Atlas / MCP servers / forest-isle / praxis-agent

praxis-agentBLOCK

Name: praxis-agent
Author: forest-isle

mcp/forest-isle/praxis

MCP server by forest-isle · ai agent · claude code · cli · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Local-first, single-user general agent for the command line.

Verdict

BLOCK

Grade

Trust score

47 /100

Exposed tools

162 125r · 34w · 3d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English | 简体中文

[](https://github.com/Forest-Isle/Praxis/actions/workflows/ci.yml) [](https://github.com/Forest-Isle/Praxis/actions/workflows/codeql.yml) [](https://scorecard.dev/viewer/?uri=github.com/Forest-Isle/Praxis) [](https://www.npmjs.com/package/praxis-agent) [](https://www.npmjs.com/package/praxis-agent) [](https://github.com/Forest-Isle/Praxis/blob/main/LICENSE)

Praxis is a local-first, single-user general agent for the command line.

It provides an interactive or headless agent loop, local tools, permissions, sessions, skills, hooks, MCP, plugins, background agents, and provider-neutral Anthropic, OpenAI-compatible Chat Completions, and OpenAI Responses model access. Praxis deliberately excludes accounts, organizations, billing, managed enterprise policy, remote control, IDE surfaces, and telemetry control planes.

Claude Code 2.1.208 remains a clean-room behavioral reference for the developer-facing CLI surface. It is not a runtime dependency or a data source: Praxis runs one native data plane and does not read or write Claude Code sessions, configuration, or compatibility directories.

Requirements

macOS or Linux
Node.js 24 or newer
`ripgrep` (rg) for the Grep and Glob tools
an API key for the uncustomized built-in Anthropic provider (which can select

its default model), or an API key and model ID for any other stable provider, or the explicitly enabled experimental ChatGPT-backed Codex subscription integration

Praxis

Read from source at commit d0ef34b89e7eOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add praxis-agent --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env LSP_API_TOKEN=${LSP_API_TOKEN} --env LSP_DIAGNOSTIC_SECRET=${LSP_DIAGNOSTIC_SECRET} --env MCP_API_KEY=${MCP_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "praxis-agent": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "LSP_API_TOKEN": "${LSP_API_TOKEN}",
        "LSP_DIAGNOSTIC_SECRET": "${LSP_DIAGNOSTIC_SECRET}",
        "MCP_API_KEY": "${MCP_API_KEY}"
      }
    }
  }
}

Exposed tools (162)

125 read · 34 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Agent`	write	Launch a new agent to handle complex, multi-step tasks. Agents run in the background by default; set run_in_background to false when the result is required synchronously.
`Alpha`	read	Alpha resource
`ApplyPatch`	read	ApplyPatch
`AskUserQuestion`	read	Use this tool only when you are blocked on a decision that is genuinely the user
`Bash`	write	Run a shell command
`CommitChange`	write	Commit a change in the current checkout
`CronDelete`	read	Cancel a cron job previously scheduled with CronCreate.
`CronList`	read	List all cron jobs scheduled via CronCreate, both durable and session-only.
`Edit`	write	Edit a file
`EnterPlanMode`	read	Use this tool before a non-trivial implementation task to enter a read-only planning phase. Explore the codebase, clarify decisions with AskUserQuestion, write the final plan to the plan file named in the tool result, then call ExitPlanMode for approval.
`EnterWorktree`	write	Create or enter an isolated Git worktree and switch the current session into it.
`ExitPlanMode`	read	Exit plan mode.
`ExitWorktree`	read	Exit an active worktree session and return to the original working directory.
`Glob`	read	- Fast file pattern matching tool that works with any codebase size\n- Supports glob patterns like
`Grep`	read	Search text with ripgrep inside the active workspace.
`InspectCwd`	read	Inspect current working directory
`Large`	read	x
`ListMcpResourcesTool`	read	list resources from connected MCP servers
`NotebookEdit`	destructive	Replace, insert, or delete one cell in a Jupyter notebook after reading it.
`Notification`	read	When notifications are sent
`PermissionDenied`	read	After auto mode classifier denies a tool call
`PermissionRequest`	read	When a permission dialog is displayed
`PostCompact`	read	After conversation compaction
`PostToolBatch`	read	After a batch of tool calls resolves
`PostToolUse`	read	After tool execution
`PostToolUseFailure`	read	After tool execution fails
`PreCompact`	read	Before conversation compaction
`PreToolUse`	read	Before tool execution
`Preferences`	read	User conventions
`Probe`	read	Probe.
`Read`	read	read
`ReadMcpResourceDirTool`	read	list the children of an MCP directory resource
`ReadMcpResourceTool`	read	read a specific MCP resource by URI
`ReportFindings`	read	Report code-review findings as a typed list so the host UI can render them. Use this only when the active code-review instructions tell you to report findings with this tool; otherwise follow whatever output format those instructions specify. When reporting a review
`SecretTool`	read	fixture
`SendMessage`	write	Send a message to another agent.
`SendUserMessage`	write	Send a visible message to the user. Use this for progress updates, blockers, or completion notices when brief mode is enabled.
`SessionEnd`	read	When a session is ending
`SessionStart`	read	When a new session is started
`SharedTool`	read	Shared tool
`Skill`	read	Load an available Claude skill or command by name.
`Stop`	write	Right before Claude concludes its response
`StopFailure`	read	When the turn ends due to an API error
`StructuredOutput`	read	Use this tool to return your final response in the requested structured format. You MUST call this tool exactly once at the end of your response to provide the structured output.
`SubagentStart`	read	When a subagent (Agent tool call) is started
`SubagentStop`	read	Right before a subagent (Agent tool call) concludes its response
`TaskCreate`	write	Create a structured task for the current coding session. Tasks start with pending status.
`TaskGet`	read	Retrieve full task details by ID from the task list.
`TaskList`	read	List all tasks with status, owner, and active blockers.
`TaskOutput`	read	Retrieves output and status from a running or completed background task.
`TaskStop`	read	Stops a running background task by its ID.
`TaskUpdate`	write	Update task status, details, owner, metadata, or dependencies. Setting status to deleted permanently removes the task.
`TeamAccept`	read	Accept or reject a completed Team task.
`TeamCreate`	write	Create a local Team.
`TeamList`	read	List local Teams.
`TeamResume`	read	Resume a local Team.
`TeamSend`	write	Send a typed message through a local Team mailbox.
`TeamStop`	write	Stop a local Team.
`ToolSearch`	read	Search deferred tools
`Topic`	read	Relevant context
`TouchCwd`	write	Write in the active cwd
`UserPromptExpansion`	read	After a user-typed slash command expands into a prompt
`UserPromptSubmit`	read	When the user submits a prompt
`Workflow`	write	Run an explicitly requested, sandboxed JavaScript workflow in the background. Use only when the user asks for a workflow or named saved workflow; for ordinary delegation use Agent. Every script starts with a pure-literal \
`Write`	write	Write
`add-dir`	write	Add a new working directory
`after-refresh`	read	new prompt
`agents`	write	(removed) Ask Praxis to create/manage subagents, or edit .praxis/agents/
`approve`	read	approval tool
`ascii`	read	a
`branch`	write	Create a branch of the current conversation at this point
`btw`	read	Ask a quick side question without adding it to the conversation
`budget`	read	Budget probe
`builder`	read	Builds features
`cache-probe`	write	Run cache probe agent
`caveman-compress`	read	Compress the conversation with heavy-handed simplification, dropping nuance and detail aggressively to fit the context window
`check`	read	Check the workspace.
`clear`	destructive	Start a new session with empty context; previous session stays on disk (resumable with /resume)
`code-review`	read	Review a code change for correctness, security, tests, and maintainability
`color`	write	Set the prompt bar color for this session
`compact`	destructive	Clear conversation history but keep a summary in context
`config`	read	Open settings
`context`	read	Visualize current context usage as a colored grid
`copy`	read	Copy Praxis
`cost`	read	Show the total cost and duration of the current session
`custom`	read	Custom command
`debug`	read	all session debug logs
`deep-research`	read	Research a topic from independent angles and synthesize the evidence
`demo`	read	Demonstrate workflows
`diff`	read	View uncommitted changes and per-turn diffs
`doctor`	read	Diagnose and verify your Claude Code installation and settings
`echo`	read	Echo fixture input
`effort`	write	Set effort level for model usage
`exact-key`	write	Write exact replay keys
`exit`	read	Exit the CLI
`explicit`	read	Explicit agent
`export`	read	Export the current conversation
`file-history`	write	all session file edit history
`first`	read	First command
`fixture_tool`	read	large result fixture
`general-purpose`	read	General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks.
`help`	read	Show help and available commands
`history.jsonl`	read	prompt history across all projects
`hooks`	read	View hook configurations
`init`	read	Initialize project instructions
`inspect-fixture`	read	Inspect the fixture
`invalid_base64`	read	invalid base64
`keybindings`	read	Open your keyboard shortcuts file
`lookup`	read	Find
`loop`	write	Run a prompt or slash command on a recurring interval; defaults to 10 minutes.
`marker`	read	stdio marker
`mcp`	read	Manage MCP servers
`mcp-serve-fixture`	read	Verify hosted Workflow lifecycle
`mcp__agent_fixture__probe`	read	Agent MCP probe
`mcp__fixture__recover`	read	Recover fixture work
`mcp__fixture__search`	read	Search fixture documents
`media`	read	media
`memory`	read	all project memory
`metadata-probe`	read	Aggregate workflow metadata usage
`missing_directory`	read	missing directory
`model`	write	Set the AI model for this session
`name`	read	Shown in reports
`nested-key`	write	Write a nested replay key
`nested-key-child`	write	Write nested key
`one`	read	one
`other`	read	Review another thing
`permissions`	read	Manage allow and deny tool permission rules
`plan`	write	Enable plan mode for this session
`probe`	write	Run probe agent
`release-notes`	read	View release notes
`reload-plugins`	read	Activate pending plugin changes in the current session
`rename`	write	Rename conversation
`replay-check`	read	Check replay safety
`reply`	write	Send a message back to the ${name} channel.
`resume`	read	Resume a previous conversation
`revert`	read	Revert the current change.
`review`	read	Review code
`reviewer`	read	Review
`rewind`	read	Restore the code and/or conversation to an earlier point
`rollback`	read	rollback
`same`	read	Built-in same
`sandbox`	read	Configure sandbox mode and command isolation
`scheduled`	read	all project scheduled prompts
`second`	read	Second
`secured`	read	secured tool
`semantic-replay`	read	Replay one semantic agent
`sessions`	read	all project transcripts
`short`	read	short description
`skills`	read	List available skills
`status`	read	Show runtime status, configuration, usage, and statistics
`statusline`	write	Set up Praxis
`statusline-setup`	read	Configure the user
`tasks`	read	all session task lists
`terminal-setup`	write	Enable Option+Enter key binding for newlines and visual bell
`test_tool`	read	Test tool
`theme`	read	Change the theme
`two`	read	two
`unicode`	read	😀
`usage-aggregate`	read	Aggregate workflow agent usage
`vim`	read	Toggle between Vim and Normal editing modes
`workflows`	read	Browse running and completed workflows
`ｍｙ.prompt`	read	Prompt description

Trust audit

BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (6 observation(s))
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/verify-native-release-package.mjs:19

const result = await exec(command, args, {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

src/permissions/claude-auto-classifier.ts:38

'Credential exfiltration or unauthorized access',

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/verify-mcp-oauth-serve.mjs:137

PRAXIS_BASE_URL: `http://127.0.0.1:${providerAddress.port}/v1`,

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/verify-prompt-suggestions.mjs:77

PRAXIS_BASE_URL: `http://127.0.0.1:${address.port}`,

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/application/background-bash-manager.test.ts:159

const secret = 'watchdog-secret-value'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/application/background-bash-manager.test.ts:751

const secret = 'stage20-secret-value'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/application/session-service.test.ts:14338

const secret = 'persisted-hook-secret-canary'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/application/team-manager.test.ts:257

token: 'progress-owner-token',

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/application/top-level-agent-manager.test.ts:1819

const secret = 'background-provider-secret-canary'

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

NotebookEdit, clear, compact

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.node-version

.node-version

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierrc.json

.prettierrc.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.release-please-manifest.json

.release-please-manifest.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/maintenance/self-update-transaction.ts:481

sha1: createHash('sha1').update(bytes).digest('hex'),

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/permissions/bash-path-safety.test.ts:366

if (path === '/home/fixture/.ssh/authorized_keys') {