expo-agent-cliCAUTION
mcp/expo/expo-agent-cli
Agent-native CLI on top of the Expo CLI family
Verdict
CAUTION
Grade
D
Trust score
66 /100
Exposed tools
2 1r · 1w · 0d
Transport
—
License
MIT
Stars
10
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Monorepo for Expo's agent CLI.
Packages
@expo/agent-cli— the agent-native CLIexpo-agent-cli— npm alias for `@expo/agent-cli`
Development
bun install bun test bun run format bun run --filter @expo/agent-cli build
oxfmt formats the whole repo from .oxfmtrc.json. CI fails on bun run format:check.
Read from source at commit
413ef91f1dc7OBSERVED · 2026-10-11Advertisement
02
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude-code
claude mcp add expo-agent-cli --env AUTH_LOG_DIR=${AUTH_LOG_DIR} --env EXPO_TOKEN=${EXPO_TOKEN} -- npx -y [email protected]claude-desktop
{
"mcpServers": {
"expo-agent-cli": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AUTH_LOG_DIR": "${AUTH_LOG_DIR}",
"EXPO_TOKEN": "${EXPO_TOKEN}"
}
}
}
}03
Exposed tools (2)
1 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
big | read | Ships a huge body |
run_cli | write | Execute @expo/agent-cli in the project directory and return its exit code, stdout and stderr. Use --help to discover commands and flags. |
04
Trust audit
CAUTIONgrade D · trust 66/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
MEDIUMInventory / provenance · inv.binary · CWE-1104
packages/@expo/agent-cli/src/__fixtures__/zip/fixture-deflated.zip
fixture-deflated.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
packages/@expo/agent-cli/src/__fixtures__/zip/fixture-stored.zip
fixture-stored.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
packages/@expo/agent-cli/src/device/approveScheme.ts
approveScheme.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
packages/@expo/agent-cli/src/project/fingerprint.ts
fingerprint.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
.oxfmtrc.json
.oxfmtrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.suspicious_name · CWE-1104
packages/@expo/agent-cli/src/runtime/__tests__/fixtures/spike-view-tree/expr-12-payload-cap.js
expr-12-payload-cap.js
Why it matters. member named after an attack tool
Fix. remove or justify
LOWInventory / provenance · inv.suspicious_name · CWE-1104
packages/@expo/agent-cli/src/runtime/__tests__/fixtures/spike-view-tree/out-12-payload-cap.json
out-12-payload-cap.json
Why it matters. member named after an attack tool
Fix. remove or justify
LOWInventory / provenance · inv.symlink · CWE-1104
packages/@expo/agent-cli/CLAUDE.md
packages/@expo/agent-cli/CLAUDE.md
Why it matters. link not followed
LOWInventory / provenance · inv.symlink · CWE-1104
packages/@expo/agent-cli/llp/foundation/0000-expo-monorepo.explainer.md
packages/@expo/agent-cli/llp/foundation/0000-expo-monorepo.explainer.md
Why it matters. link not followed
LOWInventory / provenance · inv.symlink · CWE-1104
packages/@expo/agent-cli/llp/foundation/0001-agentic-cli-on-expo-cli.rfc.md
packages/@expo/agent-cli/llp/foundation/0001-agentic-cli-on-expo-cli.rfc.md
Why it matters. link not followed
LOWInventory / provenance · inv.symlink · CWE-1104
packages/@expo/agent-cli/llp/foundation/0002-testing-and-evals.plan.md
packages/@expo/agent-cli/llp/foundation/0002-testing-and-evals.plan.md
Why it matters. link not followed
LOWInventory / provenance · inv.symlink · CWE-1104
packages/@expo/agent-cli/llp/foundation/0004-smart-start-and-project-state.rfc.md
packages/@expo/agent-cli/llp/foundation/0004-smart-start-and-project-state.rfc.md
Why it matters. link not followed
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/@expo/agent-cli/evals/harness/__tests__/runtime-fixture.test.ts:26
const untouched = await exec(root, ['dev:logs']);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/@expo/agent-cli/evals/harness/__tests__/runtime-fixture.test.ts:32
const result = await exec(root, ['runtime:reload']);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/@expo/agent-cli/evals/harness/__tests__/runtime-fixture.test.ts:65
const unavailable = await exec(root, ['runtime:errors']);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/@expo/agent-cli/evals/harness/__tests__/runtime-fixture.test.ts:70
const logs = await exec(root, ['dev:logs']);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
packages/@expo/agent-cli/evals/harness/__tests__/runtime-fixture.test.ts:76
const reload = await exec(root, ['runtime:reload']);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
packages/@expo/agent-cli/e2e/utils.ts:487
.createHash('sha1')LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
packages/@expo/agent-cli/src/deferred/doctor-fix/__tests__/doctor-fix-e2e-test.ts:87
.createHash('md5')LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
packages/@expo/agent-cli/src/deferred/doctor-fix/fixSteps.ts:105
const rootDirHash = createHash('md5').update(projectRoot.split(path.sep).join('/')).digest('hex');LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
packages/@expo/agent-cli/src/devLock/address.ts:93
.createHash('sha1')LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/@expo/agent-cli/src/agents/__tests__/agentsMd-test.ts:296
vol.writeFileSync('/outside/authorized_keys', 'ssh-ed25519 AAAA real@key\n');Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/@expo/agent-cli/src/agents/__tests__/agentsMd-test.ts:297
vol.symlinkSync('/outside/authorized_keys', `${projectRoot}/AGENTS.md`);Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
packages/@expo/agent-cli/src/agents/__tests__/agentsMd-test.ts:301
expect(vol.readFileSync('/outside/authorized_keys', 'utf8')).toBe(Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/@expo/agent-cli/.eas/workflows/agent-cli-cloud-e2e.yml:28
working_directory: ../../..
Gates applied: no_behavioural_pass.
Audited 2026-10-11 · audit v0.4.1 · source sha
413ef91f1dc7full audit observations/trust-audit/mcp-server/expo__expo-agent-cli.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 413ef91f1dc7 | CAUTION | D | 66 | first audit |
06
Questions
What is the @expo/agent-cli MCP server?
Agent-native CLI on top of the Expo CLI family
What tools does @expo/agent-cli expose?
2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @expo/agent-cli safe to connect to an agent?
With care. The audit graded it D (66/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @expo/agent-cli need?
It reads AUTH_LOG_DIR and EXPO_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (413ef91f1dc7), read on 2026-10-11. The repository is watched and re-audited when it changes.