Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

Cipher MCP server

by campfirein/cipherNOASSERTION licenceAudited 22 Sep 2026 · source e1090ca7ceaa

npm byterover-cli 3.16.1stdio★ 4,964
✕BLOCKGrade D · 69/100 · 22 Sep 2026 · e1090ca
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). It exposes 2 tools: 2 read, 0 write and 0 destructive. The audit recorded 21 findings (0 critical, 1 high, 5 medium, 15 low). Maintainer's description: ByteRover CLI (brv) - The portable memory layer for autonomous coding agents (formerly Cipher)

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Cipher MCP server (campfirein/cipher)”. Retrieved 22 Sep 2026. https://modelsatlas.com/mcp/campfirein/cipher

Why this is BLOCK. The audit found 0 critical and 1 high findings; the most severe is Code injection at src/server/infra/migrate/parsers.ts:97. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 22 Sep 2026

Trust score69/100✕BLOCK D
0 critical1 high5 medium15 low0 info

21 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared10 observations
  • NetworkDeclared15 observations
  • ShellDeclared6 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (21)

Sorted by severity

HIGHCode injectioncode.deserialize · src/server/infra/migrate/parsers.ts:97
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
parsed = yaml.load(yamlBlock, {schema: FRONTMATTER_SCHEMA})
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
MEDIUMNetwork egressnet.raw_ip · src/webui/lib/transport.ts:49
F-04 Network egressCWE-200 · CWE-319Layer L1
const socket = io(`http://127.0.0.1:${config.daemonPort}`, {
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · src/webui/vite.config.ts:178
F-04 Network egressCWE-200 · CWE-319Layer L1
target: 'http://127.0.0.1',
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · src/webui/vite.config.ts:183
F-04 Network egressCWE-200 · CWE-319Layer L1
target: 'http://127.0.0.1',
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · src/webui/vite.config.ts:193
F-04 Network egressCWE-200 · CWE-319Layer L1
if (status.running) return `http://127.0.0.1:${status.port}`
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · src/webui/vite.config.ts:198
F-04 Network egressCWE-200 · CWE-319Layer L1
return 'http://127.0.0.1:0'
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · .gitmodules
F-13 Inventory / provenanceCWE-1104Layer L0
.gitmodules
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .mocharc.json
F-13 Inventory / provenanceCWE-1104Layer L0
.mocharc.json
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .prettierrc.json
F-13 Inventory / provenanceCWE-1104Layer L0
.prettierrc.json
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInsecure cryptocrypto.weak_hash · src/server/infra/executor/query-result-cache.ts:62
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return createHash('md5').update(data).digest('hex').slice(0, 16)
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · src/server/infra/vc/file-vc-git-config-store.ts:18
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return createHash('sha1').update(projectPath).digest('hex').slice(0, 16)
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.mjs:45
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
group: ['**/server/**', '../server/**', '../../server/**', '../../../server/**', '../../../../server/**'],
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.mjs:49
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
group: ['**/agent/**', '../agent/**', '../../agent/**', '../../../agent/**', '../../../../agent/**'],
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.mjs:53
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
group: ['**/oclif/**', '../oclif/**', '../../oclif/**', '../../../oclif/**', '../../../../oclif/**'],
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.mjs:57
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
group: ['**/tui/**', '../tui/**', '../../tui/**', '../../../tui/**', '../../../../tui/**'],
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · eslint.config.mjs:75
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
group: ['**/server/**', '../server/**', '../../server/**', '../../../server/**', '../../../../server/**'],
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · src/webui/lib/base64url.ts:18
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const binary = atob(padded)
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@ai-sdk/anthropic, @ai-sdk/cerebras, @ai-sdk/cohere, @ai-sdk/deepinfra, @ai-sdk/google, @ai-sdk/groq, @ai-sdk/mistral, @ai-sdk/openai
Why
119 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainprompt.pipe_to_shell · CHANGELOG.md:185
F-08 Supply chainCWE-829 · CWE-1357Layer L2
- **Intel Mac (darwin-x64) install support** — `curl -fsSL https://byterover.dev/install.sh | sh` now installs on Intel Macs. Previously the installer rejected `darwin-x64` with an Apple-Silicon-only
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · CHANGELOG.md:407
F-08 Supply chainCWE-829 · CWE-1357Layer L2
- **Native binary installer** - Install on macOS and Linux without Node.js via `curl -fsSL https://byterover.dev/install.sh | sh`. Uninstaller script also available.
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · README.md:72
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -fsSL https://byterover.dev/install.sh | sh
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

2 declared in source · 0 destructive

2 read0 write0 destructive
ToolWhat it doesRisk
brv-curateNo description in the sourceread
brv-queryNo description in the sourceread

Safer alternatives

All memory & knowledge servers →
memostem-plugins✓SAFE

girapphe/memostem-plugins

Private, review-first AI knowledge for ChatGPT, Claude, Codex, and MCP.

Grade B
LLM Wiki✓SAFE

oshayr/llm-wiki

Autonomous knowledge base plugin for Claude Code - captures reserch, ideas, and decisions into an interlinked wiki with reserch-on-miss, semantic search, and a Wikipedia-style web UI. Knowledge compounds as you work.

3 writeGrade B
SilverBullet✓SAFE

ahmad-a0/silverbullet-mcp

A Model Context Protocol (MCP) server to interact with your SilverBullet notes and data.

1 destructiveGrade B

Audit history

  1. ✕BLOCK D 69 / 100

    Source changed, verdict held · e1090ca7ceaa

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Cipher MCP server

What is the Cipher MCP server?
ByteRover CLI (brv) - The portable memory layer for autonomous coding agents (formerly Cipher)
What tools does Cipher expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Cipher safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Cipher need?
No credential environment variables were found in its source, so it appears to need none.
How does Cipher run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as byterover-cli at 3.16.1.
How current is this page?
The grade is for one exact copy of the source (e1090ca7ceaa), read on 2026-09-22. The repository is watched and re-audited when it changes.
I already installed Cipher. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • campfirein/cipher on GitHub — the source we read, its licence, stars and activityObserved · 22 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit e1090ca7ceaaObserved · 22 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.