Atlas / MCP servers / neomjs / neo-agent-brain

neo-agent-brainBLOCK

mcp/neomjs/neo-agent-brain

Point a cross-model AI engineering team at your own codebases. The Agent OS keeps named AI maintainers' identity, memory and review across labs alive between sessions — the Brain Neo.mjs runs on itself. Multi-tenant: onboarding a codebase is a config entry, not a fork.

Verdict
BLOCK
Grade
F
Trust score
47 /100
Exposed tools
40 40r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
11
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The Brain of the Neo.mjs organism — the Agent OS.

What is Neo.mjs?

Neo.mjs is a professional, end-to-end AI engineering team whose Body and Brain live in sibling open-source repositories.

Where the industry runs one AI agent and gets slop, Neo.mjs runs a swarm of minds from rival labs — Claude, Gemini, and GPT — with shared institutional memory and cross-family review. The team builds, reviews, and maintains a production multi-threaded application Engine in public.

This repository is the Brain: the Agent OS that gives those maintainers persistent identity, shared memory, repository knowledge, durable coordination, GitHub-native workflows, and the RemDigestion feedback loop. The sibling Engine

Read from source at commit 788de89e899eOBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mini-neo-workspace --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE=${NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "mini-neo-workspace": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE": "${NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE}"
      }
    }
  }
}
03

Exposed tools (40)

40 read · 0 write · 0 destructive.

ToolRiskDescription
BroadcastreadMailbox broadcast sentinel.
Button.mjsreadMock button class
ButtonFeaturereadA newly formulated architectural concept.
EuclidreadOpenAI Codex (GPT-5.6 Sol) Agent Identity
HashDocreadsame
HeaderActionsreadthe plugin
Inreadbody
Multi-Threadingreaddup
Neo.dashboard.Mainreadcopied from the prompt example
Neo.dashboard.Xreada one-letter identity
Neo.dashboard.dock.Workspacereadthe canonical path of the façade
NullableFixturereadA structural fixture.
PartialChunkreadMust not be committed when a later chunk fails.
ProjectionSafereadadmitted
RetiredScoreFixturereadA legacy payload.
Review-Responsereaddup-by-normalized-name
Review_Responsereadnew
SchemaVocabularyFixturereadA structural fixture.
SharedThingreadShared description ${index}
SophiereadOpenAI GPT-family Agent Identity with version-free handle.
TestConceptreadTest concept for provenance edges
V-B-Areaddup
Workspacereadthe façade
Xready
alphareadoriginal wording
arch-archivedreadarchived
arch-livereadlive
availabilityreadavailability
cloud-readiness-graph-sentinelreadDeterministic provider-readiness node emitted by the mock OpenAI-compatible server.
delegate_taskreadDelegates a complex task or query to a specialized sub-agent expert. Use this when you lack the context or tools to fulfill the user
graphreadgraph
healthcheckreadHealth Check
new-tagread
operationreadoperation
plane_proberead
ratchetreadthe size gate
runtime_proberead
samplereadA test tool
unexpectedread
v1.0.0readfixture
04

