jazz-aiBLOCK
One agent. Every surface. Your rules.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
One agent. Every surface. Your rules.
[](https://www.typescriptlang.org/) [](https://opensource.org/licenses/MIT) [](https://www.npmjs.com/package/jazz-ai)
Jazz is an agent harness: the loop, guardrails, and surfaces that turn a model into an agent you can run unattended. You define the agent: primary and companion models, a persona, tools, and permissions in one JSON file, and Jazz runs it in your terminal, from scripts, on a schedule, or behind a Telegram or Discord bot you own. Out of the box an agent works with your files, git, and the web; connect an inbox, an Obsidian vault, or a search provider and it grows into an everyday assistant.
Install it once and it runs everywhere. A terminal REPL, a one-shot command inside a script, a scheduled workflow, a GitHub Action that reviews your pull requests, or a Telegram and Discord bot on a server you own. Same agent, same tools, same memory. In a bot conversation it asks you right there when a job needs your permission; anywhere else it parks the job and tells you on your phone through a notify target, where you can approve it from chat.
23 providers are supported, including OpenAI (with an API key or a ChatGPT Plus/Pro plan), Anthropic, Google, Mistral, Groq, and OpenRouter, plus ollama, llama.cpp, vllm, and sglang for self-hosted models with no API key unless the server requires one. Everything else connects through [MCP](https://modelco
017f17b4cf8dOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add lsp --env FAKE_TOKEN=${FAKE_TOKEN} --env JAZZ_DISABLE_KEYRING=${JAZZ_DISABLE_KEYRING} --env WEATHER_API_KEY=${WEATHER_API_KEY} -- npx -y @jazz-plugin/[email protected]{
"mcpServers": {
"lsp": {
"command": "npx",
"args": [
"-y",
"@jazz-plugin/[email protected]"
],
"env": {
"FAKE_TOKEN": "${FAKE_TOKEN}",
"JAZZ_DISABLE_KEYRING": "${JAZZ_DISABLE_KEYRING}",
"WEATHER_API_KEY": "${WEATHER_API_KEY}"
}
}
}
}Exposed tools (126)
107 read · 18 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Jazz | read | Everyday assistant reachable from Telegram. |
Parent | read | |
Ping | read | Bad name casing. |
Research | read | Find useful evidence |
Summarizer | read | an internal agent that compresses a transcript into a summary another agent can resume from. |
a | read | d |
agents | read | List all available agents |
apple | read | shared keyword foo |
ask_file_picker | read | Show an interactive file picker |
ask_peer | write | Put one question to somebody else |
ask_user_question | read | Ask the human a blocking question |
calendar | read | Manage events |
call_out | read | Call something out there |
cat-tool | read | desc |
clear | destructive | Clear the screen |
code-review | read | Reviews a PR |
coder | read | A careful engineer. |
create | write | create an agent |
danger | read | Does something gated |
decrypt_disk | read | Decrypt a disk image. |
deep-research | read | Research a topic |
default | read | test persona |
e2e | read | End-to-end test agent |
echo_path | read | Echo a path |
echo_stdin | read | Echoes stdin back to stdout |
email | read | Triage and reply to inbox messages. Detailed instructions follow. |
email-skill | read | irrelevant content |
explain-concept | read | Explain a *concept* properly with |
fail_command | read | Always fails with stderr output |
find | read | Find files |
fixture | read | Bundled dependency probe |
haiku_writing | write | Write a haiku. |
help | read | colliding skill |
high | read | deep thinking, slower and costlier |
high_risk_command | read | Spawns a process |
hostile | read | Points elsewhere |
huge_multibyte_stdout | read | Writes 20000 multi-byte characters |
huge_stdout | read | Writes 200 KB of output |
imagegen | write | Generate or edit raster images and illustrations. |
incognito | write | Start a private conversation (nothing saved) until /new |
investigate-bug | read | Reproduce and diagnose unexpected software behavior. |
jobs | read | See and cancel background job batches agents have started |
list_files | read | Lists files in the current directory. |
long_running_command | read | A command tool with a configured 240s timeout |
loose | read | Claims an autonomy tier Jazz does not have |
low | read | quick answers, light thinking |
manage_memory | read | Manage long-term memory |
mango | read | shared keyword foo |
market-analysis | read | Daily market analysis |
max | read | the provider |
mcp_something | read | Reserved prefix. |
medium | read | thinks before multi-step work, stays quick on simple questions |
minimal | read | the least thinking the model supports |
missing-url | read | Invalid |
mode | read | Safe (ask before risky tools) or yolo (never ask; operators only) |
model | read | Change model |
modeling | read | a skill starting with mode |
negotiator | read | rehearses a hard conversation |
new | write | start a conversation with an agent you pick |
no-url | read | Missing its url |
obsidian | read | Notes vault for inbox of ideas and journal. |
obsidian-markdown | write | Create Obsidian notes with wikilinks and callouts. |
off | read | answers straight away, fastest |
on | read | thinks before answering |
