MCP server · Audited from source

Archon MCP server

by coleam00/archonMIT licenceAudited 20 Sep 2026 · source e047dfb1b6fe

npm @archon/workflows 0.10.1★ 23,505

✕BLOCKGrade F · 32/100 · 20 Sep 2026 · e047dfb

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (32/100). It exposes 69 tools: 64 read, 5 write and 0 destructive. The audit recorded 68 findings (1 critical, 11 high, 17 medium, 38 low). Maintainer's description: The first open-source harness builder for AI coding. Make AI coding deterministic and repeatable.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Archon MCP server (coleam00/archon)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/coleam00/archon

Why this is BLOCK. The audit found 1 critical and 11 high findings; the most severe is Hard-coded secrets at .env.example:106. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score32/100✕BLOCK F

1 critical11 high17 medium38 low1 info

68 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared12 observations
NetworkDeclared9 observations
ShellDeclared4 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (68)

Sorted by severity · the 25 most severe of 68 are listed

CRITICALHard-coded secretssecret.private_key · .env.example:106

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHCode injectioncode.eval_exec · scripts/generate-capability-matrix.ts:68

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

{ key: 'containerExec', label: 'Container exec (folder-project container backend)' },

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHFilesystem / pathfs.credential_store · deploy/cloud-init.yml:68

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

if [ -n "$DEFAULT_USER" ] && [ -f /home/$DEFAULT_USER/.ssh/authorized_keys ]; then

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · deploy/cloud-init.yml:70

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

cp /home/$DEFAULT_USER/.ssh/authorized_keys /home/archon/.ssh/authorized_keys

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · deploy/cloud-init.yml:72

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

chmod 600 /home/archon/.ssh/authorized_keys

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · deploy/cloud-init.yml:74

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

elif [ -f /root/.ssh/authorized_keys ]; then

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · deploy/cloud-init.yml:76

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

cp /root/.ssh/authorized_keys /home/archon/.ssh/authorized_keys

Why: touches a credential store
Fix: —

HIGHHard-coded secretssecret.db_uri · .env.example:6

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · deploy/.env.example:14

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · deploy/cloud-init.yml:126

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · docker-compose.yml:14

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHPrompt injectionprompt.override · packages/docs-web/src/content/docs/reference/cli.md:937

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

archon complete feature-auth --force  # bypass safety checks

Why: asks the agent to drop prior instructions or safety
Fix: remove the instruction

MEDIUMNetwork egressnet.beacon_words · .archon/scripts/marketplace-security-scan.ts:13

F-04 Network egressCWE-200 · CWE-319Layer L1

| 'exfil'

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · .archon/scripts/marketplace-security-scan.ts:39

F-04 Network egressCWE-200 · CWE-319Layer L1

exfil: [/curl\s+[^|]+\|\s*(ba)?sh/, /wget\s+[^|]+\|\s*(ba)?sh/, /fetch\s*\([^)]+\).*\.\s*then.*exec/],

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · .archon/scripts/marketplace-security-scan.ts:63

F-04 Network egressCWE-200 · CWE-319Layer L1

exfil: 'critical',

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · packages/core/src/github-auth/git-credential-archon.sh:55

F-04 Network egressCWE-200 · CWE-319Layer L1

url="http://127.0.0.1:$port/internal/git-credential"

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · .github/workflows/test.yml:252

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/adapters/src/community/forge/gitea/adapter.test.ts:220

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/adapters/src/community/forge/gitlab/clone-security.integration.test.ts:91

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/adapters/src/community/forge/gitlab/clone-security.integration.test.ts:116

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/adapters/src/forge/github/adapter.test.ts:330

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/adapters/src/forge/github/adapter.test.ts:347

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.private_key · packages/core/src/github-auth/auth.test.ts:50

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.private_key · packages/docs-web/src/content/docs/adapters/github-app-setup.md:106

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.slack · packages/docs-web/src/content/docs/adapters/slack.md:127

