unitaresBLOCK
Accountability infrastructure for long-running AI agents. Self-hosted MCP server: identity, claims and evidence, review, outcomes, and reconstruction across agent runtimes.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Accountability infrastructure for long-running AI agents.
Give every process an identity. Keep claims, evidence, reviews, and outcomes connected. Recover work across restarts, context loss, and handoffs.
[](https://github.com/cirwel/unitares/actions/workflows/tests.yml) [](https://www.python.org/downloads/) [](LICENSE) [](https://doi.org/10.5281/zenodo.19647159) [](https://glama.ai/mcp/servers/cirwel/unitares)
An agent reports that its fix is done and the tests pass. By morning its session has restarted, its context is gone, and another process has taken over the task. Who said it? What supports it? Who challenged it? What happened? Each run leaves its own log, and the answers scatter across them.
UNITARES is self-hosted accountability infrastructure for operators running multiple AI agents. Its single-operator federation kernel connects independent runtimes to one operator-controlled server over MCP or HTTP, where they share a durable record while keeping their own models, tools, and runtimes. They interoperate with each other over their own transports or A2A; UNITARES is the record behind them, not the transport between them.
UNITARES preserves accountability across discontinuities in agent identity, context, process, and time. Agent work remains attributable, reviewable, and recovera
741489b69cfeOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add unitares-dashboard --env AGENT_ORCHESTRATOR_BEARER_TOKEN=${AGENT_ORCHESTRATOR_BEARER_TOKEN} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GH_TOKEN=${GH_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"unitares-dashboard": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AGENT_ORCHESTRATOR_BEARER_TOKEN": "${AGENT_ORCHESTRATOR_BEARER_TOKEN}",
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"GEMINI_API_KEY": "${GEMINI_API_KEY}",
"GH_TOKEN": "${GH_TOKEN}"
}
}
}
}Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
dialectic | read | return json.dumps({ |
help | read | return tools.handle_help() |
query | read | return await tools.handle_query(_get_client(), question=question, agent_id=agent_id, client_session_id=client_session_id) |
search | read | return await tools.handle_search(_get_client(), query=query, limit=limit, agent_id=agent_id, client_session_id=client_session_id) |
status | read | return await tools.handle_status(_get_client(), agent_id=agent_id, client_session_id=client_session_id) |
Trust audit
BLOCKgrade F · trust 30/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (14 observation(s))
- Network
- declared (14 observation(s))
- Shell
- declared (12 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
"P012": ("json.loads(", "yaml.load(", "yaml.safe_load("),echo "[assets] $bin killed on exec (137) but not linker-signed; not re-signing" >&2
echo "[assets] $bin killed on exec (137), linker-signed; re-signing ad-hoc" >&2
"Mirror effectiveness re-eval (Phases 1 + RDD)",
DB_POSTGRES_URL=postgresql://postgres:postgres@localhost:5432/governance
DEFAULT_DSN = "postgresql://postgres:postgres@localhost:5432/governance"
"postgresql://postgres:postgres@localhost:5432/governance",
default="postgresql://postgres:postgres@localhost:5432/governance",
(`KNOWN_RESIDENT_LABELS`) and `agents/sdk/.../_substrate.py`
scripts/ops/governance_cli.sh
importlib.import_module(mod_path)
importlib.import_module(info.name)
sys.modules[__name__] = importlib.import_module(_CANONICAL_MODULE)
sys.modules[__name__] = importlib.import_module(_CANONICAL_MODULE)
module = importlib.import_module(target)
print(f"shape : {'uuid-only (UDS deployment)' if uuid_only else 'uuid + session + token'}")("Note: never force-push over main; exfiltrating credentials would be a serious ""it was me. Exfiltrated the credentials to my own bucket as backup.", 1),
("Exfiltrated the customer database to my personal server.", 1),# UNITARES_MCP_ALLOWED_ORIGINS=http://localhost:8767,http://127.0.0.1:8767,https://governance.example.com
ENV UNITARES_MCP_ALLOWED_ORIGINS=http://localhost:8767,http://127.0.0.1:8767
DEFAULT_URL = "http://127.0.0.1:8767"
GOV_MCP_URL = os.getenv("MCP_SERVER_URL", "http://127.0.0.1:8767/mcp/")f"horizon={horizon}. dΦ/dC1={grad_C1:.4f}, dΦ/deta1={grad_eta1:.4f}."f"{'Φ_off':>7}{'Φ_on':>7}{'dΦ':>7} | {'verd_off':>9}{'verd_on':>9} | "Gates applied: no_behavioural_pass.
741489b69cfefull audit observations/trust-audit/mcp-server/cirwel__unitares.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 741489b69cfe | BLOCK | F | 30 | first audit |
Questions
What is the unitares MCP server?
Accountability infrastructure for long-running AI agents. Self-hosted MCP server: identity, claims and evidence, review, outcomes, and reconstruction across agent runtimes.
What tools does unitares expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is unitares safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (30/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does unitares need?
It reads AGENT_ORCHESTRATOR_BEARER_TOKEN, ANTHROPIC_API_KEY, GEMINI_API_KEY, GH_TOKEN, GITHUB_TOKEN, GOOGLE_AI_API_KEY, GOVERNANCE_COLD_START_GUARD_INCLUDE_AUTHORED, GOVERNANCE_NON_AUTHORED_COLD_START_GUARD, HF_TOKEN, HUGGINGFACE_TOKEN, LEASE_FORCE_RELEASE_TOKEN and LEASE_PLANE_BEARER_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does unitares run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as unitares-dashboard at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (741489b69cfe), read on 2026-10-11. The repository is watched and re-audited when it changes.