Atlas / MCP servers / chroneus / Vibetrack

VibetrackBLOCK

Name: Vibetrack
Author: chroneus

mcp/chroneus/vibetrack

MCP server by chroneus · deep learning · experiment tracking · machine learning · Audited 2026-10-08

⚑ Report / re-scan Source ↗

Modern experiment tracking that follows you across servers, messengers, and LLMs.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

15 14r · 1w · 0d

Transport

streamable-http

License

NOASSERTION

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Modern experiment tracking.

Key features:

Send experiment results elsewhere: Telegram, Slack, Jupyter, Gradio, and MCP.
Run locally while receiving experiment data over the network via REST API.
Use open formats: experiment data is stored in SQLite and local files.
Compare image-to-image results.
Use a rich UI to show, hide, delete, and customize runs.
TensorBoard SummaryWriter compatible drop-in APIs.
Query results through the MCP server.
Fast scalar logging; see the benchmark report.

Install

pip install vibetrack          # default with web
pip install vibetrack[all]     # all optional backends+dev; MCP on Python >=3.10

Quick start

TensorBoard-style API

from vibetrack import SummaryWriter

writer = SummaryWriter("runs/exp1", project_folder="my_project")
for step in range(100):
writer.add_scalar("loss", 1.0 / (step + 1), step)
writer.add_scalar("acc", step / 100, step)
writer.close()

See API.md for SummaryWriter and module-level logging examples.

Launch the dashboard

vibetrack --listen 0.0.0.0:6116
# -> Web UI on http://you_server:6116
# -> MCP is also mounted when installed with vibetrack[all] on Python 3.10+

Viewers and destinations syntax


writer = SummaryWriter("runs/exp1", project_folder="my_project")
writer.to("console").to("slack", every="15m")
writer.to("remote", url="http://server:8080", token="devtoken")
writer.add_scalar("loss", 0.5, step=0).to("telegram")

See VIEWERS.md for web, console, Slack, Telegram, Gradio, Jupyter, custom viewers, remote forwarding, credentials, and HTTP ingest.

vibetrack Architecture

flowchart TB
su

Read from source at commit 6798f3d8e6f0OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add vibetrack --env LLM_API_KEY=${LLM_API_KEY} --env SLACK_BOT_TOKEN=${SLACK_BOT_TOKEN} --env VIBETRACK_REMOTE_TOKEN=${VIBETRACK_REMOTE_TOKEN} --env VIBETRACK_TELEGRAM_TOKEN=${VIBETRACK_TELEGRAM_TOKEN} -- uvx vibetrack

claude-desktop

{
  "mcpServers": {
    "vibetrack": {
      "command": "uvx",
      "args": [
        "vibetrack"
      ],
      "env": {
        "LLM_API_KEY": "${LLM_API_KEY}",
        "SLACK_BOT_TOKEN": "${SLACK_BOT_TOKEN}",
        "VIBETRACK_REMOTE_TOKEN": "${VIBETRACK_REMOTE_TOKEN}",
        "VIBETRACK_TELEGRAM_TOKEN": "${VIBETRACK_TELEGRAM_TOKEN}"
      }
    }
  }
}

Exposed tools (15)

14 read · 1 write · 0 destructive.

Tool	Risk	Description
`analyze_scalar`	read	Summarize a scalar graph: min/max, best step, trend, plateau, events.
`compare_hparams_tool`	read	Compare hyperparameters across experiments side-by-side.
`compare_image_lpips`	read	Compare two logged images with LPIPS when installed plus pixel metrics.
`compare_scalar`	read	Rank experiments by best value for one scalar tag.
`find_metric_events`	read	Find notable scalar graph events such as extrema, jumps, and plateau.
`get_audio`	read	Get audio entries (step, path, sample_rate) for a specific tag.
`get_experiment_tags`	read	Get all available tags for an experiment, grouped by type.
`get_histograms`	read	Get histogram data for a specific tag in an experiment.
`get_hparams`	read	Get hyperparameters for an experiment.
`get_images`	read	Get image entries (step, path) for a specific tag.
`get_scalars`	read	Get scalar time-series data for a specific tag in an experiment.
`get_texts`	read	Get text entries for a specific tag in an experiment.
`list_experiments`	read	List all experiments in the project database.
`run_report`	write	Get a human-readable end-of-run digest for one experiment.
`summary`	read	Get a summary table: last value of each tag per experiment.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (2 observation(s))
Shell: declared (1 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (10)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94

vibetrack/viewers/web/vendor/three.min.js:6

atob( ... new function(

Why it matters. decodes a payload and executes it

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

vibetrack/viewers/__init__.py:61

module = importlib.import_module(viewers[name])

LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59

tests/test_outputs.py:919

resp = _call_app_route(client._app, "/media", path="/etc/passwd")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_media.py:213

filename="../../owned.txt",