bullswarmBLOCK
Use every coding-agent plan you pay for. Routes tasks across Claude Code, Codex and Grok by spare quota, runs multi-agent workflows, and checks the results.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Route work across your coding-agent subscriptions, spend quota before it expires, and verify what comes back.
The problem
You pay for more than one coding agent: a Claude plan or two, Codex, Grok, maybe another.
Every one of them meters you on a clock — five-hour windows, weekly caps, monthly allowances — and unused quota is simply gone when the window resets.
So one plan runs dry mid-task while the others sit idle. You switch tools by hand just to spend what you already paid for. And the agent that wrote the code is usually the one that decides it is done.
What Bullswarm does
Bullswarm turns the agent CLIs already signed in on your machine into one fleet that your main agent can command.
flowchart LR
you([You]) -->|goal| main["Your main agentClaude Code · Codex · Grok+ /bullswarm skill"]
main -->|"bullswarm run · workflow goal"| bs{{"Bullswarmpace router + workflow kernel"}}
bs --> c["claude -p"]
bs --> x["codex exec"]
bs --> g["grok -p"]
bs --> o["contributed providers"]
c & x & g & o -->|output| v["independent verification"]
v -->|"verdict + evidence"| main- Spends quota by pace. Each task goes to the plan with the most spare quota for how far its window has run, so a plan that is behind, or about to reset with quota left, gets used first.
- Picks models for you. Tasks come in three lanes (
analyze,
8929e1ef80fbOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add bullswarm --env FAKE_KEY=${FAKE_KEY} --env GIT_AUTHOR_EMAIL=${GIT_AUTHOR_EMAIL} --env GIT_AUTHOR_NAME=${GIT_AUTHOR_NAME} --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"bullswarm": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"FAKE_KEY": "${FAKE_KEY}",
"GIT_AUTHOR_EMAIL": "${GIT_AUTHOR_EMAIL}",
"GIT_AUTHOR_NAME": "${GIT_AUTHOR_NAME}",
"OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}"
}
}
}
}Exposed tools (5)
4 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
bullswarm_health | read | Re-judge saved offload outputs against their verdicts; report verify-gate failures. Run after every offload round. |
bullswarm_pools | read | Show the meter state and pace position of each pool. |
bullswarm_run | write | Offload a task to the best available coding-agent pool as a one-step workflow, routed by quota pace and judged by facts. Returns a verdict: ok=true means read outFile; ok=false means the why field names the failure and failureKind its kind; runId names the recorded run. |
retired-autonomous-v1 | read | Autonomous goal-driven workflow generated by Bullswarm. |
route | read | Switch bullswarm auto-routing of subagents on or off for this session, when the person asks. Off keeps every subagent in-session; on sends general-purpose subagents to the pool with spare quota. Report the resulting state. |
Trust audit
BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const r = exec(cfg, cfg.gh, args, { timeout: GIT_TIMEOUT_MS });const cloned = exec(cfg, cfg.gh, ['repo', 'clone', repo, 'repo'], { cwd: cfg.dir, timeout: 30 * 60_000 });const fetched = exec(cfg, 'git', ['-C', cfg.repoDir, 'fetch', '--prune', 'origin']);
const checked = exec(cfg, 'git', ['-C', cfg.repoDir, 'checkout', '-q', '--detach', 'origin/main']);
const r = exec(cfg, cfg.bullswarm, args, { env: workerEnv(cfg), timeout: DISPATCH_TIMEOUT_MS });docs-site/docs
else if (!opts.quiet) console.log(`workflow ${token} paused; nothing new starts until: ${paused.next}`);else console.log(`✓ pause withdrawn for ${token}; its running kernel continues`);const secret = 'sk-probe-secret-value-123456';
pid: process.pid, identity: processIdentity(process.pid), token: 'kernel-started-after-plan',
return createHash('sha1').update(bytes).digest('hex');return createHash('sha1').update(bytes).digest('hex');const sha1 = (text) => createHash('sha1').update(text).digest('hex');assert.equal(createHash('sha1').update(lines.join('\n')).digest('hex'), HOME_351_SUMMARIES_SHA1);`console.log(process.env.FAKE_KEY === ${JSON.stringify(secret)} ? 'PONG' : 'no key');\n`);import { MeterError } from '../../../src/provider-kit.js';import { retryAfterMsFromHeaders } from '../../../src/meters/framework.js';} from '../../../src/lib/transcripts/command-code.js';
} from '../../../src/lib/transcripts/opencode.js';
const BUNDLED_DATAPACK = fileURLToPath(new URL('../../data/epoch-benchmarks.json', import.meta.url));const base = `http://127.0.0.1:${server.address().port}`;{"type":"usage","usage":{"input_tokens":41198,"output_tokens":141,"cache_read_input_tokens":640,"cache_creation_input_tokens":0,"reasoning_tokens":33},"signature":"/PSpj5LqmZqpprtwDhJ6JxyBUPtpwTMAqylJ{"type":"usage","usage":{"input_tokens":44482,"output_tokens":124,"cache_read_input_tokens":640,"cache_creation_input_tokens":0,"reasoning_tokens":123},"signature":"dQFvGxv5SuT1YUNRr9gwkiSw8OtKhBw4XNj{"parentUuid":"d897395a-b80a-47ab-9f28-4c42bb8e4301","isSidechain":false,"message":{"model":"claude-opus-5","id":"msg_011Cf9f8NCjVKUhooCRPzeGb","type":"message","role":"assistant","content":[{"type":"vitepress
Gates applied: no_behavioural_pass.
8929e1ef80fbfull audit observations/trust-audit/mcp-server/bulls-work__bullswarm.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 8929e1ef80fb | BLOCK | F | 56 | first audit |
Questions
What is the bullswarm MCP server?
Use every coding-agent plan you pay for. Routes tasks across Claude Code, Codex and Grok by spare quota, runs multi-agent workflows, and checks the results.
What tools does bullswarm expose?
5 in total: 4 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is bullswarm safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (56/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does bullswarm need?
It reads FAKE_KEY, GIT_AUTHOR_EMAIL, GIT_AUTHOR_NAME and OPENROUTER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (8929e1ef80fb), read on 2026-10-11. The repository is watched and re-audited when it changes.