triumvirateCAUTION
Five AI agents. One coordination layer. No relay server. Plus a trust layer that checks whether the review actually happened.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/michaeljboscia/triumvirate/actions) [](https://github.com/michaeljboscia/triumvirate/releases) [](LICENSE)
Five AI agents. One daemon. A methodology for building software with all of them at once, and a trust layer that checks whether they actually did the work.
Claude, Codex, Antigravity (the Gemini seat), Grok and DeepSeek, each with different strengths, working on the same codebase, coordinated by a single Rust daemon, visible in real time from inside your editor.
The hard part of multi-agent development is not dispatch. It is knowing whether a peer that said "looks good" read anything at all. Triumvirate answers that mechanically: a review that opened no files is rejected, a reviewer that skimmed one line is rejected, and code can be validated by a different agent that writes the tests without ever seeing the implementation.
Quick Start
git clone https://github.com/michaeljboscia/triumvirate cd triumvirate bash scripts/install.sh
That's it. One binary. No Docker. No NATS. No cloud services. Register it in Claude Code:
# Add to ~/.claude.json under mcpServers:
"triumvirate": { "command": "~/.local/bin/triumvirate", "args": ["mcp"] }Do NOT point this at `daemon/target/release/triumvirate`.target/is Cargo's disposable build directory:cargo clean, a toolchain change or any disk cleaner wipes it. When that happened here on 2026-07-23, every new MCP session in every repo failed with ENOENT while already-running processes kept working, because Unix keeps a deleted binary alive for an open file descriptor. A total outage disguised as "broken everywhere except here".scripts/install.shbuilds intotarget/and then i
5b75f04ee349OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add pantheon -- npx -y [email protected]
{
"mcpServers": {
"pantheon": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (16)
16 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ask_agent | read | |
ask_session | read | |
daemon_health | read | |
dismiss_session | read | |
dispatch_codex | read | |
dispatch_codex_worktree | read | |
fleet_cancel | read | |
fleet_spawn | read | |
fleet_status | read | |
get_task_output | read | |
get_task_status | read | |
ping | read | |
query_antigravity | read | |
query_gemini | read | |
review_agent | read | |
spawn_session | read |
Trust audit
CAUTIONgrade F · trust 55/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (15 observation(s))
- Network
- declared (6 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
icon.icns
"triumvirate-agentd ready — dashboard at http://127.0.0.1:{}","éresource_exhaustedβ is an identifier",
let token = "status-daemon-token-123";
let token = "mcp-daemon-token-123";
let token = "mcp-memory-daemon-token-123";
let token = "mcp-scratchpad-daemon-token-123";
let token = "mcp-fallback-daemon-token-123";
streamable-http
.gitmodules
.goatrodeo.events.log
let frontend_dir = Path::new("../../frontend");println!("cargo:rerun-if-changed=../../frontend/src");println!("cargo:rerun-if-changed=../../frontend/package.json");println!("cargo:rerun-if-changed=../../frontend/package-lock.json");println!("cargo:rerun-if-changed=../../frontend/vite.config.ts");**G6-C4. Four egress paths are unaddressed:** IPv6 (no `::/0` denial), the metadata server at `169.254.169.254`
**6. Step 1 does not apply firewall rules at all in this range.** It provisions with `--no-address` (92-105), **but no deny/allow egress rules are created or attached.** Unaddressed paths: **IPv6** (n
# Dashboard at http://127.0.0.1:8080
Open `http://127.0.0.1:8080` in your browser.
cargo run # Boot daemon, dashboard at http://127.0.0.1:8080
- `TRIUMVIRATE_URL` can override the default `http://127.0.0.1:8080`.
{"type":"usage","usage":{"input_tokens":66559,"output_tokens":39,"cache_read_input_tokens":512,"cache_creation_input_tokens":0,"reasoning_tokens":34},"signature":"UlrgMZF1iBLUtNZn5paL3Q3AxoqM6bxx/zSl4{"type":"usage","usage":{"input_tokens":57474,"output_tokens":31,"cache_read_input_tokens":256,"cache_creation_input_tokens":0,"reasoning_tokens":30},"signature":"KZNO7heqObAmpApMsem/pnCZsCxI/Me3Yd1Et{"type":"usage","usage":{"input_tokens":1357,"output_tokens":61,"cache_read_input_tokens":11648,"cache_creation_input_tokens":0,"reasoning_tokens":30},"signature":"yvPCYL6zxTRJPxEfaPpe9LIpckX5dGuKg8OFGates applied: no_behavioural_pass.
5b75f04ee349full audit observations/trust-audit/mcp-server/michaeljboscia__triumvirate.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 5b75f04ee349 | CAUTION | F | 55 | first audit |
Questions
What is the triumvirate MCP server?
Five AI agents. One coordination layer. No relay server. Plus a trust layer that checks whether the review actually happened.
What tools does triumvirate expose?
16 in total: 16 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is triumvirate safe to connect to an agent?
With care. The audit graded it F (55/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does triumvirate need?
No credential environment variables were found in its source, so it appears to need none.
How does triumvirate run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as pantheon at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (5b75f04ee349), read on 2026-10-11. The repository is watched and re-audited when it changes.