Atlas / MCP servers / open-multi-agent / Open Multi Agent

Open Multi AgentBLOCK

Name: Open Multi Agent
Author: open-multi-agent

mcp/open-multi-agent/open-multi-agent

MCP server by open-multi-agent · agent framework · agent orchestration · agentic ai · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Self-hosted TypeScript agent runtime with durable approvals and verifiable run records. Own it, approve it, audit it.

Verdict

BLOCK

Grade

Trust score

56 /100

Exposed tools

74 66r · 8w · 0d

Transport

streamable-http

License

MIT

Stars

6,997

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

OMA

Agents your organization can own, approve, and audit. OMA (Open Multi-Agent) is a self-hosted TypeScript agent runtime: consequential actions wait for durable, tamper-evident approvals, and every run leaves a record you can verify offline, byte for byte.

Website ·

Read from source at commit dfe2da8cbc42OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add release-bot --env AGENT_API_KEY=${AGENT_API_KEY} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ARK_API_KEY=${ARK_API_KEY} --env ASTA_API_KEY=${ASTA_API_KEY} -- npx -y @open-multi-agent/[email protected]

claude-desktop

{
  "mcpServers": {
    "release-bot": {
      "command": "npx",
      "args": [
        "-y",
        "@open-multi-agent/[email protected]"
      ],
      "env": {
        "AGENT_API_KEY": "${AGENT_API_KEY}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ARK_API_KEY": "${ARK_API_KEY}",
        "ASTA_API_KEY": "${ASTA_API_KEY}"
      }
    }
  }
}

Exposed tools (74)

66 read · 8 write · 0 destructive.

Tool	Risk	Description
`a`	read	A
`b`	read	B
`bash`	write	Run a shell command.
`big`	read	Returns large output.
`big_output`	read	returns a large string
`boom`	read	fails
`change-analyst`	read	Classifies merged changes and drafts evidence-backed changelog entries.
`charge_card`	read	Charge a card.
`commit`	write	Commit a labelled side effect.
`commit_effect`	write	Commit a labelled side effect to an external system.
`compatibility-auditor`	read	Attempts to find breaking changes, migration requirements, and release blockers.
`custom_tool`	read	Custom tool
`danger`	read	Dangerous op.
`delegate_to_agent`	write	Run a sub-task on another agent from this team and return that agent\
`echo`	read	Echo input
`echo_tool`	read	Return the caller-supplied payload unchanged.
`engram_commit`	write	Commit a verified fact to Engram shared team memory.
`engram_conflicts`	read	List conflicts between facts in Engram shared memory.
`engram_query`	read	Query Engram shared memory for facts about a topic.
`engram_resolve`	read	Override an auto-resolution for a conflict between facts.
`errorbig`	read	Throws a huge error.
`fail`	read	Always throws.
`failed_pic`	read	Pic
`file_edit`	write	Edit file
`file_read`	read	Read the contents of a file from disk.
`file_write`	write	Write file
`files`	read	Files
`format_currency`	read	Format a number as a localised currency string.
`get_exchange_rate`	read	Get the current exchange rate between two currencies.
`get_release_evidence`	read	Return immutable release evidence collected from the latest core tag through the current HEAD.
`get_weather`	read	Get the weather for a city
`glob`	read	List file paths under a directory that match an optional filename glob.
`greet`	read	greets
`grep`	read	Search for a regular-expression pattern in one or more files.
`invalid`	read	returns invalid output
`json-errored`	read	Always fails with a non-JSON error message.
`json-gated-invalid`	read	Returns invalid JSON output after the gate allows it.
`json-ok`	read	Returns valid JSON output.
`json-truncated`	read	Returns broken-but-deceptive JSON output.
`leaky`	read	returns a sensitive-looking value
`legacy`	read	legacy string tool
`limited`	read	Has its own limit.
`long_tool`	read	Returns long output
`lookup`	read	Look up
`malformed_gate`	read	Uses a malformed gate decision.
`my_custom`	read	A custom capability.
`my_custom_tool`	read	A custom tool for testing
`no-schema`	read	No output schema configured.
`noop`	read	noop
`nullable_input`	read	Accepts a required nullable value.
`pic`	read	Pic
`private_lookup`	read	Privacy test tool.
`read_release_contract`	read	Read the repository release contract from .github/RELEASING.md.
`read_release_review_bundle`	read	Read one deterministic, risk-ranked, size-bounded bundle of base-to-HEAD diffs. The bot selects the paths; model-supplied repository paths are not accepted. Unselected paths remain listed in the full evidence metadata.
`release-planner`	read	Combines independent analysis into one bounded release proposal.
`release-reviewer`	read	Independently approves or rejects the bounded proposal before any mutation.
`release_marker`	read	Return a fixed marker for the provider E2E test.
`render`	read	render an artifact
`render_preview`	read	Render an image preview for a named artifact.
`repo_search`	read	Search underscore.
`run_landing_variant`	write	Generate this variant\
`search`	read	Search the web
`search_issues`	read	Search repository issues.
`short_tool`	read	Returns short output
`slow_gate`	read	Runs after a delayed gate.
`slow_tool`	read	Slow op.
`small`	read	Returns small output.
`spy`	read	Captures the abort signal from context.
`structured`	read	Structured output.
`tdam_search_conversations`	read	Search the raw conversation history captured in long-term memory.
`tdam_search_memories`	read	Search the team\
`test`	read	test
`track`	read	Tracks concurrency.
`typed`	read	typed application output

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (3 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/core/src/tool/shell/local.ts:34

exec(command: string, options: ShellExecOptions): Promise<ShellExecResult> {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/core/src/tool/shell/types.ts:37

exec(command: string, options: ShellExecOptions): Promise<ShellExecResult>

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/observability-benchmark-ci.mjs:11

const { stdout } = await exec(process.execPath, ['--expose-gc', benchmark, core, otel], {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/observability-tarball-smoke.mjs:14

const { stdout, stderr } = await exec(file, args, {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/create-oma-app/templates/pr-review/src/input.ts:134

+    console.log('login', email, password)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

bench/src/mock-upstream.mts:94

origin: `http://127.0.0.1:${port}`,

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

bench/src/proxy.mts:91

return `http://127.0.0.1:${this.port}/v1`

MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321

packages/core/tests/memory-store-contract.test.ts:156

await store.set('secret', 'token sk-ant-api03-abcdefghijklmnopqrstuvwxyz0123456789')

MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321

packages/core/tests/memory-store-contract.test.ts:158

expect(stored).not.toContain('sk-ant-api03-abcdefghijklmnopqrstuvwxyz0123456789')