Atlas / MCP servers / marian-kamenistak / marian-coach-eng-leadership-toolkit

marian-coach-eng-leadership-toolkitBLOCK

mcp/marian-kamenistak/ai-engineering-leader-toolkit

MCP server: engineering leadership answers from 3,662 mentoring sessions. Benchmarks, 1:1 playbooks, developer value calculator. One URL, no install.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
2 2r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

"I just became an engineering manager. What should I focus on?" "What's a healthy sprint completion rate?" "Do I need a mentor or a coach?" "What is this developer worth on the market?" "Should I become a team lead, or stay IC?"

Your AI already gets asked these. Now it can answer with first-party data from 3,662 paid 1:1 mentoring sessions with 300+ engineering leaders in 17+ countries, instead of guessing.

This is a remote MCP server. No install, no API key. One URL:

https://www.marian.coach/mcp

Tools

Read from source at commit b117ece84489OBSERVED · 2026-10-10
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add ai-engineering-leader-toolkit -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "ai-engineering-leader-toolkit": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
get_more_toolsread
get_startedread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
UNDECLARED (1 observation(s))
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (8)

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
src/mcp-usage.ts:306
/^(delete_user|delete_database|drop_table|run_sql|run_shell|execute_command|sudo|admin_login|reset_password|read_secrets|get_api_key|get_env|get_config|read_file|write_file|list_files|send_payment|tra
Why it matters. asks for elevated privileges
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.hidden_file · CWE-1104
.oxfmtrc.json
.oxfmtrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.oxlintrc.json
.oxlintrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/gen-agent-card.mjs:30
join(ROOT, "../../web/mc-web/public/.well-known/agent-card.json");
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@a2a-js/sdk, agents, zod, esbuild, oxfmt, oxlint, vitest, wrangler
Why it matters. 8 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
connectors-directory-packet.md:64
> Work out whether 1:1 leadership mentoring fits your situation, and what it would cost, in about sixteen minutes. Nine tools walk through focus areas, package options and a dated session plan, then c
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOPrompt injection · scope.undeclared_system · CWE-94, CWE-1427
<declared scope>
system use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare system use in the description, or remove it

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha b117ece84489full audit observations/trust-audit/mcp-server/marian-kamenistak__ai-engineering-leader-toolkit.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-10b117ece84489BLOCKD69first audit
06

Questions

What is the marian-coach-eng-leadership-toolkit MCP server?

MCP server: engineering leadership answers from 3,662 mentoring sessions. Benchmarks, 1:1 playbooks, developer value calculator. One URL, no install.

What tools does marian-coach-eng-leadership-toolkit expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is marian-coach-eng-leadership-toolkit safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does marian-coach-eng-leadership-toolkit need?

No credential environment variables were found in its source, so it appears to need none.

How does marian-coach-eng-leadership-toolkit run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as ai-engineering-leader-toolkit at 1.7.1.

How current is this page?

The grade is for one exact copy of the source (b117ece84489), read on 2026-10-10. The repository is watched and re-audited when it changes.

Advertisement