ModelsAtlas
Explore
Atlas / MCP servers / markchu-git / typesafe-mcp

typesafe-mcpBLOCK

mcp/markchu-git/typesafe-mcp
MCP server by markchu-git · agent tools · ai agents · bun · Audited 2026-10-13
⚑ Report / re-scanSource ↗

MCP server for TypeSafe AI's Jev: typed yes/no, choice and score answers with act / review / abstain gating.

Verdict
BLOCK
Grade
F
Trust score
54 /100
Exposed tools
5 5r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Deterministic decisions for AI agents — powered by TypeSafe AI's Jev.

[](https://www.npmjs.com/package/typesafe-mcp) [](https://github.com/MarkChu-git/typesafe-mcp/actions/workflows/ci.yml) [](LICENSE) [](https://bun.sh)

npm · Documentation · Issues · Releases

An MCP server that wraps Jev, TypeSafe AI's System One decision model, so any agent can ask typed questions and get compact, auditable answers back — the answer, how certain Jev is, and a threshold-gated act / review / abstain verdict. No generated text, no vibes, and as few tokens of the agent's context as possible.

bunx typesafe-mcp        # stdio server — add to any MCP host config, done
flowchart LR
A[Agent] -->|jev_ask| M[typesafe-mcp]
M -->|state + typed questions| J[TypeSafe Jev API]
J --> M
M -->|answer · certainty · decision| A
  • Jev — TypeSafe AI's hosted decision model (jev-latest / jev-1.13.0). Evaluates a state plus typed questions (Noul / Choice / Score) and returns structured answers. It does not generate text, code, or explanations.
  • TypeSafe — the company and API (api.typesafe.ai/v1/systemone) plus official JS/Python SDKs.
  • This server — a type-safe MCP wrapper. decision is computed in code by this server, never Jev's own opinion about whether you may proceed.

Install

Add to any MCP host config — Cursor, Claude Desktop, Claude Code, Windsurf,

Read from source at commit 246206ceebd6OBSERVED · 2026-10-13
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add typesafe-mcp --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env TYPESAFE_API_KEY=${TYPESAFE_API_KEY} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "typesafe-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "TYPESAFE_API_KEY": "${TYPESAFE_API_KEY}"
      }
    }
  }
}
03

Exposed tools (5)

5 read · 0 write · 0 destructive.

ToolRiskDescription
jev_askread
jev_checkread
jev_classifyread
jev_modelsread
jev_scoreread
04

Trust audit

BLOCKgrade F · trust 54/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
none-observed
Shell
declared (1 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
evals/harness/claude.ts:104
exec(cmd: readonly string[], env: Record<string, string>): Promise<{
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
.claude/skills/teamai/references/join-member.md:43
the `gf ... auth login`** (never tell the user to run them). Use the exact
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
.claude/skills/teamai/references/setup-admin.md:108
both the install and the login. **Never tell the user to run a `gf` command.** The
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
.cursor/skills/teamai/references/join-member.md:43
the `gf ... auth login`** (never tell the user to run them). Use the exact
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
.cursor/skills/teamai/references/setup-admin.md:108
both the install and the login. **Never tell the user to run a `gf` command.** The
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427
.teamai/skills/teamai/references/join-member.md:43
the `gf ... auth login`** (never tell the user to run them). Use the exact
Why it matters. asks the agent to act without the user's knowledge
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.claude/skills/team-wiki-codebase/references/methodology/phase2-document-types.md:289
```mermaid
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.claude/skills/team-wiki-codebase/references/methodology/phase2-document-types.md:296
```
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.claude/skills/team-wiki-codebase/references/methodology/phase2-document-types.md:312
```mermaid
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.claude/skills/team-wiki-codebase/references/methodology/phase2-document-types.md:318
```
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.claude/skills/team-wiki-codebase/references/methodology/phase2-document-types.md:321
```mermaid
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
tests/files.test.ts:86
writeFileSync(join(root, "certs", "server.pem"), "-----BEGIN PRIVATE KEY-----");
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
tests/files.test.ts:87
writeFileSync(join(root, "id_ed25519"), "-----BEGIN OPENSSH PRIVATE KEY-----");
LOWInventory / provenance · inv.hidden_file · CWE-1104
.gitleaks.toml
.gitleaks.toml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.gitmessage
.gitmessage
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.oxlintrc.json
.oxlintrc.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
openspec/changes/add-agent-tool-eval/.openspec.yaml
.openspec.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
openspec/changes/build-jev-mcp/.openspec.yaml
.openspec.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/files.test.ts:87
writeFileSync(join(root, "id_ed25519"), "-----BEGIN OPENSSH PRIVATE KEY-----");
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/files.test.ts:90
expect(await selectFiles(["certs/*", "id_ed25519"], [root])).toEqual({
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
tests/files.test.ts:92
skipped: { "certs/server.pem": "private key or keystore", id_ed25519: "private key or keystore" },
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
evals/harness/redact.ts:1
import { redact } from "../../src/errors.ts";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
evals/harness/stream.ts:2
import { META_KEY } from "../../src/result.ts";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
evals/tasks/payment-log-duplicates/task.ts:3
import { setF1 } from "../../verifiers.ts";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
evals/tasks/refund-gating/task.ts:3
import { weightedCost } from "../../verifiers.ts";

Gates applied: instruction_override, no_behavioural_pass.

Audited 2026-10-13 · audit v0.4.1 · source sha 246206ceebd6full audit observations/trust-audit/mcp-server/markchu-git__typesafe-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-13246206ceebd6BLOCKF54first audit
06

Questions

What is the typesafe-mcp MCP server?

MCP server for TypeSafe AI's Jev: typed yes/no, choice and score answers with act / review / abstain gating.

What tools does typesafe-mcp expose?

5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is typesafe-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (54/100) and found 11 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does typesafe-mcp need?

It reads GH_TOKEN, GITHUB_TOKEN and TYPESAFE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does typesafe-mcp run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as typesafe-mcp at 0.3.0.

How current is this page?

The grade is for one exact copy of the source (246206ceebd6), read on 2026-10-13. The repository is watched and re-audited when it changes.

Advertisement