Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

PromptX MCP server

by deepractice/promptxMIT licenceAudited 22 Sep 2026 · source d9f54f4d94e5

npm @agentxjs/runtime 2.0.2stdiostreamable-http★ 3,688
✕BLOCKGrade F · 53/100 · 22 Sep 2026 · d9f54f4
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (53/100). It exposes 57 tools: 52 read, 4 write and 1 destructive. The audit recorded 40 findings (0 critical, 5 high, 3 medium, 27 low). Maintainer's description: PromptX · 领先的AI 智能体上下文平台 | PromptX · Leading AI Agent Context Platform

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “PromptX MCP server (deepractice/promptx)”. Retrieved 22 Sep 2026. https://modelsatlas.com/mcp/deepractice/promptx

Why this is BLOCK. The audit found 0 critical and 5 high findings; the most severe is Code injection at packages/mcp-server/src/tools/toolx.ts:101. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 22 Sep 2026

Trust score53/100✕BLOCK F
0 critical5 high3 medium27 low5 info

40 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared10 observations
  • NetworkDeclared6 observations
  • ShellDeclared10 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (40)

Sorted by severity · the 25 most severe of 40 are listed

HIGHCode injectioncode.deserialize · packages/mcp-server/src/tools/toolx.ts:101
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const config = yaml.load(yamlInput) as any;
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
HIGHCode injectioncode.eval_exec · packages/core/src/project/ProjectDiscovery.js:263
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
new Function(trimmedContent)
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · packages/core/src/resource/discovery/FilePatternDiscovery.js:314
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
new Function(content)
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · packages/core/src/resource/protocols/ToolProtocol.js:70
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
new Function(content);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · packages/core/src/toolx/ToolLoggerQuery.js:50
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
data = eval(`(${dataMatch[2]})`);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
MEDIUMInventory / provenanceinv.binary · apps/desktop/assets/icons/icon.icns
F-13 Inventory / provenanceCWE-1104Layer L0
icon.icns
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMObfuscation / stealthobf.zero_width · packages/core/src/toolx/errors/ErrorCategories.js:14
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
emoji: '👨💻',
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
delete_workspace_item
Why
1 tool(s) can delete or overwrite
Fix
prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenanceinv.hidden_file · .actrc
F-13 Inventory / provenanceCWE-1104Layer L0
.actrc
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .eslintrc.js
F-13 Inventory / provenanceCWE-1104Layer L0
.eslintrc.js
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .versionrc.json
F-13 Inventory / provenanceCWE-1104Layer L0
.versionrc.json
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · apps/desktop/.eslintrc.cjs
F-13 Inventory / provenanceCWE-1104Layer L0
.eslintrc.cjs
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInsecure cryptocrypto.weak_hash · packages/core/src/project/ProjectManager.js:449
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return crypto.createHash('md5').update(path.resolve(projectPath)).digest('hex').substr(0, 8)
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · packages/core/src/resource/protocols/ProjectProtocol.js:176
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return crypto.createHash('md5').update(path.resolve(projectPath)).digest('hex').substr(0, 8)
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · packages/resource/resources/tool/pdf-reader/pdf-reader.tool.js:198
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
const hash = crypto.createHash('md5');
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · packages/resource/resources/tool/word-tool/word-tool.tool.js:307
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
const hash = crypto.createHash('md5');
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · apps/desktop/electron.vite.config.ts:51
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const esbuildBin = resolve(__dirname, '../../node_modules/.bin/esbuild')
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · apps/desktop/src/main/i18n/index.ts:65
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
translationsDir = path.join(__dirname, '../../src/main/i18n');
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · apps/desktop/src/main/services/AgentXService.ts:395
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const devPath = path.join(__dirname, '../../../../packages/mcp-office/dist/index.js')
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · apps/desktop/src/main/services/AgentXService.ts:406
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const nodeModulesPath = path.join(__dirname, '../../../node_modules/@promptx/mcp-office/dist/index.js')
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · apps/desktop/src/main/services/AgentXService.ts:424
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const devPath = path.join(__dirname, '../../../../packages/mcp-workspace/dist/mcp-server.js')
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:118
F-04 Network egressCWE-200 · CWE-319Layer L1
"url": "http://127.0.0.1:5203/mcp"
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:133
F-04 Network egressCWE-200 · CWE-319Layer L1
"url": "http://127.0.0.1:5203/mcp"
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.zh-Hans.md:116
F-04 Network egressCWE-200 · CWE-319Layer L1
"url": "http://127.0.0.1:5203/mcp"
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.zh-Hans.md:131
F-04 Network egressCWE-200 · CWE-319Layer L1
"url": "http://127.0.0.1:5203/mcp"
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

