AppkitBLOCK
Modular production foundation for modern apps: design system, multi-tenancy, forms, analytics, workflows, integrations, documents, and more.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A production application foundation you can adopt one package at a time. Design system, app shell, multi-tenancy, forms, analytics, workflows, integrations, documents, communications, and more—composable without becoming inseparable.
See what you can build · Quick start · Packages · Architecture · Demo app · Documentation
Build your app, not its foundation
AppKit is the reusable product layer between a framework and your application. It gives you the pieces teams usually spend their first year rebuilding: a coherent interface, responsive navigation, tenant isolation, permissions, auditing
7b08efc91438OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add appkit-workflows --env APPKIT_SECRET=${APPKIT_SECRET} --env NANGO_SECRET_KEY=${NANGO_SECRET_KEY} -- npx -y @braedonsaunders/[email protected]{
"mcpServers": {
"appkit-workflows": {
"command": "npx",
"args": [
"-y",
"@braedonsaunders/[email protected]"
],
"env": {
"APPKIT_SECRET": "${APPKIT_SECRET}",
"NANGO_SECRET_KEY": "${NANGO_SECRET_KEY}"
}
}
}
}Exposed tools (20)
17 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Administrator | read | Full workspace access, including identity and setup administration. |
Analyst | read | Builds dashboards and reports with read-only access to workspace records. |
Chatty | read | Low risk, but phones out. |
Doubled | read | Two commands with one name. |
Email | write | Send a bounded, sanitized, token-templated email through an app-provided transport. |
Fixture | read | Test destination |
ImageMagick | read | Convert, crop, and inspect images already in the workspace. |
Nameless | read | No package name. |
NetSuite | write | Sync employees and locations from NetSuite via the REST/SuiteQL API. Uses Token-Based Authentication; all credentials are stored encrypted per connection. |
Operator | read | Creates and updates operational records and runs assigned workflows. |
Preconstruction | read | |
Ranged | read | Pinned to a range. |
Smuggled | read | Points at a writable path. |
Standard | read | |
Uploader | read | Pushes artifacts to a remote host. |
delete_thing | destructive | Deletes a thing. |
get_thing | read | Reads a thing. |
jq | read | JSON processor baked into the golden base image. |
ripgrep | read | Fast recursive search across the files in a workspace. |
status | read | filter |
Trust audit
BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
await exec(command, args, { cwd, maxBuffer: 10 * 1024 * 1024 })exec(call: GuestExecCall): Promise<GuestExecResult>
exec(options: DeskExecOptions & { keepAlive: true }): Promise<DeskJob>exec(options: DeskExecOptions): Promise<DeskExecSnapshot>
await exec(candidate, ['--version'], { timeout: 15_000 })request: { host: '169.254.169.254', port: 80, protocol: 'http', principal: 'desk agent-7' },APPKIT_DB_URL=postgresql://appkit_app:[email protected]:5599/appkit
APPKIT_SUPER_URL=postgresql://postgres:[email protected]:5599/appkit
store.ts
'Issued by Beacon',
const PDF_URL = 'data:application/pdf;base64,JVBERi0xLjQKMSAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMiAwIFIgPj4KZW5kb2JqCjIgMCBvYmoKPDwgL1R5cGUgL1BhZ2VzIC9LaWRzIFszIDAgUl0gL0NvdW50IDEgPj4KZW5kb2JqCjM
'd09GMgABAAAAAJOQABMAAAAB1wQAAJMfAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoVWG9oiHJNMP0hWQVKDWQZgP1NUQVSBACciAIUwL1YRCAqD0WyC7wQLhWwAMIKsXgE2AiQDi1QEIAWHRAeTQVthoXEAd76EAbUT9EmW7Na2vium2zyR28F3r8aw+8yo3RytWpX
'd09GMgABAAAAAF1cAA8AAAABNpgAAFz8AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoQCG70CHJJIBmA/U1RBVEAAhTwRCAqD5DSC8UcLhW4AATYCJAOLWAQgBYYwB5M/Gzf5BezYI24HEESqdqhqmIc18EO5q/nHrUkaYhTSL84q0+T/2wEnY1w/MLUqUC0sCo4DJUm
'd09GMgABAAAAAHOcAA4AAAAA55wAAHNBAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoIOG7MOHJMCBmAAhTgRCAqC2xCCmm4LhRYAATYCJAOKKAQgBYRWB45FG+jDJcyz7IfuBAmtLer7plRwGz63Qx27+bloZCDYOIAQYu8u+f8TEuSIsYF1A/RVq3KETKwy1TX7VDg
'd09GMgABAAAAAIh8ABMAAAABXggAAIgKAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoNYG+d0HIsGP0hWQVKFEgZgP1NUQVSBTicuAIUuL34RCAqB0UCBoT4LhF4AMIK8OgE2AiQDiTgEIAWKPAeMfVtWQlEhJxtduhPyRo26TaWTbZPbbYNYt2vo2pwZtVmjVTWi/09
const pool = new Pool({ connectionString: 'postgresql://app:[email protected]:1/appkit' })secret: 'demo-provider-secret',
const SECRET = 'test-secret-that-is-at-least-thirty-two-characters'
const secret = 'a-production-length-remote-viewer-secret'
const token = 'super-secret-twilio-token'
secret: 'a-production-secret-with-enough-entropy',
delete_thing
datasets.test.ts
sniff.test.ts
endpoints.test.ts
Gates applied: no_behavioural_pass.
7b08efc91438full audit observations/trust-audit/mcp-server/braedonsaunders__appkit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 7b08efc91438 | BLOCK | F | 40 | first audit |
Questions
What is the @braedonsaunders/appkit-mcp MCP server?
Modular production foundation for modern apps: design system, multi-tenancy, forms, analytics, workflows, integrations, documents, and more.
What tools does @braedonsaunders/appkit-mcp expose?
20 in total: 17 read-only, 2 that write, and 1 that can delete or overwrite (delete_thing). Every one is listed on this page with its risk.
Is @braedonsaunders/appkit-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (40/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @braedonsaunders/appkit-mcp need?
It reads APPKIT_SECRET and NANGO_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @braedonsaunders/appkit-mcp run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @braedonsaunders/appkit-workflows at 3.0.0.
How current is this page?
The grade is for one exact copy of the source (7b08efc91438), read on 2026-10-11. The repository is watched and re-audited when it changes.