mv-agent-brokerBLOCK
Local MCP broker for coding agents from Cursor, Antigravity, ZCode, Codex, and Claude Code. Configure agent pools, models, and effort across projects; run parallel workers in isolated workspaces and coordinate independent reviews with durable sessions and artifacts.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Agent Broker lets a coordinator use coding agents from Cursor, Antigravity, ZCode, Codex and Claude Code through one local MCP server. You choose the providers, models, effort and permissions. The coordinator splits the work, selects your profiles, checks results and asks a separate agent for review.
One shared daemon serves several projects. Each project has its own folders, sessions and artifacts; provider quotas and broker concurrency limits are shared.
Install and start
Requirements: Node.js 24 or newer, Git for project worktrees, and the CLIs of the providers you want to use. Windows is the verified host; its detached launchers use the built-in Windows PowerShell. Sign in through each vendor CLI. The broker reuses that login.
The npm package is prepared locally; it has not been published to the registry. Build it from this repository:
npm ci npm run release:pack npm install --global .\releases\gemslibe-agent-broker-0.3.0.tgz agent-broker --version
Someone receiving the .tgz only needs the npm install --global command. The package contains compiled JavaScript, ready-made UI styles and the provider helper scripts. Runtime installation has no npm dependencies.
Create a configuration outside the installed package:
$config = Join-Path $env:LOCALAPPDATA 'AgentBroker\operator.json' agent-broker init --config $config agent-broker ui --config $config
Open http://127.0.0.1:4318/. Keep the UI terminal open. init creates an empty configuration and refuses to overwrite an existing file. The state folder is agent-broker-state beside that configuration.
Configure providers and a project
First open Advanced settings. Add the providers you use to Accounts JSON:
[
{"account_profile_id":"cursor","provider":"cursor","quota_scope_id":"cursor","auth_mode":"cli-owned"},
{"account_profile_id":"agy","provider":"antigravity","quota_scope_id":"antigravity","auth_mode":"cli-owned"},
37c93194d843OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agent-broker --env BROKER_TEST_SECRET=${BROKER_TEST_SECRET} --env CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN} -- npx -y @gemslibe/[email protected]{
"mcpServers": {
"agent-broker": {
"command": "npx",
"args": [
"-y",
"@gemslibe/[email protected]"
],
"env": {
"BROKER_TEST_SECRET": "${BROKER_TEST_SECRET}",
"CLAUDE_CODE_OAUTH_TOKEN": "${CLAUDE_CODE_OAUTH_TOKEN}"
}
}
}
}Exposed tools (12)
9 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
agent_artifact_read | read | Read an authorized bounded page of a retained textual artifact by art ID; follow returned offsets for more text. Binary artifacts return metadata only (§10.1). |
agent_session_status | read | Inspect state, active turn and captured profile access. required_send_binding=none for ordinary current/worktree sessions; only an explicit snapshot review_slot requires review_binding. CLI or catalogue updates do not invalidate the session. |
agent_session_stop | write | Close an idle or blocked session when no more turns should use it; this is session lifecycle cleanup, not turn cancellation, and preserves native history/worktree. Use agent_turn_cancel for active execution (§6.4). |
agent_sessions_list | read | List this coordinator |
agent_turn_cancel | write | Request cancellation of a known turn that should stop executing; this does not close its session. Idempotent; terminal turns are returned unchanged. Inspect status/events/result afterward, and resolve unknown outcomes using the same turn and key (§14.6). |
agent_turn_events | read | Read bounded event deltas after the last consumed numeric cursor; use wait_ms for one bounded wait, advance the cursor from returned rows, and repeat until terminal before reading the result (§10.5). |
agent_turn_status | write | Check turn state, deadline and execution_started after a send; inspect the known turn before any recovery or retry (§10.1). |
agent_workspace_snapshot | read | Optional manual local snapshot for diagnostics or explicit review_slot snapshot comparison. Reads files into local broker storage; launches no inference. Ordinary current/worktree tasks and Git reviews do not need snapshots. Snapshot IDs are not artifact IDs. |
agents_list | read | Discover enabled profiles and healthy workspaces for one project; follow every next_cursor. Choose an exact route_id and compatible_workspace_id. Profile access is read-only or write all project. Multiple agents may run in separate checkouts, subject to concurrency and shared provider quotas. |
broker_status | read | Check broker and bridge readiness first. Require daemon_state=READY before discovery or work; returns API/resource state and allowed project IDs, without credentials (§10.1.2). |
calculator | read | Calculates numbers |
test_tool | read | A test tool |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (20)
preact ~ react
$response = Invoke-WebRequest -Uri "http://127.0.0.1:$Port/" -UseBasicParsing -TimeoutSec 1
url = "http://127.0.0.1:$Port"
url = "http://127.0.0.1:$Port"
ui Serve the operator settings UI on http://127.0.0.1.
const workspaceKey = createHash("md5").update(path.resolve(workspaceCwd)).digest("hex");const cwdKey = crypto.createHash('md5').update(path.resolve(process.cwd())).digest('hex');} from "../../runtime/adapter.ts";
import { boundAgentReport } from "../../runtime/adapter.ts";import { BrokerError } from "../../shared/errors.ts";import { parseVendorResetMs } from "../../core/quotaCooldown.ts";} from "../../runtime/adapter.ts";
Open **http://127.0.0.1:4318/**. Keep the UI terminal open. `init` creates an
const h2 = registerBlob("константа = \"тест 🚀\"\nновое = 123"); // no newline@preact/signals, @tailwindcss/cli, @testing-library/preact, @types/node, esbuild, happy-dom, preact, tailwindcss
| App-server with explicit `account:zai-individual-coding-plan / GLM-5.3-Flash / low` | Process starts, storage ready, capabilities response and runtime-preferences handshake work; model selection fai
| App-server without model selection | Creates `sess_8a3e360b-1cb1-4bbf-9634-886f2b87489a`; snapshot reports ZCode Protocol v1 and `settings.model.available: []` | No `session/send` |
| app-server NDJSON bus | unsupported | configured | broker integration not implemented; native 0.16.9 protocol/empty-session bootstrap smoke passed, account model selection failed; requires host acco
Individual. Never put access tokens or API keys in this config.
the broker does not read credentials. Account-profile IDs remain admission
Gates applied: no_behavioural_pass.
37c93194d843full audit observations/trust-audit/mcp-server/kuzyasun__mv-agent-broker.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 37c93194d843 | BLOCK | D | 69 | first audit |
Questions
What is the mv-agent-broker MCP server?
Local MCP broker for coding agents from Cursor, Antigravity, ZCode, Codex, and Claude Code. Configure agent pools, models, and effort across projects; run parallel workers in isolated workspaces and coordinate independent reviews with durable sessions and artifacts.
What tools does mv-agent-broker expose?
12 in total: 9 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mv-agent-broker safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does mv-agent-broker need?
It reads BROKER_TEST_SECRET and CLAUDE_CODE_OAUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (37c93194d843), read on 2026-10-11. The repository is watched and re-audited when it changes.