57 declared in source · 1 destructive

52 read4 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

ToolWhat it doesRisk
delete_workspace_item删除工作区中的文件或目录。 目录会被递归删除。不能删除工作区根目录。 路径必须在已绑定的工作区范围内。 ⚠️ 此操作不可逆,请确认后再调用。destructive
DummyDriverPlaceholder driver for push-based event handlingwrite
create_workspace_directory在工作区中创建目录(支持递归创建)。 路径必须在已绑定的工作区范围内。write
rememberSave knowledge to a rolewrite
write_workspace_file在工作区中创建或覆盖写入文件。 如果父目录不存在会自动递归创建。 路径必须在已绑定的工作区范围内。 ⚠️ 会覆盖已有文件内容,请谨慎使用。write
Balanced平衡模式,系统默认行为read
Creative创造性探索模式,广泛联想,发现远距离连接read
Focused聚焦检索模式,精确查找,优先常用记忆read
concurrent-toolConcurrent toolread
discoverDiscover available AI roles and tools ## What It Does Lists all activatable roles and callable tools, grouped by source: - **📦 System**: Built-in PromptX roles/tools - **🏗️ Project**: Project-specific (requires \read
example-tool示例工具read
excel-toolExcel文件读写操作工具read
execution执行模式资源协议read
file文件系统协议,提供本地文件访问read
filesystem文件系统操作工具,提供读写、搜索、编辑等功能read
http-test-toolTest tool for HTTPread
inputTest inputread
knowledge知识资源协议read
learnLoad and learn PromptX resources by protocol URL ## What It Does Unified entry point for loading professional resources: role definitions, thinking models, execution skills, knowledge bases, tool manuals, and more. ## When to Use - Need to use a tool but donread
list_workspace_directory列出工作区中某个目录的内容。 返回文件和子目录列表(名称、绝对路径、大小、修改时间)。 自动跳过隐藏文件和 node_modules 等常见忽略目录。 路径必须在已绑定的工作区范围内。read
list_workspaces获取用户绑定的工作区文件夹列表。 返回每个工作区的 id、名称和绝对路径。 调用此工具后,可以使用 list_workspace_directory 浏览具体目录。read
list_xlsx_sheetsList all sheet names in an Excel fileread
manualManual资源协议 - 加载工具使用手册和说明文档read
pdf-readerPDF分页阅读工具,支持按页码提取文本和图片read
project项目协议,基于当前项目状态的高性能路径解析read
promptPromptX内置提示词资源协议read
read_docxRead content from a Microsoft Word document (.docx file). Returns the text content of the document.read
read_pdfRead text content from a PDF file. Returns the extracted text from all pages.read
read_pptxRead content from a Microsoft PowerPoint presentation (.pptx file). Returns the text content from all slides.read
read_workspace_file读取工作区中某个文件的文本内容。 支持 UTF-8 编码的文本文件。二进制文件(图片、压缩包等)不支持。 大文件自动截断:最多读取前 512KB / 5000 行。 路径必须在已绑定的工作区范围内。read
read_xlsxRead content from a Microsoft Excel spreadsheet (.xlsx or .xls file). Returns the data as formatted text or JSON.read
recallRetrieve memories from a roleread
roleAI角色资源协议read
role-creator角色资源CRUD操作工具,简化角色创作流程read
slow-toolSlow toolread
stdio-test-toolTest tool for stdioread
testtestread
thought思维模式资源协议read
toolTool资源协议 - 加载可执行的JavaScript工具read
tool-creator工具资源CRUD和验证工具,简化工具开发流程read
toolx使用ToolSandbox执行通过@tool协议声明的工具read
tracking-toolTracking toolread
user用户目录协议,直接映射到用户主目录read
very-slow-toolVery slow toolread
word-toolWord文档读写修改工具read
保存洞察将重要洞察保存为记忆read
应用记忆检索相关经验read
数据库报表工具连接数据库生成报表,支持dry-run测试read
查看使用帮助重新学习命令使用方法read
查看可用角色返回角色选择页面read
查看角色查看可用角色列表read
查看角色列表选择其他角色read
检索记忆检索相关记忆支持思考read
激活角色激活完整角色能力read
生成学习计划为特定角色生成学习计划read
继续学习学习其他资源read
继续思考基于生成的prompt继续深化思考read

Safer alternatives

We could not match this server to a job, so we cannot suggest a like-for-like alternative. Read-only servers are the least-privilege place to start.

Audit history

  1. ✕BLOCK F 53 / 100

    Source changed, verdict held · d9f54f4d94e5

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about PromptX MCP server

What is the PromptX MCP server?
PromptX · 领先的AI 智能体上下文平台 | PromptX · Leading AI Agent Context Platform
What tools does PromptX expose?
57 in total: 52 read-only, 4 that write, and 1 that can delete or overwrite (delete_workspace_item). Every one is listed on this page with its risk.
Is PromptX safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (53/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does PromptX need?
No credential environment variables were found in its source, so it appears to need none.
How does PromptX run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @agentxjs/runtime at 2.0.2.
How current is this page?
The grade is for one exact copy of the source (d9f54f4d94e5), read on 2026-09-22. The repository is watched and re-audited when it changes.
I already installed PromptX. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • deepractice/promptx on GitHub — the source we read, its licence, stars and activityObserved · 22 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit d9f54f4d94e5Observed · 22 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.