who2beBLOCK
Self-hosted hub for AI agent configuration: versioned personas, playbooks and knowledge with a mandatory review step, served to agents over MCP. Agent configuration you review — not behavior you hope for.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Agent configuration you review — not agent behavior you hope for.
Self-hosted hub for the personas, playbooks and knowledge your agents run on — versioned, reviewed, and served to them over MCP.
Quickstart · Connect an agent · Documentation · Changelog · Discussions
<img src="docs/assets/screenshots/version-review-light.png" width="880" alt="Who2Be web UI: the version history of a persona. Version 3 is waiting in review, and its diff against the active version 2 is open.">
Why Who2Be
Instead of scattering system prompts, workflows, and knowledge documents across chat histories, notes, or repositories, Who2Be keeps them in one self-hosted configuration store (the "AgentDB") and serves them to your agents at runtime through an MCP server.
- Stop re-typing the same instructions. Personas, playbooks and reference
knowledge li
f68bc20f3fe6OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add who2be-web --env BLOBSTORE_ACCESS_KEY=${BLOBSTORE_ACCESS_KEY} --env BLOBSTORE_SECRET_KEY=${BLOBSTORE_SECRET_KEY} --env E2E_AUTH_URL=${E2E_AUTH_URL} --env JWT_SECRET=${JWT_SECRET} -- npx -y [email protected]{
"mcpServers": {
"who2be-web": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"BLOBSTORE_ACCESS_KEY": "${BLOBSTORE_ACCESS_KEY}",
"BLOBSTORE_SECRET_KEY": "${BLOBSTORE_SECRET_KEY}",
"E2E_AUTH_URL": "${E2E_AUTH_URL}",
"JWT_SECRET": "${JWT_SECRET}"
}
}
}
}Exposed tools (5)
5 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Carla | read | |
Coach | read | Desc |
Recherche-Agent | read | |
Test | read | Desc |
coder | read |
Trust audit
BLOCKgrade F · trust 31/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
"'-----BEGIN PRIVATE KEY-----')."
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/who2be
# APP_DATABASE_URL=postgresql://who2be_app:CHANGE_ME@localhost:5432/who2be
database_url: str = "postgresql://postgres:postgres@localhost:5432/who2be"
DATABASE_URL=postgresql://supabase_admin:CHANGE_ME@db:5432/postgres
DATABASE_URL: postgresql://postgres:postgres@db:5432/who2be
Phrasen-Vorkommens liegt (z. B. Treffer „jailbreak" in erlaubtem
„Jailbreak-Detection"). Verhindert den trivialen Bypass „Allow-Phrase
- [x] **WP-4 — Doku/Code neutralisiert (meaning-erhaltend):** CLAUDE.md,
print(token)
# WHO2BE_PUBLIC_URL=http://192.168.1.42:5173
# MCP_RESOURCE_URL=http://127.0.0.1:8765/mcp
# WHO2BE_MCP_PUBLIC_URL=http://127.0.0.1:8765
token="w2b_secret_plaintext",
"-----BEGIN OPENSSH PRIVATE KEY-----",
.gitleaks.toml
2026-05-25-2021_ms2-c2-supabase-stack.md
2026-09-26-2030_mcp-payload-budget-inventar.md
mcp-payload-budget-wire-form.fixed.md
t89ffc946-mcp-payload-budget.added.md
mcp-payload-budget.md
data: dict[str, Any] = yaml.load(path.read_text(encoding="utf-8"), Loader=_ComposeLoader)
data: dict[str, Any] = yaml.load(text, Loader=_ComposeLoader)
data = yaml.load((_REPO_ROOT / relpath).read_text(encoding="utf-8"), Loader=_ComposeLoader)
module = importlib.import_module(f"who2be_mcp.tools.{module_name}")Gates applied: critical_finding, instruction_override, no_behavioural_pass.
f68bc20f3fe6full audit observations/trust-audit/mcp-server/luetzey__who2be.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | f68bc20f3fe6 | BLOCK | F | 31 | first audit |
Questions
What is the who2be MCP server?
Self-hosted hub for AI agent configuration: versioned personas, playbooks and knowledge with a mandatory review step, served to agents over MCP. Agent configuration you review — not behavior you hope for.
What tools does who2be expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is who2be safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (31/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does who2be need?
It reads BLOBSTORE_ACCESS_KEY, BLOBSTORE_SECRET_KEY, E2E_AUTH_URL, JWT_SECRET and TOKEN_TTL_SECONDS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does who2be run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as who2be-web at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (f68bc20f3fe6), read on 2026-10-11. The repository is watched and re-audited when it changes.