Atlas / MCP servers / oolab-labs / Patchwork OS

Patchwork OSBLOCK

Name: Patchwork OS
Author: oolab-labs

mcp/oolab-labs/patchwork-os

MCP server by oolab-labs · ai agent · anthropic · approval queue · Audited 2026-10-08

The decision layer for personal AI. Local-first runtime where agents automate across GitHub, Slack, Gmail & 45+ services — but every risky action can stop for your yes, workers (agents) earn autonomy from track record, and every decision leaves a receipt. Your models, your machine, your policy. Incl

Verdict

BLOCK

Grade

Trust score

26 /100

Exposed tools

200 264r · 58w · 4d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.npmjs.com/package/patchwork-os) [](https://github.com/Oolab-labs/patchwork-os/actions/workflows/ci.yml) [](https://www.npmjs.com/package/patchwork-os) [](LICENSE)

You don't have an automation problem. You have a decision problem.

Every AI-agent horror story ends the same way: an action nobody stopped to question. Patchwork OS is the layer between the agent's impulse and the action — a local-first runtime where your AI can automate real work across your editor, GitHub, Slack, Gmail, and 45+ services, while anything consequential can be made to stop and ask you first.

Who it's for: developers and technical operators who already run agents against real systems — a repo that ships, an inbox that matters, a production service — and who want a record of what was allowed and why. It expects a terminal, a Node install, and comfort editing YAML.

Three ideas, one runtime:

Ask before acting. Every action is classified by blast radius — can it be undone, and how much breaks if it's wrong? Reversible things flow freely. Risky things wait in an approval queue with the evidence attached: what exactly will run, why it fired, and what happens if it's wrong.

Trust is earned, never assumed. Workers — named agents with jobs — start supervised and earn independence from their track record, per action type. Good at filing issues ≠ allowed to push code. One bad high-stakes action outweighs a hundred trivial successes. You set the ceiling; the math never raises it for them.

Every decision leaves a receipt. What was done, why it was allowed, and how it turned out — durable, replayable, explainable via patchwork judgments, the dashboard's

Read from source at commit cf38a666309cOBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add claude-ide-bridge-extension --env AIRTABLE_ACCESS_TOKEN=${AIRTABLE_ACCESS_TOKEN} --env AIRTABLE_CLIENT_SECRET=${AIRTABLE_CLIENT_SECRET} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env API_KEY=${API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "claude-ide-bridge-extension": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AIRTABLE_ACCESS_TOKEN": "${AIRTABLE_ACCESS_TOKEN}",
        "AIRTABLE_CLIENT_SECRET": "${AIRTABLE_CLIENT_SECRET}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "API_KEY": "${API_KEY}"
      }
    }
  }
}

Exposed tools (200)

264 read · 58 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Asana`	read	Read workspaces, projects, and tasks.
`Confluence`	write	Read and write Confluence pages and spaces.
`Datadog`	read	Query monitors, dashboards, and events.
`Discord`	read	Read messages, channels, and guilds.
`GitHub`	read	Read open issues and pull requests via GitHub
`GitLab`	write	Read projects, issues, and merge requests.
`Gmail`	read	Read and triage your inbox.
`HubSpot`	read	Read contacts, deals, and companies.
`Intercom`	read	Read conversations and customer data.
`Jira`	write	Read and create Jira issues across projects.
`Linear`	read	Read and manage issues.
`Notion`	write	Query databases, read pages, and create content.
`PagerDuty`	read	Read incidents, services, and on-call rotations.
`Roadmap`	read	Q3 plan
`Slack`	write	Post messages and list channels.
`Stripe`	read	Read payment events, customers, and subscriptions.
`Telegram`	write	Send messages and read chats via a Telegram bot.
`Zendesk`	read	Read support tickets and customer context.
`addLinearComment`	write	Add a comment to a Linear issue. Requires Linear connector connected.
`allowedTool`	read	ok
`alphaOnlyTool`	read	alpha
`alwaysAvailable`	read	No extension needed
`annotated_tool`	read	has cache_control
`anotherTool`	read	Another test tool
`auditDependencies`	read	Detect outdated packages (current vs latest). Supports npm, yarn, pnpm, cargo, pip. Complement to getSecurityAdvisories.
`bad`	read	Fails
`barC`	read	x
`base`	read	Base branch or ref to diff against (default: main).
`beginTransaction`	write	Start a new multi-file edit transaction. Returns a transactionId for subsequent stageEdit calls.
`betaOnlyTool`	read	beta
`bigCjk`	read	returns a big CJK string
`bigTool`	read	test
`blast-radius`	read	Blast radius at a position: diagnostics + reference counts + risk badge. Wraps getChangeImpact.
`blocking`	read	Blocks until gate opens
`boom`	read	Fails
`brandNewTool`	read	new
`bridgeDoctor`	read	Health check: extension, git, linters, test runners, GitHub CLI. Use when tools misbehave.
`broken`	read	Throws
`build-check`	read	Check if the project builds successfully. Returns pass/fail with error summary.
`butlerForget`	read	Retract a fact by its seq (from butlerRecall). Writes a tombstone — the fact stops being believed, and the original row stays in the log so the history remains auditable.
`butlerRecall`	read	Read what Butler currently believes about the user. Returns one value per subject+predicate, already resolved for contradictions and retractions. Filter by subject to narrow.
`butlerRemember`	read	Record one durable fact about the user (preference, household, standing context) as subject + predicate + value. Stored at agent trust: auditable, but not something Butler asserts on its own.
`cached_tool`	read	cached
`cancelClaudeTask`	read	Cancel a pending or running Claude task.
`cancellable`	read	Waits for cancellation
`chained-array`	read	d
`chained-each`	read	d
`chained-outputs`	read	test recipe
`checkDocumentDirty`	read	Check if file has unsaved changes. Uses VS Code buffer when ext connected; heuristic otherwise.
`circular-deps`	write	Detect circular import dependencies. Wraps getImportTree with cycle detection.
`closeAllDiffTabs`	read	Close all diff tabs and clean up temp diff directories.
`column`	read	Column number (1-based).
`commitTransaction`	write	Write all staged edits atomically. All files are written; on partial failure, written files are NOT rolled back (use rollbackTransaction before commitTransaction to verify).
`consistency-test`	read	test recipe
`contextBundle`	read	Collect IDE context in one call: active file, diagnostics, diff, editors, handoff note, git status.
`count`	read	Number of recent commits to show (default: 10).
`coverage-gap`	read	Identify untested functions by correlating coverage with document symbols. Wraps getCodeCoverage + getDocumentSymbols.
`cowork`	read	Load IDE context (open files, diagnostics, git status, project info, handoff note) and propose a Cowork action plan. Run before any computer-use task.
`createFile`	write	Create file or directory within workspace. Uses VS Code when connected, native fs fallback.
`createGithubIssueFromAIComment`	write	Create GitHub issue from AI comment. Call getAIComments first to populate cache.
`createLinearIssue`	write	Create a new Linear issue. Requires Linear connector connected. Returns the created issue identifier and URL.
`createPlan`	write	Create .claude-plan.md in workspace root. Markdown with sections and task checklists.
`ctxGetTaskContext`	write	Unified context for issue/PR/commit/error ref. Composes issue + linked commits + related traces. mode:
`ctxQueryTraces`	write	Unified query over approval / enrichment / recipe-run trails. Filter by traceType, time window, or natural key. Answers
`ctxSaveTrace`	read	Record a problem+solution trace after resolving a task. Future sessions see it via ctxQueryTraces and the session-start digest. Keep problem + solution to one line each.
`debug-context`	read	Snapshot IDE state (open editors, diagnostics, recent terminal output) as debugging context.
`deleteFile`	destructive	Delete workspace file or directory. VS Code (with trash) when connected, native fs fallback.
`deletePlan`	destructive	Delete a plan file from the workspace root.
`deniedTool`	read	blocked
`deploy-trigger`	write	Deploy the service
`deprecations`	read	Find @deprecated APIs and count callers. Wraps searchWorkspace + findReferences.
`description`	read	What to refactor (e.g.
`detectUnusedCode`	read	Find unused exports, locals, parameters via tsc --noUnusedLocals or ts-prune.
`diagnose-and-fix`	write	Explain the first diagnostic error, propose and preview a fix, apply it, then re-check diagnostics.
`dualTimedTool`	read	Hangs forever
`echo`	read	no approval required
`echo_tool`	read	Echoes its arguments
`editText`	destructive	Insert/delete/replace text at 1-based line/col. Atomic multi-edit. Uses VS Code or native fs. Workspace files only.
`enrichCommit`	write	Enrich commit w/ linked issues. Parses #N / GH-N refs from message, fetches issue state via gh, classifies close vs ref. Missing issues flagged unresolved — not errors.
`enrichStackTrace`	read	Map stack-trace frames to introducing commits via git blame. Parses Node/Python/browser traces, filters to in-workspace files, returns per-frame commit + overall top suspect.
`envelope-flat`	read	d
`existingTool`	read	existing
`explain-diagnostics`	read	Explain diagnostics (errors/warnings) for a file and suggest fixes.
`explainDiagnostic`	read	Bundle diagnostic details + code context (±10 lines) + go-to-definition + callers (up to 5) for a file/line/character position.
`explore-type`	read	Explore a type: declaration, definition, and all implementations. Wraps getHover + goToDeclaration + goToTypeDefinition + findImplementations.
`extensionOnly`	read	Requires extension
`extensionOnlyTool`	read	Requires extension
`failing`	read	Always fails
`fake_greet`	read	greet tool
`fetchCalendarEvents`	read	Fetch upcoming Google Calendar events. Returns events for the next N days. Requires Google Calendar connector connected.
`fetchGithubIssue`	read	Fetch a GitHub issue by URL or owner/repo#number ref. Returns title, body, state, labels, assignees, and author. Requires GitHub connector connected.
`fetchGithubPR`	read	Fetch a GitHub pull request by URL or owner/repo#number ref. Returns title, body, state, branches, labels, review decision, and diff stats. Requires GitHub connector connected.
`fetchLinearIssue`	read	Fetch a Linear issue by identifier or URL. Returns title, description, state, assignee, labels, and priority. Requires Linear connector connected.
`fetchSentryIssue`	read	Fetch a Sentry issue and enrich its stack trace with git blame. Returns per-frame commit attribution + top suspect commit. Requires Sentry connector connected.
`fetchSlackProfile`	read	Get the connected Slack workspace name, team ID, and bot user ID. Use to confirm Slack is connected.
`file`	read	Path to the changed file to review (workspace-relative or absolute).
`filePath`	read	File to scope diagnostics to (optional; omit for workspace-wide first error).
`files`	read	Comma-separated list of files to consider (optional, scopes the refactor).
`filter`	read	Optional test filter pattern (e.g. file name or test name substring).
`find-callers`	read	Find every caller of a symbol with file:line locations. Wraps searchWorkspaceSymbols + getCallHierarchy(incoming) + findReferences.
`findFiles`	read	Find files by name/glob pattern in the workspace. Respects .gitignore.
`findRelatedTests`	write	Find test files that cover a source file via import search + name patterns.
`fixAllLintErrors`	read	Auto-fix lint errors. VS Code source.fixAll when connected, falls back to eslint/biome/ruff.
`flat-array`	read	d
`flat-each`	read	d
`flat-outputs`	read	test recipe
`fooA`	read	x
`fooB`	read	x
`formatAndSave`	write	Format a file and save it in one call (formatDocument + saveDocument). Formatter errors propagate; save is not attempted on format failure.
`formatDocument`	read	Format file via VS Code formatter or CLI fallback (prettier/biome/black/gofmt/rustfmt).
`fw-bug`	read	watch + use file
`gatedTool`	read	requires approval
`gen-claude-md`	write	Generate bridge workflow rules and quick-reference table, then write them into CLAUDE.md.
`generate-tests`	read	Generate missing unit tests for a file using the project
`generateAPIDocumentation`	read	Generate API docs (markdown/JSON) for TS/JS exported symbols. Extracts fns, classes, interfaces, JSDoc.
`generateTests`	read	Generate test scaffold from exported fns/classes. Returns describe/it content; does not write file.
`getAIComments`	read	Scan open docs for AI-tagged comments (// AI: <severity>: <msg>). Severity: fix/todo/question/warn/task.
`getActivityLog`	read	Query recent tool call log: names, timing, status, percentiles, co-occurrence.
`getAnalyticsReport`	read	Session analytics: top tools by call count, hook events, recent automation tasks.
`getArchitectureContext`	read	Architectural overview via codebase-memory graph: module boundaries, dependencies,
`getBridgeStatus`	read	Bridge health and connection info
`getBufferContent`	read	Read workspace file from VS Code buffer including unsaved changes. Use before editText. Returns isDirty flag. Workspace files only.
`getClaudeTaskStatus`	read	Get the status and output of a Claude task enqueued with runClaudeTask.
`getCodeCoverage`	read	Parse coverage report (lcov/coverage-summary.json/clover.xml) → per-file line/branch/fn %. Does not run tests.
`getCommitDetails`	write	Full commit details: author, date, message, changed files, optional diff patch.
`getCommitsForIssue`	write	Reverse commit→issue lookup from the persisted enrichment log. Returns commits that referenced the given issue, newest first.
`getConnectorStatus`	read	Returns the auth status of all MCP connectors (GitHub, Linear, Sentry). Shows whether each is connected, when the token expires, and whether re-authorization is needed.
`getCurrentSelection`	read	Get the current text selection in the editor
`getDependencyTree`	read	Dependency tree (npm/cargo/go/pip). Auto-detects package manager. Returns names and versions.
`getDiagnostics`	read	Fake low-tier tool
`getDiffBetweenRefs`	read	Diff between two git refs (branches/tags/commits). statOnly for file-level summary only.
`getDiffFromHandoff`	read	Compute what changed since the handoff note was written: git diff summary + new/resolved diagnostics.
`getDocumentSymbols`	read	List symbols (fns, classes, interfaces, methods) in a file: names, kinds, lines, parents.
`getFileTree`	read	Workspace file tree. Respects .gitignore. Skips node_modules, .git, dist, build, coverage.
`getGitDiff`	read	Get the git diff output for the workspace or a specific file
`getGitHotspots`	read	Most frequently changed files in git history. High frequency → active dev or instability.
`getGitLog`	read	Get recent git log entries for the workspace or a specific file
`getGitStatus`	read	Show working tree status. More detail here.
`getHoverAtCursor`	read	Hover docs for symbol at current cursor. Zero-input wrapper around getHover.
`getImportTree`	read	Tree of local imports for a file. Useful for understanding deps and finding circular imports.
`getLatestSelection`	read	Get the most recent text selection (even if not in the active editor)
`getOpenEditors`	read	Open files/tabs with isDirty, isActive when ext connected. Fallback: session-opened files only.
`getOrchestratorStatus`	read	Show the orchestrator bridge status: which IDE instances are connected, their workspaces, health, and how many Claude sessions are active.
`getPRTemplate`	read	PR description from commits and diff stats vs base branch. Returns markdown → pass to githubCreatePR.
`getPerformanceReport`	read	Live performance assessment: per-tool latency percentiles, throughput, extension health, session counts, and overall health score.
`getPlan`	read	Read plan file. Returns title, sections, tasks, and completion status.
`getProjectContext`	write	Cached session-start brief: active file, errors, recent commits, modules. Skips cold-start re-exploration.
`getProjectInfo`	read	Project overview: name/version, languages, pkg manager, scripts, deps, config, git. Call at session start.
`getSecurityAdvisories`	read	Security audit: CVEs with severity and remediation. Auto-detects npm/yarn/pnpm/cargo/pip-audit.
`getSessionUsage`	read	Token usage estimate for this session: schema size, call counts, largest tool results.