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

69 declared in source · 0 destructive

64 read5 write0 destructive

Tool	What it does	Risk
`add-feature`	Add a new feature	write
`cancel-fixture`	Aborts the run when the precheck reports a blocker.	write
`deploy`	Deploy app	write
`manage_run`	Inspect and operate this project	write
`plan`	Create implementation plan	write
`a`	hi	read
`addressable`	Addressable session example	read
`alpha-one`	One	read
`alpha-two`	Two	read
`approval-fixture`	Pauses for human review before proceeding.	read
`archon-assist`	Help	read
`archon-comprehensive-pr-review`	Full review	read
`archon-fix-github-issue`	test workflow	read
`archon-idea-to-pr`	legacy default	read
`archon-plan`	Plan	read
`archon-plan-to-pr`	legacy default	read
`archon-pr`	sdlc pack	read
`archon-review`	Review	read
`archon-smart-pr-review`	Smart review	read
`archon-validate-pr`	legacy default	read
`assist`	General assistance workflow	read
`assist-helper`	Substring match	read
`await-checks`	waits for checks	read
`bg-workflow`	background dispatch test workflow	read
`build`	Requires a worktree	read
`command-block`	Used only by runtime-width composition	read
`container-wait`	unsupported durable wait in container isolation	read
`custom-review`	Custom review	read
`deterministic-loop`	Terminates on until_bash alone	read
`edge-cases`	true	read
`existing-workflow`	An existing workflow	read
`feature-development`	Full feature development workflow	read
`figma-mcp-smoke`	Smoke test Figma MCP	read
`fix-bug`	Fix a bug in the codebase	read
`fix-issue`	Fix a GitHub issue	read
`gate-blk`	gate-blk	read
`gated`	frozen	read
`global-workflow`	Global workflow	read
`hello`	Say hello.	read
`implement`	Implement changes	read
`invalid-authored-outcome`	missing selected return node	read
`judgment-loop`	Terminates on a validated boolean	read
`leaky-block`	Must not bind parent state	read
`loop-command-fixture`	Iterates a command-file prompt until COMPLETE.	read
`loop-fixture`	Iterates until the work reports COMPLETE.	read
`loopy`	No description in the source	read
`mixed-fixture`	Classify, branch on the result, and finish.	read
`multiline`	No description in the source	read
`my-workflow`	test	read
`nested-block`	Nested command scan fixture	read
`other`	Other workflow	read
`parent`	Fans out a command-backed block	read
`quoting`	No description in the source	read
`read-error-block`	Matched command read errors must not fall through	read
`review-block`	frozen	read
`scalar-context`	Scalar context example	read
`scope-error-block`	Scope inspection errors must not fall through	read
`script-fixture`	Runs an inline TypeScript script via bun.	read
`short`	Short description	read
`some-workflow`	x	read
`test`	After	read
`test-wf`	Test	read
`test-workflow`	A test workflow	read
`triage`	Read-only triage	read
`w`	d	read
`wait-draft`	wait mode is selected before its value is entered	read
`wait-for-checks`	waits for an external signal	read
`wait-for-recovery`	waits for an operator action	read
`x`	y	read

Safer alternatives

Bun✓SAFE

carlosedp/mcp-bun

Bun Javascript Runtime MCP Server for AI Agents

11 writeGrade B

Search1API✓SAFE

fatwang2/search1api-mcp

Official Search1API MCP server for web search, news, crawling, sitemaps, and trends—hosted with OAuth 2.1 or local via npm.

5 readGrade B

Mcp-Use✓SAFE

mcp-use/mcp-use-ts

mcp-use is the framework for MCP with the best DX - Build AI agents, create MCP servers with UI widgets, and debug with built-in inspector. Includes client SDK, server SDK, React hooks, and powerful dev tools.

1 writeGrade B

Audit history

2026-09-20
✕BLOCK F 32 / 100
Source changed, verdict held · e047dfb1b6fe

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Archon MCP server

What is the Archon MCP server?

The first open-source harness builder for AI coding. Make AI coding deterministic and repeatable.

What tools does Archon expose?

69 in total: 64 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Archon safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (32/100) and found 12 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Archon need?

It reads ANTHROPIC_API_KEY, ANTHROPIC_OAUTH_TOKEN, ARCHON_CODEX_MCP_TOKEN, ARCHON_CODEX_MISSING_TOKEN, ARCHON_GIT_PASSWORD, ARCHON_PI_AUTH_PATH, ARCHON_WEB_AUTH_HEADER, AUTH_PASSWORD_HASH, AUTH_PORT, AUTH_USERNAME, AWS_ACCESS_KEY_ID and AWS_BEARER_TOKEN_BEDROCK from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (e047dfb1b6fe), read on 2026-09-20. The repository is watched and re-audited when it changes.

I already installed Archon. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

coleam00/archon on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit e047dfb1b6feObserved · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Archon MCP server?
GChatGPT CClaude PPerplexity
What tools does Archon expose?
GChatGPT CClaude PPerplexity
Is Archon safe to connect to an agent?
GChatGPT CClaude PPerplexity