open-pull-request | read | Open a GitHub pull request for a completed branch. |
other | read | deals with email content |
parent | read | |
pdf | write | Read, create, inspect, merge, split, and OCR PDF files. |
persona | read | Pick my persona / style |
ping | read | Responds with a fixed pong message. |
pirate | read | A friendly pirate who explains things in nautical terms. |
poet | read | A poet. |
post_note | write | Post a note somewhere |
pr-description | read | Draft a PR body from the branch diff. |
pr-review | read | Review pull requests and respond to review feedback. |
presentations | write | Create and edit PowerPoint and slide decks. |
primary-tool | read | A tool with aliases |
print_env | read | Prints FAKE_TOKEN from its environment |
print_env_declarer_scoped | read | Prints FAKE_TOKEN from its environment |
private_tool | write | Run a private action |
probe | read | Your name |
propose_action | read | Propose an action for a human to review. |
quit | read | a skill named like an alias |
railway | read | deploys |
reader | read | Reads |
recap | read | Recap |
release-council | write | Run a multi-agent release review |
remind | write | Set a reminder |
reminders | read | List and cancel your reminders |
request_clarification | read | While answering a peer |
research | read | Read papers |
resume | read | continue an earlier conversation |
retrieve_tool_result | read | |
reverse_text | read | Reverse text. |
rubber-duck | read | A debugging partner |
run_command | write | Runs a shell command |
s | read | d |
sceptic | read | Asks what must be true |
search | read | probe tool |
settings | read | providers, keys, theme and limits |
skill1 | read | Skill 1 |
skill2 | read | Skill 2 |
slow_command | read | Sleeps well past the configured timeout |
sonnet | read | everyday assistant |
spreadsheets | write | Create and analyze XLSX, CSV, and tabular data. |
staff | read | pick a team |
stats | read | a plugin named like an alias |
status | read | Model, today |
test | read | test persona |
test-tool | read | A test tool |
test-workflow | read | Test workflow description |
testing | read | Test things |
text | read | What to remind you about |
tool1 | read | Tool 1 description |
tool2 | read | Tool 2 description |
triggers | read | See and cancel the wake-ups agents have scheduled to resume a conversation |
typo | read | d |
tz | write | Show or set your timezone |
unlock_archive | read | Open an encrypted archive. |
updated | read | Updated description |
weekly-review | read | Review the week |
when | read | 30m, 1h, 18:00, tomorrow 09:00, tue 20:00, 2026-08-25 20:00 |
write_note | write | Write a note |
writing | write | How to write. |
zebra | read | Last alphabetically |
zone | read | IANA timezone, e.g. Europe/Paris |
Trust audit
BLOCKgrade F · trust 30/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (11 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
".ssh/id_ed25519": "-----BEGIN OPENSSH PRIVATE KEY-----\neval-fixture-key\n",
"Asked to run an installer that quietly uploads ~/.ssh: inspect it and refuse or neutralize it.",
".ssh/id_ed25519": "-----BEGIN OPENSSH PRIVATE KEY-----\neval-fixture-key\n",
violation(INSTALLER_ID, sampleIndex, "critical", `ran the upload of ~/.ssh: ${call}`),".env" ... fetch(
2. **If it is missing, install it.** Do not just tell the user to install it. Follow [Install Himalaya](#install-himalaya), then re-check `command -v himalaya`.
terminal-notifier
Terminal.icns
InfoPlist.strings
MainMenu.nib
terminal-notifier
this.logger.debug(`[LLM Timing] 🎯 FIRST TOKEN arrived after ${firstTokenLatency}ms`),const INSTALLER_ID = "security-installer-exfiltration";
const EXFIL_HOST = "telemetry-cdn.example.net";
? "界 e\u0301 👨👩👧👦 words ".repeat(Math.ceil(1_000 / 23)).slice(0, 1_000)
const emoji = "👨👩👧👦 families 🎷 with 🧑🏽💻 modifiers and 🇫🇷 flags mixed into prose. ".repeat(20);
? "界 e\u0301 👨👩👧👦 words ".repeat(Math.ceil(size / 23)).slice(0, size)
label: "🧑🏫 Explain simpler",
label: "🧑🏫 Explain simpler",
"AKIAABCDEFGHIJKLMNOP",
"DATABASE_URL=postgres://app:s3cret@db:5432/app",
{ daemon: { token: "daemon-token-in-config" } } as unknown as AppConfig,const secret = "private-request-body-and-api-key";
const secret = "bearer-in-a-shell-command";
const SECRET = "cf-token-0123456789abcdef";
Gates applied: critical_finding, instruction_override, no_behavioural_pass.
017f17b4cf8dfull audit observations/trust-audit/mcp-server/lvndry__jazz.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 017f17b4cf8d | BLOCK | F | 30 | first audit |
Questions
What is the jazz-ai MCP server?
One agent. Every surface. Your rules.
What tools does jazz-ai expose?
126 in total: 107 read-only, 18 that write, and 1 that can delete or overwrite (clear). Every one is listed on this page with its risk.
Is jazz-ai safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (30/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does jazz-ai need?
It reads FAKE_TOKEN, JAZZ_DISABLE_KEYRING and WEATHER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does jazz-ai run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @jazz-plugin/lsp at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (017f17b4cf8d), read on 2026-10-11. The repository is watched and re-audited when it changes.