Atlas / MCP servers / delimit-ai / delimit-cli

delimit-cliBLOCK

mcp/delimit-ai/delimit-mcp-server

Building your AI organization: shared records and handoffs, plus a merge gate for AI-written code with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.

Verdict
BLOCK
Grade
F
Trust score
38 /100
Exposed tools
66 55r · 10w · 1d
Transport
stdio
License
MIT
Stars
24
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Keep the state. Change the model.

Keep decisions, records, and handoffs across Claude Code, Codex, Cursor, Antigravity, GitHub Copilot, and Muse. Bring configured models together for hard calls. For code repositories, Delimit also offers a merge gate and local signed attestations.

[](https://www.npmjs.com/package/delimit-cli) [](https://github.com/marketplace/actions/delimit-merge-gate-for-ai-written-code) [](https://opensource.org/licenses/MIT) [](https://glama.ai/mcp/servers/delimit-ai/delimit-mcp-server/score)

Glama directory grades: License A · Quality A · Maintenance A. Observed September 15, 2026, for this public repository. View the listing.

$ delimit wrap -- claude "fix the flaky test in tests/api.spec.ts"

✓ repo_diagnose
✓ security_audit       0 critical · 0 secrets
✓ test_smoke           165/165
✓ changed_files        1
✓ attestation signed   att_a05050eb8e13277e
delimit.attestation.v1 · HMAC-SHA256
receipt → .delimit/attestations/att_a05050eb8e13277e.json

Every wrapped run emits a local delimit.attestation.v1 bundle: repo head before/after, changed files, gate results, and an HMAC-SHA256 signature. Verify it offline with delimit seal-verify; hosted replay is not available yet. Advisory by default; flip to enforcing when you're ready.

Fastest path to value: delimit check

Zero-config PR safety gate. No init, no setup, no account, no keys — run it on any repo and it applies deterministic checks (breaking API changes + leaked secrets) to your staged or modified files.

npx delimit-cli check
$ deli
Read from source at commit ad21df6adee0OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add delimit-cli -- npx -y [email protected]
03

Exposed tools (66)

55 read · 10 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
delimit_agent_dashboardreadView the multi-agent orchestration dashboard.
delimit_agent_pollreadRead a tracked worker
delimit_agent_statusreadCheck status of dispatched agent tasks.
delimit_config_exportreadExport the current governance config as a shareable JSON bundle.
delimit_content_intel_weeklywriteRun the weekly content intelligence summary (LED-797).
delimit_content_publishwriteManually trigger a content publish (tweet, YouTube video, or report) (Pro).
delimit_content_schedulewriteView the upcoming content schedule (queued + pending + recent).
delimit_context_initreadInitialize a context filesystem namespace for a venture (STR-048).
delimit_context_listreadList all artifacts in a venture
delimit_corp_dashboardwriteOne-call corp status — replaces the 6-call session-start ritual (LED-189).
delimit_cost_analyzereadAnalyze a project for cost drivers (Dockerfile, deps, cloud) (Pro).
delimit_cost_optimizereadFind cost optimization opportunities in a project (Pro).
delimit_daemon_classifyreadClassify a ledger item
delimit_daemon_statusreadReport the autonomous daemon
delimit_data_backupreadBack up SQLite and JSON data files to ~/.delimit/backups/.
delimit_data_migratereadInspect migration files (alembic / Django / Prisma / Knex) for status.
delimit_data_validatereadValidate data files: JSON parse, CSV shape, SQLite integrity.
delimit_deliberation_statusreadCheck deliberation usage and mode (hosted free tier vs BYOK).
delimit_docs_generatereadGenerate a markdown API reference from source docstrings/JSDoc.
delimit_docs_validatereadValidate documentation quality and completeness.
delimit_drift_historyreadList recent drift-check results from the drift monitor.
delimit_gov_healthreadReport whether the governance kernel and policy are reachable.
delimit_gov_policyreadRead the active governance policy for a repository (Pro).
delimit_gov_statusreadReport governance state (open tasks, decisions) for a repo.
delimit_handoff_preflightreadValidate cross-agent handoff invariants before switching coding agents (LED-1710).
delimit_heartbeat_checkreadWalk the heartbeat directory and report which scheduled services are stale (LED-1412).
delimit_helpreadGet help for a Delimit tool — purpose, parameters, examples.
delimit_inbox_daemonreadControl the inbox polling daemon for email governance (Pro).
delimit_intel_dataset_freezereadFreeze a dataset to make it immutable for replay integrity.
delimit_intel_dataset_listreadList all datasets in the intel registry.
delimit_ledger_contextreadQuick summary of what
delimit_license_statusreadReport the current Delimit license tier, validity, and expiry.
delimit_loop_statusreadCheck autonomous loop metrics for a session.
delimit_memory_recentreadReturn the most recent memory entries (Free tier).
delimit_obs_statusreadReturn a high-level health rollup from the observability layer (Pro).
delimit_os_gatesreadCheck governance gates for an OS plan (Pro).
delimit_os_statusreadReport overall Delimit platform status (plans, tasks, tokens) (Pro).
delimit_outreach_loop_tickwriteRun one tick of the autonomous github-outreach loop (LED-2214b).
delimit_quickstartwrite60-second guided quickstart for a new install.
delimit_reddit_fetch_threadreadFetch and score a single Reddit thread by id or URL.
delimit_release_statusreadReport the active release version for a whole environment (Pro).
delimit_release_syncwriteAudit or report config of public surfaces for consistency (Pro).
delimit_repo_analyzereadAnalyze repository structure and quality (experimental).
delimit_repo_config_auditreadAudit repository configuration for compliance (experimental).
delimit_repo_config_validatereadValidate repository configuration files (experimental).
delimit_repo_diagnosereadDiagnose repository health issues (experimental) (Pro).
delimit_resource_driversreadList available data plane drivers and their resource schemas.
delimit_scanreadScan a project and report what Delimit can do for it.
delimit_secret_access_logreadShow the audit log of secret accesses.
delimit_secret_listreadList secrets in the broker (metadata only — never values).
delimit_secret_revokedestructiveRevoke a secret to prevent any future access.
delimit_security_scanreadScan a repository for security vulnerabilities.
delimit_self_repair_daemonreadControl the self-repair watcher daemon (LED-191, internal).
delimit_social_accountsreadList configured social media accounts.
delimit_social_daemonreadControl the social sensing daemon (Pro).
delimit_social_generatewriteGenerate a social media post draft (no posting) (Pro).
delimit_spec_healthreadScore an OpenAPI spec on quality dimensions (0-100, A-F grade).
delimit_substantive_content_checkwritePre-submit gate for autonomous github outreach (LED-2214b).
delimit_vault_healthreadReport vault subsystem health (Pro).
delimit_vault_searchreadSearch vault entries by query string (Pro).
delimit_vault_snapshotreadCapture a snapshot of vault state (Pro).
delimit_vendor_news_healthreadHealth check for the vendor-news riff system (LED-1253).
delimit_vendor_news_scanreadScan watchlisted vendor accounts and auto-draft riffs (Pro) (LED-1253).
delimit_venturesreadList all registered ventures (auto-registered project directories).
delimit_versionreadReturn Delimit server version, tool count, and environment status.
forbidden_write_toolwriteA synthetic tool the adapter must never advertise or invoke.
04

Trust audit

BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (18 observation(s))
Network
declared (7 observation(s))
Shell
declared (19 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
bin/delimit-cli.js:436
const policyContent = yaml.load(fs.readFileSync(policyPath, 'utf-8'));  // nosec B-yaml_unsafe_load: parses user-local policy YAML; trusted input
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
bin/delimit-cli.js:3919
const policy = yaml.load(fs.readFileSync(policyPath, 'utf8'));  // nosec B-yaml_unsafe_load: parses user-local .delimit/ YAML; trusted input
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
bin/delimit-cli.js:4308
policy = yaml.load(fs.readFileSync(policyPath, 'utf8'));  // nosec B-yaml_unsafe_load: parses user-local .delimit/ YAML; trusted input
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
bin/delimit-cli.js:4423
const parsed = specPath.endsWith('.json') ? JSON.parse(content) : yaml.load(content);  // nosec B-yaml_unsafe_load: parses user-local .delimit/ YAML; trusted input
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
lib/agent.js:127
policy: yaml.load(fs.readFileSync(userPolicyPath, 'utf8')),  // nosec B-yaml_unsafe_load: parses agent-config YAML authored by the user locally
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
gateway/ai/backends/tools_infra.py:102
"eval_usage": (r"\beval\s*\(", "Use of eval() — potential code injection", "high"),  # nosec B-eval_usage: regex-pattern DEFINITION string (not runtime eval)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
gateway/ai/backends/tools_infra.py:103
"exec_usage": (r"\bexec\s*\(", "Use of exec() — potential code injection", "high"),  # nosec B-exec_usage: regex-pattern DEFINITION string (not runtime exec)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
gateway/ai/integrations/opensage_wrapper.py:73
SENSITIVE = ["/etc/", "/.ssh/", "/.aws/", "/credentials/", "/.env"]
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
hooks/post-tool-hook.js:89
const sensitivePaths = ['/etc/', '/.ssh/', '/.aws/', '/credentials/'];
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
hooks/pre-tool-hook.js:40
'/.ssh/',
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
hooks/pre-tool-hook.js:41
process.env.HOME + '/.ssh/',
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
hooks/pre-tool-hook.js:42
'/.aws/',
Why it matters. touches a credential store
HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427
CHANGELOG.md:1688
- **LED-305**: [P0] [SYSTEM] Fix [email protected] IMAP/SMTP authentication failure
Why it matters. a tool description carrying instructions to the agent
Fix. tool descriptions describe the tool; nothing else
MEDIUMInventory / provenance · inv.binary · CWE-1104
scripts/__pycache__/accept-packed-artifact.cpython-310.pyc
accept-packed-artifact.cpython-310.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
gateway/ai/_compile_status.py:55
mod = importlib.import_module(import_name)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
gateway/ai/_compile_status.py:97
mod = importlib.import_module(import_name)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
gateway/ai/activate_helpers.py:359
__import__(pkg)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
gateway/ai/backends/ops_bridge.py:32
mod = importlib.import_module(f"{pkg}.server")
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
gateway/ai/backends/repo_bridge.py:32
mod = importlib.import_module(f"{pkg}.server")
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
bin/delimit-cli.js:6985
console.log(chalk.red(`  Secret "${name}" not found.`));
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
bin/delimit-cli.js:6995
console.log(chalk.red(`  Failed to read secret "${name}".`));
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
gateway/ai/server.py:249
(r"send\s+(all|this|the)\s+(the\s+)?data\s+to", "data exfiltration"),
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
bin/delimit-cli.js:35
const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`;
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
hooks/post-bash-hook.js:4
const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`;
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
hooks/post-mcp-hook.js:4
const AGENT_URL = `http://127.0.0.1:${process.env.DELIMIT_AGENT_PORT || 7823}`;

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha ad21df6adee0full audit observations/trust-audit/mcp-server/delimit-ai__delimit-mcp-server.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11ad21df6adee0BLOCKF38first audit
06

Questions

What is the delimit-cli MCP server?

Building your AI organization: shared records and handoffs, plus a merge gate for AI-written code with signed, replayable attestation. Works with Claude Code, Codex, Cursor, and Gemini CLI.

What tools does delimit-cli expose?

66 in total: 55 read-only, 10 that write, and 1 that can delete or overwrite (delimit_secret_revoke). Every one is listed on this page with its risk.

Is delimit-cli safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (38/100) and found 13 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does delimit-cli need?

It reads ANTHROPIC_API_KEY, CHATOPS_AUTH_TOKEN, DELIMIT_AUTH_TOKEN, DELIMIT_INTERNAL_BRIDGE_TOKEN, DELIMIT_SECRETS_SCOPE_FAILCLOSED, DELIMIT_SMTP_PASS, DELIMIT_TELEGRAM_BOT_TOKEN, DELIMIT_X_USAGE_SECRET, DEV_TO_API_KEY, GOOGLE_APPLICATION_CREDENTIALS, OPENAI_API_KEY and RAPIDAPI_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does delimit-cli run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as delimit-cli at 4.21.0.

How current is this page?

The grade is for one exact copy of the source (ad21df6adee0), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement