WorkitBLOCK
Workflow rails for agentic coding: one shared task and policy core with native OpenCode, Cursor, Codex, Pi, and CLI surfaces.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/BrainerVirus/workit/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@brainervirus/workit-cli) [](LICENSE)
Workflow rails for agentic coding. The agent decides what to do; the workit CLI does the how (branch, commit, push, PR, CI, stack, merge) and records proof of what it observed. You stay in the loop for product judgment, not for checking whether the tests really ran or the push really landed.
One shared core ships as native integrations for Claude Code, OpenCode, Cursor, Codex CLI/desktop and Pi, plus a standalone CLI.
- Observed, not claimed.
workit checkruns your real test command and
records the exit code, HEAD and tree. An agent saying "tests pass" is a note, not evidence.
- Author ≠ verifier. Verdicts are recorded per session in a SHA-keyed
ledger; the session that wrote the code can never verify it.
- Bounded autonomy. Per-workspace grants decide how far an agent may go
(push, PR, merge) without asking. Your host's permission prompts still win.
- No bookkeeping. Every branch is its own implicit task. Agents never
manage ids.
Contents
- Quickstart
- Core concepts
- Daily workflow
- Skills
- CLI reference
- Upgrading
- Troubleshooting
- Contributing
Quickstart
Requires Node.js 24+. The setup wizard detects your hosts, installs the ones you pick with their native commands, and writes your global config:
npx @brainervirus/workit-cli init workit doctor # after a global install (npm i -g @brainervirus/workit-cli)
Or install a single host by hand:
Claude Co
0c1d8baf701eOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add v2probe --env GIT_ASKPASS=${GIT_ASKPASS} --env WORKFLOW_YT_TOKEN_FILE=${WORKFLOW_YT_TOKEN_FILE} --env WORKFLOW_YT_TOKEN_NAME=${WORKFLOW_YT_TOKEN_NAME} --env WORKIT_EVALUATION_AUTHORIZATION=${WORKIT_EVALUATION_AUTHORIZATION} -- npx -y [email protected]{
"mcpServers": {
"v2probe": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GIT_ASKPASS": "${GIT_ASKPASS}",
"WORKFLOW_YT_TOKEN_FILE": "${WORKFLOW_YT_TOKEN_FILE}",
"WORKFLOW_YT_TOKEN_NAME": "${WORKFLOW_YT_TOKEN_NAME}",
"WORKIT_EVALUATION_AUTHORIZATION": "${WORKIT_EVALUATION_AUTHORIZATION}"
}
}
}
}Exposed tools (7)
5 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
beta | read | b |
no-worktrees | read | NEVER use worktrees |
probe_ping | read | Probe tool that returns pong |
workit | write | OpenCode workit — /wk-issue-update and /wk-meetings |
workit_context | read | Read Git, pull request, YouTrack, issue, changelog, release, or affected-file context. |
workit_init_apply | write | Apply a confirmed toolkit initialization action |
zeta | read | z |
Trust audit
BLOCKgrade F · trust 54/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (12 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (11 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
exec(["stash", "pop", String(ref)]);
exec(["check-ref-format", "--branch", target]);
exec(["rev-parse", "--verify", "--quiet", `refs/heads/${target}`]);exec(["stash", "pop", stash_ref]);
const fetchedBase = exec(["rev-parse", "--verify", `refs/remotes/origin/${base}`]).trim();? `if ${host} is an ssh alias of GitHub/GitLab, add "Host ${host}" with "HostName github.com" (or gitlab.com) to ~/.ssh/config; if it is a self-hosted GitHub/GitLab, set github.host or gitlab.host in["url password with colon", "postgres://admin:pa:ss@db:5432/x", "pa:ss"],
const token = "ghp_S3cretS3cretS3cretS3cretS3cret0000";
"console.log('1 fail: expected 2'); console.error('token=ghp_abcdefghijklmnopqrstuvwxyz123456'); process.exit(1)",expect(JSON.stringify(data.logTail)).not.toContain("ghp_abcdefghijklmnopqrstuvwxyz123456");const token = "ghp_S3cretS3cretS3cretS3cretS3cret0000";
"CLI auth token --hostname github.com --user octo": "gho_token_for_octo_0000000000000000",
"CLI auth token --hostname github.com --user octo": "gho_token_for_octo_0000000000000000",
"-----BEGIN RSA PRIVATE KEY-----\nMIIabc\n-----END RSA PRIVATE KEY-----",
"-----BEGIN OPENSSH PRIVATE KEY-----",
redactor.write("stderr", "-----BEGIN RSA PRIVATE KEY-----\n");bounded.write("stdout", "-----BEGIN PRIVATE KEY-----\n");"-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXk\n-----END OPENSSH PRIVATE KEY-----",
.commitlintrc.json
.node-version
.oxfmtrc.json
.oxlintrc.json
payload-replay.test.ts
} else out.set(rel, createHash("sha1").update(readFileSync(file)).digest("hex"));IdentityFile ~/.ssh/id_work
Gates applied: no_behavioural_pass.
0c1d8baf701efull audit observations/trust-audit/mcp-server/brainervirus__workit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 0c1d8baf701e | BLOCK | F | 54 | first audit |
Questions
What is the @brainervirus/workit-core MCP server?
Workflow rails for agentic coding: one shared task and policy core with native OpenCode, Cursor, Codex, Pi, and CLI surfaces.
What tools does @brainervirus/workit-core expose?
7 in total: 5 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @brainervirus/workit-core safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (54/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @brainervirus/workit-core need?
It reads GIT_ASKPASS, WORKFLOW_YT_TOKEN_FILE, WORKFLOW_YT_TOKEN_NAME and WORKIT_EVALUATION_AUTHORIZATION from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @brainervirus/workit-core run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as v2probe at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (0c1d8baf701e), read on 2026-10-11. The repository is watched and re-audited when it changes.