Atlas / MCP servers / nafeeur / MaskShift

MaskShiftBLOCK

Name: MaskShift
Author: nafeeur

mcp/nafeeur/maskshift

MCP server by nafeeur · agent skills · agentic workflow · anthropic · Audited 2026-10-11

⚑ Report / re-scan Source ↗

Maximalist harness

Verdict

BLOCK

Grade

Trust score

53 /100

Exposed tools

200 125r · 69w · 13d

Transport

streamable-http

License

GPL-3.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A general-purpose agent harness for any model, in one terminal application with no runtime dependencies. Give a model controlled access to your files, shell, browser, documents and services, and let it carry a task through to a verified result.

MaskShift connects a language model to the tools it needs to get real work done — reading and writing files, running commands, browsing the web, working with PDFs and notebooks, querying databases, calling MCP servers, remembering what matters and delegating to sub-agents — and keeps a person in control with checkpoints, an audit log and optional approvals.

It works for software engineering, but nothing about it is specific to code: summarize a folder of invoices into a spreadsheet, research a topic and write up the findings, reorganize files, run a recurring report. The model is a line of configuration; the tools are the same whichever one you use.

Highlights

Any model. Ollama, LM Studio, vLLM, OpenAI, Anthropic, Gemini, OpenRouter and any

OpenAI-compatible server. A model with no native tool API still gets the full tool surface through an in-prompt protocol. → providers

Adapts to the model. Each model gets a help level from

Read from source at commit e389ef952e8dOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add maskshift --env BRAVE_API_KEY=${BRAVE_API_KEY} --env EXA_API_KEY=${EXA_API_KEY} --env TAVILY_API_KEY=${TAVILY_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "maskshift": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "BRAVE_API_KEY": "${BRAVE_API_KEY}",
        "EXA_API_KEY": "${EXA_API_KEY}",
        "TAVILY_API_KEY": "${TAVILY_API_KEY}"
      }
    }
  }
}

Exposed tools (200)