Trust audit

BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (10 observation(s))
Network
declared (19 observation(s))
Shell
declared (12 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
ai/demo-agents/dev.mjs:96
return yaml.load(yamlMatch[1]);
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
ai/demo-agents/dev.mjs:101
return yaml.load(cleanBody);
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
ai/mcp/ToolService.mjs:167
const openApiDocument = yaml.load(fs.readFileSync(me.openApiFilePath, 'utf8'));
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
ai/scripts/diagnostics/mcpHandlerSignatureCensus.mjs:623
const doc                     = yaml.load(fs.readFileSync(path.join(root, server.openApi), 'utf8'));
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
ai/scripts/lint/lint-openapi-service-parity.mjs:543
specCache.set(service.specPath, yaml.load(fs.readFileSync(service.specPath, 'utf8')));
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
ai/scripts/diagnostics/presetQualityFloor.mjs:322
const {stdout} = await exec(process.execPath, ['--input-type=module', '-e', childSource(root)], {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
ai/scripts/lint/check-commit-authorship.mjs:42
tryExec  = command => { try { return exec(command) } catch { return '' } };
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
ai/mcp/server/shared/services/AuthService.mjs:537
logger.info(`[AuthService] Authorization enabled (mode: seat-token, plane: ${aiConfig.plane.id})`)
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
ai/mcp/server/shared/services/AuthService.mjs:576
logger.info(`[AuthService] Seat-token registry loaded (generation ${cachedRegistry.generation}, ${cachedRegistry.rows.length} seat(s))`);
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
ai/services/github-workflow/GraphqlService.mjs:146
logger.error(`No GitHub token for seat '${seat}': GH_TOKEN and GITHUB_TOKEN are unset, and the \`gh\` keyring fallback is refused.`);
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
ai/mcp/server/memory-core/helpers/recordTurnPresenceOverMcp.mjs:97
'recordTurnPresenceOverMcp requires an identity: without it the plane records this beacon ' +
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
ai/mcp/server/memory-core/helpers/recordTurnPresenceOverMcp.mjs:171
`'${identity}' — refusing to report a beacon written against another agent`
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
ai/mcp/server/memory-core/openapi.yaml:675
beacon, which decides online before any absence verdict, because add_memory lands at turn
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
ai/mcp/server/memory-core/openapi.yaml:677
the deployment-agnostic fallback where no beacon is emitted, roster-scoped and graph-backed
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
ai/mcp/server/memory-core/openapi.yaml:765
turn-presence beacon carrying an agent whose write is stale or not yet written.
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ai/configBase.mjs:471
cockpitOrigins : leaf(['http://localhost:8080', 'http://127.0.0.1:8080'], 'NEO_FLEET_COCKPIT_ORIGIN', 'csv'),
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ai/configBase.mjs:851
host          : leaf('http://127.0.0.1:11434', 'NEO_OLLAMA_HOST', 'string'),
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ai/configBase.mjs:887
host                   : leaf('http://127.0.0.1:11434', 'NEO_OPENAI_COMPATIBLE_HOST', 'string'),
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ai/mcp/client/config.mjs:77
url              : "http://127.0.0.1:3102/kb/mcp",
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
ai/mcp/client/config.mjs:83
url              : "http://127.0.0.1:3102/mc/mcp",
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
ai/services/shared/a2aCollisionTags.mjs:42
const LEADING_MARKS = /^[\s\p{Extended_Pictographic}\p{Emoji_Modifier}\p{Regional_Indicator}️]*/u;
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/playwright/unit/ai/daemons/orchestrator/services/DeploymentStateBridgeService.spec.mjs:4859
SECRET  = 'glpat-SECRET-must-never-appear',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/playwright/unit/ai/daemons/orchestrator/services/DeploymentStateBridgeService.spec.mjs:5060
const TOKEN = 'secret-token-value-high-entropy-material';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/playwright/unit/ai/daemons/orchestrator/services/HeavyMaintenanceLeaseService.spec.mjs:586
token: 'release-timing-token'
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/playwright/unit/ai/daemons/orchestrator/services/HeavyMaintenanceLeaseService.spec.mjs:606
lease : {owner: 'sandman', token: 'release-timing-token'}

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 788de89e899efull audit observations/trust-audit/mcp-server/neomjs__neo-agent-brain.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11788de89e899eBLOCKF47first audit
06

Questions

What is the neo-agent-brain MCP server?

Point a cross-model AI engineering team at your own codebases. The Agent OS keeps named AI maintainers' identity, memory and review across labs alive between sessions — the Brain Neo.mjs runs on itself. Multi-tenant: onboarding a codebase is a config entry, not a fork.

What tools does neo-agent-brain expose?

40 in total: 40 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is neo-agent-brain safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (47/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does neo-agent-brain need?

It reads GEMINI_API_KEY, GH_TOKEN, GITHUB_TOKEN, NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE, NEO_AUTH_REALM, NEO_FLEET_BRIDGE_PUBLIC_KEY, NEO_FLEET_BRIDGE_TOKEN, NEO_FLEET_SECRET_KEY, NEO_FLEET_SIGNING_KEY, NEO_GITMIRROR_TEST_TOKEN, NEO_HEAVY_MAINTENANCE_LEASE_INHERITED_TOKEN and NEO_LOCAL_MODELS_CHAT_CONTEXT_LIMIT_TOKENS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does neo-agent-brain run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as mini-neo-workspace at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (788de89e899e), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement