Atlas / MCP servers / cronusl-1141 / AI Team OS

AI Team OSCAUTION

Name: AI Team OS
Author: cronusl-1141

mcp/cronusl-1141/ai-team-os

MCP server by cronusl-1141 · agent framework · agent orchestration · ai agents · Audited 2026-10-03

Multi-agent team operating system for Claude Code. 108 MCP tools, 40+ agent templates, 10 lifecycle hooks, 7 pipeline workflows. Persistent teams, structured meetings, task wall, real-time React dashboard. No LangChain/AutoGen — pure CC native integration.

Verdict

CAUTION

Grade

Trust score

46 /100

Exposed tools

116 81r · 33w · 2d

Transport

stdio · streamable-http

License

MIT

Stars

368

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English | 中文

Shared context, accountable work, native agents.

AI Team OS is a shared operating layer for Claude Code and Codex. Keep tasks, project memory, reports and team messages in one place, and follow work across sessions in one Dashboard. Each host keeps its native agent tools; the OS provides the durable record that makes their work understandable and reusable.

🤝 Codex is supported. Use Codex or Claude Code on its own, or connect both to the same OS task wall, project memory, reports, channels and Dashboard. Codex uses its own MCP and hook configuration; native agent tools, host settings and hook trust remain separate. See the installation and capability sections below for the per-host setup and boundaries.

⚡ v1.15.0 - One notice channel, sturdier hooks. Things OS needs you to know or do now come from one bilingual ledger, shown at session start, on your next message or when a turn ends, and each host hears only about its own install. Failed hook deliveries are counted and resent by later hooks, text meant for other agents is checked when it is written, and one shared digest leads the task wall. Codex users need to update the adapter once by hand; see the changelog. Full version history: CHANGELOG.md

[](https://python.org) [](LICENSE) [](https://fastapi.tiangolo.com) [](https://react.dev) [![MCP](https://img.shields.io/badge/M

Read from source at commit b34bd1e1f63fOBSERVED · 2026-10-03

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add dashboard --env API_KEY=${API_KEY} --env ECOSYSTEM_KEYWORDS=${ECOSYSTEM_KEYWORDS} --env MCP_PRIVATE_TEST_SECRET=${MCP_PRIVATE_TEST_SECRET} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "dashboard": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "ECOSYSTEM_KEYWORDS": "${ECOSYSTEM_KEYWORDS}",
        "MCP_PRIVATE_TEST_SECRET": "${MCP_PRIVATE_TEST_SECRET}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (116)

81 read · 33 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`agent_activity_query`	read	Query Agent activity records for a team.
`agent_list`	read	List a team
`agent_reuse_recommend`	read	Recommend whether to reuse an existing sub-agent for a follow-up task.
`agent_template_list`	read	List every Agent template CC can actually resolve.
`agent_template_recommend`	read	Recommend Agent templates — and, for a known project type, a team shape.
`agent_update_status`	write	Update an Agent
`briefing_add`	write	Park a decision for the user while the user is NOT in the conversation.
`briefing_dismiss`	read	Dismiss a Leader Briefing item (no action needed).
`briefing_list`	read	List Leader Briefing items. Default shows pending items for user review.
`briefing_resolve`	read	Record the user
`channel_mentions`	read	Get channel messages that mention a specific agent.
`channel_read`	read	Read messages from a channel.
`channel_read_ack`	read	把某频道的已读水位推进到你实际读到的那一条,清掉对应未读。
`channel_send`	write	Send a message to a channel.
`channel_unread`	read	某读者在某项目下的逐频道未读计数(谁在叫你、有几条、最新一条讲什么)。
`channel_wait`	read	等待指定对端的新消息:先补读,随后以 WebSocket 等待,不轮询模型。
`context_resolve`	read	Get the current active OS context — active project, active teams, member list.
`debate_code_review`	write	Start a debate-style code review for a specific file or change.
`debate_start`	write	Start a structured 4-round debate meeting between an Advocate and a Critic.
`decision_log`	read	Query team decision log — task assignments, approach selections, Agent scheduling decisions.
`diagnose_task_failure`	read	Auto-diagnose why a task failed and suggest fixes.
`dismiss_project_registration`	read	Mark current cwd as dismissed for project registration — won
`ecosystem_apply_architecture_md`	write	Stage 1 writeback — submit architecture_md OR report failure.
`ecosystem_apply_debate_result`	write	Stage 2 writeback — submit debate conclusion to advance to ``debated``.
`ecosystem_apply_quality_review`	write	Submit quality review result and release the claim lock.
`ecosystem_apply_shallow_summary`	write	Stage 0 worker callback: write back a shallow summary OR report a failure.
`ecosystem_claim_review`	read	Claim the next shallow_done repo for quality review.
`ecosystem_claim_shallow`	read	Claim the next queued repo for shallow scanning (stage_status=
`ecosystem_deep_review_cancel`	read	Cancel an in-flight (stage_status=
`ecosystem_deep_review_list`	read	List deep-reviews newest-first, optionally filtered by status.
`ecosystem_deep_review_request`	read	Queue a deep-review for a repo and return the dispatch prompt.
`ecosystem_deep_review_request_batch`	read	Stage 1 — Queue architecture-analysis dispatches for tag-filtered candidates.
`ecosystem_deep_review_status`	read	Look up the most recent deep-review for ``repo_id``.
`ecosystem_diff_period`	read	Return a time-period diff computed dynamically from the per-repo event log.
`ecosystem_index_diff_latest`	read	Fetch the latest IndexDiff snapshot for the current project.
`ecosystem_index_update`	write	Trigger ecosystem index update — runs scanner + computes diff.
`ecosystem_link_debate_meeting`	read	Stage 2 helper — link ``debate_start`` meeting id back to review rows.
`ecosystem_link_integration_task`	read	Stage 3 helper — link integration task id back to review row.
`ecosystem_mark_as_reference`	write	Stage 3 reference path — add ``lifecycle:reference`` tag + advance to ``referenced``.
`ecosystem_quick_setup`	read	Record data-source and scan-profile rows for the project.
`ecosystem_rebuild_queries_from_repos`	read	Return a recap of all search queries that have discovered repos in this project.
`ecosystem_refresh`	read	On-demand incremental refresh of the project
`ecosystem_release_claim`	read	Release a worker claim without submitting a quality review.
`ecosystem_repo_events`	read	Return event history for a single ecosystem repo.
`ecosystem_repo_get`	read	Get holistic detail of an ecosystem repo (profile + tags + deep_reviews + relations + scan_run).
`ecosystem_repo_manual_status`	destructive	Set (or clear) the human override on a repo
`ecosystem_repo_tags`	read	List all tags currently associated with a single ecosystem repo.
`ecosystem_scan`	write	Scan popular Claude ecosystem repos (>=min_stars) and update ecosystem_repo_profiles.
`ecosystem_scan_history`	read	List recent scan runs ordered by started_at descending.
`ecosystem_scan_periodic`	write	Run an incremental or full ecosystem scan via the scanner service.
`ecosystem_scan_status`	read	Fetch a single EcosystemScanRun by id.
`ecosystem_search`	read	Query the project
`ecosystem_search_by_capability`	read	Search ecosystem repos by capability tags (reverse lookup from tag → repo).
`ecosystem_shallow_queue_status`	read	Show Stage 0 shallow-scan queue status for the active project.
`ecosystem_start_integration`	write	Stage 3 integrate path — build a task_create payload + tag the repo.
`ecosystem_summary_by_tag`	read	List every repo carrying ``tag`` as a markdown table.
`ecosystem_summary_health`	read	Platform self-check markdown: profile / scan / tag coverage / archive ratio.
`ecosystem_summary_top_n`	read	Top-N markdown table of ecosystem repos.
`ecosystem_summary_weekly`	read	Generate the past-N-days ecosystem briefing as markdown.
`ecosystem_tag_apply_batch`	write	Apply Layer 1 + Layer 2 auto-tagging to a batch of ecosystem repos.
`ecosystem_tag_apply_llm_result`	write	Submit Layer 3 LLM tagging result from a sub-agent.
`ecosystem_tag_dispatch_llm`	read	Build a Layer 3 sub-agent dispatch plan for repos that need LLM fallback.
`ecosystem_tag_list`	read	List ecosystem tag dictionary entries.
`ecosystem_trigger_debate`	write	Stage 2 — Build debate dispatch payload (Leader still calls debate_start).
`event_list`	read	List recent events in the system, optionally filtered.
`failure_analysis`	read	Record a failed task as a templated lesson entry (failure alchemy).
`find_skill`	read	Find ecosystem skills/plugins using a 3-layer progressive loading system.
`fleet_dispatch`	read	Dispatch an operational instruction to another ship (CC session) in the fleet.
`link_query`	read	Query cross-domain reference edges for an object (who references it / what it references).
`link_trace`	read	Trace the reference neighborhood of an object (undirected fanout, depth <= 2).
`meeting_attendance_check`	read	Check which expected participants have spoken in the current round.
`meeting_conclude`	read	Conclude a meeting, marking it as completed.
`meeting_create`	write	Create a team meeting and return a ready-to-use dispatch_plan for spawning participant Agents.
`meeting_list`	read	List meetings for a team, optionally filtered by status.
`meeting_read_messages`	read	Read a meeting
`meeting_send_message`	write	Send a discussion message in a meeting.
`meeting_template_list`	read	List available meeting templates and their round structures.
`meeting_update`	write	Update a meeting
`memory_add`	write	Add a direction-layer memory — the team
`memory_invalidate`	read	Invalidate a direction-layer memory — mark it invalid without deleting.
`memory_list`	read	List direction-layer memories — valid entries by default, grouped by kind.
`memory_reconcile_apply`	write	按需整理·应用:批量执行 LLM 精判确认后的操作(确定性,幂等)。
`memory_reconcile_candidates`	read	按需整理·粗筛:返回情景层候选组 + 方向层清单 + 蒸馏素材 + 操作说明。
`memory_search`	read	Search memory entries within one scope, ranked by BM25.
`model_config_get`	read	Get model governance state: available models (auto-discovered from
`model_config_set`	write	Set the default startup model for new CC sessions (writes the
`notice_dismiss`	write	Stop showing one notice: for good, or for a number of hours.
`notice_list`	read	List the notices OS shows the user (the
`os_config_change`	read	Change the user
`os_health_check`	read	Check the health status of the AI Team OS API service.
`os_restart_api`	write	Restart the AI Team OS FastAPI process safely (standardized restart flow).
`project_create`	write	Create a new project with a default Phase automatically created.
`project_delete`	destructive	Delete a project and everything filed under it. Irreversible.
`project_list`	read	List all projects in the system.
`project_summary`	read	Get a quick project summary: status (active/inactive), teams, top tasks.
`project_update`	write	Update a project
`prompt_effectiveness`	read	Return effectiveness statistics for Agent templates.
`report_list`	read	List saved reports, optionally filtered by author, topic, or type.
`report_read`	read	Read the full content of a saved report by ID.
`report_save`	write	Save a research/analysis report to the database.
`task_create`	write	Create a new task in a project (not bound to a team).
`task_execution_trace`	read	Get a task
`task_list_project`	read	Get the task wall — project-scoped by default, team-scoped on request.
`task_memo_add`	write	Add a memo record to a task — for tracking progress, recording decisions, marking issues.
`task_memo_read`	read	Read all memo records for a task — read before picking up a task to understand historical progress.
`task_run`	write	Put a task on a team
`task_status`	read	Get one task
`task_update`	write	Update a task
`team_list`	read	List teams — active ones by default, newest first.
`team_status`	read	Get a team
`unified_search`	read	Search across all OS knowledge: task memos, reports, and tasks.
`usage_attribution`	read	Report token usage together with how much of it can actually be accounted for.
`verify_completion`	read	Verify whether a task is truly complete.
`workflow_get`	write	Get a Workflow run
`workflow_list`	read	List CC ultracode/Workflow runs tracked by the OS observability layer.
`workflow_reconcile`	read	Reconcile finished Workflow runs from disk into the OS (repair after OS was offline).

Trust audit

CAUTIONgrade F · trust 46/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (7 observation(s))
Network: declared (9 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found

Findings (25)

MEDIUMInsecure crypto · crypto.weak_random · CWE-327, CWE-338

scripts/bench_ecosystem_search.py:139

kw = random.choice(keywords)

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

scripts/codex_adapter.py:876

print(f"MCP helper 路径不存在: {token}")

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

src/aiteam/memory/content_safety.py:77

"system prompt exfiltration (en)",

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

src/aiteam/memory/content_safety.py:87

"system prompt exfiltration (zh)",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/unit/test_codex_send_event.py:312

secret = "/Users/private/secret"

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

tests/unit/test_memory_content_safety.py:81

"-----BEGIN RSA PRIVATE KEY-----",

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

ecosystem_repo_manual_status, project_delete

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.mcp.json.example

.mcp.json.example

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/unit/test_permission_denied_recovery.py:19

return importlib.import_module(mod_name)