neo-agent-brainBLOCK
Point a cross-model AI engineering team at your own codebases. The Agent OS keeps named AI maintainers' identity, memory and review across labs alive between sessions — the Brain Neo.mjs runs on itself. Multi-tenant: onboarding a codebase is a config entry, not a fork.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The Brain of the Neo.mjs organism — the Agent OS.
What is Neo.mjs?
Neo.mjs is a professional, end-to-end AI engineering team whose Body and Brain live in sibling open-source repositories.
Where the industry runs one AI agent and gets slop, Neo.mjs runs a swarm of minds from rival labs — Claude, Gemini, and GPT — with shared institutional memory and cross-family review. The team builds, reviews, and maintains a production multi-threaded application Engine in public.
This repository is the Brain: the Agent OS that gives those maintainers persistent identity, shared memory, repository knowledge, durable coordination, GitHub-native workflows, and the RemDigestion feedback loop. The sibling Engine
788de89e899eOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mini-neo-workspace --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE=${NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE} -- npx -y [email protected]{
"mcpServers": {
"mini-neo-workspace": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GEMINI_API_KEY": "${GEMINI_API_KEY}",
"GH_TOKEN": "${GH_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE": "${NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE}"
}
}
}
}Exposed tools (40)
40 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Broadcast | read | Mailbox broadcast sentinel. |
Button.mjs | read | Mock button class |
ButtonFeature | read | A newly formulated architectural concept. |
Euclid | read | OpenAI Codex (GPT-5.6 Sol) Agent Identity |
HashDoc | read | same |
HeaderActions | read | the plugin |
In | read | body |
Multi-Threading | read | dup |
Neo.dashboard.Main | read | copied from the prompt example |
Neo.dashboard.X | read | a one-letter identity |
Neo.dashboard.dock.Workspace | read | the canonical path of the façade |
NullableFixture | read | A structural fixture. |
PartialChunk | read | Must not be committed when a later chunk fails. |
ProjectionSafe | read | admitted |
RetiredScoreFixture | read | A legacy payload. |
Review-Response | read | dup-by-normalized-name |
Review_Response | read | new |
SchemaVocabularyFixture | read | A structural fixture. |
SharedThing | read | Shared description ${index} |
Sophie | read | OpenAI GPT-family Agent Identity with version-free handle. |
TestConcept | read | Test concept for provenance edges |
V-B-A | read | dup |
Workspace | read | the façade |
X | read | y |
alpha | read | original wording |
arch-archived | read | archived |
arch-live | read | live |
availability | read | availability |
cloud-readiness-graph-sentinel | read | Deterministic provider-readiness node emitted by the mock OpenAI-compatible server. |
delegate_task | read | Delegates a complex task or query to a specialized sub-agent expert. Use this when you lack the context or tools to fulfill the user |
graph | read | graph |
healthcheck | read | Health Check |
new-tag | read | |
operation | read | operation |
plane_probe | read | |
ratchet | read | the size gate |
runtime_probe | read | |
sample | read | A test tool |
unexpected | read | |
v1.0.0 | read | fixture |
Trust audit
BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (10 observation(s))
- Network
- declared (19 observation(s))
- Shell
- declared (12 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
return yaml.load(yamlMatch[1]);
return yaml.load(cleanBody);
const openApiDocument = yaml.load(fs.readFileSync(me.openApiFilePath, 'utf8'));
const doc = yaml.load(fs.readFileSync(path.join(root, server.openApi), 'utf8'));
specCache.set(service.specPath, yaml.load(fs.readFileSync(service.specPath, 'utf8')));
const {stdout} = await exec(process.execPath, ['--input-type=module', '-e', childSource(root)], {tryExec = command => { try { return exec(command) } catch { return '' } };logger.info(`[AuthService] Authorization enabled (mode: seat-token, plane: ${aiConfig.plane.id})`)logger.info(`[AuthService] Seat-token registry loaded (generation ${cachedRegistry.generation}, ${cachedRegistry.rows.length} seat(s))`);logger.error(`No GitHub token for seat '${seat}': GH_TOKEN and GITHUB_TOKEN are unset, and the \`gh\` keyring fallback is refused.`);'recordTurnPresenceOverMcp requires an identity: without it the plane records this beacon ' +
`'${identity}' — refusing to report a beacon written against another agent`beacon, which decides online before any absence verdict, because add_memory lands at turn
the deployment-agnostic fallback where no beacon is emitted, roster-scoped and graph-backed
turn-presence beacon carrying an agent whose write is stale or not yet written.
cockpitOrigins : leaf(['http://localhost:8080', 'http://127.0.0.1:8080'], 'NEO_FLEET_COCKPIT_ORIGIN', 'csv'),
host : leaf('http://127.0.0.1:11434', 'NEO_OLLAMA_HOST', 'string'),host : leaf('http://127.0.0.1:11434', 'NEO_OPENAI_COMPATIBLE_HOST', 'string'),url : "http://127.0.0.1:3102/kb/mcp",
url : "http://127.0.0.1:3102/mc/mcp",
const LEADING_MARKS = /^[\s\p{Extended_Pictographic}\p{Emoji_Modifier}\p{Regional_Indicator}️]*/u;SECRET = 'glpat-SECRET-must-never-appear',
const TOKEN = 'secret-token-value-high-entropy-material';
token: 'release-timing-token'
lease : {owner: 'sandman', token: 'release-timing-token'}Gates applied: no_behavioural_pass.
788de89e899efull audit observations/trust-audit/mcp-server/neomjs__neo-agent-brain.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 788de89e899e | BLOCK | F | 47 | first audit |
Questions
What is the neo-agent-brain MCP server?
Point a cross-model AI engineering team at your own codebases. The Agent OS keeps named AI maintainers' identity, memory and review across labs alive between sessions — the Brain Neo.mjs runs on itself. Multi-tenant: onboarding a codebase is a config entry, not a fork.
What tools does neo-agent-brain expose?
40 in total: 40 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is neo-agent-brain safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (47/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does neo-agent-brain need?
It reads GEMINI_API_KEY, GH_TOKEN, GITHUB_TOKEN, NEO_AI_ORCHESTRATOR_AUTHORITY_PROFILE, NEO_AUTH_REALM, NEO_FLEET_BRIDGE_PUBLIC_KEY, NEO_FLEET_BRIDGE_TOKEN, NEO_FLEET_SECRET_KEY, NEO_FLEET_SIGNING_KEY, NEO_GITMIRROR_TEST_TOKEN, NEO_HEAVY_MAINTENANCE_LEASE_INHERITED_TOKEN and NEO_LOCAL_MODELS_CHAT_CONTEXT_LIMIT_TOKENS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does neo-agent-brain run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as mini-neo-workspace at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (788de89e899e), read on 2026-10-11. The repository is watched and re-audited when it changes.