codeam-cliBLOCK
Public source for CodeAgent Mobile clients: codeam-cli (npm), VS Code / Cursor / Windsurf extension, and JetBrains plugin. Control AI coding agents (Claude Code, Copilot, Cursor) from your phone.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Public source for the client-side bridges of CodeAgent Mobile — the workflow-continuity layer for AI coding agents.
apps/cli—codeam-cli, the terminal bridge that wraps Claude Code in a PTY and streams it to any deviceapps/vsc-plugin— extension for VS Code, Cursor, and Windsurfapps/jetbrains-plugin— plugin for the IntelliJ family (IntelliJ IDEA, WebStorm, PyCharm, Rider, GoLand, ...)
What is CodeAgent Mobile? The supervision layer for agents already running in your IDE. Now that AI agents run for hours, not seconds, you no longer need to stare at a terminal — CodeAgent streams the session to your phone or web dashboard so you can approve diffs, redirect prompts, and stay in the loop async. Works with Claude Code, Copilot, Cursor, Windsurf, JetBrains AI, OpenAI Codex, Vertex AI, and any agent in your editor. Install once in your IDE, pair with a QR, your workflow follows you across devices. See codeagent-mobile.com.
Install (users)
CLI — codeam-cli
npm install -g codeam-cli codeam pair # generates a 6-character code codeam # starts Claude Code with mobile control
[](https://www.npmjs.com/package/codeam-cli)
VS Code / Cursor / Windsurf
- VS Code Marketplace → search for CodeAgent Mobile · listing
- Cursor / Open VSX → CodeAgentMobile/codeagent-mobile
JetBrains
- JetBrains Marketplace → CodeAgent-Mobile
Environment variables
Every client (CLI + both plugins) reads the same two env vars to pic
c7bddfbf85e1OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add shared --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} --env CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN} --env CODEAM_AUTO_TOKEN=${CODEAM_AUTO_TOKEN} -- npx -y @codeam/[email protected]{
"mcpServers": {
"shared": {
"command": "npx",
"args": [
"-y",
"@codeam/[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}",
"CLAUDE_CODE_OAUTH_TOKEN": "${CLAUDE_CODE_OAUTH_TOKEN}",
"CODEAM_AUTO_TOKEN": "${CODEAM_AUTO_TOKEN}"
}
}
}
}Exposed tools (20)
11 read · 8 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Coder | read | Implements the task with tests, TDD-first. |
Default | read | Normal editing |
QA | read | Verifies every acceptance criterion end to end and writes the final report. |
Reviewer | read | Skeptical review in a fresh context — finds and fixes what the coder missed. |
Specifier | read | Turns the task into testable acceptance criteria before any code. |
call_tool | write | Invoke one integration tool by its |
clear_highlights | destructive | Remove every mark you drew in the Preview with highlight_element. |
data | read | Read documents from a table (most-recent first). Provide the table name. |
deploy | write | Deploy this repo\ |
describe_tool | read | Return the full JSON input schema of one tool, given its |
highlight_element | write | Point at an element in the running Preview: the user sees your cursor move to it and a labelled box drawn |
list_integrations | read | List the integrations attached to this session (Jira, Linear, ClickUp, Postman, ...) with how many tools each exposes and whether it is available. Call this first when the user asks what you can do with an external service. |
preview_status | read | Current state of the Preview: running (with its URL), starting, error (with the reason) or idle. |
run_mutation | write | Run a Convex mutation function by its path with JSON args (writes data). |
run_query | write | Run a read-only Convex query function by its path (e.g. |
schema | read | Get the deployed schema (table definitions + validators) of the Convex deployment. |
search_tools | read | Search the tools of the attached integrations by keywords (e.g. |
start_preview | write | Open this project |
stop_preview | write | Stop the Preview (dev server + public URL). Only when the user asks. Never to apply code changes — the dev |
tables | write | List the tables in the connected Convex deployment (name + id). Start here to discover the schema. |
Trust audit
BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (2 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
payload.ts
persist-from-payload.ts
const { stdout: keys } = await exec(await exec(
exec(workspaceId: string, command: string): Promise<ExecResult>;
exec(
{ ...process.env } ... curl'DATABASE_URL=postgresql://postgres:postgres@localhost:5432/app',
gradle-wrapper.jar
- **Never expose or exfiltrate** secrets, credentials, tokens, or customer data, and never print a credential's value.
'sk-ant-oat01-AbC123_def-456GHI_jkl789-MNOpqr',
expect(extractSetupTokenFromOutput(out)).toBe('sk-ant-oat01-AbC123_def-456GHI_jkl789-MNOpqr');'sk-ant-api03-ABCDEFGHIJKLMNOP Bearer abcdefghijklmnopqrstuvwxyz ' +
{ key: 'URL', value: 'postgres://u:p@h:5432/db?x=1' },{ key: 'URL', value: 'postgres://u:p@h:5432/db?x=1' },const secret = 'super-secret-enroll-token';
const TOKEN = 'gho_realgit_secret_123';
clear_highlights
codex-multiline-reply.bin
.gitmessage
.vscodeignore
origin-payload.test.ts
payload-parsing.test.ts
return createHash('md5').update(s).digest('hex');const computed = path.join(chatsRoot, createHash('md5').update(cwd).digest('hex'), sessionId);Gates applied: no_behavioural_pass.
c7bddfbf85e1full audit observations/trust-audit/mcp-server/edgar-durand__codeagent-mobile-clients.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c7bddfbf85e1 | BLOCK | F | 41 | first audit |
Questions
What is the codeam-cli MCP server?
Public source for CodeAgent Mobile clients: codeam-cli (npm), VS Code / Cursor / Windsurf extension, and JetBrains plugin. Control AI coding agents (Claude Code, Copilot, Cursor) from your phone.
What tools does codeam-cli expose?
20 in total: 11 read-only, 8 that write, and 1 that can delete or overwrite (clear_highlights). Every one is listed on this page with its risk.
Is codeam-cli safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (41/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does codeam-cli need?
It reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, CODEAM_AUTO_TOKEN, CODEAM_ENROLL_TOKEN, CODEAM_MCP_PLUGIN_TOKEN, CODEAM_MCP_POLL_SECRET, CODEAM_VERCEL_BYPASS, DEEPSEEK_API_KEY, FAKE_TOKEN, GEMINI_API_KEY and GROQ_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does codeam-cli run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @codeam/shared at 2.2.0.
How current is this page?
The grade is for one exact copy of the source (c7bddfbf85e1), read on 2026-10-12. The repository is watched and re-audited when it changes.