125 read · 69 write · 13 destructive. Blast radius: 13 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`agent_bridge_discover`	read	Detect locally installed Claude Code, Codex, OpenCode, Copilot, Hermes, Aider, and configured coding-agent CLIs.
`agent_bridge_help`	read	Read the installed command help for an external coding-agent bridge before delegating.
`agent_bridge_run`	write	Run an installed Claude Code, Codex, OpenCode, Copilot, Hermes, Aider, or configured agent against the current workspace. Can wait or return a persistent process.
`agent_cancel`	write	Cancel a running subagent or other active MaskShift run.
`agent_dag_execute`	write	Execute the current dependency DAG in bounded parallel waves. Edit nodes default to isolated Git worktrees; failed dependencies block downstream work.
`agent_delegate`	write	Run a focused subagent with its own session and capability context. Optionally give it a named persona (see agent_persona_list) to frame its system prompt, and optionally isolate editing in a Git worktree and branch.
`agent_parallel`	read	Delegate multiple independent research, review, test, or implementation tasks concurrently and aggregate their final results. Each task may set its own persona.
`agent_persona_list`	read	List named personas (bundled and project-defined) that can be passed as agent_delegate\
`agent_route`	read	Recommend an available external coding-agent bridge or internal subagent based on the task profile.
`agent_run_status`	write	Inspect active and recent agent runs, including parent/subagent relationships.
`archive_create`	write	Create tar.gz, tar.zst, tar, or zip archives from arbitrary host paths.
`archive_extract`	read	Extract zip, tar.gz, tar.zst, tar, and common compressed archives.
`archive_list`	read	List the files inside a zip or tar archive without extracting it.
`audit-fixture`	read	Fixture skill used to check reference sandboxing.
`automation_create`	write	Schedule a recurring or one-time autonomous agent prompt, tool call, or unrestricted shell command. Schedules accept cron, ISO timestamps, or strings like every 15m.
`automation_delete`	destructive	Permanently remove a scheduled automation.
`automation_list`	write	List scheduled agent, tool, and shell automations with next/last run state.
`automation_pause`	write	Disable an automation without deleting it.
`automation_resume`	write	Enable an automation and compute its next run.
`automation_run_now`	write	Immediately execute an automation regardless of its next scheduled time.
`automation_update`	write	Edit an automation schedule, action, name, metadata, or enabled state.
`browser_accessibility`	read	Return the Chrome accessibility tree for semantic page understanding.
`browser_click`	read	Click a CSS selector or page coordinate through the Chrome input pipeline.
`browser_close`	destructive	Terminate a MaskShift browser instance and its CDP connections.
`browser_close_tab`	read	Close one browser page target.
`browser_console`	read	Read recent console messages, exceptions, and browser log entries from the page.
`browser_discover`	read	Detect an installed Chromium, Chrome, or Edge executable for dependency-free CDP automation.
`browser_evaluate`	write	Execute arbitrary JavaScript in the active page and return a serializable value.
`browser_instances`	read	List browser processes launched by MaskShift.
`browser_launch`	read	Launch a persistent-profile Chromium browser with DevTools automation. Headless by default; visible mode supports interactive logins.
`browser_navigate`	read	Navigate a browser tab and wait for the document to load.
`browser_network`	read	Read recent Chrome DevTools Network events for the page.
`browser_new_tab`	write	Create a new browser tab at a URL.
`browser_print_pdf`	read	Render the current browser page to a PDF artifact using Chrome print layout.
`browser_screenshot`	read	Capture a viewport or full-page screenshot to a workspace artifact file.
`browser_snapshot`	read	Return page title, URL, visible text, and a selector map of interactive elements.
`browser_tabs`	read	List all page targets in a browser instance.
`browser_type`	write	Focus an optional CSS selector, type text, and optionally submit with Enter.
`browser_wait_for`	read	Wait for a CSS selector to become visible, hidden, attached, or detached.
`capability_activate`	write	Load selected capabilities into the current model context. Local tools add schemas, skills add instructions, and MCP servers connect lazily and expose their tools.
`capability_search`	read	Search local tools, reusable skills, imported MCP servers, and discovered MCP tools. Use this whenever the current tool set is insufficient.
`capability_state`	write	Show the exact tools, skills, and MCP servers currently loaded for this run.
`change_impact`	write	Walk reverse imports and call relationships before an edit to identify affected symbols, modules, and likely tests.