`getSymbolHistory`	write	Symbol evolution: LSP definition + git blame on definition site + file commit history.
`getToolCapabilities`	read	Available CLI tools, ext connection state, and which features are functional vs stub-only.
`getTypeHierarchy`	read	Type hierarchy: supertypes (parents) and subtypes (impls/subclasses). Requires LSP support.
`getWorkspaceFolders`	read	Get workspace folders
`getWorkspaceSettings`	read	Read VS Code workspace settings. Filter by section (e.g.
`git-review`	read	Review uncommitted changes (staged + unstaged) against a base branch before commit or PR.
`gitAdd`	write	Stage files for commit. Omit to stage all tracked (git add -u). addUntracked:true for new files.
`gitBlame`	write	Per-line last modifier and commit. Trace why code was written or find the introducing commit.
`gitCheckout`	write	Switch to a branch, or create and switch to a new branch. Use create: true to create from HEAD or a specified base.
`gitCommit`	read	Fake high-tier tool
`gitFetch`	read	Fetch updates from a remote without merging. Updates remote-tracking branches so gitListBranches
`gitListBranches`	read	List git branches. Returns local branches with the current branch marked. Pass includeRemote: true for remote-tracking branches.
`gitPull`	read	Pull changes from a remote into the current branch. Defaults to origin with merge. Use rebase: true for linear history.
`gitPush`	write	write tool
`gitStash`	read	Stash current changes to get a clean working tree. Required before switching branches with uncommitted changes.
`gitStashList`	read	List all stash entries in the repository.
`gitStashPop`	read	Restore stashed changes to the working tree. Pops the most recent stash by default,
`githubActions`	read	Composite GitHub Actions tool. Dispatches to the appropriate operation based on
`githubApprovePR`	read	[Deprecated: use githubPR instead]
`githubCommentIssue`	read	[Deprecated: use githubIssue instead]
`githubCreateIssue`	read	[Deprecated: use githubIssue instead]
`githubCreatePR`	read	[Deprecated: use githubPR instead]
`githubGetIssue`	read	[Deprecated: use githubIssue instead]
`githubGetPRDiff`	read	[Deprecated: use githubPR instead]
`githubGetRunLogs`	read	[Deprecated: use githubActions instead]
`githubIssue`	read	Composite GitHub issue tool. Dispatches to the appropriate operation based on
`githubListIssues`	read	[Deprecated: use githubIssue instead]
`githubListPRs`	read	[Deprecated: use githubPR instead]
`githubListRuns`	read	[Deprecated: use githubActions instead]
`githubMergePR`	read	[Deprecated: use githubPR instead]
`githubPR`	read	Composite GitHub pull request tool. Dispatches to the appropriate operation based on
`githubPostPRReview`	read	[Deprecated: use githubPR instead]
`githubViewPR`	read	[Deprecated: use githubPR instead]
`gmail-health-check`	read	Verify Gmail connector is working.
`good`	read	Succeeds
`guarded`	read	d
`health-check`	read	Full health check: tests, diagnostics, security advisories, git status, dependency audit. For scheduled nightly/hourly runs.
`hw.greet`	write	Returns a greeting. Replace this with your own logic to create a custom tool.
`ide-coverage`	read	Generate an HTML coverage heatmap and open in browser. Requires --full mode (getCodeCoverage + openInBrowser).
`ide-deps`	destructive	D3 force-directed dependency graph for an entry point, opened in browser. Requires --full mode.
`ide-diagnostics-board`	read	Workspace diagnostics grouped by severity/file, rendered as a sortable HTML table in the browser.
`im_send`	write	Send an iMessage to a phone number (E.164 like +14155551234) or
`imports-of`	read	List files importing a symbol with reference counts. Wraps findReferences + getImportTree.
`integ_hello`	read	t
`internalTimeoutTool`	read	Has internal timeout
`internal_fields_tool`	read	has internal fields
`invalid-name`	read	x
`json-recipe`	read	a json recipe
`jumpToFirstError`	read	Jump to first workspace error (getDiagnostics→openFile→decoration). Returns {found:false} if none.
`keepMe`	read	stays

Trust audit

BLOCKgrade F · trust 26/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (14 observation(s))
Network: declared (8 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.slack · CWE-798, CWE-321

src/companions/registry.ts:69

SLACK_BOT_TOKEN: "<xoxb-your-token>",

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/index.ts:6962

exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

deploy/macos/install-mac-bridge.sh:95

SSH_KEY="${SSH_KEY:-$HOME/.ssh/id_ed25519}"