KXMBLOCK
Pi extensions for multi-agent communication and orchestration
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/kontextmind/kxm/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@kontextmind/kxm) [](https://nodejs.org/) [](LICENSE)
KXM gives coding agents (Claude Code, Pi and other harnesses) a durable, authenticated message and workflow plane, so they can delegate bounded work to each other and prove who answered, without sharing one giant context.
KXM runs on your machine: one kxm CLI, a local hub for messages and webhook workflows, and a local Runtime for workflow runs. Your project is reviewable YAML in Git, every agent keeps its own context and its own safety controls, and the docs say plainly what KXM does not guarantee (Status and limits).
What makes KXM different
- Durable messages, not chat. Every request is a SQLite record that moves from
queuedtodeliveredtoreplied, survives hub and agent restarts, and deduplicates retries by idempotency key. Agents authenticate with a project token and see only their own project's peers. Message peer agents - Provenance you can check. A quorum gate counts only replies the hub itself routed, from distinct eligible peers, for the exact run, stage and attempt. Text a coordinator writes never counts. It proves who answered, not that the answer is right. Peer provenance and quorum gates
- Workflows that release the turn. Signed Jira, GitHub or generic webhooks start durable runs. A coordinator can park a stage, give up its turn, and resume only when a signed CI, review or merge callback arrives. [Run webhook workflows](docs/guides/webhook-
d14728209819OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add claude-plugin --env KXM_ATTEMPT_TOKEN=${KXM_ATTEMPT_TOKEN} --env KXM_AUTH_TOKEN=${KXM_AUTH_TOKEN} --env KXM_PROJECT_TOKENS=${KXM_PROJECT_TOKENS} --env KXM_PROJECT_TOKENS_EXPLICIT=${KXM_PROJECT_TOKENS_EXPLICIT} -- npx -y [email protected]{
"mcpServers": {
"claude-plugin": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"KXM_ATTEMPT_TOKEN": "${KXM_ATTEMPT_TOKEN}",
"KXM_AUTH_TOKEN": "${KXM_AUTH_TOKEN}",
"KXM_PROJECT_TOKENS": "${KXM_PROJECT_TOKENS}",
"KXM_PROJECT_TOKENS_EXPLICIT": "${KXM_PROJECT_TOKENS_EXPLICIT}"
}
}
}
}Exposed tools (20)
18 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
bad | read | x |
bad-pointer | read | b |
broken | read | broken |
cycle | read | c |
cycle-obj | read | c |
deep | read | d |
flaky-gate-retry | read | Retry flaky gates with bounded backoff |
grep | read | search |
into-scalar | read | s |
kxm_reply | read | |
kxm_send | write | |
map-scalar | read | m |
ok | read | ok |
patch-promo | write | Test patch promotion |
pointers | read | p |
read | read | read |
root-ref | read | r |
scalar | read | s |
union | read | u |
x | read |
Trust audit
BLOCKgrade F · trust 29/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
| `kxm hub bind <url>` | Bind this machine to a running hub and record the non-secret endpoint in `.kxm/config.yaml` | http or https URL. `--token-env` and `--key-op` for either mode. `--cloud` with `
Insights are pull-only and derived from git/CI evidence (webhook-joined `KM-Session` trailers). Never from agent self-report.
Report the exact check that failed (server unreachable, auth 401, hook missing, version lag). Do not edit hook scripts into forging trailers. Do not weaken secret gates to "make it work".
exec(sql) {const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);exec(sql) {exec(sql: string): unknown;
runtime.io.stdout("No configured SSH host aliases found in ~/.ssh/config\n");JSON.stringify(process.env ... websocket
- Read the Steel credential at runtime from 1Password.
`kxm assign` spawns `node scripts/assignment-run.mjs` from the project root and returns the child's exit code. Paths are passed through as given. `--dry-run` prints that argv and does not spawn. `--js
print(runtime.io, runtime.json, { ok: true, command: "auth token", token }, token);`npm run e2e` runs the launcher and then `playwright test`. `connectBrowserOverCdp()` uses Obscura (`OBSCURA_CDP_URL`, or `http://127.0.0.1:${OBSCURA_PORT:-9222}`) unless `KXM_BROWSER=steel`.Local pages require the launcher flag `--allow-private-network` (the launcher always passes it). Without that flag, `page.goto("http://127.0.0.1:...")` fails with `Access to private/internal IP addresdescription: Start, inspect, stop, bind, and unbind the KXM hub (default http://127.0.0.1:7331), read tenant status, and back up or restore its SQLite state. Use when kxm_list or peer commands cannot
The hub serves peers and webhook workflows on `http://127.0.0.1:7331` by
kxm hub bind http://127.0.0.1:7331
const apiKey = "sk-ant-api03-abcdefghijklmnopqrstuvwxyz0123456789ABCD";
const sessionJson = '{"sessionKey":"sk-ant-sid01-secretSessionMaterialValue"}';assert.doesNotMatch(redacted, /sk-ant-api03-abcdefghijklmnopqrstuvwxyz/);
assert.doesNotMatch(local, /sk-ant-api03-abcdefghijklmnopqrstuvwxyz/);
return JSON.stringify({ token: "ya29.recorded-access", projectId });const secret = "context-hub-secret-with-entropy";
const token = "app-password-not-a-bearer";
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
d14728209819full audit observations/trust-audit/mcp-server/kontextmind__kxm.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | d14728209819 | BLOCK | F | 29 | first audit |
Questions
What is the @kontextmind/kxm MCP server?
Pi extensions for multi-agent communication and orchestration
What tools does @kontextmind/kxm expose?
20 in total: 18 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @kontextmind/kxm safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (29/100) and found 12 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @kontextmind/kxm need?
It reads KXM_ATTEMPT_TOKEN, KXM_AUTH_TOKEN, KXM_PROJECT_TOKENS, KXM_PROJECT_TOKENS_EXPLICIT, KXM_SESSION_TOKEN, KXM_WORKER_IDENTITY_KEY, KXM_WORKFLOW_SIGNAL_SECRET, LOG_TOKENS, NOUS_API_KEY, PASS_CLI_OUTPUT_MOCK, STEEL_API_KEY and STEEL_AUTH_BASIC from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @kontextmind/kxm run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as claude-plugin at 0.7.1.
How current is this page?
The grade is for one exact copy of the source (d14728209819), read on 2026-10-11. The repository is watched and re-audited when it changes.