AgentPlaybooks

Overview

From the repository's own README, as read at the audited commit.

# AgentPlaybooks**One playbook, every agent.** A portable operating environment for AI agents — persona, skills, MCP servers, project instructions, and memory in one source of truth.Keep your agents yours. AgentPlaybooks stores skills, personas, MCP servers, project instructions, and memory in one portable playbook, so you can switch platforms, use several at once, or self-host without vendor lock-in.Your agent setup stays in sync across Claude, ChatGPT, Cursor, Codex, Gemini, local models, and future platforms. The playbook is the portable source of truth—not any single vendor or editor.## Highlights**What a playbook holds**- Persona: 1 per playbook, stored directly on the playbook record- Instructions: always-on project rules — the `AGENTS.md` / `CLAUDE.md` content- Skills: JSON schema definitions plus optional SKILL.md content- Skill attachments: secure file storage for code, prompts, and docs- MCP servers: tools and resources in Model Context Protocol format- Memory: key-value store with tags and descriptions- Canvas: versioned markdown work documents, scoped to a playbook run, so several  teams can execute the same playbook without sharing work products**Credentials, without handing them over**- Secrets vault: AES-256-GCM, per-user derived keys. Agents reference a secret by  name and the platform injects it server-side (`use_secret`), so the value never  enters an agent's context. Optional per-secret host allow-lists.- Federation: other MCP servers and OpenAPI services become tools on your  playbook, with their credentials resolved from that same vault by name- Audit trail: every federated call and every vault operation, refusals included**Getting it into your tools**- CLI + Claude Code plugin: audit your local agent config, then sync one playbook  to Claude Code, Cursor, ChatGPT/Codex, Google Antigravity, Grok Bot and Hermes- Publishing: a public playbook's skills are served as plain markdown over HTTP  at `/.well-known/skills/` — installable from a URL, no re

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add cli --env AGENTPLAYBOOKS_API_KEY=${AGENTPLAYBOOKS_API_KEY} --env AGENTPLAYBOOKS_OAUTH_CLIENT_ID=${AGENTPLAYBOOKS_OAUTH_CLIENT_ID} --env AGENTPLAYBOOKS_PLAYBOOK_KEY=${AGENTPLAYBOOKS_PLAYBOOK_KEY} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y @agentplaybooks/[email protected]

{
  "mcpServers": {
    "cli": {
      "command": "npx",
      "args": [
        "-y",
        "@agentplaybooks/[email protected]"
      ],
      "env": {
        "AGENTPLAYBOOKS_API_KEY": "${AGENTPLAYBOOKS_API_KEY}",
        "AGENTPLAYBOOKS_OAUTH_CLIENT_ID": "${AGENTPLAYBOOKS_OAUTH_CLIENT_ID}",
        "AGENTPLAYBOOKS_PLAYBOOK_KEY": "${AGENTPLAYBOOKS_PLAYBOOK_KEY}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (109) 64 read · 35 write · 10 destructive

Blast radius: 10 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Details

Source

matebenyovszky/agentplaybooks

npm

@agentplaybooks/cli@0.3.0-beta.3

Transports

streamable-http

Credentials it reads

AGENTPLAYBOOKS_API_KEYAGENTPLAYBOOKS_OAUTH_CLIENT_IDAGENTPLAYBOOKS_PLAYBOOK_KEYGITHUB_TOKENLOG_TOKENSNEXT_PUBLIC_SUPABASE_ANON_KEYSECRETS_ENCRYPTION_KEYSECRETS_REQUIRE_ALLOWED_HOSTSSUPABASE_SERVICE_ROLE_KEY

License

MIT

Stars

5 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (6 observation(s))

Network

declared (17 observation(s))

Shell

declared (1 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (25)

hostname === "metadata.google.internal" ||

hostname === "metadata.google.internal" ||

if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal") || host === "metadata.google.internal") {

console.log(`  ${plan.manifest.spec.secrets.length} secret reference(s): ${plan.manifest.spec.secrets.map((secret) => secret.name).join(", ")}`);

console.log(`  ${secret.name} (${secret.value.length} characters)`);

console.log(`About to store a secret in the playbook vault at ${url}:`);

console.log(`${stored.has(secret.name) ? "Rotated" : "Stored"} ${secret.name}.`);

console.log(`  ${secret.name} (${secret.value.length} characters)`);

const url = new URL(request2.url, "http://127.0.0.1");

const redirectUri = `http://127.0.0.1:${port}/callback`;

const redirectUri = `http://127.0.0.1:${port}/callback`;

const url = new URL(request.url, "http://127.0.0.1");

delete_entities, delete_mcp_server, delete_memory, delete_observations, delete_persona, delete_relations, delete_run, delete_secret, delete_skill, write_query

import { requireAuth } from "../../_shared/auth";

import { getServiceSupabase } from "../../_shared/supabase";

import { getAuthenticatedUser } from "../../_shared/auth";

import { getPlaybookAccessRole } from "../../_shared/guards";

} from "../../_shared/formatters";

"http://169.254.169.254/callback",

redirectUri: "http://127.0.0.1:5555/callback",

const str = atob(src.replace(/[\n\r]/g, ""));

return new TextDecoder().decode(Uint8Array.from(atob(match[1]), (char) => char.charCodeAt(0)));

const binary = atob(base64);

return decodeURIComponent(escape(atob(padded)));

@supabase/supabase-js, clsx, framer-motion, hono, jszip, lucide-react, next-intl, tailwind-merge

Gates applied: no_behavioural_pass.

Audited 2026-09-18 · audit v0.4.0 · source sha 933131272c1d · full audit: observations/trust-audit/mcp-server/matebenyovszky__agentplaybooks.json · Report an issue or request a re-scan

Audit history

Alternatives

Other servers in the same categories, safer ones first.

Questions