@orboto/mcpSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Model Context Protocol server for orboto - a self-hosted ticket and project management platform. Connect Claude Desktop, Cursor, GitHub Copilot Chat, or any MCP-aware AI client and operate orboto as a structured set of tools.
131 tools cover tickets, projects, milestones, time tracking, documents, primer facts, alerts and absences. Every call respects the caller's permission set - what the API key behind the MCP session cannot do in the web UI, the MCP session cannot do either.
Quickstart
The shortest path is the orboto CLI:
npm i -g orboto orboto login orboto mcp install # writes the "orboto" server entry into ./.mcp.json orboto mcp install --scope user # or into the Claude Code user config
The entry it writes runs orboto mcp serve, which installs and starts @orboto/mcp at the version of the instance it connects to, so the tool schemas always match that API. The proxy versions are cached under ~/.orboto/mcp//, the entry carries no credential, and orboto mcp status prints the instance version, the cached proxies and the entry of the current directory. In Claude Code, orboto claude then starts a session with the wake channel loaded.
Everything below configures the proxy by hand, for clients the CLI does not write. There are two ways to authenticate the stdio proxy:
- OAuth login (recommended for people). Omit
ORBOTO_API_KEY. On first use the proxy opens your browser to the orboto login (which is your SSO login when SSO is configured), you approve once, and it keeps a short-lived, self-refreshing session cached on disk. Nothing to paste, nothing long-lived. - API key (service accounts / CI). Set
ORBOTO_API_KEYto anorb_...key from Profile → API keys → Generate. Best for headless machines with no browser.
The proxy reads ORBOTO_API_URL (the workspace URL including /api) and ORBOTO_API_KEY. The orboto CLI uses d
eeafeefff946OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp --env ORBOTO_API_KEY=${ORBOTO_API_KEY} --env ORBOTO_AUTH=${ORBOTO_AUTH} --env ORBOTO_MCP_TOKEN_CACHE=${ORBOTO_MCP_TOKEN_CACHE} --env ORBOTO_PROJECT_KEY=${ORBOTO_PROJECT_KEY} -- npx -y @orboto/[email protected]{
"mcpServers": {
"mcp": {
"command": "npx",
"args": [
"-y",
"@orboto/[email protected]"
],
"env": {
"ORBOTO_API_KEY": "${ORBOTO_API_KEY}",
"ORBOTO_AUTH": "${ORBOTO_AUTH}",
"ORBOTO_MCP_TOKEN_CACHE": "${ORBOTO_MCP_TOKEN_CACHE}",
"ORBOTO_PROJECT_KEY": "${ORBOTO_PROJECT_KEY}"
}
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Acme | read | |
Custom | read | hello |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
.eslintrc.cjs
const read = (relative: string) => readFileSync(new URL(`../../../${relative}`, import.meta.url), 'utf8');const read = (relative: string) => readFileSync(new URL(`../../../${relative}`, import.meta.url), 'utf8');const go = readFileSync(new URL('../../../cli/internal/cmd/connect_probe.go', import.meta.url), 'utf8');const read = (relative: string) => readFileSync(new URL(`../../../${relative}`, import.meta.url), 'utf8');const root = resolve(dirname(fileURLToPath(import.meta.url)), '../../..');
server = createHttpServer({ baseUrl: `http://127.0.0.1:${apiPort}`, sessionStore: store, limits });return `http://127.0.0.1:${port}`;return `http://127.0.0.1:${port}`;server = createHttpServer({ baseUrl: `http://127.0.0.1:${apiPort}`, sessionStore: store });return { base: `http://127.0.0.1:${port}`, internals };@modelcontextprotocol/sdk, zod, @types/node, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, tsx, typescript
Gates applied: no_behavioural_pass.
eeafeefff946full audit observations/trust-audit/mcp-server/orboto__orboto-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | eeafeefff946 | SAFE | B | 89 | first audit |
Questions
What tools does @orboto/mcp expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @orboto/mcp safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does @orboto/mcp need?
It reads ORBOTO_API_KEY, ORBOTO_AUTH, ORBOTO_MCP_TOKEN_CACHE and ORBOTO_PROJECT_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @orboto/mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @orboto/mcp at 0.220.0.
How current is this page?
The grade is for one exact copy of the source (eeafeefff946), read on 2026-10-11. The repository is watched and re-audited when it changes.