Atlas / MCP servers / imdheerajkube / agent-nuvira

agent-nuviraBLOCK

Name: agent-nuvira
Author: imdheerajkube

mcp/imdheerajkube/agent-nuvira

MCP server by imdheerajkube · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Verdict

BLOCK

Grade

Trust score

24 /100

Exposed tools

200 238r · 93w · 9d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

name: agent-nuvira shortdescription: "Autonomous AI agent — codes, creates, writes, analyzes, and automates anything" architecture: "multi-agent pipeline" agents: "Swarm (100+ agents, consensus)" orchestration: "Sequential sub-agent pipeline" orchestrationdetails: "planner, gatherer, writer, reviewer, tester, security auditor; GOAP & swarm topologies" memory: "Persistent AgentDB (vector DB) + JSON cache; optional session-only modes" parallelexecution: "Yes (parallel agent execution & async pipelines)" securityguardrails:

"Privacy-focused"
"AI Defence (prompt injection, PII detection)"
"Security scan CLI"

publishing: "Standalone eject available; npm publishing & npx installer" features:

"multi-provider routing"
"native FAISS backend"
"checkpoint and resume"
"plugin marketplace"

Agent-Nuvira — `agent-nuvira`

Developed by Dheeraj Sharma · 🌐 [www.agent-nuvira.com](https://www.agent-nuvira.com)

[](https://www.npmjs.com/package/agent-nuvira) [](https://www.npmjs.com/package/agent-nuvira) [](./LICENSE) [](https://www.agent-nuvira.com)

Autonomous AI agent with a visual dashboard and powerful CLI — codes, creates, writes, analyzes, and automates anything. Run models locally (Ollama) or route across 22+ cloud providers (Groq, Gemini, OpenRouter, Bedrock, Azure, Anthropic, OpenAI, and more). Specialized agents plan, write, review, test, create images, generate videos, write documents, and ship code — learning from every run.

# Quick examples
agent-nuvira chat "explain recursion in Rust"
agent-nuvira chat "write a birthday poem for my daughter"
agent-nuvira chat "generate an image of a sunset over mountains"
agen

Read from source at commit bc7b9d581f03OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add agent-nuvira-vscode --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANYSCALE_API_KEY=${ANYSCALE_API_KEY} --env API_KEY=${API_KEY} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "agent-nuvira-vscode": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANYSCALE_API_KEY": "${ANYSCALE_API_KEY}",
        "API_KEY": "${API_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}"
      }
    }
  }
}

Exposed tools (200)

