Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

OpenHarness MCP server

by maxgfeller/open-harnessMIT licenceAudited 26 Oct 2026 · source f1532d3fcec8

npm @openharness/vue 2.0.1★ 619
✓SAFEGrade B · 88/100 · 26 Oct 2026 · f1532d3
619GitHub stars
InstallView source on GitHub ↗

Is it safe? Yes — SAFE, grade B (88/100). It exposes 6 tools: 6 read, 0 write and 0 destructive. The audit recorded 16 findings (0 critical, 0 high, 0 medium, 15 low). Maintainer's description: A code-first, composable SDK to build powerful AI agents

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “OpenHarness MCP server (MaxGfeller/open-harness)”. Retrieved 26 Oct 2026. https://modelsatlas.com/mcp/maxgfeller/open-harness

Trust audit

Audit 0.4.1 · full source read 26 Oct 2026

Trust score88/100✓SAFE B
0 critical0 high0 medium15 low1 info

16 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared1 observation
  • NetworkNone observedNothing seen in the source
  • ShellDeclared5 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

LayerWhat we checkResult
L0 ProvenanceRepo owner, licence, archive status, activityPASS
L1 Static sourceSecrets, path traversal, supply chainPASS 15 findings
L2 InstructionsPrompt injection and authority framing in docs and tool descriptionsPASS 1 finding
L3 InventoryDeclared tools match the sourcePASS
L4 SandboxRun in isolation and watch behaviourSKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

  • Repository owner maxgfellerUser accountAccount type recorded when we read the repository.
  • PackagePublished on npm@openharness/vue at version 2.0.1
  • LicenceMITFrom the repository, as read at the audited commit.
  • Last push3 months agoActivity of the repository when we read it.
  • Source commit readf1532d3fcec8The audit covers exactly this commit, read on 26 Oct 2026.

Runtime

  • Sandbox runNot run yetThis audit read the source only; it did not execute the server.
  • Tool inventory6 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (16)

Sorted by severity

LOWCode injectioncode.eval_exec · packages/core/src/__tests__/tools/create-bash-tool.test.ts:14
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const result = await exec(bash, { command: "echo hello", timeout: 30000 });
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · packages/core/src/__tests__/tools/create-bash-tool.test.ts:24
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const result = await exec(bash, { command: "anything", timeout: 30000 });
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · packages/core/src/__tests__/tools/create-fs-tools.test.ts:40
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const result = await exec(tools.readFile, { filePath: "hello.txt" });
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · packages/core/src/__tests__/tools/create-fs-tools.test.ts:51
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const result = await exec(tools.readFile, { filePath: "lines.txt", offset: 5, limit: 3 });
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · packages/core/src/__tests__/tools/create-fs-tools.test.ts:64
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const result = await exec(smallTools.readFile, { filePath: "big.txt" });
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · packages/core/src/__tests__/middleware/compaction.test.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { AgentEvent } from "../../agent.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/core/src/__tests__/middleware/compaction.test.ts:3
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { Runner } from "../../runner.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/core/src/__tests__/middleware/compaction.test.ts:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { CompactionStrategy, CompactionContext } from "../../session.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/core/src/__tests__/middleware/compaction.test.ts:5
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { withCompaction } from "../../middleware/compaction.js";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/core/src/__tests__/middleware/hooks.test.ts:2
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { AgentEvent } from "../../agent.js";
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · apps/docs/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
mintlify
Why
1 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · apps/web/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
nuxt, vue, vue-router, shadcn-nuxt, @tailwindcss/vite, tw-animate-css, tailwindcss, typescript
Why
16 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · examples/cli/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@ai-sdk/openai, @types/node, chalk, ora, tsx, typescript
Why
6 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · examples/nextjs-demo/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@ai-sdk/openai, @ai-sdk/react, ai, zod, next, react, react-dom, @types/react
Why
10 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · examples/nuxt-demo/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@ai-sdk/openai, @ai-sdk/vue, ai, zod, nuxt, vue, typescript
Why
7 dependency range(s) float
Fix
pin exact versions or ship a lockfile
INFOPrompt injectionprompt.credential_read · packages/provider-chatgpt/README.md:91
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
`OpenCodeTokenStore` reads and writes OpenCode's `openai` auth entry explicitly. The package does not silently read another tool's credentials.
Why
asks the agent to read credentials
Fix
—

Tools it exposes

6 declared in source · 0 destructive

6 read0 write0 destructive
ToolRiskWhat it does
bare-skillreadBare
explorereadRead-only codebase exploration. Use for searching, reading files, and understanding code.
other-skillreadAnother one
real-skillreadReal
researcherreadInvestigate code
test-skillreadA test skill

Install

Package version 2.0.1 · audited commit f1532d3

Add to CursorAdd to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 2.0.1. The audit covers commit f1532d3 only.

claude mcp add vue -- npx -y @openharness/[email protected]

The command pins the package version recorded in the source (2.0.1); the audit covers commit f1532d3fcec8. Transport: not declared. No environment variables required.

Audit history

  1. ✓SAFE B 88 / 100

    First audit · f1532d3fcec8

README badge

For maintainers · updates on every re-audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B 
[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/maxgfeller/open-harness/badge.svg)](https://modelsatlas.com/mcp/maxgfeller/open-harness/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about OpenHarness MCP server

What is the OpenHarness MCP server?
A code-first, composable SDK to build powerful AI agents
What tools does OpenHarness expose?
6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is OpenHarness safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (88/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does OpenHarness need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (f1532d3fcec8), read on 2026-10-26. The repository is watched and re-audited when it changes.

Sources

  • MaxGfeller/open-harness on GitHub — the source we read, its licence, stars and activityObserved · 26 Oct 2026
  • ModelsAtlas trust audit — SAFE verdict for commit f1532d3fcec8Observed · 26 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.