Talk to Billion call, from the request to the merged PR: [watch the 38s video with sound](https://github.com/bill10/agent-007/releases/download/v0.54.1.0/phone-call.mp4). Scripted demo with stand-in agents, sped up; voices are text-to-speech (`scripts/demo/phone-call.mjs`).

  • A job board your agents work from. Each card gets its own git worktree, a Claude Code or Codex worker and a real terminal you can type into, and ends as a pull request (or a summary, for work that isn't code).
  • One manager agent, Billion. Give it a goal: it posts the cards, reviews the diffs, merges the PRs, and brings you only what needs a person (money, access, security, anything irreversible) in a briefing twice a day.
  • Agents that find the right skill. Claude Code fits every installed skill's description into about 1% of its context window; past a hundred or so skills most show as a bare name and get missed. Agent 007 groups them into skill families: its agents see one line per family, and eac
Read from source at commit 9c29711fe472OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add agent-007 --env CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN} --env GH_TOKEN=${GH_TOKEN} -- npx -y @bill10/[email protected]
claude-desktop
{
  "mcpServers": {
    "agent-007": {
      "command": "npx",
      "args": [
        "-y",
        "@bill10/[email protected]"
      ],
      "env": {
        "CLAUDE_CODE_OAUTH_TOKEN": "${CLAUDE_CODE_OAUTH_TOKEN}",
        "GH_TOKEN": "${GH_TOKEN}"
      }
    }
  }
}
03

Exposed tools (28)

17 read · 10 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
add_repowriteAdd a git repository to the Agent 007 board, so job cards can be posted in it
answer_permissionreadAnswer a worker\
billion_readyreadOpen your inbox: until you call this, messages from agents and job board
close_jobreadClose one of your own cards, finished one way or the other. On a card in
datavizreadCharts.
drop_queueddestructiveTake a queued question out of the briefing queue before the owner sees it. Name it by number (3 for Q3) or id.
edit_jobwriteChange a card that is still in To do: its title, detail, repository,
finish_jobreadReport that the job-board job you were dispatched to do is finished, which
list_agentsreadList the other agents running in Agent 007 that you can message with
list_jobsreadList the cards on the Agent 007 job board — To do, In progress and Review,
list_round_queuereadList the questions you queued with notify_owner that the owner has not seen yet, by project, in the order the
marketingread${DEFAULT_MAP.summaries.marketing} A family of 2 skills; read this for the catalog.
merge_checkwriteBefore you merge a pull request, check whether the merge deploys something. Reads the repo\
notify_ownerreadQueue a question or a decision for the owner. The owner is come to in briefings, twice a day (by default 08:30 and
post_jobwritePost a job card to the Agent 007 job board, in the To do column. Use this when
read_agent_screenreadRead the last lines of a worker\
read_approvalreadRead a waiting permission request in full: tool, whole input, worker, card
read_jobreadRead one card on the Agent 007 job board in full, including the detail the
reopen_questionwritePut an answered question in the Billion tab back to open, when the answer it
resolve_questionreadClose a question in the Billion tab that the owner answered somewhere else, such as
respawn_agentreadBring back an orphaned worker on one of your cards: it resumes its own
send_messagewriteSend a message to another agent running in Agent 007, whether it runs on
set_next_wakewriteSay when the server should next wake you for an operating cycle, in minutes
set_round_briefwriteSet the brief shown at the top of a briefing in the owner
set_statuswriteSay in one line (up to ${MAX_STATUS_CHARS} characters) what you are doing now, e.g.
tell_ownerwriteSend the owner a reply or status update that needs no answer (
withdraw_messagereadTake back a message you sent with send_message that is still queued, by the id
xreada b
04

Trust audit

BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (8 observation(s))
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
server/agent-accounts.js:96
const r = await exec(file, ['auth', 'status', '--json'], { CLAUDE_CONFIG_DIR: folder === join(home, '.claude') ? undefined : folder });
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
server/agent-accounts.js:103
const r = await exec(file, ['login', 'status'], { CODEX_HOME: folder });
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
server/agent-accounts.js:126
exec(path, ['--version']),
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319
server/remote-setup.js:159
'.env' ... WebSocket
Why it matters. reads secrets in the same file that sends data out
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
bin/adduser.js:62
console.log(`\n  Login token (shown once — copy it now):\n`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
bin/adduser.js:63
console.log(`      ${token}\n`);
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
bin/agent-007.js:70
http://127.0.0.1:<port>; docs/REMOTE.md. With --all, takes
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/demo/scratch.mjs:17
const url = `http://127.0.0.1:${port}`;
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/account-migration.test.js:872
keychain.get(DEFAULT_SERVICE).secret = 'latest-refreshed-old-token';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/mcp-endpoint.test.js:51
const token = 'usertoken-abcdefghijklmnop';
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
drop_queued
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
test/worktree-branch-collisions.test.js:55
exec(file, args, options, callback);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
lib/helpers.js:553
const hash = createHash('md5').update(repoPath).digest('hex').slice(0, 4);
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
server/git.js:710
const hash = createHash('md5').update(stdout).digest('hex');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/demo/scratch.mjs:11
export const root = fileURLToPath(new URL('../../', import.meta.url));
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
server/skill-store.js:378
fix: `git mv .claude/skills/${name} .agents/skills/${name} && ln -s ../../.agents/skills/${name} .claude/skills/${name}, then commit both` });
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
server/skill-store.js:386
: `ln -s ../../${sub}/${name} .claude/skills/${name}, then commit the link` });
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
test/git-diff.test.js:33
const out = await getDiff({ worktreePath: wt }, '../../../../../../etc/hosts', '?');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
test/jobs-dispatch.test.js:57
attachments: [{ name: 'shot.png', data: png }, { name: '../evil/../../x.txt', data: png }],
LOWNetwork egress · net.env_exfil · CWE-200, CWE-319
test/server.test.js:158
'.env' ... fetch(
Why it matters. reads secrets in the same file that sends data out
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/REMOTE.md:145
Any proxy that terminates https and forwards to `http://127.0.0.1:7007` works,
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/REMOTE.md:204
service: http://127.0.0.1:7007
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/REMOTE.md:269
proxy_pass http://127.0.0.1:7007;
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
public/modules/terminal.js:223
const bytes = Uint8Array.from(atob(msg.data), c => c.charCodeAt(0));
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
public/modules/waiting.js:61
if (/^image\//.test(entry.type) && URL.createObjectURL) entry.url = URL.createObjectURL(new Blob([Uint8Array.from(atob(f.data), c => c.charCodeAt(0))], { type: entry.type }));

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 9c29711fe472full audit observations/trust-audit/mcp-server/bill10__agent-007.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-119c29711fe472BLOCKF46first audit
06

Questions

What is the @bill10/agent-007 MCP server?

From web terminals for your coding agents to a self-running agent company: Claude Code and Codex in parallel git worktrees, a job board they pick work from, and one agent that runs the board from a goal.

What tools does @bill10/agent-007 expose?

28 in total: 17 read-only, 10 that write, and 1 that can delete or overwrite (drop_queued). Every one is listed on this page with its risk.

Is @bill10/agent-007 safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (46/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does @bill10/agent-007 need?

It reads CLAUDE_CODE_OAUTH_TOKEN and GH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (9c29711fe472), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement