tianshu-mcpBLOCK
天枢harness × AI-Agent 编排 MCP server:调度外部 Agent 干活,用运行时证据做客观验收,不通过自动返修闭环。
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
天枢编排 MCP tianshu-mcp
把开发交给 AI-Agent,把验收交给运行时 · Dispatch with agents, verify with evidence.
官网 · GitHub 主仓 · Gitee 镜像 · 天枢 Tianshu · 简体中文 · English
架构说明 · Agent 配置 · 验收配置 · 视觉验收 · 事件流 · 日志台 GUI · 交接文档
a99af01bf61bOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add tianshu-mcp --env GH_TOKEN=${GH_TOKEN} --env GITEE_ACCESS_TOKEN=${GITEE_ACCESS_TOKEN} --env GITEE_TOKEN=${GITEE_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"tianshu-mcp": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GH_TOKEN": "${GH_TOKEN}",
"GITEE_ACCESS_TOKEN": "${GITEE_ACCESS_TOKEN}",
"GITEE_TOKEN": "${GITEE_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}"
}
}
}
}Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
approve_visual_baseline | read | 仅在用户明确审阅并授权后批准视觉基准。必须核对候选摘要与批准说明;自动返修禁止调用。宿主必须实施实际审批控制。 |
manage_task | read | 任务生命周期管理(合并原 cancel_task / continue_task / rework_task),用 action 区分: |
prepare_visual_baseline | read | 准备视觉基准候选,返回摘要与预览;不采用正式基准。需要用户授权。 |
query_info | read | 统一信息查询入口(合并原 list_tasks / get_task_report / get_profiles),用 type 区分: |
query_task | read | 查询任务状态 / 进度 / 最近日志尾部(默认 agent.log 末 40 行)/ 最近细粒度事件。返回任务 meta 与日志片段。 |
verify_task | read | 对已完成任务或项目路径执行一次验收(不改源码):自动命令检查 + 代码分析(相对 git 基线)。可用 extraChecks 临时加验。需任务/项目二选一。可选 idempotencyKey:同一 key 重试不重跑验收——执行中的同键请求返回进行中提示,已完成的直接返回既有报告与轮次,参数变更则报冲突。 |
wait_task | read | 等待任务到达停点(阻塞只读原语,合并原 wait_task / wait_any)。 |
Trust audit
BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (12 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
await page.$eval(step.selector, (element) => {await page.$eval(step.selector, (element) => element.scrollIntoView());
assert!(resolve_rel(home, "/etc/passwd").is_err());
assert!(validate_task_id("/etc/passwd").is_err());const url = `http://127.0.0.1:${server.address().port}`;assert!(validate_task_id("tаsk").is_err()); // 西里尔 а.prettierrc.json
const fn = new Function(
expect(() => new Function(`${resolveFnSource()}; return __opendesignResolve;`)()).not.toThrow();expect(() => new Function(expression), expression.slice(0, 60)).not.toThrow();
const hash = buf.length > HASH_MAX_BYTES ? null : createHash("sha1").update(buf).digest("hex");return createHash("sha1").update(buf).digest("hex");return createHash("sha1").update(buf).digest("hex");const r = parseDryRunPlan({ files: [{ path: "/etc/passwd", action: "modify" }] });["/etc/passwd", "linux"],
checks: [makeCheck({ outputTail: "/etc/other/x.ts(1,1): error TS1005: oops." })],let info = read_baseline(&home, &req("../../outside/evil"));assert!(resolve_rel(home, "tasks/../../x").is_err());
assert!(task_dir(home, "../../outside/evil").is_err());
task_id: "../../outside/evil".to_string(),
rel_path: "../../etc/passwd".to_string(),
{ "type": "existing", "url": "http://127.0.0.1:4173" }{ "type": "command", "command": "npm", "args": ["run", "preview", "--", "--port", "4173"], "cwd": ".", "env": { "TEST_TOKEN": "VISUAL_TEST_TOKEN" }, "readyUrl": "http://127.0.0.1:4173" }{ "type": "existing", "url": "http://127.0.0.1:4173" }{ "type": "command", "command": "npm", "args": ["run", "preview", "--", "--port", "4173"], "cwd": ".", "env": { "TEST_TOKEN": "VISUAL_TEST_TOKEN" }, "readyUrl": "http://127.0.0.1:4173" }Gates applied: no_behavioural_pass.
a99af01bf61bfull audit observations/trust-audit/mcp-server/lanlan0811__tianshu-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | a99af01bf61b | BLOCK | F | 57 | first audit |
Questions
What is the tianshu-mcp MCP server?
天枢harness × AI-Agent 编排 MCP server:调度外部 Agent 干活,用运行时证据做客观验收,不通过自动返修闭环。
What tools does tianshu-mcp expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is tianshu-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (57/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does tianshu-mcp need?
It reads GH_TOKEN, GITEE_ACCESS_TOKEN, GITEE_TOKEN and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does tianshu-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as tianshu-mcp at 0.9.6.
How current is this page?
The grade is for one exact copy of the source (a99af01bf61b), read on 2026-10-10. The repository is watched and re-audited when it changes.