Atlas / MCP servers / mungowang / mohou-mini-app

mohou-mini-appBLOCK

Name: mohou-mini-app
Author: mungowang

mcp/mungowang/mohou-mini-app

MCP server by mungowang · agent skills · agentic ai · design · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Mohou. Your own place to make mini-apps, and to run them.

Verdict

BLOCK

Grade

Trust score

50 /100

Exposed tools

74 70r · 4w · 0d

Transport

stdio · streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English | 中文

[](https://github.com/mungowang/mohou-mini-app/actions/workflows/check.yml) [](package.json) [](package.json) [](package.json) [](docs/architecture/decisions.md)

Mohou. Your own place to make mini-apps, and to run them.

It lays out the desk, so the agent you already use can build your library of programs and a workbench to go with it.
The shelves are steady. You invent. It runs them and looks after them. Open it and start.
Make the front page of your day however you like. A different situation gets a different workbench.

阶段看板, opened from the library. Counts on top, four columns under them, and a button that asks the model to log time.

Those apps call back into this machine. ctx.llm and ctx.agent use the provider Shell started (Echo, or Pi when it is installed). ctx.mcp calls an MCP server you already connected. ctx.bash runs on this computer.

What you can build

You describe the thing. The agent scaffolds it, opens it, reads the errors, and keeps going until the screen matches.

These need nothing but the host. Connect your own systems later and the same shape covers them.

Read from source at commit a5c067132007OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add values --env MCP_TOKEN=${MCP_TOKEN} -- npx -y @mohou/[email protected]

claude-desktop

{
  "mcpServers": {
    "values": {
      "command": "npx",
      "args": [
        "-y",
        "@mohou/[email protected]"
      ],
      "env": {
        "MCP_TOKEN": "${MCP_TOKEN}"
      }
    }
  }
}

Exposed tools (74)

70 read · 4 write · 0 destructive.

Tool	Risk	Description
`Beta`	read	One line
`Board`	read	Workbench board
`Desk`	read	Home
`Early`	read	a
`Example`	read	One line
`Forest`	read	Green
`GITLAB_BASE_URL`	read	GitLab instance root, for example http://gitlab.example.com
`GITLAB_TOKEN`	read	Personal access token with the api scope
`JENKINS_API_TOKEN`	read	Jenkins API token
`JENKINS_URL`	read	Jenkins root, for example https://jenkins.example.com
`JENKINS_USERNAME`	read	Jenkins user
`JIRA_BASE_URL`	read	Jira instance root, for example https://jira.example.com
`JIRA_PASSWORD`	read	Jira password or API token
`JIRA_USERNAME`	read	Jira account name
`Late`	read	b
`Mine`	read	x
`None`	read	c
`Notes`	read	A pad
`Other`	read	desk notes
`Todo`	read	A list
`X`	read	d
`a`	read	one
`com.mohou.lab`	write	schedule
`github`	read	个人 GitHub
`gitlab`	read	GitLab
`gitlab_branches_list`	read	项目分支,新建 MR 前确认源分支
`gitlab_labels_list`	read	项目标签名——写标签前先查,避免建出拼错的标签
`gitlab_mr_changes`	write	逐文件 diff 摘要(patch 有截断上限)
`gitlab_mr_get`	read	一个合并请求的字段,含 work_in_progress
`gitlab_mr_list`	read	项目的合并请求,默认只看 opened
`gitlab_mr_pipelines`	read	这个合并请求的流水线状态,合并前的闸门
`gitlab_project_get`	read	按路径或 id 读项目,拿默认分支
`gitlab_project_search`	read	按名字搜项目,拿项目路径
`gitlab_server_version`	read	目标实例的 GitLab 版本
`gitlab_whoami`	read	当前凭据对应的账号——证明 token 可用最便宜的一步
`jenkins_get_build_changes`	read	这次构建带的提交
`jenkins_get_build_status`	read	一次构建的结果、时长、参数
`jenkins_get_console_log`	read	控制台输出(排错主入口)
`jenkins_get_job_status`	read	一个任务的状态与最近构建
`jenkins_get_pipeline_stages`	read	流水线各阶段与耗时
`jenkins_get_recent_builds`	read	最近几次构建的编号与结果
`jenkins_get_version`	read	控制器版本与就绪状态,最便宜的一次探活
`jenkins_list_jobs`	read	任务列表(可按 folder 收窄)
`jenkins_list_nodes`	read	节点与在线状态
`jenkins_search_jobs`	read	按名字搜任务
`jira_get_current_user`	read	当前凭据对应的账号,用来确认 token 配对正确
`jira_get_fields`	read	字段目录(自定义字段用 id 才稳)
`jira_get_issue`	read	读一条 issue 的字段与描述
`jira_get_transitions`	read	一条 issue 当前可做的状态流转
`jira_list_comments`	read	一条 issue 的评论
`jira_list_projects`	read	可见项目列表,拿 project key 用
`jira_search_issues`	read	按 JQL 搜索 issue
`jira_server_info`	read	确认 Jira 版本与部署类型(Server / Cloud),不取业务数据
`lab`	read	课表
`mini_app_register`	write	Create an app
`n`	read	d
`openai`	read	OpenAI
`ping`	read	pong
`一键杂事`	read	三个按钮,在这台机器上跑已知脚本,结果回到 app
`今日待办`	read	打开就看见我的一屏:本地事项 + 筛选 + 归档
`会计`	read	课表
`信息雷达`	read	拉源、做简报、长任务可取消
`值班屏`	read	打开就自己在跳。没有开始按钮。
`实验台`	read
`工作台`	read	第一屏是今天要处理的事,应用列表在旁边
`我的今日`	read	edited
`执行器`	write	模型自己走多步,UI 就是这条 run,可取消
`桌面`	read	自定义首页
`模型实验台`	read	LLM / Agent / MCP 三台实验,流式输出、执行步骤跟踪、运行记录
`每日站会`	read	Daily standup review
`表格台`	read	文件进,格子上干活,哪里变了
`识图`	read	粘贴截图
`阶段看板`	read	看板/表格双视图 · 状态与评论 · AI 记一笔
`骨架示例`	read	最小可运行:一次 call 往返 + 读 Host 配置