`checksum_verify`	read	Compute a file\
`chmod_set`	write	Change a path\
`code_graph_build`	read	Build a persistent repository graph of files, symbols, imports, containment, and likely calls for dependency-aware navigation.
`code_graph_query`	read	Find files and symbols in the persistent code graph, including incoming and outgoing relationship counts.
`command_lookup`	read	Find whether one or more commands are installed and return their executable paths.
`container_build`	read	Build a Docker/Podman image from a Dockerfile or Containerfile with build args and tags.
`container_compose`	write	Run Docker Compose or Podman Compose actions such as up, down, build, logs, ps, and config.
`container_engine`	read	Detect Docker or Podman and return version and runtime information.
`container_exec`	write	Execute a command in an existing Docker/Podman container.
`container_list`	read	List running or stopped Docker/Podman containers as structured records.
`container_logs`	read	Read recent container logs with timestamps, tail, and since controls.
`container_run`	write	Run any Docker/Podman image with ports, volumes, environment, network, privilege, and detach controls.
`container_stop`	destructive	Stop, kill, restart, pause, unpause, or remove a container.
`context7`	read	Current library and framework documentation with version-aware examples.
`context_plan_explain`	read	Build a dry context plan and report budgets, selected source files, retrieval reasons, and excluded stale memories.
`database_cli`	write	Execute a command through psql, mysql, redis-cli, mongosh, duckdb, or another installed database client.
`dependency_scan`	read	Inspect imports across selected source files and return a compact file-to-dependency graph without installing parsers.
`disk_usage`	read	Report filesystem-level free/used space (df), or a per-directory usage breakdown (du) when a path is given.
`echo`	read	Echo arguments
`environment_list`	read	List process environment variable names and optionally values. MaskShift autonomous mode permits direct secret-bearing environment access.
`environment_set`	destructive	Set or delete environment variables for this running MaskShift daemon and future child processes.
`external_agent_run`	write	Execute any configured or ad-hoc coding-agent command with placeholder arguments such as {prompt}, {cwd}, and {workspace}.
`fetch-mcp`	read	Retrieve and convert web content for language models.
`file_diff`	read	Show a unified diff between two arbitrary paths (files or directories), independent of Git — for comparing anything on disk, not just a repo working tree.
`file_hash`	read	Calculate SHA-256, SHA-512, SHA-1, or MD5 for a file without loading it all into model context.
`filesystem-mcp`	read	Standard MCP filesystem server. MaskShift already has native host filesystem tools; use for compatibility tests.
`fleet_ask`	read	Give one member a task or question and wait for its reply. Its inbox is delivered with it. Any [[send]] messages it writes are queued for the teammates it addresses (use fleet_relay to have them acted on).
`fleet_harnesses`	write	List the agent harnesses a fleet member can run on (${HARNESS_HINT}) and whether each is installed.
`fleet_list`	read	List the fleet members with their harness, role, status, unread mail and last reply. Pass name for one member\
`fleet_messages`	read	Read the recent messages passed between fleet members (optionally just those to or from one member).
`fleet_relay`	read	Hand a task to the fleet and let its members work it out together: the lead gets the task, members message each other with [[send]] blocks, and rounds continue until someone writes [[done]], everyone falls quiet, or the round/time limit is reached. Returns the outcome and a per-turn trace.
`fleet_send`	write	Queue a message from one member (or you) to another, or to=
`fleet_spawn`	write	Create a persistent, named fleet member backed by ${HARNESS_HINT}. Several members may share a harness. Members keep their history and inbox between turns and can message each other. Use isolated=true to give an editing member its own Git worktree.
`fleet_stop`	write	Cancel a member\
`fleet_suggest`	read	Rank the installed agent harnesses (Claude Code, Codex, OpenCode, Hermes, ...) for a task by how each has actually done on similar tasks before, with the evidence behind the ranking.
`fs_apply_patch`	write	Apply a unified diff using git apply. The patch can update multiple files and is checked before application.
`fs_delete`	destructive	Delete a file or directory recursively. Autonomous mode executes immediately without an approval prompt.
`fs_list`	read	List a directory tree with file sizes and types. Paths may be workspace-relative or absolute in autonomous mode.
`fs_mkdir`	write	Create a directory and missing parent directories.
`fs_move`	write	Move or rename a file or directory, optionally replacing the destination.
`fs_patch`	write	Apply oldText/newText replacements to a file.
`fs_read`	read	Read a UTF-8 text file with optional 1-based line range and hard output bounds.
`fs_read_binary`	read	Read a bounded binary file as base64 with MIME-relevant metadata.
`fs_replace_lines`	read	Replace lines startLine..endLine (1-based, inclusive, as shown by fs_read) with new text. Pass expect (the first old line) to refuse the edit if the file has moved. Use an empty newText to delete lines, or endLine = startLine - 1 style ranges via fs_patch to insert.
`fs_stat`	read	Return file type, size, timestamps, mode, target and hash metadata.
`fs_write`	destructive	Create or overwrite a file atomically. Parent directories are created automatically.
`git-mcp`	read	Git repository inspection and operations through the standard Python MCP server.
`git_branch`	destructive	List, create, switch, rename, or delete branches. MaskShift runs these directly without permission prompts.
`git_checkpoint_create`	write	Snapshot tracked and untracked workspace changes so an agent run can be rolled back without interrupting normal Git history.
`git_checkpoint_list`	read	List reversible MaskShift workspace checkpoints.
`git_checkpoint_restore`	read	Restore a prior MaskShift checkpoint. This is destructive to current workspace changes.
`git_commit`	write	Stage selected or all changes and create a commit. Optional amend and no-verify modes are supported.
`git_diff`	write	Show working-tree, staged, commit-range, or selected-file diffs with configurable context and output bounds.
`git_log`	write	Read compact commit history, optionally for a branch, range, author, grep expression, or path.
`git_show`	write	Show a commit, tag, tree, or file at a revision.
`git_status`	read	Inspect branch, upstream, staged, modified, deleted, renamed, conflicted, and untracked files.
`git_worktree_create`	write	Create a branch-backed Git worktree for isolated subagent or experimental work.
`kubernetes_exec`	write	Execute any kubectl operation with a structured argument list and optional context, namespace, and kubeconfig.
`learn_forget`	destructive	Remove one learned lesson or preference by id (from learn_status). Use it when something MaskShift learned is wrong or no longer applies.
`learn_status`	read	Show what MaskShift has learned from its own runs on this machine: lessons from earlier runs, preferences noticed from your messages, how each model and harness has done on which kinds of task, workflows it could turn into skills, and how well context was used.
`lsp_code_actions`	read	List the refactors and quick fixes the language server offers at a position or range (fix this error, extract a function, add a missing import...) and optionally apply one by index, by title, or the preferred one. Prefer this over hand-editing for mechanical refactors.
`lsp_definition`	read	Resolve the definition location for a symbol at a source position.
`lsp_diagnostics`	read	Return language-server errors, warnings, hints, and related information for a file.
`lsp_discover`	read	Detect installed language servers for TypeScript, Python, C/C++, Rust, Go, Java, Ruby, Lua, JSON, HTML, CSS, and YAML.
`lsp_format`	write	Ask the language server to format a document and optionally apply the edits.
`lsp_hover`	read	Get type, signature, and documentation information at a 1-based source position.
`lsp_organize_imports`	read	Sort and prune a file\
`lsp_references`	read	Find language-aware references for a symbol at a source position.
`lsp_rename`	write	Compute and optionally apply a workspace-wide language-aware symbol rename.
`lsp_status`	read	List active workspace language server processes and capabilities.
`lsp_stop`	write	Stop one or all lazy language server processes for the workspace.
`lsp_symbols`	read	Return language-server document symbols and hierarchy for a source file.
`mcp_add`	write	Add any stdio or HTTP MCP server definition, including command, arguments, environment, URL, headers, and lazy loading settings.
`mcp_call`	write	Invoke a connected MCP tool directly. Prefer activating its qualified tool so the model can call it natively on later turns.
`mcp_connect`	write	Lazily start or connect an MCP server, negotiate modern or legacy protocol, and discover its tools.
`mcp_disconnect`	read	Close a workspace-scoped MCP connection and unload its tool schemas.
`mcp_list`	read	List curated, imported, project, and configured MCP servers with live connection status and tool counts.
`mcp_prompts`	read	List prompt templates provided by an MCP server.
`mcp_registry_install`	write	Resolve a server from the official registry and add its remote or package transport to MaskShift configuration.
`mcp_registry_search`	read	Search the live official MCP Registry instead of relying on a stale built-in server list.
`mcp_resource_read`	read	Read a URI exposed by an MCP server.
`mcp_resources`	read	Connect to a server and list its MCP resources.
`mcp_search`	read	Search discovered MCP servers and tools already known to MaskShift. Servers remain lazy until connected.
`measured-workflow`	read	A workflow used to test evidence-based promotion.
`memory-mcp`	read	Standard persistent knowledge graph memory server.
`memory_delete`	destructive	Delete a memory by ID.
`memory_list`	read	List memories ordered by effective importance: raw importance blended with a recency decay so stale, untouched memories sink without being deleted.
`memory_optimize`	write	Find duplicate-title memories to merge and stale, low-importance, never-accessed memories to prune. Defaults to a dry run that only reports candidates; set dryRun to false to apply the merge and prune.
`memory_save`	write	Save a durable project or global fact, architectural decision, convention, result, or reusable lesson. Automatically merges into an existing memory with the same title in the same scope instead of creating a duplicate, unless dedupe is set to false.
`memory_search`	read	Search project and global long-term memory, ranked by a blend of text relevance, importance, and recency (older, untouched memories decay in rank without being deleted).
`mined-demo`	read	d
`model_calibrate`	write	Run short probes (tool calling, a precise edit, planning, long-context recall) against a model and store the scores, so the harness sizes its help to what the model can actually do. Costs a few thousand tokens.
`model_profile`	read	Show a model
`model_route`	read	Rank configured models for a task using language/domain fit and prior MaskShift outcomes.
`network_diagnose`	write	Run ping, DNS lookup, or traceroute against a host and return structured, parsed results instead of raw command text.
`node_cell`	write	Execute arbitrary JavaScript as an ES module in a temporary script with workspace cwd.
`notebook_edit`	destructive	Replace, insert, or delete one cell in a Jupyter (.ipynb) notebook by index. Replacing or inserting a code cell clears its stale outputs and execution count.
`notebook_read`	read	Read a Jupyter (.ipynb) notebook and return each cell\
`openai-docs`	read	Search and read official OpenAI developer documentation.
`plan_dag_update`	write	Create a dependency-aware execution plan whose ready nodes can run concurrently and whose dependent nodes receive predecessor results.
`plan_get`	write	Return the current run plan and progress.
`plan_update`	write	Create or update the run plan with concise steps and statuses. Use it for multi-step work and keep it synchronized with actual progress.
`playwright`	read	Browser navigation, interaction, screenshots, accessibility snapshots, and UI testing.
`plugin_activate`	read	Load a plugin directly into the MaskShift process with full tool registration access.
`plugin_deactivate`	destructive	Run a plugin cleanup hook and remove its registered tools.
`plugin_install`	write	Install a plugin from a local directory, Git repository, or npm package and activate it.
`plugin_list`	read	List discovered runtime plugins, their status, tools, and skill directories.
`plugin_reload`	write	Deactivate and re-import one plugin, or every discovered plugin, without restarting MaskShift.
`plugin_scaffold`	read	Generate and activate a complete single-tool MaskShift plugin scaffold.
`plugin_scan`	read	Rescan user and workspace plugin directories and activate newly discovered plugins.
`port_inspect`	read	Inspect listening sockets and processes using ss, netstat, or lsof.
`project_index_status`	read	Show local indexed file, chunk, character, and freshness statistics.
`project_inspect`	read	Summarize repository shape, dominant languages, build manifests, instructions, Git state, and local index health.
`project_instructions`	read	Load AGENTS.md, CLAUDE.md, MASKSHIFT.md, Copilot instructions, and other configured context files from repository root through the working directory.
`project_read_manifest`	read	Read and optionally parse a package/build manifest such as package.json, pyproject.toml, Cargo.toml, go.mod, or CMakeLists.txt.
`project_tree`	read	Render a bounded source tree for any workspace subdirectory.
`provider_list`	read	Inspect configured model providers, connectivity status, and discovered models.
`ps_list`	read	List running processes on the host as structured records (pid, user, cpu%, mem%, command) — parsed, so nothing needs to eyeball raw
`python_cell`	write	Execute an arbitrary Python code cell in a temporary script with workspace cwd and return stdout/stderr.
`race-telemetry`	read	Fixture plugin
`race_telemetry_snapshot`	read	Return a compact snapshot of the live MaskShift capability platform.
`record_value`	read	Record one named value.
`repo_index`	read	Build or refresh MaskShift’s local SQLite FTS code index for structure-aware context retrieval.
`repo_search`	read	Search the local repository index using full-text ranking, blended with embedding-based semantic similarity when a local Ollama embedding model is available, and return bounded source chunks.
`router_explain`	read	Show how MaskShift would route a task: the models and the installed agent harnesses ranked by how they have actually done on similar tasks (success rate, cost), and how much evidence is behind each.
`rsync_transfer`	write	Synchronize local and remote files with rsync over SSH.
`search_files`	read	Find files by fuzzy substring or glob across a workspace while respecting common repository ignores.
`search_text`	read	Fast recursive source search using ripgrep when available, with regex, glob, case, hidden-file, and context controls.
`sequential-thinking`	read	Structured multi-step reasoning tool for complex planning and revision.
`session_history`	read	Read messages and recent runs from the current MaskShift session.
`shell_exec`	write	Run any Unix shell command on the host with the full user environment. Use for builds, tests, package managers, compilers, scripts, system inspection, and repository automation.
`shell_exec_parallel`	write	Run multiple independent shell commands concurrently and return every result.
`shell_process_list`	read	List processes launched by MaskShift, optionally limited to the current workspace or active processes.
`shell_process_read`	read	Read current status and incremental output from a persistent process.
`shell_process_stop`	destructive	Terminate a persistent process and its Unix process group.
`shell_process_write`	write	Send text or control sequences to a persistent process stdin.
`shell_start`	write	Start a persistent host process with live stdout/stderr streaming. Returns a process ID for later reads, input, or termination.
`skill_create`	write	Create a durable user skill from a successful workflow so future runs can discover it automatically.
`skill_evaluate`	read	Record comparable baseline and candidate outcomes for a reusable skill. This creates empirical evidence without changing the skill.
`skill_improve`	read	Append a validated lesson or refinement to an existing skill.
`skill_load`	read	Load the full instructions and metadata for a selected skill into the current run.
`skill_mine`	read	Look through recent runs for sequences of steps repeated across several runs that mostly went well, and draft a skill for each. Nothing is installed until skill_mine_accept.
`skill_mine_accept`	write	Install a skill drafted by skill_mine (by name or id), or dismiss it so it is not suggested again.
`skill_promote_validated`	write	Apply a skill improvement only when recorded A/B trials meet minimum evidence and improve success without regressions.
`skill_read_reference`	read	Read a file referenced by a skill while preventing path escape from the skill directory.
`skill_search`	read	Search all bundled, project, Claude, Codex, Copilot, and user skill catalogs. Skill bodies are loaded only when selected.
`sqlite_query`	write	Open any SQLite database directly through Node native SQLite, execute parameterized SQL, and return structured rows. Write statements are allowed.
`sqlite_schema`	write	Return tables, views, indexes, triggers, and CREATE statements from a SQLite database.
`ssh_exec`	write	Run a command on any SSH host with user, port, identity, jump host, environment, and timeout controls.
`storage_prune`	destructive	Delete old checkpoints, stale search indexes, old run events and oversized logs according to the host-derived retention. Never deletes chats, memory or workspace files. Defaults to a dry run that only lists what would go.
`storage_status`	read	Report how much disk MaskShift uses (database, checkpoints, browser profiles, logs), the budget derived from this machine\
`symbol_outline`	read	Extract a lightweight outline of classes, functions, interfaces, structs, methods, and test blocks from source files.
`symbol_read`	read	Return one definition (function, class, method as Class.method) with its line range, without reading the whole file. With no symbol, list the definitions in the file.
`symbol_replace`	read	Replace one definition by name with new source. You supply only the new text; the old text is located for you, so it never has to be reproduced exactly. Use Class.method for methods.
`system_info`	read	Return operating system, CPU, memory, process, shell, runtime, and workspace information.
`system_service`	write	Inspect, start, stop, restart, reload, enable, or disable a systemd service on the host.
`text_stats`	read	Report line, word, and byte counts for one or more text files (like wc) without spending context on their contents — use before deciding whether to read a file in full.

Trust audit

BLOCKgrade F · trust 53/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (10 observation(s))
Shell: declared (4 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

skills/claude-api/SKILL.md:395

**Managed Agents** is a third surface: server-managed stateful agents with Anthropic-hosted tool execution. You create a persisted, versioned Agent config (`POST /v1/agents`), then start Sessions that

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/learning/uncertainty.mjs:65

const SENSITIVE_PATHS = /(^|\/)(\.ssh|\.gnupg|\.aws|\.config\/gcloud|\.bashrc|\.zshrc|\.profile|\.bash_profile|authorized_keys|id_rsa|id_ed25519|\.netrc|\.npmrc|sudoers)(\/|$)|^\/(etc|boot|usr|bin|sbi

Why it matters. touches a credential store

MEDIUMInventory / provenance · inv.binary · CWE-1104

skills/web-artifacts-builder/scripts/shadcn-components.tar.gz

shadcn-components.tar.gz

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

.env.example:14

OLLAMA_BASE_URL=http://127.0.0.1:11434

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

.env.example:17

LMSTUDIO_BASE_URL=http://127.0.0.1:1234/v1

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

.env.example:18

VLLM_BASE_URL=http://127.0.0.1:8000/v1

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/browser/manager.mjs:182

try { version = await fetchJson(`http://127.0.0.1:${port}/json/version`, {}, 1000); break; } catch { await new Promise((resolve) => setTimeout(resolve, 120)); }

MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

skills/claude-api/SKILL.md:23

2. **Raw HTTP** (`curl`, `requests`, `fetch`, `httpx`, etc.) - only when the user explicitly asks for cURL/REST/raw HTTP, the project is a shell/cURL project, or the language has no official SDK.

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

automation_delete, browser_close, container_stop, environment_set, fs_delete, fs_write, git_branch, learn_forget, memory_delete, notebook_edit, plugin_deactivate, shell_process_stop, storage_prune

Why it matters. 13 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

tests/fixtures/documents/deck.odp

deck.odp

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

tests/fixtures/documents/deck.pptx

deck.pptx

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

tests/fixtures/documents/report.docx

report.docx

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

tests/fixtures/documents/report.odt

report.odt

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.nojekyll

.nojekyll

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/documents/pdf.mjs:269

const md5 = (...parts) => crypto.createHash('md5').update(Buffer.concat(parts.map((part) => (typeof part === 'string' ? Buffer.from(part, 'latin1') : Buffer.from(part))))).digest();

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/documents/pdf.mjs:271

function rc4(key, data) {

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/documents/pdf.mjs:325

let method = 'RC4';

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/documents/pdf.mjs:355

if (R === 2) check = rc4(fileKey, PAD);

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/documents/pdf.mjs:357

check = rc4(fileKey, md5(PAD, ids[0] ?? ''));

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

tests/learning.test.mjs:381

assert.equal(assessCall({ name: 'fs_write', args: { path: '~/.ssh/authorized_keys', content: 'x' } }).level, 'high');

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/agent/personas.mjs:7

const BUNDLED_AGENTS = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../agents');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/agent/skills.mjs:6

const BUNDLED_SKILLS = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../skills');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/regressions.test.mjs:219

runtime.toolRegistry.execute('skill_read_reference', { name: 'audit-fixture', reference: '../../../etc/passwd' }, context),

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/smoke-test.mjs:106

baseUrl: `http://127.0.0.1:${modelPort}/v1`, apiKeyEnv: null,

LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

tests/image.test.mjs:23

'/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4RDgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.

Audited 2026-10-11 · audit v0.4.1 · source sha e389ef952e8dfull audit observations/trust-audit/mcp-server/nafeeur__maskshift.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-11	`e389ef952e8d`	BLOCK	F	53	first audit

Questions

What is the MaskShift MCP server?

Maximalist harness

What tools does MaskShift expose?

200 in total: 125 read-only, 69 that write, and 13 that can delete or overwrite (automation_delete, browser_close, container_stop, environment_set, fs_delete). Every one is listed on this page with its risk.

Is MaskShift safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (53/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 13 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does MaskShift need?

It reads BRAVE_API_KEY, EXA_API_KEY and TAVILY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does MaskShift run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as maskshift at 2.0.0.

How current is this page?

The grade is for one exact copy of the source (e389ef952e8d), read on 2026-10-11. The repository is watched and re-audited when it changes.

Source	nafeeur/MaskShift
npm	`maskshift@2.0.0`
Transports	streamable-http
Credentials it reads	`BRAVE_API_KEYEXA_API_KEYTAVILY_API_KEY`
License	GPL-3.0
Activity	pushed 0d ago