delimit-cliBLOCK
Building your AI organization: shared records and handoffs, plus a merge gate for AI-written code with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Keep the state. Change the model.
Keep decisions, records, and handoffs across Claude Code, Codex, Cursor, Antigravity, GitHub Copilot, and Muse. Bring configured models together for hard calls. For code repositories, Delimit also offers a merge gate and local signed attestations.
[](https://www.npmjs.com/package/delimit-cli) [](https://github.com/marketplace/actions/delimit-merge-gate-for-ai-written-code) [](https://opensource.org/licenses/MIT) [](https://glama.ai/mcp/servers/delimit-ai/delimit-mcp-server/score)
Glama directory grades: License A · Quality A · Maintenance A. Observed September 15, 2026, for this public repository. View the listing.
$ delimit wrap -- claude "fix the flaky test in tests/api.spec.ts" ✓ repo_diagnose ✓ security_audit 0 critical · 0 secrets ✓ test_smoke 165/165 ✓ changed_files 1 ✓ attestation signed att_a05050eb8e13277e delimit.attestation.v1 · HMAC-SHA256 receipt → .delimit/attestations/att_a05050eb8e13277e.json
Every wrapped run emits a local delimit.attestation.v1 bundle: repo head before/after, changed files, gate results, and an HMAC-SHA256 signature. Verify it offline with delimit seal-verify; hosted replay is not available yet. Advisory by default; flip to enforcing when you're ready.
Fastest path to value: delimit check
Zero-config PR safety gate. No init, no setup, no account, no keys — run it on any repo and it applies deterministic checks (breaking API changes + leaked secrets) to your staged or modified files.
npx delimit-cli check
$ deli
ad21df6adee0OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add delimit-cli -- npx -y [email protected]
Exposed tools (66)
55 read · 10 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
delimit_agent_dashboard | read | View the multi-agent orchestration dashboard. |
delimit_agent_poll | read | Read a tracked worker |
delimit_agent_status | read | Check status of dispatched agent tasks. |
delimit_config_export | read | Export the current governance config as a shareable JSON bundle. |
delimit_content_intel_weekly | write | Run the weekly content intelligence summary (LED-797). |
delimit_content_publish | write | Manually trigger a content publish (tweet, YouTube video, or report) (Pro). |
delimit_content_schedule | write | View the upcoming content schedule (queued + pending + recent). |
delimit_context_init | read | Initialize a context filesystem namespace for a venture (STR-048). |
delimit_context_list | read | List all artifacts in a venture |
delimit_corp_dashboard | write | One-call corp status — replaces the 6-call session-start ritual (LED-189). |
delimit_cost_analyze | read | Analyze a project for cost drivers (Dockerfile, deps, cloud) (Pro). |
delimit_cost_optimize | read | Find cost optimization opportunities in a project (Pro). |
delimit_daemon_classify | read | Classify a ledger item |
delimit_daemon_status | read | Report the autonomous daemon |
delimit_data_backup | read | Back up SQLite and JSON data files to ~/.delimit/backups/. |
delimit_data_migrate | read | Inspect migration files (alembic / Django / Prisma / Knex) for status. |
delimit_data_validate | read | Validate data files: JSON parse, CSV shape, SQLite integrity. |
delimit_deliberation_status | read | Check deliberation usage and mode (hosted free tier vs BYOK). |
delimit_docs_generate | read | Generate a markdown API reference from source docstrings/JSDoc. |
delimit_docs_validate | read | Validate documentation quality and completeness. |
delimit_drift_history | read | List recent drift-check results from the drift monitor. |
delimit_gov_health | read | Report whether the governance kernel and policy are reachable. |
delimit_gov_policy | read | Read the active governance policy for a repository (Pro). |
delimit_gov_status | read | Report governance state (open tasks, decisions) for a repo. |
delimit_handoff_preflight | read | Validate cross-agent handoff invariants before switching coding agents (LED-1710). |
delimit_heartbeat_check | read | Walk the heartbeat directory and report which scheduled services are stale (LED-1412). |
delimit_help | read | Get help for a Delimit tool — purpose, parameters, examples. |
delimit_inbox_daemon | read | Control the inbox polling daemon for email governance (Pro). |
delimit_intel_dataset_freeze | read | Freeze a dataset to make it immutable for replay integrity. |
delimit_intel_dataset_list | read | List all datasets in the intel registry. |
delimit_ledger_context | read | Quick summary of what |
delimit_license_status | read | Report the current Delimit license tier, validity, and expiry. |
delimit_loop_status | read | Check autonomous loop metrics for a session. |
delimit_memory_recent | read | Return the most recent memory entries (Free tier). |
delimit_obs_status | read | Return a high-level health rollup from the observability layer (Pro). |
delimit_os_gates | read | Check governance gates for an OS plan (Pro). |
delimit_os_status | read | Report overall Delimit platform status (plans, tasks, tokens) (Pro). |
delimit_outreach_loop_tick | write | Run one tick of the autonomous github-outreach loop (LED-2214b). |
delimit_quickstart | write | 60-second guided quickstart for a new install. |
delimit_reddit_fetch_thread | read | Fetch and score a single Reddit thread by id or URL. |
delimit_release_status | read | Report the active release version for a whole environment (Pro). |
delimit_release_sync | write | Audit or report config of public surfaces for consistency (Pro). |
delimit_repo_analyze | read | Analyze repository structure and quality (experimental). |
delimit_repo_config_audit | read | Audit repository configuration for compliance (experimental). |
delimit_repo_config_validate | read | Validate repository configuration files (experimental). |
delimit_repo_diagnose | read | Diagnose repository health issues (experimental) (Pro). |
delimit_resource_drivers | read | List available data plane drivers and their resource schemas. |
delimit_scan | read | Scan a project and report what Delimit can do for it. |
delimit_secret_access_log | read | Show the audit log of secret accesses. |
delimit_secret_list | read | List secrets in the broker (metadata only — never values). |
delimit_secret_revoke | destructive | Revoke a secret to prevent any future access. |
delimit_security_scan | read | Scan a repository for security vulnerabilities. |
delimit_self_repair_daemon | read | Control the self-repair watcher daemon (LED-191, internal). |
delimit_social_accounts | read | List configured social media accounts. |
delimit_social_daemon | read | Control the social sensing daemon (Pro). |
delimit_social_generate | write | Generate a social media post draft (no posting) (Pro). |
delimit_spec_health | read | Score an OpenAPI spec on quality dimensions (0-100, A-F grade). |
delimit_substantive_content_check | write | Pre-submit gate for autonomous github outreach (LED-2214b). |
delimit_vault_health | read | Report vault subsystem health (Pro). |
delimit_vault_search | read | Search vault entries by query string (Pro). |
delimit_vault_snapshot | read | Capture a snapshot of vault state (Pro). |
delimit_vendor_news_health | read | Health check for the vendor-news riff system (LED-1253). |
delimit_vendor_news_scan | read | Scan watchlisted vendor accounts and auto-draft riffs (Pro) (LED-1253). |
delimit_ventures | read | List all registered ventures (auto-registered project directories). |
delimit_version | read | Return Delimit server version, tool count, and environment status. |
forbidden_write_tool | write | A synthetic tool the adapter must never advertise or invoke. |
Trust audit
BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (18 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (19 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const policyContent = yaml.load(fs.readFileSync(policyPath, 'utf-8')); // nosec B-yaml_unsafe_load: parses user-local policy YAML; trusted input
const policy = yaml.load(fs.readFileSync(policyPath, 'utf8')); // nosec B-yaml_unsafe_load: parses user-local .delimit/ YAML; trusted input
policy = yaml.load(fs.readFileSync(policyPath, 'utf8')); // nosec B-yaml_unsafe_load: parses user-local .delimit/ YAML; trusted input
const parsed = specPath.endsWith('.json') ? JSON.parse(content) : yaml.load(content); // nosec B-yaml_unsafe_load: parses user-local .delimit/ YAML; trusted inputpolicy: yaml.load(fs.readFileSync(userPolicyPath, 'utf8')), // nosec B-yaml_unsafe_load: parses agent-config YAML authored by the user locally
"eval_usage": (r"\beval\s*\(", "Use of eval() — potential code injection", "high"), # nosec B-eval_usage: regex-pattern DEFINITION string (not runtime eval)"exec_usage": (r"\bexec\s*\(", "Use of exec() — potential code injection", "high"), # nosec B-exec_usage: regex-pattern DEFINITION string (not runtime exec)SENSITIVE = ["/etc/", "/.ssh/", "/.aws/", "/credentials/", "/.env"]
const sensitivePaths = ['/etc/', '/.ssh/', '/.aws/', '/credentials/'];
'/.ssh/',
process.env.HOME + '/.ssh/',
'/.aws/',
- **LED-305**: [P0] [SYSTEM] Fix [email protected] IMAP/SMTP authentication failure
accept-packed-artifact.cpython-310.pyc
mod = importlib.import_module(import_name)
mod = importlib.import_module(import_name)
__import__(pkg)
mod = importlib.import_module(f"{pkg}.server")mod = importlib.import_module(f"{pkg}.server")console.log(chalk.red(` Secret "${name}" not found.`));console.log(chalk.red(` Failed to read secret "${name}".`));(r"send\s+(all|this|the)\s+(the\s+)?data\s+to", "data exfiltration"),
const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`;const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`;const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`;Gates applied: no_behavioural_pass.
ad21df6adee0full audit observations/trust-audit/mcp-server/delimit-ai__delimit-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | ad21df6adee0 | BLOCK | F | 38 | first audit |
Questions
What is the delimit-cli MCP server?
Building your AI organization: shared records and handoffs, plus a merge gate for AI-written code with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.
What tools does delimit-cli expose?
66 in total: 55 read-only, 10 that write, and 1 that can delete or overwrite (delimit_secret_revoke). Every one is listed on this page with its risk.
Is delimit-cli safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (38/100) and found 13 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does delimit-cli need?
It reads ANTHROPIC_API_KEY, CHATOPS_AUTH_TOKEN, DELIMIT_AUTH_TOKEN, DELIMIT_INTERNAL_BRIDGE_TOKEN, DELIMIT_SECRETS_SCOPE_FAILCLOSED, DELIMIT_SMTP_PASS, DELIMIT_TELEGRAM_BOT_TOKEN, DELIMIT_X_USAGE_SECRET, DEV_TO_API_KEY, GOOGLE_APPLICATION_CREDENTIALS, OPENAI_API_KEY and RAPIDAPI_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does delimit-cli run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as delimit-cli at 4.21.0.
How current is this page?
The grade is for one exact copy of the source (ad21df6adee0), read on 2026-10-11. The repository is watched and re-audited when it changes.