puenteoBLOCK
Let your coding agents talk to each other: search every Claude Code / Codex / Gemini / Cursor session and message live sessions. CLI · MCP · hooks · HTTP/SSE · A2A.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Let your coding agents talk to each other.
When you run Claude Code in one terminal, Codex in another and Gemini or Cursor in the IDE, they can't see each other. One renames a column, another breaks on it, and you end up copy-pasting context between windows. puenteo gives every session on your machine:
- 🔎 Shared memory: ranked full-text search over the history of every local agent (Claude Code, Codex, Gemini/Antigravity, Cursor, Copilot, OpenCode, Grok, Pi, Qwen, Continue, Aider, OpenHands, Goose), plus structured handoffs: goal, state, files, commits, failures.
- 💬 Live messaging: see who's running (
puenteo ps), ask another session a question and wait for its answer, broadcast to the project, share#channels. - 🔒 Coordination: claim files or dirs so parallel agents don't edit the same code. Optional git pre-commit guard.
- 🔌 Every interface: CLI, MCP (stdio + HTTP), hooks, instant
watch, HTTP/SSE, an A2A v1.0 facade, a web dashboard and Python, set up by onepuenteo install.
Codex asks Claude about a schema change and gets the answer two seconds later. Claude claims `src/db`, Cursor reports its frontend fix and Gemini checks a number for the release notes. All of it runs locally: one SQLite file, no daemon, no network.
Puenteo comes from Spanish puente (bridge).
No runtime dependencies · Python ≥ 3.9 · macOS · Linux · Windows · optional Rust core
[](https://mano7onam.github.io/puenteo/) [](https://pypi.org/project/puenteo/) [](https://github.com/mano7onam/puenteo/actions/workflows/ci.yml) [
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
example_count_sessions | read | Count local agent sessions per provider (example plugin). |
Trust audit
BLOCKgrade F · trust 42/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (25)
Every session has an address `agent:session-id` (e.g. `claude:8765...`, `codex:01a1...`). `puenteo whoami` prints yours; `puenteo ps` lists everyone running now. If the puenteo MCP server is connected
Every session has an address `agent:session-id` (e.g. `claude:8765...`, `codex:01a1...`). `puenteo whoami` prints yours; `puenteo ps` lists everyone running now. If the puenteo MCP server is connected
Every session has an address `agent:session-id` (e.g. `claude:8765...`, `codex:01a1...`). `puenteo whoami` prints yours; `puenteo ps` lists everyone running now. If the puenteo MCP server is connected
- Open other agents' stores read-only (SQLite `mode=ro`). Never write into them, and never read credential or auth files.
- Open other agents' stores read-only (SQLite `mode=ro`). Never write into them, and never read credential or auth files.
- Open other agents' stores read-only (SQLite `mode=ro`). Never write into them, and never read credential or auth files.
_core.abi3.so
print(f"joined room #{args.name}{' (private)' if args.secret else ''}. Post: puenteo send '#{args.name}@*' \"...\""puenteo serve --open # http://127.0.0.1:7357 in the browser
puenteo serve --open # http://127.0.0.1:7357 in the browser
base = f"http://127.0.0.1:{self.port}"url = f"http://127.0.0.1:{gw.port}/?token={token}"print(f"puenteo serve on http://127.0.0.1:{gw.port} (dashboard: {url})", file=sys.stderr, flush=True)_WORD_RE = re.compile(r"[a-zA-Zа-яА-ЯёЁ0-9_./-]{2,}")"key sk-ant-api03-AAAAAAAAAAAAAAAAAAAAAAAAAAAA and ghp_" + "a" * 36 + "\n"
"postgres://admin:[email protected]/x AKIAABCDEFGHIJKLMNOP\n"
"postgres://admin:[email protected]/x AKIAABCDEFGHIJKLMNOP\n"
"-----BEGIN RSA PRIVATE KEY-----\nMIIE...\n-----END RSA PRIVATE KEY-----\n"
.gitleaks.toml
.nojekyll
want = base64.b64encode(hashlib.sha1((key + GUID).encode()).digest()).decode() # nosec B324 - RFC 6455
accept = base64.b64encode(hashlib.sha1((key + GUID).encode()).digest()).decode() # nosec B324 - RFC 6455
tag = hashlib.sha1(scope.encode(), usedforsecurity=False).hexdigest()[:10]
return hashlib.sha1(address.encode("utf-8"), usedforsecurity=False).hexdigest()[:20]sid = hashlib.sha1(path.encode(), usedforsecurity=False).hexdigest()[:16]
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
bab09c162ff5full audit observations/trust-audit/mcp-server/mano7onam__puenteo.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | bab09c162ff5 | BLOCK | F | 42 | first audit |
Questions
What is the puenteo MCP server?
Let your coding agents talk to each other: search every Claude Code / Codex / Gemini / Cursor session and message live sessions. CLI · MCP · hooks · HTTP/SSE · A2A.
What tools does puenteo expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is puenteo safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (42/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does puenteo need?
No credential environment variables were found in its source, so it appears to need none.
How does puenteo run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as puenteo.
How current is this page?
The grade is for one exact copy of the source (bab09c162ff5), read on 2026-10-11. The repository is watched and re-audited when it changes.