ModelsAtlas
Explore
Atlas / MCP servers / juliusbrussee / caveman-shrink

caveman-shrinkBLOCK

mcp/juliusbrussee/caveman
MCP server by juliusbrussee · ai · anthropic · caveman · Audited 2026-10-12
⚑ Report / re-scanSource ↗

🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.

Verdict
BLOCK
Grade
F
Trust score
41 /100
Exposed tools
23 19r · 4w · 0d
Transport
—
License
Apache-2.0
Stars
111,213
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Caveman make your AI agent say less and read less. Code stay exact. Brain still big.

33.2% fewerinput tokens through the proxy54 Claude Code runs, 18 of 18 answers right 129.8× smallerweb pages for the agentcaveman browse vs a Playwright snapshot 1.4 to 2.4× cheaperwith caveman-style outputAdobe Research, eight models

Cited by [Adobe Research](https://arxiv.org/abs/2606.24083) · A/B tested by [JetBrains](https://blog.jetbrains.com/ai/2026/07/speak-to-ai-agents-like-cavemen-tosave-tokens/) · Remade for Elasticsearch on [Elasticsearch Labs](https://www.elastic.co/search-labs/blog/elastic-caveman-ai-token-reduction) #1 on Hacker News · #1 on GitHub Trending · "No way this actually works." ThePrimeagen

**[How it talks](#how-caveman-ta

Read from source at commit ffbca449c090OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add caveman-opencode-plugin --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_BEARER_TOKEN_BEDROCK=${AWS_BEARER_TOKEN_BEDROCK} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "caveman-opencode-plugin": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
        "AWS_BEARER_TOKEN_BEDROCK": "${AWS_BEARER_TOKEN_BEDROCK}"
      }
    }
  }
}
03

Exposed tools (23)

19 read · 4 write · 0 destructive.

ToolRiskDescription
EditwriteEdit a file after reading it in this session.
alwaysreadmandatory
always2readmandatory
caveman_contextreadRead connected identity, accessible projects, and selected project. Never returns tokens or provider secrets.
caveman_delegatewriteRun a bounded, mechanical subtask (search, test run, log triage, bulk edit) in a token-efficient worker agent and return its report. Prefer this over spawning a subagent for bounded mechanical work.
caveman_experiment_getreadList experiments or read experiment detail/results. Read-only.
caveman_planreadRead ranked Cave Plan. Headline values are inferred per-day rates, never verified savings.
caveman_reportreadRead one aggregate report. Keeps provider-list-price cost, inferred headroom, and verified savings separate.
caveman_retrievereadhost tool
caveman_trace_getreadRead selected-project trace metadata plus payload-stripped spans. Prompt, completion, tool, attribute, and event content is excluded.
caveman_trace_searchreadSearch trace metadata and aggregate evidence. Payload content remains excluded.
do_thingreadDetailed tool description for OpenAI chat fixture.
failreadFail
fetch_orderwriteFetch order details by order ID
get_weatherreadThe function returns the current weather for a city.
lazyreadlazy loaded
lazy1readlazy
lazy2readlazy
lookupreadLook up one account.
readreadRead
safereadsafe
search_customersreadSearch customers by name or email
send_emailwriteSends an email to a given recipient.
04

Trust audit

BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (10 observation(s))
Network
declared (14 observation(s))
Shell
declared (10 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
shared/platform/redact/payload.go
payload.go
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
browse/cdp.go:246
func (d *CDPDriver) Eval(ctx context.Context, expression string) (any, error) {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
browse/cmd/caveman-browse/main.go:485
func (nilDriver) Eval(context.Context, string) (any, error) { return nil, context.Canceled }
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
browse/session.go:34
Eval(ctx context.Context, expression string) (any, error)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
proxy/internal/store/middleware.go:852
if _, err := exec(fmt.Sprintf(statement, strings.Join(in, ",")), args...); err != nil {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
shared/platform/awscreds/awscreds.go:64
defaultIMDSBase      = "http://169.254.169.254"
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
shared/platform/awscreds/awscreds.go:467
netip.MustParseAddr("169.254.169.254"),
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
shared/platform/awscreds/awscreds.go:531
return fmt.Errorf("awscreds: refusing plaintext IMDS endpoint at host %q (allowed: loopback, 169.254.169.254, fd00:ec2::254)", u.Hostname())
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
packages/cli/src/index.ts:13417
"--telemetry", "--debug", "--bare", "--safe-mode", "--insecure", "--chat-recording",
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
shared/platform/postgresconfig/postgresconfig.go:74
config.ConnConfig.TLSConfig.InsecureSkipVerify = false
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
shared/platform/postgresconfig/postgresconfig.go:81
fallback.TLSConfig.InsecureSkipVerify = false
Why it matters. certificate verification is disabled
Fix. leave verification on
MEDIUMInventory / provenance · inv.binary · CWE-1104
dist/caveman.skill
caveman.skill
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
engine/pixel/assets/atlas-codepoints.bin.gz
atlas-codepoints.bin.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
engine/pixel/assets/atlas-offsets.bin.gz
atlas-offsets.bin.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
engine/pixel/assets/atlas-pixels.bin.gz
atlas-pixels.bin.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
engine/pixel/assets/atlas-wideflags.bin.gz
atlas-wideflags.bin.gz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
packages/middleware/python/caveman_middleware/_httpx2.py:28
http = importlib.import_module(name)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
packages/middleware/python/caveman_middleware/llama_index.py:68
if isinstance(model, getattr(importlib.import_module(module), name)):
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
packages/middleware/python/caveman_middleware/pydantic_ai.py:66
if isinstance(model, getattr(importlib.import_module(module), name)):
MEDIUMInsecure crypto · crypto.weak_random · CWE-327, CWE-338
evals/snapshots/reminder.json:28
"That's React's default behavior. When a parent re-renders, React re-renders every child it renders, whether or not the child's props changed. React doesn't compare props unless you ask it to.\n\n**To
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
proxy/cmd/caveman-proxy/main.go:416
func withKeepalive(next http.Handler, beacon func()) http.Handler {
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
proxy/cmd/caveman-proxy/main.go:419
beacon()
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
.blocks/release-smoke.py:108
gateway = f"http://127.0.0.1:{port}"
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
browse/cmd/caveman-browse/main.go:236
endpoint := "http://127.0.0.1:" + strconv.Itoa(port)
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
engine/pixel/testdata/transform_anthropic/early_history_only.expected.json:17
"data": "iVBORw0KGgoAAAANSUhEUgAABiAAAALQCAIAAACWoC/QAAAxF0lEQVR4nO3dUW7kRrJAUS3C3/YevAZhtlRemPdXr0GCxchIMquolNohvXNhDHiSKTYlNQaDGLL8dpckSZIkSZImevuvb0CSJEmSJEnfOwMmSZIkSZIkTWXAJEmSJEmSpKl+34Dpj3/+fnr

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha ffbca449c090full audit observations/trust-audit/mcp-server/juliusbrussee__caveman.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12ffbca449c090BLOCKF41first audit
06

Questions

What is the caveman-shrink MCP server?

🪨 why use many token when few token do trick. Viral skill + proxy for coding agents that cuts 65% of tokens by talking like a caveman.

What tools does caveman-shrink expose?

23 in total: 19 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is caveman-shrink safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (41/100) and found 11 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does caveman-shrink need?

It reads ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, AWS_ACCESS_KEY_ID, AWS_BEARER_TOKEN_BEDROCK, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, CAVEMAN_BINARY_SIGNING_PRIVATE_KEY_PEM, CAVEMAN_LEARN_NUDGE_TOKEN, CAVEMAN_MAX_OUTPUT_TOKENS, CAVEMAN_TELEMETRY_TOKEN_READ_TIMEOUT_MS, CAVE_API_KEY and CAVE_NO_KEYCHAIN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (ffbca449c090), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement