Atlas / MCP servers / max-listov / stitchkit

stitchkitBLOCK

Name: stitchkit
Author: max-listov

mcp/max-listov/stitchkit

MCP server by max-listov · ai agents · api · backend · Audited 2026-10-12

Contract-first backend framework for Bun and Node — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client.

Verdict

BLOCK

Grade

Trust score

42 /100

Exposed tools

167 130r · 36w · 1d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Contract-first backend framework for Bun and Node. Define your API once — get an HTTP API, MCP tools, AI-agent tools, a CLI and a typed client.

= 22" />

One defineContract() → an HTTP API, MCP tools, AI-agent tools and a CLI on the server — plus a fully-typed client to call them.

Why

One contract, five surfaces. Define your API once — get HTTP routes, MCP tools (for Claude/Cursor), AI SDK tools (for agents), a CLI (for scripts & Skills), and a typed client.
Zero HTTP framework deps. Built on Bun.serve() (Bun) or srvx (Node). No Hono, no Elysia, no Express.
Fullstack type safety. Server handlers, client calls, MCP tools — all typed from the same contract.
Inspectable. A focused core with explicit adapters. No generated

application code or framework build step in your app.

Thin over what you already use. WebSocket = Socket.IO (createSocketIOClient / createSocketIOServer). React data layer = react-query-kit (`createCurs

Read from source at commit 9f710db052ddOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add stitchkit-tui -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "stitchkit-tui": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (167)

130 read · 36 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`admin_action`	read	Admin action
`agent_inline`	read	Inline Agent registration
`alternate`	read	Alternatives
`audit`	read	Audit and report by exit code
`blocked`	read	Never allowed
`broken`	read	Carries a pointer nothing can resolve
`broken_preview`	read	Presenter failure fixture
`broken_round`	read	Round resolver failure fixture
`business_result`	read	Return business data
`change_item`	read	Change an item
`chatty`	read	Returns a result and logs on the way
`check`	read	Measure native idle and framework deadline boundaries
`classified`	read	Classify a valid result
`clear`	destructive	Start clean while keeping this conversation available to resume
`composed`	read	Upsert composed structured data
`confirmed_measure`	read	Typed MCP input round
`count_records`	read	Count records
`counted`	read	Count dispatches
`create_goal`	write	Create the durable objective for this conversation.
`custom_id`	read	Read a custom id
`dangerous_change`	write	Apply one fixture effect.
`denied_change`	write	Must not run after denial.
`describe`	read	Describe the compiled catalogue
`discovered`	read	Discovered bounds
`doctor`	read	Inspect the packed executable
`double`	read	Double a number
`download_native`	read	Download a packed native result
`duplicate_name`	read	Duplicate runtime name
`durable_effect`	read	Record one fixture effect.
`durable_operation`	write	Run an application-owned durable operation
`dynamic_policy`	read	Identity-dependent CLI policy probe
`echo`	read	x
`edit_file`	write	Replace an exact snippet in one workspace file.
`effect`	read	Record an effect
`effectful_input`	read	Exercise schema compilation
`entity_action`	read	Act on an entity
`entity_update`	write	Update an entity
`export`	read	Export a document
`first`	read	First
`get_goal`	read	Read the durable objective for this conversation.
`glob`	read	List workspace files matching a
`goal`	read	The durable objective and lifecycle of this conversation.
`guarded`	write	Apply referenced object guards
`guarded_operation`	read	Produce one typed safe refusal
`guarded_policy`	read	Guard policy phases
`handoff`	read	Hand a batch of files to a project
`handoff_read`	read	Read one handoff
`hidden_runtime`	read	Not a CLI command by default
`inline_tool`	read	Inline registration
`inspect`	read	Inspect the packed Node executable
`inspect_asset`	read	Inspect one asset
`inspect_local`	read	Inspect a local value
`integers`	read	Integer limits
`internal_upload`	write	Internal managed failure
`interrupt`	write	Interrupt the active run
`interrupt_agent`	write	Stop one active child conversation at a durable policy boundary.
`invalid_exit`	read	Return an invalid process status
`invalid_output`	read	Return invalid output
`invalid_outputless_policy`	read	Compile-only negative probe
`invalid_presenter`	read	Return invalid presentation bytes
`job`	write	Run job
`jobs_snapshot`	read	Snapshot job state
`jobs_status`	read	Read job status
`jsonl`	read	Stream JSON lines
`list_agents`	read	List the durable child graph for one parent conversation.
`list_directory`	read	List the direct entries of one workspace directory.
`list_widgets`	read	Collision
`literal`	read	Read catalog-restored primitive literals
`local`	read	Local
`local_runtime`	write	Run a packed pathless CLI operation
`logs`	read	Read service logs
`managed`	read	A managed operation
`mcp_inline`	read	Inline MCP registration
`mcp_only`	read	MCP only
`measure`	read	Typed SDK presenters
`member_lookup`	read	Look up a member
`model`	write	Choose the model for the next run
`native`	read	Inspect a parsed invocation
`native_fail`	read	Fail locally
`native_once`	read	Native
`native_update`	write	Update through native MCP content
`need`	read	Echo required text
`new`	write	Start a new durable conversation
`numbers`	read	A numeric trailing list
`numeric_stdin`	read	No-policy stdin compatibility probe
`ordered`	read	Invalid positional ordering probe
`ordered_values`	read	Several explicit positional values
`packed_catalog_probe`	read	Packed catalog probe
`packed_operation`	read	Packed durable operation composition
`packed_preview`	read	Render packed preview
`permissions`	read	Show approval and sandbox enforcement
`preview`	read
`preview_asset`	read	Preview one asset
`print`	write	Write directly
`publish_project`	write	Publish a project
`push`	write	A command whose field collides with a global
`raw_download`	read	Raw managed download
`raw_upload`	write	Raw managed upload
`read-only`	read	Upsert read-only structured data
`read_file`	read	Read a bounded UTF-8 slice from a host-authorized workspace file.
`read_item`	read	Read an item
`read_resource`	read	Read one exact discovered harness skill or resource by canonical name.
`recoverable_change`	write	Apply one recoverable fixture effect.
`render_image`	read	Render an image
`render_preview`	read	Render a preview
`resource_clock`	read	Current server time and timezone.
`resource_disk`	read	Free space on the data volume.
`resume`	read	Resume a durable conversation
`run_command`	write	Run a finite host-declared executable with bounded arguments, time and output.
`runtime`	read	Runtime
`runtime_array`	read	Return a runtime array
`runtime_denied`	read	Denied operation
`runtime_metadata`	read	Inspect runtime-tool MCP metadata
`runtime_only`	read	Runtime-only CLI
`runtime_parallel`	write	Run in parallel
`runtime_policy`	read	Exercise resolved runtime CLI policy
`runtime_preview`	read	Render a preview
`runtime_update`	write	Update a runtime entity
`safe_upload`	write	Safe managed failure
`schedule_after`	write	Schedule durable input after a relative delay.
`schedule_at`	write	Schedule durable input at an absolute timestamp with an explicit offset.
`schedule_cancel`	write	Cancel one durable deferred-input schedule.
`schedule_every`	write	Schedule recurring durable input in an explicit conversation timezone.
`schedule_list`	write	List durable schedules for one conversation.
`search_files`	read	Search bounded relative paths or UTF-8 file content under the workspace root.
`send_message`	write	Send one follow-up input to an active child conversation.
`serve`	write	Run the server
`session_event`	read	Read one durable event by exact conversation and sequence address.
`session_search`	read	Search authorized durable conversation events and return exact addresses.
`session_trace`	read	Read a bounded contiguous slice of this conversation event trace.
`sessions`	read	Browse durable conversations
`shared_name`	read	Identity binding fixture
`skills`	read	Show lazily available skills and resources
`slow_operation`	read	Wait until transport cancellation
`stamp`	read	Return the identity compiled into this executable
`status`	read	Show native health
`stitchkit.application.admission.accepted`	read	Absolute number of operations accepted in this application lifetime.
`stitchkit.application.admission.accepting`	read	Whether application admission is currently open.
`stitchkit.application.admission.completed`	read	Absolute number of operations completed in this application lifetime.
`stitchkit.application.admission.pending`	read	Current number of admitted operations still pending.
`stitchkit.application.lifecycle`	read	Current application lifecycle and health state.
`stitchkit.application.ready`	read	Whether the application currently accepts readiness traffic.
`stitchkit.application.resource.ready`	read	Whether each declared managed resource is currently ready.
`strict_logs`	read	Read a bounded log stream
`structured_alias`	read	Structured alias coercion probe
`sum`	write	Add two numbers
`throwing_presenter`	read	Throw from presentation policy
`throwing_tool`	read	Throw
`todo`	read	The durable ordered work plan for this conversation.
`todo_write`	write	Replace the durable ordered work plan for this conversation.
`tools`	read	Show the direct tool surface
`transport_probe`	read	Probe transport registration
`typed-managed`	read	Strict neutral construction
`typed_input`	read	Typed input
`unknown`	read	Unknown failure control
`update_goal`	write	Update the durable objective or lifecycle status.
`upload_native`	write	Upload a packed native input
`upsert`	read	Upsert structured data
`view_file`	read
`view_native`	read	View protected packed media
`void_tool`	read	No output
`wait_for_job`	read	Wait for a job
`wait_for_native`	read	Wait for a packed native operation
`whoami`	read	Report the invocation context
`workspace_echo`	read	Echo a workspace value.
`write_file`	write	Write bounded UTF-8 content to a host-authorized workspace file.
`x`	read	d

Trust audit

BLOCKgrade F · trust 42/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (8 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

packages/core/src/agent-runtime/invocation-payload.ts

invocation-payload.ts

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/core/src/internal/sqlite.ts:36

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/core/src/telegram/update-store-sqlite.ts:22

exec(sql: string): unknown;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

scripts/release-prepush.ts:35

let verify = false;

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/create-stitchkit/template/.data/board.sqlite

board.sqlite

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

packages/core/src/entrypoints/tracking.ts:18

export { sendUnloadBeacon } from '../tracking/beacon';

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

packages/core/src/tracking/client.ts:15

import { sendUnloadBeacon } from './beacon';

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:110

STARTER_TEST_DATABASE_ADMIN_URL: postgresql://postgres:[email protected]:5432/postgres

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:150

STARTER_TEST_DATABASE_ADMIN_URL: postgresql://postgres:[email protected]:5432/postgres

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:317

STARTER_TEST_DATABASE_ADMIN_URL: postgresql://postgres:[email protected]:5432/postgres

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:352

STARTER_TEST_DATABASE_ADMIN_URL: postgresql://postgres:postgres@postgres:5432/postgres

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

packages/core/tests/observability-secret-values.test.ts:17

DATABASE_URL: 'postgresql://app_role:db-pass%[email protected]:5432/app',