Whodb

Overview

From the repository's own README, as read at the audited commit.

# Agent Instructions IndexThis directory contains shared agent guidance for WhoDB. It is intentionally tool-neutral so Codex, Claude Code, opencode, Pi, and other coding agents can use the same source of truth.Start with `../AGENTS.md`. Use this index only to find the one or two deeper references that match the task.## Directory Layout| Path | Purpose ||------|---------|| `.agents/docs/` | Detailed runbooks and reference material for specific systems or policies. || `.agents/rules/` | Domain-specific rules for backend, frontend, GraphQL, localization, and E2E work. || `.agents/workflows/` | Step-by-step procedures for recurring implementation, review, handoff, and research tasks. |If `ee/` is present, also read `ee/AGENTS.md` for Enterprise Edition boundaries and use `ee/.agents/` for EE-specific rules, workflows, and docs.## Common Workflows| Task | Read ||------|------|| Add a database plugin | `.agents/workflows/new-plugin.md` || Add a GraphQL field end-to-end | `.agents/workflows/new-graphql-field.md` || Add a frontend page | `.agents/workflows/new-frontend-page.md` || Add translation keys | `.agents/workflows/add-translation.md` || Add CLI behavior | `.agents/workflows/cli-feature.md` || Prepare or consume a handoff | `.agents/workflows/task-handoff.md` || Prove claims about external behavior | `.agents/workflows/research-proof.md` || Verify before finishing | `.agents/workflows/review-checklist.md` |## Usage Rules- Do not read the whole `.agents` tree by default. Start with `AGENTS.md`, then open only the relevant rule, workflow, or doc.- Keep tool-specific instructions in adapter files such as `CLAUDE.md`; keep shared behavior here.- Do not move user-facing product documentation into this directory. Public docs belong under `docs/`.- When adding new agent guidance, prefer a focused workflow or rule over expanding always-loaded instructions.- After changing agent instructions, run `dev/check-agent-instructions.sh`.

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add whodb-sdk --env OPENAI_API_KEY=${OPENAI_API_KEY} --env WHODB_API_KEY=${WHODB_API_KEY} --env WHODB_IPC_TOKEN=${WHODB_IPC_TOKEN} -- npx -y @clidey/[email protected]

{
  "mcpServers": {
    "whodb-sdk": {
      "command": "npx",
      "args": [
        "-y",
        "@clidey/[email protected]"
      ],
      "env": {
        "OPENAI_API_KEY": "${OPENAI_API_KEY}",
        "WHODB_API_KEY": "${WHODB_API_KEY}",
        "WHODB_IPC_TOKEN": "${WHODB_IPC_TOKEN}"
      }
    }
  }
}

Exposed tools (4) 4 read · 0 write · 0 destructive

Details

Source

clidey/whodb

npm

@clidey/whodb-sdk@0.0.0

PyPI

whodb-sdk

Transports

streamable-http

Credentials it reads

OPENAI_API_KEYWHODB_API_KEYWHODB_IPC_TOKEN

License

Apache-2.0

Stars

5,032 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (15 observation(s))

Network

declared (10 observation(s))

Shell

declared (10 observation(s))

Dependencies

pinned

Secrets in source

found

Findings (25)

-----BEGIN PRIVATE KEY-----

-----BEGIN PRIVATE KEY-----

-----BEGIN PRIVATE KEY-----

func (e *executableSchema) Exec(ctx context.Context) graphql.ResponseHandler {

func (c *cliCredentials) exec(ctx context.Context) (*printTokenOutput, error) {

fn exec(&self) -> Result<CliCache> {

cached = await exec();

if (!cached) cached = await exec();

String.raw`(?:^|[/\\])id_rsa(?:$|[._-])[^/\\]*$`,

Requires the host to be in your ~/.ssh/known_hosts file.

return nil, fmt.Errorf("~/.ssh/known_hosts not found — run 'ssh %s' once to add the host key", "user@host")

inputs[fieldSSHKeyFile] = newInput("~/.ssh/id_rsa", 200)

helpAuthDefaultDesc: uses ~/.aws/credentials, env vars, or IAM role

if ip.Equal(net.ParseIP("169.254.169.254")) {

- --insecure

CONN_FLAGS="--insecure"

This is fire-and-forget. Do not show the user the helper's JSON output; only the human-readable trend line and the written path. Failures here should not block the rest of the flow; print the error an

data_types.xlsx

orders.xlsx

products.xlsx

data_types.xlsx

orders.xlsx

.claude/skills/impeccable

console.log(`Token: ${state.token}\n`);

strategy: "Pure near-black bg lets the seed's cold marine blue read as a luminous beacon, while a pale frost-cyan accent evokes diffused dawn light cutting through fog." },

Gates applied: critical_finding, instruction_override, no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 660016fbed80 · full audit: observations/trust-audit/mcp-server/clidey__whodb.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions