Atlas / MCP servers / itlackey / akm-cli

akm-cliBLOCK

Name: akm-cli
Author: itlackey

mcp/itlackey/akm

MCP server by itlackey · agent kit manager · agent tools · ai agents · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Agent Knowledge Manager (akm). A CLI tool to manage AI agent knowledge, memories, skills, and more.

Verdict

BLOCK

Grade

Trust score

34 /100

Exposed tools

126 90r · 34w · 2d

Transport

—

License

MPL-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/akm-cli) [](https://github.com/itlackey/akm/actions/workflows/ci.yml) [](LICENSE)

Give every coding agent the capabilities your team has already built.

Build your agent library once. Use it from any shell-capable coding agent.

Why AKM exists

Every coding agent wants its own copy of your team's knowledge — an AGENTS.md here, a tool-specific skills folder there, prompts scattered across repos and chat logs. AKM indexes existing agent assets in place, loads only what a task needs, packages capabilities into shareable bundles, improves the library through reviewable proposals, and runs durable workflows — locally and without tying the library to one assistant. The core loop is connect -> index -> curate -> show -> use/run -> feedback -> proposal (not every task uses every stage).

Five reasons to use it

One library for every agent

Use the same capability library from Claude Code, OpenCode, Cursor, Aider, Windsurf, or any assistant that can run shell commands.

Load only what the task needs

Search or curate a shortlist, then load full content by ref. No giant startup prompt is required.

Package complete capabilities

Install and share bundles containing skills, scripts, workflows, agents, instructions, memories, and knowledge — not just prompt snippets.

Improve through evidence, with review

Feedback re-ranks assets right away. A negative report can carry an exact text fix, and akm improve repairs metadata; every edit lands as a diffable proposal you accept, reject or revert, and only writable bundles are changed.

Turn knowledge into repeatable work

Run persisted workflows with dispatch, gates, retries, budgets, and resume instead of reconstructing a process from prose every session.

AKM retrie

Read from source at commit 400ad4047f3eOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add akm-cli --env AKM_EMBED_API_KEY=${AKM_EMBED_API_KEY} --env AKM_LLM_API_KEY=${AKM_LLM_API_KEY} --env AKM_PIPELINE_TEST_KEY=${AKM_PIPELINE_TEST_KEY} --env AKM_PROBE_KEY_TEST=${AKM_PROBE_KEY_TEST} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "akm-cli": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AKM_EMBED_API_KEY": "${AKM_EMBED_API_KEY}",
        "AKM_LLM_API_KEY": "${AKM_LLM_API_KEY}",
        "AKM_PIPELINE_TEST_KEY": "${AKM_PIPELINE_TEST_KEY}",
        "AKM_PROBE_KEY_TEST": "${AKM_PROBE_KEY_TEST}"
      }
    }
  }
}

Exposed tools (126)

90 read · 34 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`SKILL.md`	read	Curated review workflow
`abandon`	write	Give up on a workflow run: mark it failed so it stops counting as active (resume can reopen it)
`accept`	read	Accept a proposal and promote it into the bundle
`add`	write	Add a registry by URL
`agent`	read	Dispatch an agent CLI (opencode, claude, ...) with an optional agent persona and model defaults. Use --prompt for work; stored commands run through akm command run. Nonempty tool requests require separate operator authorization and are rejected by the current CLI.
`agent-skills`	read	Production-ready agent skills
`agents`	read	Print agent instructions on how to use akm — the short guide by default; pass --full for the complete guide
`alpha`	read	twinmarker
`alpha-deploy`	write	deploy the alpha cluster
`apply`	write	Back up and apply every pending migration (
`atomic-publish`	write	uniquefoundationmarker
`atomic-rollback`	read	rollbackfoundationmarker
`auth-uses-jwt`	read	Auth pipeline uses JWT tokens with 24h TTL instead of session cookies.
`auth-uses-jwt-24h`	read	Auth pipeline uses JWT tokens with 24h TTL — switched from session cookies in May.
`azure-ops`	read	Azure ops kit
`bad-type`	read	Description that
`batch`	read	Implement a batch of independent work items in parallel worktrees (Sonnet), review each as it lands (Sonnet), integrate and gate once, then one Opus/Fable final review that loops back with a brief of its findings
`bravo-backup`	read	nightly backup routine
`bundle`	write	Create, add to, inspect, and manage your bundles (working bundle + configured sources)
`cache-pruner`	read	Removes expired build artifacts
`café-déploiement`	read	Orchestration naïve à Montréal
`charlie-cache`	read	cache warming
`claude-prefs.derived.md`	read	Distilled Claude style preferences: three-space indent, no semicolons, prefer TypeScript.
`claude-prefs.md`	read	Use three-space indent and no semicolons.
`cli-configured-only`	read	only discoverable through the configured registry
`clone`	read	Clone an asset from any source into a managed bundle or an unmanaged custom destination
`code-review`	read	Automated code review skill
`command`	write	Run reusable agent prompt templates through AKM
`completions`	write	Generate or install shell completion script
`config`	read	Show and manage configuration
`copy-defaults`	read	Copy AKM
`create`	write	Create an env file (empty by default; seed an existing
`curate`	read	Pick the assets worth loading for a task. Unlike
`deploy`	write	exact match
`deploy-guide`	write	deploy applications safely
`deploy-stash`	write	Registry deploy stash
`deploy.sh`	write	Deploy the application
`deployment-helper`	read	partial
`diff`	read	Show effective-config differences against another config file or bundle-relative file, secrets redacted
`disable`	write	Disable a task in this host
`doctor`	read	Report the active scheduler backend, akm bin path, log dir, and supported schedule subset
`drain`	read	Drain the pending proposal backlog: accept what a quality judge passed, reject empty diffs, leave the rest for judgment or review
`enable`	write	Enable a task in this host
`env`	read	Manage
`environment`	read	Target environment
`explain`	read	Print a task
`export`	write	Write safe
`extract`	read	Experimental: extract durable insights from native session files (claude, codex, opencode) and queue them as proposals.
`fact-1`	read	Description of length above 20 characters for the schema check to pass.
`feedback`	read	Record positive or negative feedback for any indexed bundle asset.\n\n
`field-notes`	read	Assorted operational observations
`frozen-triage`	read	Frozen extract settings remain stable throughout a long-running watch invocation.
`generic-agent-utils`	read	Utility functions for agent development
`get`	read	Get a configuration value by key
`good.sh`	read	Valid asset
`guide`	read	Manual guide
`health`	read	Check akm runtime health, artifacts, and improve metrics
`help`	read	Print the command overview, detailed help for a command, agent instructions, or a release
`hints`	read	Print agent instructions on how to use akm — the complete guide by default; pass --detail brief for the short one
`history`	write	Show recent task run history
`image_name`	write	Docker image name to deploy
`import`	write	Import a knowledge document or URL into the default bundle
`improve`	read	Analyze existing AKM assets and generate improvement proposals; also consolidates memories when the selected strategy enables consolidate.
`index`	read	Build search index (incremental by default; --full forces full reindex)
`info`	read	Show system capabilities, configuration, and index stats
`inputFile`	read	Path to the input CSV file
`layout-21`	read	kept across the upgrade
`list`	read	List current configuration
`log`	read	List events from the append-only state.db events stream
`lonely-pref.md`	read	Always prefix branch names with feat/.
`malformed-quoted-wrapped`	read
`metrics`	read	Experimental: report asset usage, feedback, utility, LLM usage, tasks, proposals and workflow spend from local records. Read-only. --format html writes a self-contained dashboard.
`migrate`	read	Print release notes and migration guidance for a version. Bundled notes live in docs/migration/release-notes/<version>.md; an unknown version lists what
`missing-wtu`	read	This is a valid-length description that does not specify when to use the lesson.
`models`	read	Inspect and customize model intent alias defaults
`my-tool`	read	A useful tool
`nested-atomic-rollback`	read	nestedrollbackmarker
`new`	read	Ask the configured engine to author a brand-new asset as JSON and queue it as a proposal
`new-note`	read	Added after the upgrade.
`no-desc`	read
`no-trigger`	write	This is a valid-length description for the memory candidate in the test.
`ok-name`	read	This is a valid-length description for the memory candidate in the test.
`only-stash`	read	only one
`outputFormat`	read	Output format (json, xml, yaml)
`over`	read	Description that
`path`	read	Show paths to config, bundle, cache, and index
`plain-wrapped`	read	The release gate runs on localhost:5173 and preserves the complete description across physical lines.
`plan`	read	Compile and freeze a workflow WITHOUT publishing it: the canonical step graph, per-step frozen target
`port-inform-phase`	write	Run one phase of the inform→akm port under the plan\
`proposal`	read	Manage the proposal queue: list, show, diff, accept, reject, reopen, revert, extract, new, drain
`prune`	destructive	Remove installed scheduler entries
`region`	read	deployment region
`registry`	read	Manage bundle registries
`reject`	read	Reject a proposal and record the reason
`release-policy`	read	Release policy for production deploys
`release-stash`	read	github description
`remember`	read	Record a memory in the default bundle
`remove`	destructive	Remove an env file (and its .sensitive marker, if any)
`rename`	write	Rename a configured bundle
`reopen`	write	Reopen rejected proposals: move them back to pending, keeping the rejection in their history.
`resume`	write	Resume a blocked or failed workflow run, flipping it back to active
`revert`	read	Revert an accepted proposal: restore the prior asset content from the backup captured at promotion time.
`run`	write	Resolve a stored command through its bundle adapter, apply portable arguments, and execute one fresh session
`safe-package`	read	typed registry package
`search`	read	Search the bundle
`secret`	read	Manage secrets — one standalone sensitive value per file (an API token, a PEM private key, a TLS cert).\n\n
`set`	write	Set a configuration value by key; prints the resulting config with ok: true
`setup`	read	Interactive configuration wizard. Configures embeddings/LLM connections (for indexing/enrichment), agent profiles (CLI agent, embedded SDK, or none), sources, and registries. Shows which features are enabled at the end. Use --config <json> or --yes for non-interactive/scripting mode.
`setup.sh`	read	Setup script for local development
`short-desc`	read	too short
`show`	read	Show a single proposal and its validation findings
`spectral-quokka-rotation`	read	Exact operator procedure
`status`	read	Read-only check of every pending migration
`sync`	write	Sync changes in a git-backed bundle: commits (and pushes when writable + remote is configured). No-op for non-git bundles.
`task`	write	Schedule recurring commands, prompts, and workflows through the OS scheduler (cron / launchd / schtasks)
`unset`	read	Unset an optional configuration key or whole embedding/engine section; prints the resulting config with ok: true
`update`	write	Refresh one or all configured bundles and reconcile their index. Git refresh is explicit; schedule this command for automatic updates.
`upgrade`	write	Upgrade akm to the latest release, then update the akm plugin of each installed harness
`valid`	read	A valid param
`validate`	read	Parse a single task file by filesystem path — not a concept ref, and the file need not live in a
`verbose`	write	Enable verbose logging
`vpn-before-deploy`	write	Always connect to the corporate VPN before running deploy.sh — otherwise stage rollouts hang.
`vpn-deploy-order`	write	Production deploys require the VPN connection before the deployment script starts.
`workflow`	write	Experimental: author, inspect, and execute step-by-step workflow assets
`x`	read	a
`zeta`	read	twinmarker

Trust audit

BLOCKgrade F · trust 34/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (12 observation(s))
Network: declared (11 observation(s))
Shell: declared (7 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/storage/database.ts:94

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/storage/database.ts:221

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/core/errors.ts:227

"Choose a path inside your home directory (e.g. ~/akm) or another empty workspace. The bundle directory cannot be the filesystem root, your home directory itself, or a sensitive system path like /etc,

Why it matters. touches a credential store

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

src/core/network-policy.ts:40

if (bare === "metadata.google.internal" || bare === "metadata.goog") return "metadata";

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

docs/architecture/testing/manual-testing-checklist.md:562

unsafe root. `--no-init` must not bypass target safety.

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/tasks/backends/schtasks.ts:530

fs.writeFileSync(file, `${content}`, { encoding: "utf16le" });

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

docs/architecture/specs/reviews/task-workflow-unification/library-eval-openworkflow.md:241

`postgresql://postgres:postgres@localhost:5432/postgres` — the standard local-dev default — in