Atlas / MCP servers / cgoinglove / Better Chatbot

Better ChatbotBLOCK

Name: Better Chatbot
Author: cgoinglove

mcp/cgoinglove/better-chatbot

MCP server by cgoinglove · agent · ai · ai chatbot · Audited 2026-09-25

⚑ Report / re-scan Source ↗

Formerly Better Chatbot. Navigator is an open-source AI workspace for agents, MCP and workflow automation.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

19 19r · 0w · 0d

Transport

stdio · streamable-http

License

MIT

Stars

1,182

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Keinsaas Navigator - A better open-source AI chatbot for individuals and teams.

Originally created by Choi Sung Keun.

[](https://modelcontextprotocol.io/introduction) [](https://localfirstweb.dev/) [](https://discord.gg/gCRu69Upnp)

[](<https://vercel.com/new/clone?repository-url=https://github.com/cgoinglove/better-chatbot&env=BETTERAUTHSECRET&env=OPENAIAPIKEY&env=GOOGLEGENERATIVEAIAPIKEY&env=ANTHROPICAPIKEY&envDescription=BETTERAUTHSECRET+is+required+(enter+any+secret+value).+At+least+one+LLM+provider+API+key+(OpenAI,+Claude,+or+Google)+is+required,+but+you+can+add+all+of+them.+See+the+link+below+for+details.&envLink=https://github.com/cgoinglove/better-chatbot/blob/main/.env.example&demo-title=better-chatbot&demo-description=An+Open-Source+Chatbot+Template+Built+With+Next.js+and+the+AI+SDK+by+Vercel.&products=[{"type":"integration","protocol":"storage","productSlug":"neon","integrationSlug":"neon"},{"type":"integration","protocol":"storage","productSlug":"upstash-kv","integrationSlug":"upstash"},{"type":"blob"}]>)

🚀 [Live Demo](https://app.keinsaas.com/) | See the experience in action in the preview below!

Demo Chats

MCP Tools Demo: Chat with Tools
Image Generation Demo: Chat with Image Generation

Quick Start 🚀

**Get your app running in minutes! No installation or payment requir

Read from source at commit 305302d89aafOBSERVED · 2026-09-25

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add better-chatbot --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET} --env BETTER_AUTH_URL=${BETTER_AUTH_URL} --env BLOB_READ_WRITE_TOKEN=${BLOB_READ_WRITE_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "better-chatbot": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "BETTER_AUTH_SECRET": "${BETTER_AUTH_SECRET}",
        "BETTER_AUTH_URL": "${BETTER_AUTH_URL}",
        "BLOB_READ_WRITE_TOKEN": "${BLOB_READ_WRITE_TOKEN}"
      }
    }
  }
}

Exposed tools (19)

19 read · 0 write · 0 destructive.

Tool	Risk	Description
`ADDITIONAL_SEARCH`	read	Perform supplementary search based on specific instruction
`ANALYSIS`	read	Analyze search results and determine research strategy
`CONTENT_EXTRACTION`	read	Extract detailed content from important URL
`INITIAL_SEARCH`	read	Perform initial web search based on user query and parameters
`INPUT`	read
`LLM`	read	Get latitude and longitude from the LLM
`NOTE`	read	# 🌦️ Regional Weather Lookup Workflow This workflow retrieves weather information for a specified region by chaining together an LLM for geocoding and an HTTP request to a public weather API. ### ➡️ Execution Pipeline 1. Input Region: A user provides a region name (e.g.,
`ORGANIZATION`	read	Organize and summarize all collected information for report generation
`OUTPUT`	read
`REPORT_GUIDE`	read
`SEARCH_CONDITION`	read
`SUMMARY`	read	Synthesize all information into comprehensive research report
`URL_CONDITION`	read
`cached-tool`	read	A cached tool
`changeBrowserTheme`	read	Change the browser theme
`endConversation`	read	End the current voice conversation, similar to hanging up a call. This tool should be invoked when the user clearly expresses a desire to finish, exit, or end the dialogue.
`get_weather`	read	Get the current weather at a location.
`new-tool`	read	New tool
`test-tool`	read	A test tool

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (5 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (14)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/lib/code-runner/safe-js-run.ts:216

const func = new Function(...Object.keys(safeGlobals), wrappedCode);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/lib/code-runner/safe-js-run.ts:289

• Forbidden operations: Avoid DOM access, eval(), or global object manipulation

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

public/sounds/start_voice.ogg

start_voice.ogg

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/components/workflow/workflow-list-page.tsx:192

👨🏻🔬 {t("Workflow.example.babyResearch")}

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/e2e-tests.yml:16

POSTGRES_URL: postgresql://testuser:testpass@localhost:5432/better_chatbot_test

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/lib/code-runner/safe-js-run.test.ts:105

const result = await safeJsRun({ code: "new Function('return 1')();" });

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table