OpenAgentPackCAUTION
Manage, review, and migrate cloud AI agents with Git and YAML. The open-source IaC control plane for managed AI agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English | 简体中文
Manage, review, and migrate cloud AI agents with Git and YAML. The open-source IaC control plane for managed AI agents.
[](./LICENSE) [](https://github.com/modelstudioai/OpenAgentPack/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@openagentpack/cli) [](./CONTRIBUTING.md)
[!IMPORTANT] OpenAgentPack is in beta. Public APIs and theagents.yamlschema may change before1.0. See the changelog.
agents.yaml → validate → plan → apply: bring agents back into Git, review the pending changes, then update remote resources.
One agents.yaml defines an agent's environment, model, instructions, tools, skills, MCP servers, vaults, and credentials. Review every change in a PR, preview it with plan, and apply it when ready — instead of rebuilding the same agent through console clicks.
- Reviewable agent assets — keep prompts, tools, skills, and configuration in Git; reuse, roll back, and hand them off.
- Predictable changes —
validate → plan → applypreviews creates, updates, and deletes before changing remote resources. - Portable core declaration — target Bailian, Qoder, Claude, or Volcengine Ark with an explicit provider capability contract.
npm install -g @openagentpack/cli agents init # Configure one provider's credentials, then: agents validate && agents plan
Run the 5-minute quick start · View provider support · [Browse runnable examples](./docs/example
551bc865793cOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add sdk --env AGENTS_PLAYGROUND_TOKEN=${AGENTS_PLAYGROUND_TOKEN} --env AGENTS_TEST_SCOPED_SECRET=${AGENTS_TEST_SCOPED_SECRET} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ARK_API_KEY=${ARK_API_KEY} -- npx -y @openagentpack/[email protected]{
"mcpServers": {
"sdk": {
"command": "npx",
"args": [
"-y",
"@openagentpack/[email protected]"
],
"env": {
"AGENTS_PLAYGROUND_TOKEN": "${AGENTS_PLAYGROUND_TOKEN}",
"AGENTS_TEST_SCOPED_SECRET": "${AGENTS_TEST_SCOPED_SECRET}",
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"ARK_API_KEY": "${ARK_API_KEY}"
}
}
}
}Exposed tools (7)
7 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Agents__demo | read | d |
Assistant | read | Pinned description |
assistant | read | Agents live drift original agent |
bailian-cli | read | 百炼 CLI 云端环境 |
lead | read | |
notes | read | notes |
显示名称 | read | 描述 |
Trust audit
CAUTIONgrade C · trust 77/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
category: categoryKeys[Math.floor(Math.random() * categoryKeys.length)]!,
const response = await fetch(`http://127.0.0.1:${port}/`);const response = await fetch(`http://127.0.0.1:${port}/`);const assetResponse = await fetch(`http://127.0.0.1:${port}${asset}`);credentials: { token: "must-not-enter-state" },bailian-cli.zip
.dependency-cruiser.cjs
.openspec.yaml
expect(buildPreview.canonical_yaml).not.toContain("../../agents/assistant/files/input/input.txt");import { useRc } from "../../context";import { useSelectionSet } from "../../hooks/useSelectionSet";import { fileStatusBadge } from "../../shared/badges";import { fmtTime, formatBytes, shortId } from "../../shared/formatters";base_url: http://127.0.0.1:1
@hono/zod-openapi, chokidar, hono, yaml, @types/bun, @types/node, typescript
i18next, lucide-react, react, react-dom, react-i18next, react-markdown, rehype-sanitize, remark-gfm
@ast-grep/cli, @biomejs/biome, @changesets/cli, @types/bun, dependency-cruiser, tsup, typescript
@clack/prompts, chalk, commander, yaml, @types/bun, typescript
@types/bun, typescript
Cloud AI agents are increasingly built by clicking through provider consoles: create an environment here, upload a skill there, paste an API key, wire up an MCP server. The resulting state lives only
- **Qoder 是完整的多 Agent 运行时模型,且 Managed Mode 与 Forward Mode 都有官方契约**:Managed Agent roster 通过 `id`/`version` 引用 Agent;Forward Template roster 通过 `template_id` 引用另一个 Template,两种模式不能共用同一请求映射。协调者将工作委派给独立 Se
- **百炼的多智能体配置页主要给出 roster 契约,Session/Event 与 Webhook API 补充了部分运行时契约,真机进一步证实了独立 child Thread、并行执行和 Session 内共享文件系统**:支持 `coordinator`,成员为另一个 Agent 或 coordinator 自身,条目数最多 20;事件可携带 child Thread 标识并支持定向中断
| API / 资源清理端点 | **文档已证实**:base URL `https://api.qoder.com/api/v1/cloud`。[API Overview](https://docs.qoder.com/cloud-agents/api/conventions/overview#gateway-url) 真机临时 Agent 已通过 DELETE 清理。 | **文档已证实**:
线程列表同时包含 coordinator 与 child,结构中可观测 `id`、`type`、`parent_thread_id`、`agent`、`status` 等字段;child 是否由目标 Template 产生,应以 `parent_thread_id` 和 `agent` 快照共同判断,不能仅凭响应文本猜测。Thread Event 历史不支持 Session Event 的 `ty
packages/sdk/docs/agents.gif
Gates applied: no_behavioural_pass.
551bc865793cfull audit observations/trust-audit/mcp-server/modelstudioai__openagentpack.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 551bc865793c | CAUTION | C | 77 | first audit |
Questions
What is the @openagentpack/sdk MCP server?
Manage, review, and migrate cloud AI agents with Git and YAML. The open-source IaC control plane for managed AI agents.
What tools does @openagentpack/sdk expose?
7 in total: 7 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @openagentpack/sdk safe to connect to an agent?
With care. The audit graded it C (77/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does @openagentpack/sdk need?
It reads AGENTS_PLAYGROUND_TOKEN, AGENTS_TEST_SCOPED_SECRET, ANTHROPIC_API_KEY, ARK_API_KEY, DASHSCOPE_API_KEY, OPENAGENTPACK_TEST_API_KEY and OPENAGENTPACK_VERSION_AUTHOR from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @openagentpack/sdk run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @openagentpack/sdk at 0.8.0.
How current is this page?
The grade is for one exact copy of the source (551bc865793c), read on 2026-10-12. The repository is watched and re-audited when it changes.