jules-orchestrator-kitBLOCK
Framework-agnostic toolkit for orchestrating Google Jules background AI coding workers.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Task dispatch and local verification for coding agents. Requires Node.js 22+ and Git; uses no third-party runtime dependencies.
[](https://www.npmjs.com/package/jules-orchestrator-kit) [](https://github.com/FullThrottle83/jules-orchestrator-kit/actions/workflows/jules-audit.yml)
Overview
Use the kit to describe a scoped coding task, send it to Google Jules or an installed Claude Code, Codex or Gemini CLI, and verify the resulting changes. You can also run local checks without connecting an agent provider.
Dispatch, verification and repair are explicit. Dispatch sends the task; gate runs configured checks without mutating the working tree. Use agentctl repair explicitly for repair workflows. Provider output and passing checks still need review before merging.
The current release is v0.75.7, a pre-1.0 release. A long-term stability policy is a v1.0 goal.
Quickstart
Start in an existing Git repository with working tests. Commit or stash unrelated changes so that you can review exactly what setup adds. Node.js runs the kit; your project's own runtime and test tools must also be installed.
1. Configure the repository
npx jules-orchestrator-kit init
The wizard detects the project and asks about provider and verification settings. Use init --yes to accept defaults. By default it writes only the canonical .agent/config.yml plus runtime-state entries in .gitignore when they are missing. Inspect the generated configuration and diff, especially the test command and protected paths. Use init --dry-run to preview the exact writes without changing the repository.
The historical full scaffold (AGENTS.md, specialist prompts, rules, workflows and c
3579a36dc837OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add jules-orchestrator-kit --env AGENT_MAIN_TOKEN=${AGENT_MAIN_TOKEN} --env AGENT_SECONDARY_TOKENS=${AGENT_SECONDARY_TOKENS} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env JULES_API_KEY=${JULES_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"jules-orchestrator-kit": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AGENT_MAIN_TOKEN": "${AGENT_MAIN_TOKEN}",
"AGENT_SECONDARY_TOKENS": "${AGENT_SECONDARY_TOKENS}",
"GEMINI_API_KEY": "${GEMINI_API_KEY}",
"JULES_API_KEY": "${JULES_API_KEY}"
}
}
}
}Exposed tools (20)
15 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
audit_jules_gate | write | Run the 4-phase safety gatekeeper (Scope, Payload, Secrets, Verify) against the current workspace branch. |
check_risk_tier | read | Classify changed files into Risk Tiers (R0 Cosmetic, R1 Routine, R2 Consequential, R3 Restricted). |
dispatch_jules_task | read | Dispatch an autonomous task to the Jules AI agent provider with security bounds and budget check. |
get_jules_status | read | Retrieve orchestrator status: daily task budget, active locks, stack diagnostics, the configured provider and whether it is reachable, and the verification stages the gate will run. |
get_web_task_template | read | Retrieve or synthesize a web development task envelope (web-cwv, web-wcag, web-seo, web-playwright, web-flaky-heal) with exploration budget and critic steering. |
jules_apply_patch | write | Extract and apply a Jules session |
jules_approve_plan | read | Approve a proposed execution plan for a Jules session awaiting plan approval. |
jules_archive_session | read | Archive a Jules coding session to clean up the dashboard. |
jules_delete_session | destructive | Permanently delete a Jules coding session. |
jules_get_session_output | write | Extract the git diff patch, pull request metadata, and changed files from a Jules session. |
jules_list_activities | read | List execution activities, logs, and error outputs for a specific Jules session. |
jules_list_sessions | read | List remote Jules coding sessions with optional pagination and state filtering. |
jules_list_sources | read | List connected GitHub repository sources available to the Jules account. |
jules_prune_sessions | read | Batch-archive or prune old/completed Jules sessions matching age and state filters. |
jules_retry_session | read | Retry a failed Jules session by extracting failure diagnostics and dispatching a new OODA repair session. |
jules_send_message | write | Send feedback, steering instructions, or reply message to an active Jules session. |
jules_wait_for_session | read | Poll a Jules session until it reaches a terminal or action-required state (COMPLETED, FAILED, AWAITING_PLAN_APPROVAL). |
optimize_jules_prompt | read | Evaluate task prompt falsifiability, check static path validity, and synthesize optimized task envelope. |
record_system_learning | read | Record a persistent system learning or platform quirk into .agent/SYSTEM_LEARNINGS.md (SPORE Memory). |
telemetry_tail | read | Query the last N telemetry events from the orchestrator telemetry spine. |
Trust audit
BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
"**/id_rsa*",
"**/.git-credentials",
"**/.aws/**",
"**/.ssh/**",
"**/.kube/**",
"Verify zero TLS certificate verification bypasses (\`rejectUnauthorized: false\`, \`NODE_TLS_REJECT_UNAUTHORIZED=0\`, \`verify=False\`).",
- Strictly prohibit disabling TLS validation (\`rejectUnauthorized: false\`, \`NODE_TLS_REJECT_UNAUTHORIZED=0\`, \`verify=False\`, \`--no-check-certificate\`).
console.log(`💡 Remediation Hint (Exit ${res.code} Unreadable Test Dialect — no secret was found):`);console.log(` • Nothing needs rotating: this exit code is shared with the secret scanner.\n`);
console.log(`💡 Remediation Hint (Exit ${res.code} Test Integrity Violation — no secret was found):`);console.log(` • Nothing needs rotating: this exit code is shared with the secret scanner.\n`);
console.log(` • Scope- and secret-scanning only, on purpose? Set verify.required: false there.\n`);
stdout.write(`Dashboard running at http://127.0.0.1:4100\nPress Ctrl+C to exit.\n`);
const fakeKey = "sk-ant-api03-abcdefghijklmnopqrstuvwxyz1234567890";
+const token = "ghp_123456789012345678901234567890123456";
assert.equal(hasEncodedSecret(b64(`password: "hunter2hunter2hunter2"`)), false);
const secret = "test-webhook-secret-12345";
Buffer.concat([Buffer.from([0]), Buffer.from("ghp_123456789012345678901234567890123456\n")])const fakeToken = "ghp_123456789012345678901234567890123456";
assert.ok(!redacted.includes("ghp_123456789012345678901234567890123456"));+const token = "ghp_123456789012345678901234567890123456";
"-----BEGIN RSA PRIVATE KEY-----",
const rsaPrivateKey = "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEA098...\n-----END RSA PRIVATE KEY-----";
assert.ok(!redacted.includes("-----BEGIN RSA PRIVATE KEY-----"), "Should redact RSA Private Key header");+const key = \`-----BEGIN RSA PRIVATE KEY-----
Gates applied: no_behavioural_pass.
3579a36dc837full audit observations/trust-audit/mcp-server/fullthrottle83__jules-orchestrator-kit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 3579a36dc837 | BLOCK | F | 44 | first audit |
Questions
What is the jules-orchestrator-kit MCP server?
Framework-agnostic toolkit for orchestrating Google Jules background AI coding workers.
What tools does jules-orchestrator-kit expose?
20 in total: 15 read-only, 4 that write, and 1 that can delete or overwrite (jules_delete_session). Every one is listed on this page with its risk.
Is jules-orchestrator-kit safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (44/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does jules-orchestrator-kit need?
It reads AGENT_MAIN_TOKEN, AGENT_SECONDARY_TOKENS, GEMINI_API_KEY, JULES_API_KEY, JULES_API_KEYS, JULES_API_KEY_SECONDARY, JULES_MAIN_TOKEN, JULES_SECONDARY_TOKENS, JULES_WEBHOOK_SECRET and TEST_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (3579a36dc837), read on 2026-10-12. The repository is watched and re-audited when it changes.