Trust audit

BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (7 observation(s))
Shell: declared (3 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/host/src/events/view-bridge.ts:176

const run = new Function('mma', `return (async () => {\n${data.code}\n})()`) as (mma: typeof helpers) => Promise<unknown>

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.rtl_override · CWE-94, CWE-1427

.agents/notes/implemented/simplification/2026-10-08-grok-marked-block.md:23

file_path/Users/wangpeng/Workspace/Source/monkey-mini-app-next/.agents/notes/implemented/simplification/2026-10-08-grok-marked-block.md

Why it matters. bidirectional override can render text differently from how it is read

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/launcher/tauri/icons/icon.icns

icon.icns

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/host/src/http/bind.ts:84

url: `http://127.0.0.1:${input.policy().hostPort}${httpLayout.mcp}`,

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/host/src/http/owner.ts:53

url: `http://127.0.0.1:${ports.readPolicy().hostPort}${httpLayout.mcp}`,

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/mcp/client/tests/secrets.spec.ts:16

for (const value of ['Bearer abcdefgh', 'sk-live-123', 'ghp_abcdef', 'eyJhbGciOiJIUzI1NiJ9', '-----BEGIN RSA PRIVATE KEY-----', '0123456789abcdef0123456789abcdef01234567']) {

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/mcp/client/tests/secrets.spec.ts:39

expect(maskCredential('-----BEGIN RSA PRIVATE KEY-----')).toBe('-----BEGIN RSA PRIVATE KEY-----')

LOWInventory / provenance · inv.hidden_file · CWE-1104

.oxlintrc.json

.oxlintrc.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.oxlintrc.staged.json

.oxlintrc.staged.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence

LOWInventory / provenance · inv.symlink · CWE-1104

CLAUDE.md

CLAUDE.md

Why it matters. link not followed

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/host/tests/runner.spec.ts:15

eval(source: string): void

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/host/tests/runner.spec.ts:62

eval(source: string): void

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/host/tests/view-bridge.spec.ts:215

const start = new Function(source) as () => void

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table