Atlas / MCP servers / kitepon / aiterm-mcp

aiterm-mcpBLOCK

Name: aiterm-mcp
Author: kitepon

mcp/kitepon/aiterm-mcp

MCP server by kitepon · agentic ai · ai agent · anthropic · Audited 2026-10-12

One persistent MCP terminal your AI drives — and launches other coding agents (Codex/Grok/Composer) into. SSH, containers, and REPLs nest as text you send in. tmux-backed, token-reduced reads, headless over MCP.

Verdict

BLOCK

Grade

Trust score

57 /100

Exposed tools

9 8r · 1w · 0d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

From any MCP client, launch Claude Code, Codex CLI, Grok CLI, or Cursor Agent CLI through one harness API inside a persistent interactive TUI.

This image represents different intelligences sharing one persistent workspace and advancing the same work from their own perspectives.

[](https://github.com/kitepon/aiterm-mcp/actions/workflows/ci.yml) [](https://www.npmjs.com/package/aiterm-mcp) [](https://www.npmjs.com/package/aiterm-mcp) [](https://nodejs.org) [](LICENSE)

(日本語: README.ja.md)

Let your AI orchestrate other AIs. One agent_launch call selects the execution harness separately from its model and hands you a persistent session to drive. Cursor can run GPT, Claude, or Grok while Cursor still owns the session, hooks, and transcript. What it is: one persistent MCP terminal your AI drives — and can launch other coding agents into. ssh, docker exec, a REPL, or another agent's TUI all nest inside that one terminal as just text you send in. The mechanism is deliberately plain — your MCP client drives the other agent's terminal turn by turn: no hidden protocol, no separate aiterm-owned shared-memory layer, no autonomous negotiation. Launched agents still read the normal project and harness memory/configuration that a direct CLI launch would use. No human at a terminal required. aiterm is driven programmatically over MCP, so an AI can launc

Read from source at commit 6ed15160cac7OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add aiterm-mcp -- npx -y [email protected]

Exposed tools (9)

8 read · 1 write · 0 destructive.

Tool	Risk	Description
`agent_launch`	read
`diagnostics`	read
`pty_close`	read	セッションを閉じ、ログ/読取位置を破棄する。
`pty_key`	read	制御キーを送る(C-c, C-d, Enter, Tab, Up, Down... の別名に対応)。
`pty_list`	read	握っているセッション一覧(名前 / 現在の前面コマンド / attach 状態 / サイズ)。
`pty_open`	read	ローカル永続端末(tmux セッション)を1個開き、session_id を返す。
`pty_read`	read	セッションの出力をトークン削減して読む(既定は前回読取位置からの増分)。
`pty_send`	write	セッションへテキスト(コマンド)を送る。送信後の出力は pty_read で取得する。
`read`	read	試験用の固定文字列を返す

Trust audit

BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (9 observation(s))
Network: declared (4 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/update-cli.ts:7

"--hostは~/.ssh/configの接続名かホスト名です。接続先は保存しません。--checkは入れ替えずに現在の版と更新先だけを確かめます。\n" +

Why it matters. touches a credential store

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

rag/sources/ansi-handling/terminal-coding-agent-context-engineering.md:2271

with independently designed layers ensures that no single bypass compromises safety: schema gating prevents

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

rag/sources/completion-detection/roo-code-shell-integration-fallback.md:79

## What is Shell Integration?[](#what-is-shell-integration "Direct link to What is Shell Integration?")

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

rag/sources/completion-detection/roo-code-shell-integration-fallback.md:97

## Terminal Integration Settings[](#terminal-integration-settings "Direct link to Terminal Integration Settings")

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

rag/sources/completion-detection/roo-code-shell-integration-fallback.md:104

### Command Execution Timeout Settings[](#command-execution-timeout-settings "Direct link to Command Execution Timeout Settings")

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

rag/sources/completion-detection/roo-code-shell-integration-fallback.md:108

#### `roo-cline.commandExecutionTimeout`[](#roo-clinecommandexecutiontimeout "Direct link to roo-clinecommandexecutiontimeout")

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

rag/sources/completion-detection/roo-code-shell-integration-fallback.md:127

#### `roo-cline.commandTimeoutAllowlist`[](#roo-clinecommandtimeoutallowlist "Direct link to roo-clinecommandtimeoutallowlist")

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/parent-hook-diagnostic.ts:29

const value: unknown = JSON.parse(readFileSync(file, "utf8").replace(/^/u, ""));

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

rag/sources/discoverability/claude-code-mcp-configuration.md:624

--dsn "postgresql://readonly:[email protected]:5432/analytics"

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

test/runtime-error-report.test.mjs:14

const SECRET = "bughub-test-secret-do-not-use-0123456789abcdef";

LOWInventory / provenance · inv.binary · CWE-1104

rag/sources/completion-detection/libes-expect-paper.md

libes-expect-paper.md

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

rag/sources/safety/cert-vu763073-iterm2-tmux-rce.md

cert-vu763073-iterm2-tmux-rce.md

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

rag/sources/safety/xterm-bracketed-paste-spec.md

xterm-bracketed-paste-spec.md

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/tmux-runtime.ts:27

export const WIN_NS = `aiterm-${createHash("sha1").update(SOCKDIR).digest("hex").slice(0, 12)}`;

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/experiments/codex-queue-hook.test.mjs:140

const url = `http://127.0.0.1:${http.address().port}`;

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/experiments/codex-stdio-relay.test.mjs:93

const baseUrl = `http://127.0.0.1:${http.address().port}`;

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

test/codex-parent-hooks-official.test.mjs:113

const url = `http://127.0.0.1:${http.address().port}`;

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

test/codex-relay-official.test.mjs:104

const baseUrl = `http://127.0.0.1:${http.address().port}`;

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

test/core-agent.test.mjs:3749

[{ message: "unexpected status 401 Unauthorized: fixture: token expired, url: http://127.0.0.1:43221/v1/responses",