deriveBLOCK
Review and approval for work made by AI agents. Fair Source, self-hostable, and MCP-native.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Publish, review, and own your AI artifacts.
One durable URL for every version, comment, revision, and decision. Your team reviews the work; any compatible agent can act on the feedback. Hosted, or one self-hosted container.
Try free · Self-host · Docs
Try it now
No account or install is needed. One request publishes a live page:
curl -F [email protected] https://derive.to/v1/drafts # or a .zip of a whole site # → a live URL, plus a claim link that turns the draft into a # permanent, versioned artifact in your workspace
Give your agent a durable place to publish, find, and improve work:
npx skills add derive-to/derive --skill derive # any agent that reads skills claude mcp add --transport http derive https://derive.to/mcp # or connect over MCP
Or paste this into a compatible coding agent and let it set itself up:
3c0918ddbae9OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add storage --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} --env DERIVE_AUTH_SECRET=${DERIVE_AUTH_SECRET} --env DERIVE_MODEL_API_KEY=${DERIVE_MODEL_API_KEY} -- npx -y @derive/[email protected]{
"mcpServers": {
"storage": {
"command": "npx",
"args": [
"-y",
"@derive/[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}",
"DERIVE_AUTH_SECRET": "${DERIVE_AUTH_SECRET}",
"DERIVE_MODEL_API_KEY": "${DERIVE_MODEL_API_KEY}"
}
}
}
}Exposed tools (64)
55 read · 8 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Accounts | write | Model accounts: the credential a machine uses to call a model. Write-only. |
Agents | read | Agents: named workers with instructions, a machine, and what they can reach. Also the OAuth agents a user has authorized. |
Analyst | read | answers data questions |
Analytics | read | Aggregate view statistics for an artifact. |
Artifacts | write | Documents (files and bundles): browse, publish, version, restore, and control access. |
Assets | read | Standalone binary image assets referenced from bundles. |
Builder | read | builds things |
Collections | read | Shareable groups of artifacts, each with its own members. |
Comments | read | Threaded, anchored comments with reactions, edits, and resolution. |
Contexts | read | Papers imported from arXiv: each is a read-only Context whose artifact is the paper. |
Derive | read | A workspace for agent-made artifacts — documents, plans, decks, and fully-styled |
Domains | read | Custom domains and vanity subdomains bound to artifacts. |
Favorites | read | The caller |
Follows | read | Follow people to build the activity feed. |
GMAIL_LIST | read | |
GitHub | write | Install-backed GitHub access for reading pull requests and posting comments. |
Jobs | write | One unit of agent work: someone asked, a schedule fired, or a graph opened a node. People ask, follow, answer, cancel, and retry; runners pull and report. |
Moderation | read | Abuse reports and takedown / reinstate actions. |
Notifications | read | The caller |
OAuth | read | OAuth 2.1 authorization-server endpoints and sign-in capabilities. |
Project | read | Project name |
Realtime | read | Live presence and cursor sharing on an artifact. |
Review | write | Review rounds on an artifact: request a review, or send it back with a note. |
Reviewer | read | reviews pull requests |
Session | read | Identity: the signed-in user, public profiles, and the people directory. |
Sharing | read | Per-artifact collaborator roles (shares) layered over the workspace baseline. |
Slack | read | Slack connection status and integration toggles. |
Vitals | read | Client-reported web-vitals ingestion. |
Webhooks | read | Outgoing webhooks and their delivery log. |
Workspace | read | The workspace itself: members, settings, invitations, and switching. |
agents | read | |
ask | read | |
ask_user | write | Ask for a missing choice. Persist and pause this run until the person answers. |
browse_library | read | |
call | read | |
catch_up | read | |
checkpoint | read | |
clear_queue | destructive | |
comment | read | |
derive_code | read | |
docs.search | read | Search |
fetch | read | Fetch one doc. |
find | read | |
get_balance | read | Account balance. |
get_current_weather | read | Current weather for a place, by name. Returns temperature in Celsius, wind speed in km/h, |
jobs | read | |
list_artifacts | read | |
list_workspaces | read | |
organize | read | |
project | read | Duplicate project name |
publish | write | |
pull | read | |
read | read | |
release-notes | write | How we write release notes. |
same_tool | read | d |
search | read | Search the docs. |
shelve | read | |
show | read | |
stage | read | |
svc.read | read | read |
weekly-brief | read | Build a cited weekly brief. |
wx_get | read | d |
x | read | X |
y | read | two |
Trust audit
BLOCKgrade F · trust 36/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
exec(query: string): Promise<D1ExecResult>;
# DATABASE_URL=postgres://derive:password@postgres:5432/derive
migrate-auth-d1.ts
/^\/v1\/vitals$/, // anonymous Core Web Vitals beacon (telemetry, no state)
const BASE = `http://127.0.0.1:${PORT}`"data:font/woff2;base64,d09GMgABAAAAAHLYABQAAAABAQgAAHJiAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoYFG4GfHhyHTD9IVkFSh1s/TVZBUjwGYD9TVEFUgTgAhRAvfhEICvZo3iMLhEIAMIGoaAE2AiQDiQAEIAWIGgeLSQwHGyLxFWxXY6CewOalNZfP
const FRONTMATTER = /^?---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n)*/
if (text.endsWith("\n")) runs.push({ text: "", mention: false }){o.line || ""}const m = s.match(/^?---[ \t]*\r?\n([\s\S]*?)\r?\n---/)
let head = text.replace(/^/, "").trimStart()
* TEST_DATABASE_URL=postgres://postgres:[email protected]:55432/derive_test \
password: "safe-bootstrap-password",
password: "safe-bootstrap-password",
const SECRET = "tamper-secret-at-least-16-chars"
const token = "collection-invite-test-token"
const secret = "sk_game_admin_9f3a7b2c1d"
["private key", "-----BEGIN PRIVATE KEY-----\nabc"],
bot_token: "xoxb-content-mention",
bot_token: encryptSecret("xoxb-real-bot-token", "k"),expect(body).not.toContain("xoxb-real-bot-token")expect(calls[0]?.auth).toBe("Bearer xoxb-real-bot-token")clear_queue
.dependency-cruiser.mjs
Gates applied: no_behavioural_pass.
3c0918ddbae9full audit observations/trust-audit/mcp-server/derive-to__derive.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 3c0918ddbae9 | BLOCK | F | 36 | first audit |
Questions
What is the derive MCP server?
Review and approval for work made by AI agents. Fair Source, self-hostable, and MCP-native.
What tools does derive expose?
64 in total: 55 read-only, 8 that write, and 1 that can delete or overwrite (clear_queue). Every one is listed on this page with its risk.
Is derive safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (36/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does derive need?
It reads ANTHROPIC_API_KEY, CLOUDFLARE_API_TOKEN, DERIVE_AUTH_SECRET, DERIVE_MODEL_API_KEY, DERIVE_PASSKEY_RPID, DERIVE_SMOKE_PASSWORD, DERIVE_TOKEN, GH_TOKEN, GITHUB_TOKEN, OPENAI_API_KEY, ORTAM_API_KEY and SLACK_PROBE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does derive run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @derive/storage at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (3c0918ddbae9), read on 2026-10-14. The repository is watched and re-audited when it changes.