huskBLOCK
Husk gives your AI chat a real computer of its own: files, a browser, and somewhere to run code. It can build things, look stuff up online and keep your work between chats. Turn a chat you already had into a bot that does the job again tomorrow. Free and open source; there is no paid tier.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Your AI chat gets a computer. A terminal, files and a browser it can actually use, and a workspace that keeps what it finds for next time.
Husk gives your AI chat named local workspaces. Save public web sources, ask your AI for a cited brief, comparison, or action list, then review and download the result. Reopen the same workspace in your next chat. No Husk account, Docker, terminal, or additional model API key is needed for this starter flow.
For coding and automation, Husk also provides optional computer tools: a shell, files, and a browser. Existing MCP and CLI computer workflows remain available.
[!NOTE] 0.2.0 public preview. Download the unsigned desktop extension from the GitHub prerelease. It has passed automated checks; installation and first-task completion inside Claude Desktop still need beta testing. See the one-day delivery and launch checklist.
Start with a workspace
Download husk-0.2.0.mcpb from the public preview. Install it in C
4d58b80f842bOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp -- npx -y @husk-ai/[email protected]
Exposed tools (38)
28 read · 8 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
asker | read | asks |
bot | read | runs in C:\\Users\\bob |
box | read | uses the machine |
broken | read | broken |
browse | read | Load a web page from inside your own computer and return its title, readable text and links. |
browser_click | read | Click the element with this ref, then return a fresh snapshot of whatever the page became. |
browser_goto | read | Open a URL in a real Chromium running inside your computer and wait for it to load. |
browser_hover | write | Move the pointer over an element, for menus that only appear on hover. |
browser_navigate | read | Go back, go forward, or reload the current page. |
browser_screenshot | write | Save a PNG of the current page into your computer and return its path. |
browser_scroll | read | Scroll the page, or bring one element into view. The snapshot lists the whole document, |
browser_select | read | Choose an option in a dropdown (a native <select>). Clicking one does nothing useful -- |
browser_snapshot | read | List what is on the current page: every element you can read or act on, each with a |
browser_status | read | Whether this computer already has a browser, without installing one, and whether this |
browser_tabs | read | List the open tabs, or switch to one. A link that opens in a new tab lands somewhere you |
browser_type | read | Type text into the field with this ref, replacing whatever is already there. |
browser_upload | write | Attach files to a file input. The paths are paths inside your computer, so write or |
browser_wait_for | read | Wait until some text or a CSS selector appears on the page (or disappears, with gone). |
chatty | read | chatty |
computer_info | read | Describe the computer: os, kernel, arch, user, CPU count, memory, disk, working directory |
counter | read | counts |
delete | destructive | Delete a file, or a directory when recursive is true. There is no undo. |
docker | read | a container per computer |
edit_file | write | Replace an exact string in a file. oldString must appear exactly once unless replaceAll is true. |
expose_port | write | Publish a port from inside the computer to the host so a human can open it in a browser. |
fetch_url | read | Fetch a web page or API response and return it as readable text. HTML is stripped down to its prose. |
http_request | read | Make an arbitrary HTTP request and return status, headers and body. Use this for APIs that need a method, |
leaky | read | leaks |
list_dir | write | List a directory on the computer. Set recursive to walk subdirectories, bounded by limit. |
local | read | a guarded working directory on this machine |
move | write | Move or rename a file or directory on the computer. |
probe | read | probe |
read_file | read | Read a text file from the computer. Supply startLine/endLine (1-based, inclusive) to read part of a large file. |
release-bot | read | Cuts releases |
search_files | read | Search file contents for a regular expression. Uses ripgrep when the computer has it and falls back to a |
shell | write | Run a shell command on the Linux computer. Returns exit code, stdout and stderr. |
web_search | read | Search the web (via ${creds.backend}) and return titles, URLs and snippets. Follow up with fetch_url to read a result. |
write_file | destructive | Create or overwrite a text file on the computer. Parent directories are created. |
Trust audit
BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
line with <code>exec(tty: true)</code> in <code>{ready?.workdir ?? active?.workdir ?? '/work'}</code>. The{' '}exec(req: ExecRequest): Promise<ExecResult>;
exec(id: string, req: ExecRequestBody, opts: CallOptions = {}): Promise<ExecResult> {Two of those refusals are not worth undoing lightly. <code>169.254.169.254</code> is the cloud metadata
cron.ts
scaffold.ts
Dockerfile.node
placeholder="http://127.0.0.1:7377"
return 'export ANTHROPIC_API_KEY=sk-ant-abcdefghijklmnopqrstuvwxyz012345';
expect(JSON.stringify(router.requests[1]?.messages)).not.toContain('sk-ant-abcdefghijklmnopqrstuvwxyz012345');return 'sk-ant-abcdefghijklmnopqrstuvwxyz012345';
const KEY = 'sk-ant-api03-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
const out = summariseArgs({ command: 'export TOKEN=sk-ant-api03-REALLOOKINGSECRETVALUE' });const anthropic = new AnthropicProvider({ apiKey: 'sk-ant-test-key-value-long-enough', fetch: hangingFetch });-----BEGIN RSA PRIVATE KEY-----... -> [redacted private key]
delete, write_file
Search.tsx
gemini.test.ts
.oxlintrc.json
return new Function(`return ${expression}`)() as T;husk.ssh.key: /keys/id_ed25519
expect(settings?.keyPath).toBe('/keys/id_ed25519');labels: { 'husk.ssh': 'deploy@build-box:2222', 'husk.ssh.key': '/keys/id_ed25519' },'husk.ssh.key': '/keys/id_ed25519',
for (const bad of ['/etc/passwd', '/', '/home/me/.ssh/id_rsa', '/proc/self/environ']) {Gates applied: no_behavioural_pass.
4d58b80f842bfull audit observations/trust-audit/mcp-server/hotragn__husk.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 4d58b80f842b | BLOCK | F | 41 | first audit |
Questions
What is the husk MCP server?
Husk gives your AI chat a real computer of its own: files, a browser, and somewhere to run code. It can build things, look stuff up online and keep your work between chats. Turn a chat you already had into a bot that does the job again tomorrow. Free and open source; there is no paid tier.
What tools does husk expose?
38 in total: 28 read-only, 8 that write, and 2 that can delete or overwrite (delete, write_file). Every one is listed on this page with its risk.
Is husk safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (41/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does husk need?
It reads HUSK_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does husk run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @husk-ai/workspaces at 0.2.0.
How current is this page?
The grade is for one exact copy of the source (4d58b80f842b), read on 2026-10-12. The repository is watched and re-audited when it changes.