Atlas / MCP servers / interactive-inc / Open Claude Funnel

Open Claude FunnelBLOCK

mcp/interactive-inc/open-claude-funnel
Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
10 8r · 2w · 0d
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/@interactive-inc/claude-funnel) [](./LICENSE)

Slack のメンション、GitHub の Issue、毎朝 9 時の cron。こうした外部の出来事を Claude Code エージェントに届け、エージェントの返信を同じ経路で外へ返すハブ。

Slack    ─┐                       ┌─→  Claude エージェント A
GitHub   ─┤                       │
Discord  ─┼──→  funnel daemon  ──→┼─→  Claude エージェント B
cron     ─┘                       │
└─→  Claude エージェント C

funnel daemon が外部接続を1か所に常駐保持し、購読中の各エージェントへ配信する。
返信は同じコネクタを逆向きに通る(エージェント → MCP tool → 外部サービス)。

コマンドは funnel(短縮形 fnl)。Claude Code を中心に作っているが、アーキテクチャはエージェント非依存。現在のバージョンは 0.53.0。

funnel がやること

  • 外部の出来事(チャットのメンション、新しい Issue、cron の tick)を、起動中のエージェントセッションにそのまま届ける
  • エージェントの返信を受信と同じコネクタで外へ返す。bash サブシェルも CLI のコールドスタートもなく、実質同期
  • 外部接続は常駐デーモンが 1 か所で持つ。エージェントを何個起こしても接続は 1 回だけ。ヘルスチェックと自動再起動で監視する
  • 複数のエージェントで 1 つのソースを共有(fanout)するか、ワーカーとして分担(exclusive)するかを選べる

対応コネクタは Slack(Socket Mode)、GitHub(gh 経由の poll)、Discord(Gateway)、cron スケジュールの 4 種類。

必要なもの

  • Bun 1.3 以降
  • Claude Code CLI
  • 接続する外部サービスのトークンまたは CLI(Slack アプリ、gh 認証、Discord bot など)

リポジトリで使う(推奨)

設定を funnel.json としてリポジトリに commit し、チームで共有・バージョン管理できる。グローバルに何も入れないので、リポジトリの lock ファイルでバージョンが固定される。

インストール

bun add -D @interactive-inc/claude-funnel

これで bunx funnel(または bunx fnl)が使える。

設定

リポジトリ直下に funnel.json を置く。transport(channels[])と起動レシピ(profiles[])を宣言する。

{
"$schema": "./node_modules/@interactive-inc/claude-funnel/funnel.schema.json",
"channels": [
{
"name": "ops",
"connectors": [{ "type": "slack", "name": "my-slack" }]
},
{
"name": "review"
}
],
"profiles": [
{
"name": "pm",
"channel": "ops",
"options": ["--brief", "--agent", "pm"],
"e
Read from source at commit 8e17f4a94117OBSERVED · 2026-10-12
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add claude-funnel --env FUNNEL_GATEWAY_TOKEN=${FUNNEL_GATEWAY_TOKEN} -- npx -y @interactive-inc/[email protected]
claude-desktop
{
  "mcpServers": {
    "claude-funnel": {
      "command": "npx",
      "args": [
        "-y",
        "@interactive-inc/[email protected]"
      ],
      "env": {
        "FUNNEL_GATEWAY_TOKEN": "${FUNNEL_GATEWAY_TOKEN}"
      }
    }
  }
}
03

Exposed tools (10)

8 read · 2 write · 0 destructive.

ToolRiskDescription
fnl_connection_errorsreadReturn listener connection lifecycle errors (auth-failed / error). Use when a listener never connects or keeps disconnecting — the detail field carries the upstream error message.
fnl_connection_timelinereadFull connection lifecycle (started / connected / disconnected / stopped + auth-failed / error). Use when fnl_connection_errors only shows the failure but you need to see how the listener got there — was it ever connected, is it flapping, how many reconnects.
fnl_debugreadReturn a full channel diagnosis as JSON — gateway health, listeners, Claude WS connection, last 5 inbound events, connection errors (when listener is dead), and
fnl_docsreadReturn embedded funnel documentation. Without
fnl_doctorwriteDiagnose every channel and optionally apply safe self-healing fixes. Returns { status (ok|warn|error), message, appliedActions[], remainingIssues[], before, after }. When status is
fnl_dropped_eventsreadReturn events that were filtered out (outcome starts with
fnl_raw_eventsreadReturn raw inbound rows the connector recorded BEFORE any processing. Use when fnl_dropped_events and fnl_recent_events both come up empty — this is the table that captures every event the listener ever saw, including ones it dropped pre-processor (envelope shape change, pre-READY, malformed).
fnl_recent_eventsreadReturn the last N processed events for a channel as JSON, with
fnl_replay_eventwriteRe-publish a past event back into a channel so subscribers receive it again. Call after applying a fix to verify Claude handles the previously-failed event correctly. Without
fnl_statusreadReturn the gateway status as JSON — gateway running state, every listener
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (4 observation(s))
Shell
declared (2 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (8)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
vitest.setup.ts:18
exec() {}
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
lib/engine/http/gateway-base-url.ts:10
return `http://127.0.0.1:${port}`
LOWInventory / provenance · inv.hidden_file · CWE-1104
public/.nojekyll
.nojekyll
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:129
- HTTP(publisher / listeners client / MCP channel server)— loopback base は `gatewayLoopbackUrl(port)` に一元化。`http://127.0.0.1:${port}` を直書きしない
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
CLAUDE.md:290
`Bun.serve` で WebSocket と内部管理 API を同一ポートにホストする daemon。listener registry、broadcaster、event log、フラットなルート群を抱える。CLI から listener 操作のために `http://127.0.0.1:9742` を叩くのは gateway 経由のみ。
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:331
- `FUNNEL_GATEWAY_URL` — MCP が WS 購読と HTTP 返信の両方で使うデーモンのベース URL(デフォルト `http://127.0.0.1:<port>`)
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:408
const base = gatewayLoopbackUrl(9743) // → http://127.0.0.1:9743
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@interactive-inc/flume, @modelcontextprotocol/sdk, hono, yaml, zod, @types/bun, @typescript/native-preview, vite-plus
Why it matters. 9 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 8e17f4a94117full audit observations/trust-audit/mcp-server/interactive-inc__open-claude-funnel.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-128e17f4a94117BLOCKD69first audit
06

Questions

What tools does @interactive-inc/claude-funnel expose?

10 in total: 8 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @interactive-inc/claude-funnel safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does @interactive-inc/claude-funnel need?

It reads FUNNEL_GATEWAY_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @interactive-inc/claude-funnel run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @interactive-inc/claude-funnel at 0.71.4.

How current is this page?

The grade is for one exact copy of the source (8e17f4a94117), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement