Archon

Overview

From the repository's own README, as read at the audited commit.

# Maintainer StandupDaily morning briefing for Archon maintainers. Pulls latest `dev`, fetches all open PRs and assigned issues, classifies them **P1–P4** against `direction.md`, and surfaces progress versus the previous run (merged, closed, what you shipped).## Files in this folder| File | Committed? | Purpose ||------|:---:|---------|| `direction.md` | ✓ | Project north-star — what Archon IS / IS NOT. **Shared by all maintainers.** Drives PR triage and polite-decline classification. || `README.md` | ✓ | This file. || `profile.md.example` | ✓ | Template for new maintainers to copy. || `profile.md` | gitignored | Your personal config (gh handle, role, focus areas). || `state.json` | gitignored | Auto-written carry-over for the next run. || `briefs/YYYY-MM-DD.md` | gitignored | Daily prose briefs. Last 3 are read into the next run. |`direction.md` is committed because triage decisions should be consistent across maintainers and across runs. `profile.md`, `state.json`, and `briefs/` are personal — your focus, your daily notes, your reading material — so each maintainer manages their own.## Setup for a new maintainer1. Copy the template:   ```bash   cp .archon/maintainer-standup/profile.md.example .archon/maintainer-standup/profile.md   ```2. Edit `profile.md`:   - Set `gh_handle` to your GitHub login.   - Set `role` and `scope` to match your maintainer focus (`main_maintainer` / `everything` for full coverage; narrower for sub-maintainers).   - Optionally fill in **Currently focused on** — the synthesizer weights items toward what you list there.3. Run it:   ```bash   archon workflow run maintainer-standup ""   ```4. The first run is a baseline (no prior state to diff). Subsequent runs compare against `state.json` and surface "Resolved since last run" / "What you shipped" / aged carry-over items.## How it works (engine view)1. **Three gather scripts** run in parallel (`bun`, no AI):   - `maintainer-standup-git-status.ts` — fetches `origin/dev`, fast-forwards if safe, 

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add workflows --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_OAUTH_TOKEN=${ANTHROPIC_OAUTH_TOKEN} --env ARCHON_CODEX_MCP_TOKEN=${ARCHON_CODEX_MCP_TOKEN} --env ARCHON_CODEX_MISSING_TOKEN=${ARCHON_CODEX_MISSING_TOKEN} -- npx -y @archon/[email protected]

{
  "mcpServers": {
    "workflows": {
      "command": "npx",
      "args": [
        "-y",
        "@archon/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_OAUTH_TOKEN": "${ANTHROPIC_OAUTH_TOKEN}",
        "ARCHON_CODEX_MCP_TOKEN": "${ARCHON_CODEX_MCP_TOKEN}",
        "ARCHON_CODEX_MISSING_TOKEN": "${ARCHON_CODEX_MISSING_TOKEN}"
      }
    }
  }
}

Exposed tools (69) 64 read · 5 write · 0 destructive

Details

Source

coleam00/archon

npm

@archon/workflows@0.10.1

Credentials it reads

ANTHROPIC_API_KEYANTHROPIC_OAUTH_TOKENARCHON_CODEX_MCP_TOKENARCHON_CODEX_MISSING_TOKENARCHON_GIT_PASSWORDARCHON_PI_AUTH_PATHARCHON_WEB_AUTH_HEADERAUTH_PASSWORD_HASHAUTH_PORTAUTH_USERNAMEAWS_ACCESS_KEY_IDAWS_BEARER_TOKEN_BEDROCK

License

MIT

Stars

23,480 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (12 observation(s))

Network

declared (9 observation(s))

Shell

declared (4 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

# GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

{ key: 'containerExec', label: 'Container exec (folder-project container backend)' },

if [ -n "$DEFAULT_USER" ] && [ -f /home/$DEFAULT_USER/.ssh/authorized_keys ]; then

cp /home/$DEFAULT_USER/.ssh/authorized_keys /home/archon/.ssh/authorized_keys

chmod 600 /home/archon/.ssh/authorized_keys

elif [ -f /root/.ssh/authorized_keys ]; then

cp /root/.ssh/authorized_keys /home/archon/.ssh/authorized_keys

# DATABASE_URL=postgresql://postgres:postgres@localhost:5432/remote_coding_agent

# DATABASE_URL=postgresql://postgres:postgres@postgres:5432/remote_coding_agent

DATABASE_URL=postgresql://postgres:postgres@postgres:5432/remote_coding_agent

#     DATABASE_URL=postgresql://postgres:postgres@postgres:5432/remote_coding_agent

archon complete feature-auth --force  # bypass safety checks

| 'exfil'

exfil: [/curl\s+[^|]+\|\s*(ba)?sh/, /wget\s+[^|]+\|\s*(ba)?sh/, /fetch\s*\([^)]+\).*\.\s*then.*exec/],

exfil: 'critical',

url="http://127.0.0.1:$port/internal/git-credential"

ARCHON_TEST_PG_URL: postgres://postgres:postgres@localhost:5432/postgres

const token = 'gitea-clone-token-123';

const token = 'gitlab-adapter-token-789';

const token = 'gitlab-rejected-token-987';

{ kind: 'pat', token: 'fake-token-for-testing' },

{ kind: 'pat', token: 'fake-token-for-testing' },

'-----BEGIN RSA PRIVATE KEY-----\nMIIBOgIBAAJBAKj34GkxFhD90vcNLYLInFEX6Ppy1tPf9Cnzj4p4WGeKLs1Pt8Qu\n-----END RSA PRIVATE KEY-----';

GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

SLACK_BOT_TOKEN=xoxb-your-bot-token

Gates applied: critical_finding, instruction_override, no_behavioural_pass.

Audited 2026-09-16 · audit v0.4.0 · source sha e047dfb1b6fe · full audit: observations/trust-audit/mcp-server/coleam00__archon.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions