cmuxlayerBLOCK
10 public MCP tools for controlling cmux workspaces and managing Claude, Codex, Gemini, Kiro, and Cursor agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
cmuxLayer exposes a 10-tool public MCP surface for controlling cmux terminal workspaces and managing CLI agents.
[](#quick-start) [](LICENSE) [](https://modelcontextprotocol.io) [](#testing)
Quick start
brew install etanhey/layers/cmuxlayer # stable, pinned release brew install --HEAD etanhey/layers/cmuxlayer # or: dogfood the latest main
This installs the cmuxlayer command plus cmuxlayer-app-server and cmuxlayer-proxy. cmux must be running. For fleet wiring, versions, dogfooding, and the CMUX_SOCKET_PATH pin, see docs/guides/releases-and-brew.md.
Then set up this machine:
cmuxlayer init
The wizard selects spawnable repositories, per-repo launchers or direct CLI launches, and approval behavior. It writes ~/.config/cmuxlayer/env.sh and, in launcher mode, a launcher registry. cmuxlayer reads both at startup, including when an MCP client starts it from a GUI. The wizard asks before replacing a file and creates a backup first.
For scripted installs, pass --yes with --repo =. cmuxlayer does not assume a fixed repository layout. See docs/guides/fresh-install.md for the walkthrough and docs/guides/registry-optional-spawn.md for how each lane behaves.
Raise the open-files limit for agent CLIs
Agent CLIs open many files, while macOS login shells can start with a low soft open-files limit. If you use repoGolem launc
71edd61491beOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add site --env CMUX_SOCKET_PASSWORD=${CMUX_SOCKET_PASSWORD} -- npx -y [email protected]{
"mcpServers": {
"site": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CMUX_SOCKET_PASSWORD": "${CMUX_SOCKET_PASSWORD}"
}
}
}
}Exposed tools (10)
8 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
close_surface | read | Close one surface, managed agent, or workspace with live-agent guards. scope= |
control_health | read | Report terse control-path health by default; pass detail=full for diagnostics. |
list_agents | read | |
list_surfaces | read | List workspace, pane, and surface topology. Condensed by default; verbose=true adds raw cmux fields. |
read_screen | read | Read a terminal screen and parsed harness status. Use raw=true for full text or parsed_only=true for monitoring. |
report_to_parent | read | Raise a short blocker to this managed agent |
send_to | write | |
spawn_agent | read | Spawn a managed agent or terminal, or resume a captured agent on a fresh surface preserving its ID. Resume: {resume_agent_id:\ |
update_surface | write | Move or rename one terminal surface. |
wait_for | read | Block until one agent_id or every agent in ids reaches a target registry state and return health. Defaults to waiting for completion ( |
Trust audit
BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const windowsOut = await exec(config.cmuxBin, listWindowsCliArgs(), {const output = await exec(
const panesOut = await exec(
exec(config.cmuxBin, listPaneSurfacesCliArgs(workspace, pane), {await exec(config.cmuxBin, listPaneSurfacesCliArgs(workspace, pane), {<string>http://127.0.0.1:3847/notify</string>
const token = "test-reconnect-capability";
const token = "test-health-capability";
const token = "PRIVATE_SYNTHETIC_CAPABILITY_RUN";
const token = "RATCHET_SYNTHETIC_UNIQUE_RUN";
.deepsource.toml
typed-unsubmitted-wrapped-payload-pro-high.txt
multiline-payload-premature-submit.json
payload-slim.test.ts
// 4. RC4 — all N stay registered (the resync sweep is automatic now)
// 5. RC4 — send_to(agent_id) MUST deliver to each (still registry-addressable)
// 4. RC4 — still registered + addressable. The resync sweep is automatic;
// 5. RC4 — send_to each must deliver
it("RC4: preserves live pending sibling seats on different surfaces during repair", async () => {default_repo="$(cd "${script_dir}/../../.." && pwd)"const { loadLauncherRegistrySnapshot, resolveLauncherNameFromRegistry, resolveRepoRootFromLauncherRegistry } = registry ?? await import("../../dist/launcher-registry.js");const { parseScreen } = await import("../../dist/screen-parser.js");const { deriveRoleColumnIndex } = await import("../../dist/layout-policy.js");const { agentProcessLiveness } = await import("../../dist/util/pid-alive.js");"notifyUrl": "http://127.0.0.1:3847/notify",
Gates applied: no_behavioural_pass.
71edd61491befull audit observations/trust-audit/mcp-server/etanhey__cmuxlayer.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 71edd61491be | BLOCK | F | 57 | first audit |
Questions
What is the cmuxlayer MCP server?
10 public MCP tools for controlling cmux workspaces and managing Claude, Codex, Gemini, Kiro, and Cursor agents.
What tools does cmuxlayer expose?
10 in total: 8 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is cmuxlayer safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (57/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does cmuxlayer need?
It reads CMUX_SOCKET_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does cmuxlayer run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as site at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (71edd61491be), read on 2026-10-08. The repository is watched and re-audited when it changes.