Atlas / MCP servers / jamesmorales04 / agentic-engineering-harness

agentic-engineering-harnessBLOCK

Name: agentic-engineering-harness
Author: jamesmorales04

mcp/jamesmorales04/agentic-engineering-harness

MCP server by jamesmorales04 · Audited 2026-10-14

⚑ Report / re-scan Source ↗

Verdict

BLOCK

Grade

Trust score

49 /100

Exposed tools

16 12r · 4w · 0d

Transport

—

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

AEH is an OSS-first control plane for governed software engineering with coding agents. It binds agent work to explicit user intent, frozen policy and scope, candidate identity, executable evidence, independent review, deterministic acceptance, and controlled delivery. No paid hosted service or paid license is mandatory.

Core Architecture v2 is the current, complete architecture. The normative contract is docs/COREARCHITECTUREV2.md; this README is the product entry point, not the full architecture specification.

How AEH works

human request
-> INFORMATIONAL | AUDIT | CHANGE
-> governed OperationRecord for engineering work
-> frozen policy, authority, route, and assurance
-> candidate identity + WorkGraph + compiled participants
-> deterministic validation + independent Reviewer assessment
-> AcceptanceOracle + ObjectiveCompletion
-> ToolActionGate + delivery
-> terminal resource reconciliation or explicit recovery

The decision path is hybrid: the Lead interprets user intent and product semantics; deterministic controller rules freeze scope and authority, verify evidence, decide acceptance, and gate effects. Model output cannot choose tools or grant authority, change frozen requirements, accept a candidate, or bypass a gate.

Requests use three entry classes:

INFORMATIONAL answers or looks up repository information without creating an engineering operation.
AUDIT performs governed, read-only engineering assessment with deterministic validators and independent reviewers.
CHANGE routes a requested mutation through NO_AGENT, DIRECT, DELEGATED, or FORMAL_SDD. Assurance (NONE, STANDARD, ELEVATED, or CRITICAL) is decided separately from the route.

The Lead owns user intent, genuine product decisions, semantic ambiguity, and user-facing coordination. The Operation Supervisor owns bounded orchestration. Explorer discovers repository facts

Read from source at commit 47ecbcb81d77OBSERVED · 2026-10-14

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add control-center --env AEH_CONTROLLER_TOKEN=${AEH_CONTROLLER_TOKEN} --env AEH_DIRECT_TEST_SECRET=${AEH_DIRECT_TEST_SECRET} --env AEH_SERENA_WRITER_LEASE_TOKEN=${AEH_SERENA_WRITER_LEASE_TOKEN} --env AEH_TEST_QUEUE_TOKEN=${AEH_TEST_QUEUE_TOKEN} -- npx -y @aeh/[email protected]

claude-desktop

{
  "mcpServers": {
    "control-center": {
      "command": "npx",
      "args": [
        "-y",
        "@aeh/[email protected]"
      ],
      "env": {
        "AEH_CONTROLLER_TOKEN": "${AEH_CONTROLLER_TOKEN}",
        "AEH_DIRECT_TEST_SECRET": "${AEH_DIRECT_TEST_SECRET}",
        "AEH_SERENA_WRITER_LEASE_TOKEN": "${AEH_SERENA_WRITER_LEASE_TOKEN}",
        "AEH_TEST_QUEUE_TOKEN": "${AEH_TEST_QUEUE_TOKEN}"
      }
    }
  }
}

Exposed tools (16)

12 read · 4 write · 0 destructive.

Tool	Risk	Description
`PostgreSQL`	read	PostgreSQL schema, query, migration, and operational safety practice.
`aeh_context_retrieve`	read	Retrieve a controller-authorized, current-session AEH context reference. Arbitrary fragment names and filesystem paths are rejected.
`aeh_context_status`	read	Read the managed lead
`aeh_informational_context`	read	Answer a purely informational repository question with bounded read-only repository context. This never creates an operation, TaskContract, audit report, reviewer, or delivery artifact.
`aeh_informational_evidence`	read	Retrieve one explicitly referenced repository evidence range for an informational answer. New refs carry file identity and may add &read=<start>-<end> for a later bounded range. This is lazy, read-only, and operation-free; the compact informational context must be used first.
`aeh_operation_ack`	read	Acknowledge exactly one current durable operation revision as the bound interactive lead without reading the full OperationRecord. Use after consuming a blocked/terminal continuation event; never use as a progress poll.
`aeh_operation_cancel`	read	Cancel an AEH operation and return its compact terminal digest. The detached liveness monitor owns eventual lead continuation/recovery.
`aeh_operation_digest`	read	Read a compact, read-only operation digest: status, phase, revision, participant counts, supervisor state, attention and result references. Use this for normal lead inspection instead of the full OperationRecord.
`aeh_operation_portfolio`	read	Read the compact project operation portfolio used by the thin lead to manage multiple concurrent supervised operations without multiplexing child timelines.
`aeh_operation_recover_participant`	read	As the bound Lead, continue or resume one participant or request a controller-owned rotation/replan/split/reassignment under the frozen Owner policy. Requires an exact binding digest and current durable activity evidence; it cannot widen policy or exceed an Owner hard boundary.
`aeh_operation_start_audit`	write	Start a detached supervised AEH AUDIT and return a compact operation digest. The lead should return idle after start; healthy progress is controller-owned and does not require polling.
`aeh_operation_start_change`	write	Start a durable CHANGE operation and return a compact digest. The operation controller/supervisor own intermediate progress and recovery.
`aeh_operation_start_run`	write	Start detached supervised execution of an already prepared/sealed AEH task and return a compact digest. Do not poll healthy progress from the lead.
`aeh_operation_status`	read	Read operation status without acknowledging it. Default detail=compact returns the same bounded digest as aeh_operation_digest. Use detail=full only for exceptional diagnostics or one-time terminal result inspection; it returns the authoritative OperationRecord.
`aeh_submit_result`	write	Submit the final ${channel.contract} contract result for the current controller-activated AEH turn. This durable submission is authoritative; operation, agent, contract and destination are controller-bound and cannot be supplied by the caller.
`external_directory`	read	private /home/user/secret

Trust audit

BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (2 observation(s))
Shell: declared (7 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

policies/opengrep/rules/aeh-v1.yml:25

pattern: eval(...)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

policies/opengrep/rules/aeh-v1.yml:36

pattern: new Function(...)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/audit/intent.ts:55

const NEGATED_EVALUATION = /\b(?:do not|don't|without|not|no|sin|no eval(?:uate|u(?:ar|es))?|no revis(?:e|es)|no audit(?:ar|es)|sin evaluar|sin revisar)\b.{0,80}\b(?:review|audit|assess|inspect|analy[

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/provenance/generate.ts:298

const result = await runExecutable("cosign", ["verify-blob", "--insecure-ignore-tlog", "--bundle", bundle, "--key", publicKey, statement], { cwd: root, timeoutMs: 60_000 });

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/entry.ts:500

console.log(`To expose over your private Tailnet (no public internet): tailscale serve --bg http://127.0.0.1:${port}`);

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

tests/validation/impactReviewValidators.test.ts:934

const root = await fixture({ "creds.env": 'aws_access_key_id = "AKIAZZZZQWERTYUIOPAS"\n' });

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

tests/packed/s10RealSastCampaign.mjs:60

await fs.writeFile(credentialsPath, 'export const GITHUB_TOKEN = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij";\n');

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

docs/evidence/s13/round-22/frozen-release/audit/intent.js:26

const NEGATED_EVALUATION = /\b(?:do not|don't|without|not|no|sin|no eval(?:uate|u(?:ar|es))?|no revis(?:e|es)|no audit(?:ar|es)|sin evaluar|sin revisar)\b.{0,80}\b(?:review|audit|assess|inspect|analy[

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/providerContracts.test.ts:57

await fs.writeFile(path.join(root, "rules", "aeh.yml"), "rules:\n  - id: aeh-eval\n    languages: [javascript]\n    message: eval is forbidden\n    severity: ERROR\n    pattern: eval(...)\n");

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

scripts/ci/verify-npm-identity.mjs:162

which === "sha512" ? `sha512-${createHash("sha512").update(bytes).digest("base64")}` : createHash("sha1").update(bytes).digest("hex");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/evidence/s13/round-22/frozen-release/context/compression/headroom.d.ts:2

import { runShell } from "../../utils/process.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/evidence/s13/round-22/frozen-release/context/compression/headroom.js:4

import { runShell, commandExists } from "../../utils/process.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/evidence/s13/round-22/frozen-release/context/compression/headroom.js:5

import { providerVersions } from "../../providers/versions.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/evidence/s13/round-22/frozen-release/context/compression/headroom.js:6

import { PACKAGE_ROOT } from "../../version.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

docs/evidence/s13/round-22/frozen-release/context/projectors/informational.d.ts:2

import type { UserFacingClaim } from "../../operations/evidence.js";

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

tests/controlCenter.test.ts:391

await fs.writeFile(registryPath, JSON.stringify({ version: 1, projects: [{ ...project, health: { status: "healthy", healthUrl: "http://169.254.169.254/latest/meta-data", nonceDigest: "0".repeat(64), r

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

tests/projectRegistry.test.ts:88

await expect(registry.register({ rootPath: path.join(root, "first"), repositoryIdentity: "acme/one", configDigest: "digest", health: { healthUrl: "http://169.254.169.254/latest/meta-data", nonce: "one

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/CONTROL_CENTER_REMOTE.md:13

→ trusted local proxy (tailscale serve → http://127.0.0.1:<port>)

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/CONTROL_CENTER_REMOTE.md:50

tailscale serve --bg http://127.0.0.1:<port>

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/CORE_ARCHITECTURE_V2_S13_WORKGRAPH.md:99

| project-home | ACCEPTED | Codex session `01a0e008-0a45-7382-a6c1-cb8f2eae2ff9`; `project register` + `home --once` exit 0 with `AEH Home ready at http://127.0.0.1:<port>` (`controlCenterPairing` red

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/evidence/s13/round-22/frozen-release/workers/runtimeSessions.js:21

const base = `http://127.0.0.1:${port}`;

LOWNetwork egress · net.tls_off · CWE-200, CWE-319

docs/evidence/s13/round-22/frozen-release/provenance/generate.js:357

const result = await runExecutable("cosign", ["verify-blob", "--insecure-ignore-tlog", "--bundle", bundle, "--key", publicKey, statement], { cwd: root, timeoutMs: 60_000 });

Why it matters. certificate verification is disabled

Fix. leave verification on

LOWNetwork egress · net.tls_off · CWE-200, CWE-319

scripts/ci/prepareSupplyChainEvidence.mjs:76

execFileSync("cosign", ["verify-blob", "--insecure-ignore-tlog", "--bundle", sourceFiles.bundle, "--key", sourceFiles.publicKey, sourceFiles.statement], { stdio: "ignore" });

Why it matters. certificate verification is disabled

Fix. leave verification on

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

docs/evidence/s13/round-22/frozen-release/package.json

@opentelemetry/api, @opentelemetry/context-async-hooks, @opentelemetry/exporter-trace-otlp-http, @opentelemetry/resources, @opentelemetry/sdk-metrics, @opentelemetry/sdk-trace-node, commander, minimat

Why it matters. 14 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@opentelemetry/api, @opentelemetry/context-async-hooks, @opentelemetry/exporter-trace-otlp-http, @opentelemetry/resources, @opentelemetry/sdk-metrics, @opentelemetry/sdk-trace-node, commander, minimat

Why it matters. 16 dependency range(s) float

Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-14 · audit v0.4.1 · source sha 47ecbcb81d77full audit observations/trust-audit/mcp-server/jamesmorales04__agentic-engineering-harness.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-14	`47ecbcb81d77`	BLOCK	F	49	first audit

Questions

What tools does agentic-engineering-harness expose?

16 in total: 12 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is agentic-engineering-harness safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (49/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does agentic-engineering-harness need?

It reads AEH_CONTROLLER_TOKEN, AEH_DIRECT_TEST_SECRET, AEH_SERENA_WRITER_LEASE_TOKEN, AEH_TEST_QUEUE_TOKEN, AEH_TEST_SECRET, COSIGN_PASSWORD, GH_TOKEN, NPM_TOKEN and PASEO_DAEMON_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (47ecbcb81d77), read on 2026-10-14. The repository is watched and re-audited when it changes.

Source	JamesMorales04/agentic-engineering-harness
npm	`@aeh/control-center@0.1.0`
Credentials it reads	`AEH_CONTROLLER_TOKENAEH_DIRECT_TEST_SECRETAEH_SERENA_WRITER_LEASE_TOKENAEH_TEST_QUEUE_TOKENAEH_TEST_SECRETCOSIGN_PASSWORDGH_TOKENNPM_TOKENPASEO_DAEMON_PASSWORD`
License	Apache-2.0
Activity	pushed 0d ago