ennodiaSAFE
Connects the AI agents you use: your agent hands a task to another and gets the answer back
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Ennodia isn't another agent. It connects the agents you use.
Stay in Codex, Claude Code, or any agent you like. When a task needs another model, your agent hands that part over through Ennodia and brings the answer back. Ennodia runs on your computer, and each agent uses your own account.
Have Gemini listen to meeting.mp3 through Ennodia and tell me what was decided.
Why use it
- Keep the app you like. Ennodia has no window of its own. You work in your agent as before, and it can now reach the others.
- Your agents work together. Any agent can hand part of a task to any other and get the answer back in your chat.
- Nothing to pay, nothing to join. Ennodia is free and open source, with no account. It uses the agents and plans you have.
- It grows with your agents. It is a set of tools, not a framework or a method. Each new model one agent gains becomes an ability for all of them.
- It stays on your computer. Every handoff leaves a receipt there: who did the work, how long it took, and what came back.
- Less to keep up with. You don't need to follow every new model. Name the task, and your agent hands it to one that can do it.
Next on the roadmap: Ennodia reads its receipts, so your agent stops repeating what failed.
What each agent adds
No model leads every task, so each agent you connect brings an ability the others lack.
- Listen. Gemini hears audio files. Codex hands it the file path and gets back what Gemini heard.
- Draw. Codex draws with GPT Image. Claude Code can hand it a brief and get the images back.
- Review. Two other agents review the same patch in fresh sessions. Compare maps where they agree and differ.
- Read. Kimi K3 in OpenCode reads long documents. Your agen
bed2a9e22073OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ennodia -- npx -y [email protected]
Exposed tools (26)
17 read · 9 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ennodia_cancel_compare | read | |
ennodia_cancel_plan_advice | read | |
ennodia_cancel_run | write | |
ennodia_cancel_task | read | |
ennodia_estimate_budget | read | |
ennodia_estimate_compositional_budget | read | |
ennodia_get_compare | read | |
ennodia_get_compositional_status | read | |
ennodia_get_plan_advice | read | |
ennodia_get_run | write | |
ennodia_get_task | read | |
ennodia_history | read | |
ennodia_install_skills | write | |
ennodia_list_compares | read | |
ennodia_list_harnesses | read | |
ennodia_list_plan_advice | read | |
ennodia_list_runs | read | |
ennodia_list_skills | read | |
ennodia_list_tasks | read | |
ennodia_plan | read | |
ennodia_run | write | |
ennodia_start | write | |
ennodia_start_advised_plan | write | |
ennodia_start_compare | write | |
ennodia_start_compositional | write | |
ennodia_start_plan_advice | write |
Trust audit
SAFEgrade B · trust 88/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (19)
compare-strip.webm
draw-strip.webm
orchestrate-strip.webm
perception-strip.webm
read-strip.webm
import { createDefaultEnnodiaCore } from "../../src/index";import { createDefaultEnnodiaCore } from "../../src/index";{ cwd: join(import.meta.dir, "../../packages/ennodia-io") },const root = new URL("../../", import.meta.url);import { estimateRunBudget } from "../../../src/budget";curl http://127.0.0.1:17273/v1/provider-options
curl http://127.0.0.1:17273/v1/chat/completions \
"http://127.0.0.1/v1/provider-options",
"http://127.0.0.1/v1/models",
"http://127.0.0.1/v1/provider-options?includeUnavailable=false",
@modelcontextprotocol/sdk, zod, @types/bun, oxlint, typescript
zod, @types/bun, typescript
@astrojs/react, @astrojs/starlight, @lucide/astro, astro, react, react-dom, recharts, sharp
airplay, alert-circle, alert-octagon, alert-triangle, aperture, arrow-down-circle, arrow-down-left, arrow-down-right, arrow-down, arrow-left-circle, arrow-left, arrow-right-circle, arrow-right, arrow-
Gates applied: no_behavioural_pass.
bed2a9e22073full audit observations/trust-audit/mcp-server/cherninlab__ennodia.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | bed2a9e22073 | SAFE | B | 88 | first audit |
Questions
What is the ennodia MCP server?
Connects the AI agents you use: your agent hands a task to another and gets the answer back
What tools does ennodia expose?
26 in total: 17 read-only, 9 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ennodia safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (88/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does ennodia need?
It reads ENNODIA_IO_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ennodia run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @ennodia/website at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (bed2a9e22073), read on 2026-10-11. The repository is watched and re-audited when it changes.