238 read · 93 write · 9 destructive. Blast radius: 9 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`BigReader`	read	reads big files
`ContextProbe`	read	captures context
`Debugger`	read	Diagnoses test failures and iteratively applies fixes
`Debugging`	read	Diagnose and fix test failures and runtime errors
`Delegate`	read	Fans out sub-agent delegation specs in parallel with fresh isolated contexts and aggregates their summary results
`FakeFail`	read	Fake failing sub-agent
`FakeWorker`	read	Fake sub-agent
`FileReader`	read	reads files
`Formatter`	read	Custom description
`GPT-4o`	read	OpenAI flagship model
`Gen`	read	Gen
`Git`	write	Manages git operations (branch, commit, PR)
`GitLab`	read	Manages GitLab operations (MR, issues, comments, pipelines)
`Hanging`	read	Never resolves
`MCP`	read	Invokes MCP (Model Context Protocol) tools from connected servers
`Package`	write	Manages package version, build, and npm publish
`Planner`	read	Analyzes user goals and creates detailed execution plans
`Reasoner`	read	Makes technical decisions (language, framework, platform) before planning
`Refactoring`	read	Restructure existing code without changing behavior
`Reviewer`	read	Validates code changes for correctness, security, and quality
`Runner`	read	Executes shell commands and captures output
`S`	read	d
`Security`	read	Scans for PII, prompt injection, and dangerous code patterns
`SkillRunner`	read	Executes a compiled skill as a pre-filled task plan
`Tester`	read	Runs tests in a sandboxed environment
`Throwing`	write	Throws on execute
`Writer`	read	Generates code changes based on the plan and context
`a11y-audit`	read	Audit web applications for accessibility (WCAG 2.1 AA compliance): check color contrast, keyboard navigation, screen-reader compatibility, ARIA attributes, and semantic HTML. Use when the goal asks to audit, fix, or improve accessibility.
`academic-research`	read	Conduct academic literature research: paper discovery, citation analysis, systematic reviews, and research summaries. Use when the goal is to review academic literature on a topic.
`accounting-integration`	read	Integrate accounting software: QuickBooks, Xero, or FreshBooks API integration for invoices, expenses, and financial reporting. Use when the goal is to sync financial data with an accounting system.
`action`	write	Docker action to perform: run \| stop \| start \| restart \| exec \| logs \| build \| pull \| compose-up \| compose-down \| compose-ps \| disk-usage \| cleanup \| health
`add_memory`	write	Add a new memory entry (fact, preference, lesson, observation, pattern).
`agent-pack`	read	Multi-agent package structure for distributing multiple agents together
`alertChannel`	read	Alert notification channel
`algorithm`	read	Algorithm
`ansi_strip`	read	Strip ANSI escape codes from text.
`api-creation`	write	Create a complete API: design endpoints, implement routes, add auth/rate-limiting, write tests, generate OpenAPI docs, and deploy. Use when the goal asks to create an API, build a backend service, or scaffold an HTTP server with routes.
`api-design`	read	Design and implement a REST API: gather requirements, design endpoints with proper HTTP methods/status codes, produce an OpenAPI spec, implement routes, and write integration tests. Use when the goal asks to create an API, design endpoints, build a REST service, or scaffold an HTTP backend.
`api-testing`	write	Test REST and GraphQL APIs: write automated tests for endpoints, validate status codes, response schemas, auth flows, and edge cases. Use when the goal asks to test, validate, or verify an API.
`api-versioning`	read	Implement API versioning: URL path, header, or content-type versioning with deprecation notices and migration guides. Use when the goal asks to version an API, handle breaking changes, or add deprecation notices.
`approach`	write	Sync approach
`approval`	read	Request approval before dangerous operations.
`approval-tool`	read	Implement approval workflows: request approval before dangerous actions, track approval decisions, and enforce approval policies. Use when adding safety gates to agent operations.
`ask`	read	Ambiguous request — fall back to a chat answer; no pipeline runs on a guess
`assess`	read	Answer a question or analyze/explain something — a direct chat response, no file writes
`ast_audit`	read	AST-based code audit: detect eval(), hardcoded secrets, SQL injection patterns.
`async_delegation`	write	Run child agents in background without blocking parent — parallel task execution.
`audience`	read	Target audience (default: API consumers)
`auth`	read	Authentication method
`auth-setup`	read	Implement authentication and authorization: OAuth2 (Google, GitHub), magic links, JWT sessions, role-based access control. Use when the goal asks to add login, signup, auth, SSO, or RBAC to an app.
`authType`	read	Authentication method (default: API key)
`autonomous-agents`	write	Design, build, and deploy autonomous AI agents with tool use, memory, planning loops, and self-correction. Use when the goal is to create an agent that can reason, act, and iterate without constant human oversight.
`backend`	read	Cache backend
`backup-recovery`	read	Design and implement backup and disaster recovery: automated database backups, point-in-time recovery, S3 snapshots, and runbook documentation. Use when the goal asks to set up backups, recovery, or disaster resilience.
`backup-strategy`	write	Design and implement backup strategies. Use when the goal asks to set up backups, disaster recovery, or data protection.
`baseImage`	read	Base Docker image (auto-detected from project language if not specified)
`basic-agent`	read	Minimal agent with package.json, tsconfig, and source file
`binary-extensions`	read	Detect and handle binary file extensions: identify binary vs text files, handle binary content appropriately, and configure editors/tools to skip binary files. Use when processing mixed file types in a codebase.
`binary_extensions`	read	Detect binary file extensions, check MIME types.
`blob-storage`	write	Set up blob/file storage: S3, Cloudflare R2, or Azure Blob for uploads, assets, and backups. Use when the goal asks to add file uploads, cloud storage, or asset hosting.
`budget-config`	read	Configure and manage budgets: API usage tracking, cost alerts, spending limits, and billing optimization. Use when setting up cost controls for API usage or cloud resources.
`budget_config`	destructive	Budget management: check limits, record usage, reset daily.
`build`	read	Generate new code, files, projects, plugins or addons through the full agent pipeline
`cache-setup`	write	Set up caching: Redis, Memcached, or in-memory caching for API responses, sessions, and expensive computations. Use when the goal asks to add caching, improve response times, or reduce database load.
`cached_tool`	read	From last time.
`capacity-planning`	read	Capacity planning: load testing, performance baselines, growth forecasting, and scaling strategies. Use when planning for system growth.
`cdn-setup`	write	Configure CDN for static assets. Use when the goal asks to set up CDN, optimize asset delivery, or reduce latency.
`channels`	read	Notification channels
`chaos-engineering`	read	Practice chaos engineering: inject faults, measure resilience, and improve system reliability. Covers experiment design, fault injection (network, CPU, memory), and blast radius control. Use when testing system resilience.
`checkpoint`	write	Save and restore execution state for rollback.
`checkpoint-manager`	write	Manage code checkpoints: save progress snapshots, rollback to checkpoints, compare versions, and restore state. Use when building safety nets for complex refactoring or migration tasks.
`ci-cd-setup`	write	Set up CI/CD: detect the platform and project stack, write the workflow/pipeline file, configure secrets, trigger a test run, and verify the pipeline passes. Use when the goal asks to set up CI/CD, add GitHub Actions, configure pipelines, automate tests, or set up continuous integration.
`cicd-advanced`	read	Advanced CI/CD pipelines: multi-stage builds, canary deployments, rollback strategies, artifact management, and pipeline optimization. Use when building sophisticated deployment pipelines.
`cli-tool`	write	Create a command-line tool with argument parsing, help text, subcommands, and packaging. Use when the goal asks to create a CLI tool, command-line utility, or terminal application.
`cloud-deploy`	write	Deploy applications to AWS, GCP, or Azure. Use when the goal asks to deploy, host, or infrastructure-as-code for cloud platforms.
`cloud-migration`	read	Migrate applications to the cloud: assessment, planning, containerization, deployment, and optimization. Covers AWS, GCP, and Azure migration paths. Use when moving on-premise applications to cloud infrastructure.
`code-assist`	read	Assist with code edits
`code-refactor`	read	Refactor code safely: analyze the target, identify patterns to improve, plan the changes, apply the refactoring surgically, and verify with tests. Use when the goal asks to refactor, restructure, extract, inline, rename, clean up, or improve code organization.
`code-review`	read	Conduct thorough code reviews: correctness, security, performance, readability, and test coverage. Covers review checklists, constructive feedback, and automated review tools. Use when reviewing pull requests or code changes.
`command`	write	Command to execute in container (for exec action)
`commandName`	read	The command name
`compliance-check`	read	Check regulatory compliance: GDPR, HIPAA, SOC2, PCI-DSS. Covers requirements mapping, gap analysis, control implementation, and audit preparation. Use when ensuring an application meets compliance standards.
`configure`	write	Set up API keys, switch providers/models, or change configuration
`container`	read	Container name (required for most actions)
`container-security`	read	Container security: image scanning, runtime protection, network policies, and secrets management. Use when securing containerized applications.
`container-supervision`	read	Monitor and supervise Docker container health: check health status, configure restart policies, set up health checks, auto-restart unhealthy containers, and log container events. Use when the goal is to ensure containers stay running and recover from failures.
`context7`	read	Up-to-date library/framework documentation retrieval
`cors-setup`	read	Configure CORS: cross-origin resource sharing for APIs, web apps, and embedded content. Use when the goal asks to fix CORS errors, configure cross-origin access, or set up CORS headers.
`cost-optimization`	read	Cloud cost optimization: right-sizing, reserved instances, spot instances, resource tagging, and cost monitoring. Use when optimizing cloud spending.
`crash`	read	Crashes on call
`create_issue`	write	Create an issue.
`credential_files`	read	Manage credential files for remote terminal backends — Docker, SSH, Modal.
`cron-job`	write	Set up scheduled tasks and cron jobs. Use when the goal asks to automate recurring tasks, schedule jobs, or set up crons.
`cron-setup`	write	Set up scheduled tasks and cron jobs: periodic reports, cleanup jobs, data sync, and monitoring probes. Use when the goal asks to schedule tasks, set up cron jobs, or automate periodic work.
`cronjob`	destructive	Cronjob management: create, list, enable, pause, delete jobs.
`cross-platform-build`	read	Build cross-platform applications: shared codebase targeting web, desktop (Electron/Tauri), and mobile (React Native/Flutter). Covers platform detection, shared logic, and platform-specific adaptations. Use when building for multiple platforms from one codebase.
`daemon_pool`	write	Background daemon process management: register, start, stop, monitor health.
`data-analysis`	read	Analyze datasets, identify trends, generate insights, and produce visualizations (charts, summaries, dashboards). Use when the goal asks to explore, analyze, summarize, or visualize data from CSV, JSON, databases, or APIs.
`data-governance`	read	Data governance: policies, access controls, compliance, and stewardship. Use when implementing data governance frameworks.
`data-lineage`	read	Data lineage tracking: origin, transformations, dependencies, and impact analysis. Use when tracking data flow through systems.
`data-migration`	write	Plan and execute data migrations: schema mapping, ETL pipelines, validation, rollback strategies, and zero-downtime migrations. Use when moving data between systems or databases.
`data-processing`	read	Process and transform data using Pandas, NumPy, or Polars. Use when the goal asks to clean, transform, aggregate, or analyze datasets.
`data-quality`	read	Data quality management: validation rules, profiling, cleansing, and monitoring. Use when ensuring data accuracy and completeness.
`data-sync`	write	Set up data synchronization between systems: ETL pipelines, API sync, database replication, and real-time streaming. Use when the goal asks to sync data, build ETL pipelines, or connect data sources.
`data-visualization`	write	Create data visualizations: charts, dashboards, interactive plots with D3.js, Plotly, Matplotlib, or Chart.js. Covers data transformation, chart selection, accessibility, and export. Use when the goal is to visualize data.
`database`	read	Database to use
`dbType`	read	Database type (auto-detected from project config if not specified)
`debug`	read	Debug helpers: analyze errors, capture hook output.
`debug-helpers`	read	Debug application issues: breakpoints, logging, profiling, memory analysis, and network inspection. Covers Chrome DevTools, Node.js inspector, and language-specific debuggers. Use when diagnosing bugs or performance issues.
`decision-framework`	write	Apply structured decision-making frameworks: RICE scoring, weighted matrix, decision trees, and ADR (Architecture Decision Records). Use when the goal is to make a systematic, well-documented technical or product decision.
`delegate`	read	Spawn a specialized sub-agent (context-gatherer, reviewer, security, tester, ...) with a fresh isolated context to work on a focused subtask. Returns the sub-agent summary result.
`delegate_system`	write	Full delegation: spawn subagents, batch execute. REQUIRES a child executor to be wired in — without one
`delegation-live-log`	read	Monitor delegated tasks in real-time: live log streaming, progress tracking, and status updates. Use when supervising background tasks or parallel agent operations.
`delegation_live_log`	read	Live tail-able transcripts for delegated subagents — real-time monitoring.
`delete_memory`	destructive	Delete a memory by ID.
`demo-fix`	read	Fix a demo issue
`dep-update`	write	Update dependencies safely: audit for outdated versions and vulnerabilities, select update targets, update, run tests, fix breakages, and document changes. Use when the goal asks to update deps, upgrade packages, fix vulnerabilities, or modernize dependencies.
`dependency-audit`	read	Audit project dependencies for vulnerabilities, outdated versions, license compliance, and supply chain risks. Use when ensuring dependency health and security.
`deploy-site`	write	Deploy a static site to Cloudflare Pages
`description`	read	Project description
`design-system`	read	Build a component library / design system: tokens, base components, composition patterns, documentation, and testing. Use when the goal asks to create a design system, component library, or shared UI kit.
`disaster-recovery`	read	Disaster recovery planning: backup strategies, failover mechanisms, RTO/RPO targets, and DR testing. Use when planning for system resilience.
`discord-bot`	read	Build a Discord bot with slash commands, embeds, buttons, modals, and event handlers. Covers bot setup, permission configuration, deployment, and hosting. Use when the goal is to create a bot for a Discord server.
`dns-setup`	write	Configure DNS records and domains. Use when the goal asks to set up DNS, configure domains, or manage DNS records.
`docker-config`	write	Configure Docker for a project: analyze dependencies, write a multi-stage Dockerfile, optimize layer caching, test the build, and optionally add docker-compose. Use when the goal asks to containerize, add Docker, create a Dockerfile, or set up docker-compose for local development.
`echo`	read	Echo back input text
`edit_file`	write	Edit a file
`electron-app`	read	Build an Electron desktop application: main process, renderer process, IPC communication, auto-updates, and native modules. Use when creating a desktop application with web technologies.
`email-setup`	write	Set up transactional email: design responsive HTML templates, configure SMTP/API delivery (SendGrid, Resend, Mailgun, Postmark), and build email sending functions. Use when the goal asks to send emails, build email templates, or configure email delivery.
`engine`	read	Search engine
`env-setup`	write	Set up a development environment: detect the stack, install dependencies, configure services, verify everything works, and document the setup. Use when the goal asks to set up the environment, configure dev tools, bootstrap a project, or get the project running locally.
`env_probe`	read	Probe environment variables and credential files.
`error-tracking`	write	Set up error tracking: Sentry, Bugsnag, or Rollbar for frontend and backend error monitoring. Use when the goal asks to add error tracking, exception monitoring, or crash reporting.
`feature-engineering`	read	Engineer features for ML: encoding, scaling, selection, transformation, and feature stores. Use when preparing data for machine learning models.
`feature-flags`	read	Implement feature flags: LaunchDarkly, Unleash, or custom flags for gradual rollouts, A/B testing, and kill switches. Use when the goal asks to add feature flags, gradual rollouts, or toggle features.
`featureName`	read	Name of the feature
`fetch`	read	Fetch a URL and convert it to readable markdown
`filesystem`	write	Filesystem access (read/write/search within allowed roots)
`fine-tuning`	read	Fine-tune LLMs: data preparation, training config, training loop, evaluation, and deployment. Use when the goal is to customize a base model for a specific task or domain.
`fitness-api`	read	Build a fitness API: workout tracking, exercise database, nutrition logging, and progress analytics. Use when creating a fitness or wellness application backend.
`fixture-skill`	read	A fixture skill for render tests
`focus`	read	Optional comma-separated dimension focus (e.g. security, performance)
`forensics`	read	Digital forensics: evidence collection, chain of custody, analysis, and reporting. Use when investigating security incidents.
`form-builder`	read	Build dynamic forms: validation, conditional fields, multi-step wizards, and file uploads. Use when the goal asks to create forms, add form validation, or build multi-step forms.
`format`	read	Output format (default: markdown)
`framework`	read	HTTP framework (auto-detected from package.json if not specified)
`full-agent`	read	Complete agent with package.json, tsconfig, vitest, source, and unit tests
`game-development`	write	Create a GUI game with graphics, input handling, game logic, and packaging. Use when the goal asks to create, build, or develop a game (board games, card games, puzzle games, 2D games, snake-and-ladder, tic-tac-toe, chess, etc.).
`gameType`	write	Type of game to create
`git-release`	read	Manage git releases: changelog generation, semantic versioning, release branches, tagging, and publishing to package registries. Use when the goal asks to cut a release, create a changelog, or publish a package.
`github`	read	GitHub API via MCP (repos, issues, PRs, search)
`github-actions`	write	Set up GitHub Actions CI/CD workflows. Use when the goal asks to automate testing, building, or deployment via GitHub Actions.
`goal`	write	The goal to plan and execute
`graphql-api`	read	Design and implement GraphQL APIs: schema definition, resolvers, subscriptions, N+1 prevention, and query complexity limiting. Use when the goal asks to build a GraphQL API or migrate from REST to GraphQL.
`greet`	read	Greet a user by name
`group-policy`	read	Manage Group Policy: Local Group Policy Editor, GPO creation, policy deployment, and troubleshooting. Use when configuring Windows security and administrative policies.
`haunt`	read	Haunt.
`health-data`	read	Integrate health data APIs: Apple HealthKit, Google Fit, or Fitbit for reading and writing health metrics. Covers authorization, data types, and privacy compliance. Use when building health or wellness applications.
`horizon`	read	Roadmap horizon, e.g.
`i18n-setup`	write	Set up internationalization (i18n): extract translatable strings, configure a translation framework, and add RTL support. Use when the goal asks to add multi-language support, translations, or localization.
`image-optimize`	read	Optimize images for web: compress, resize, convert formats (WebP, AVIF), generate thumbnails, and set up responsive images. Use when the goal asks to optimize images, reduce image size, or add responsive images.
`incident-response`	read	Incident response procedures: detection, containment, eradication, recovery, and post-incident review. Use when responding to security incidents.
`infra-as-code`	read	Define infrastructure with code: Terraform, Pulumi, or CloudFormation. Covers modules, state management, drift detection, and multi-environment setups. Use when the goal is to provision or manage cloud infrastructure.
`infra-monitoring`	read	Infrastructure monitoring setup: Prometheus, Grafana, alerting rules, dashboards, and SLI/SLO tracking. Use when setting up observability for production systems.
`interrupt`	write	Global interrupt: stop all running operations or interrupt a specific task.
`kafka-queue`	write	Set up Kafka message queues. Use when the goal asks to add event streaming, message queues, or async processing with Kafka.
`kanban-board`	destructive	Build a Kanban board: drag-and-drop columns, WIP limits, swimlanes, and workflow automation. Use when creating a visual project management tool.
`knowledge`	read	Work with the USER\
`knowledge-base`	read	Build a knowledge base system: document ingestion, search, versioning, and collaborative editing. Use when the goal is to create a searchable knowledge repository for a team or product.
`kubernetes`	write	Configure and manage Kubernetes clusters. Use when the goal asks to deploy, scale, or manage containerized applications on Kubernetes.
`language`	read	Language/runtime (auto-detected from project if not specified)
`languages`	read	Languages/runtimes to test (auto-detected from project if not specified)
`lazy_deps`	read	Lazy dependency loading — only imports heavy modules when invoked, reducing startup time.
`legal-compliance`	write	Add legal compliance: privacy policy, terms of service, cookie consent, GDPR/CCPA data handling, and cookie banners. Use when the goal asks to add legal pages, privacy policy, cookie consent, or compliance with privacy regulations.
`library`	read	PDF library
`list_dir`	read	list
`list_files`	read	List files and directories in a path. Useful for discovering project structure.
`list_repos`	read	List repos.
`live_tool`	read	From right now.
`load-balancer`	read	Configure load balancing with Nginx, HAProxy, or cloud LBs. Use when the goal asks to distribute traffic, set up health checks, or configure failover.
`log-rotation`	write	Set up log rotation and management. Use when the goal asks to configure log rotation, manage log files, or prevent disk filling.
`logo-design`	read	Generate logos and brand assets using SVG, canvas, or AI image generation. Covers logo concepts, color palettes, typography, SVG creation, and export formats. Use when the goal is to create a logo or visual brand identity.
`managed_gateway`	read	Managed tool gateway: call vendor APIs through proxy.
`marketplace-skill`	read	A marketplace skill
`mcp-client`	read	Build an MCP client: connect to MCP servers, discover tools/resources, and execute operations. Covers server management, tool calling, and resource reading. Use when your agent needs to consume MCP servers.
`mcp-connector`	read	Bridge APIs to MCP: wrap existing REST/GraphQL APIs as MCP servers with auto-generated tool schemas. Use when you need to expose an existing API to AI agents without rewriting it.
`mcp-server`	read	Build a Model Context Protocol (MCP) server: expose tools, resources, and prompts to AI agents via the MCP standard. Covers stdio and HTTP transports, tool definitions, resource URIs, and OAuth. Use when making your service available to AI agents.
`mcp_oauth`	read	MCP OAuth2 authentication: authorize MCP servers via auth code, client credentials, or PKCE flows.
`mcp_schema_cache`	read	MCP schema cache: cache tool schemas for faster discovery, invalidate cache.
`mcp_watchdog`	write	MCP stdio watchdog: monitor MCP server process health, auto-restart crashed servers.
`memory`	read	Knowledge-graph based persistent memory (entities, relations, observations)
`memory-tool`	read	Manage agent memory: store and retrieve facts, preferences, and context across sessions. Covers short-term (working memory) and long-term (persistent) memory with semantic search. Use when the agent needs to remember information across interactions.
`micro-frontend`	write	Set up micro-frontends: module federation, iframes, or Web Components for independent team deployments. Covers routing, shared state, and communication between micro-frontends. Use when scaling frontend development across teams.
`migrationTool`	read	Migration tool (auto-detected from project if not specified)
`ml-model`	read	Build and train ML models using scikit-learn, TensorFlow, or PyTorch. Use when the goal asks to train, evaluate, or deploy machine learning models.
`mlops`	write	Set up ML operations: model training pipelines, experiment tracking, model registry, deployment, monitoring, and drift detection. Use when the goal is to operationalize ML models for production.
`mobile-bridge`	read	Bridge web and native mobile: Capacitor, Cordova, or React Native bridge for accessing native device features from web code. Use when adding native mobile capabilities to a web application.
`mode`	read	Integration mode
`model`	read	Tenancy model
`monitoring-setup`	write	Set up application monitoring: structured logging, metrics collection, alerting rules, and health checks. Use when the goal asks to add logging, monitoring, observability, or alerting.

Trust audit

BLOCKgrade F · trust 24/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (17 observation(s))
Network: declared (17 observation(s))
Shell: declared (10 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

.agents/skills/api-design/SKILL.md:426

.send({ email: "[email protected]", password: "password" });

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

.agents/skills/teams-webhook/SKILL.md:39

4. [reviewer] Test: send test webhook, verify card rendering, test bot conversation, verify message extension, check authentication flow. (after: step-2)

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/config/workspace.ts:42

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/learning/eval-framework.ts:564

'    const result = new Function(\'return (\' + expression + \')\')();',

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/memory/better-sqlite3.d.ts:3

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/skills/bundled-skills.ts:621

'- unsafe deserialization: JSON.parse on untrusted input without schema validation, pickle.loads, eval()',

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/tools/registry.ts:2532

description: 'AST-based code audit: detect eval(), hardcoded secrets, SQL injection patterns.',

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/agents/agents/security-agent.ts:45

'~/.ssh/',