Atlas / MCP servers / parnmanas / awb-agent-manager

awb-agent-managerBLOCK

Name: awb-agent-manager
Author: parnmanas

mcp/parnmanas/ai-workflow-board

MCP server by parnmanas · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Verdict

BLOCK

Grade

Trust score

44 /100

Exposed tools

200 136r · 84w · 20d

Transport

stdio · streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Run AI CLI sessions on your own machines, give agents a queue of work, and follow the results in one place.

AWB is a self-hosted platform for working with AI agents. Start with a native CLI session, turn work into tickets when you need a queue and an audit trail, or give a larger mission to a team. The browser is your work interface; your Runtime Hosts run the CLIs and hold their native session history.

Each ticket has one assignee, a fixed status, tags, and an optional project. Ready tickets start automatically when that assignee has capacity. Agents use MCP (Model Context Protocol) to read instructions, report results, and update work. Despite the project name, there are no configurable board or column objects: Tickets offers a kanban view of fixed statuses and a list view.

Work pages combine the accounts you can access. Accounts govern ownership, membership, credentials, execution policy, and budgets; you do not need to switch accounts to find your work.

What you can do
How the pieces fit together
Install the AWB server
Connect your first Runtime Host
Run your first session
Automate work with tickets and projects
Give a mission to a team
Connect an external MCP client
Configuration and operations
Troubleshooting
Development
Documentation

What you can do

Read from source at commit d32bac6f405fOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add ai-workflow-board --env AGENT_API_KEY=${AGENT_API_KEY} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} --env API_KEYS_LEAK_PORT=${API_KEYS_LEAK_PORT} -- npx -y ai-workflow-board

claude-desktop

{
  "mcpServers": {
    "ai-workflow-board": {
      "command": "npx",
      "args": [
        "-y",
        "ai-workflow-board"
      ],
      "env": {
        "AGENT_API_KEY": "${AGENT_API_KEY}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}",
        "API_KEYS_LEAK_PORT": "${API_KEYS_LEAK_PORT}"
      }
    }
  }
}

Exposed tools (200)

136 read · 84 write · 20 destructive. Blast radius: 20 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`AWB`	read	board-less
`Account`	read
`Deploy`	write	ships prod
`Model`	read	Models reported by this Runtime Host’s session adapter.
`OAuth`	read
`Organization`	read	Separate existing owner
`Personal`	read	Default ownership account
`Smart`	read	slower
`W`	read
`a-very-long-command-name-for-testing`	read	A long command description
`add_chat_message_attachment`	write	Upload a file into a chat room using the shared attachment storage backend. Pass returned attachment_id in send_chat_room_message.attachment_ids.
`add_chat_participants`	write	Add participants to an existing chat room (group or DM). Inviting into a DM promotes it to a group in place — same room id and history, and the promotion CANNOT be undone. Already-active participants are skipped silently (idempotent). Fails on rooms outside the caller\
`add_comment`	write	Add one ticket comment
`add_orchestration_note`	write	Record a note on the mission timeline — your reasoning for a decision, a risk you are tracking, or
`add_ticket_attachment`	write	Attach a file directly to a ticket (NOT through Resources — distinct from comment attachments).
`add_ticket_prerequisites`	write	Block this ticket until the specified prerequisite ticket(s) are done.
`answer_question`	read	Answer a previously-asked question. Creates a comment with type=answer and parent_id pointing at the question; the parent question auto-resolves so the ticket no longer shows it as open. The original question must exist on the same ticket and have type=question.\n\n
`answer_session_permission`	read	${WHO} Passes the user
`answer_session_question`	read	${WHO} Passes the user
`archive_ticket`	read	Archive a ticket. Sets archived_at=now; the ticket is excluded from the ticket list and from dispatch.
`ask_question`	read	Ask a question on a ticket — creates a comment with type=question, status=open. The ticket creator (or @mentioned user) is notified. Use this when you are blocked and need a human answer before continuing; the ticket detail UI surfaces the open question prominently.\n\n
`attach_qa_artifact`	read	Attach one or more artifact Resource ids (video/image/dump) to a QaRun at the run level
`attach_security_artifact`	read	Attach one or more artifact Resource ids (report/SBOM/dump) to a SecurityRun at the run level.
`await_ci_run`	write	Register a durable wait on ONE external GitHub Actions run (typically the Merging workflow\
`awb-web`	read
`bot`	read
`cancel_ci_wait`	read	Cancel an active CI wait registered by
`claim_ticket`	read	Compatibility verb: AWB already moves a ticket to in_progress when it dispatches it to you.
`clear_current_task`	destructive	Clear this agent\
`clipboard_read`	read	Read the system clipboard as text. Cross-OS: PowerShell on Windows, pbpaste on macOS, wl-paste / xclip / xsel on Linux.
`clipboard_write`	write	Write text to the system clipboard. Useful when the agent has prepared a code snippet / answer for a human to paste somewhere the agent cannot directly type into.
`compact`	read	Compact the context
`complete_action_run`	write	Report the outcome of an Action Run and close the loop back to the ticket that
`complete_orchestration_mission`	read	End a mission you orchestrate. Use status
`complete_qa_run`	write	Finalize a QaRun with an overall status (passed if every step passed, else failed/error)
`complete_security_run`	write	Finalize a SecurityRun.
`correct_confirmed_ticket_duplicate`	read	Correct a previously confirmed false-positive canonical link: clears the link (an audited data correction) and, when the ticket is queued or in progress, wakes its assignee. The canonical ticket is never modified.
`create_account`	write	Create an ownership account for permissions, credentials and execution policy
`create_api_key`	write	Create a new API key for MCP authentication, scoped to your account. The raw key is returned ONLY in this response — save it immediately.
`create_automation_schedule`	write	Create a account schedule — a general-purpose
`create_channel`	write	Create a notification channel (e.g. Discord)
`create_chat_room`	write
`create_child_ticket`	write	Create a child ticket (a checklist item) under a parent ticket. Children are worked by the parent\
`create_orchestration_mission`	write	Teams and their rosters are authored by humans in the AWB UI — this tool cannot create or join a team.
`create_qa_scenario`	write	Create a QA scenario.
`create_qa_schedule`	write	Create a QA schedule — an automatic trigger that kicks a SEQUENTIAL batch (start_qa_batch) when
`create_security_profile`	write	Create a security-inspection profile.
`create_security_schedule`	write	Create a security schedule — an automatic trigger that fires when due.
`create_ticket`	write	Create a ticket. A ticket is done end-to-end by ONE agent (
`create_user`	write	Create a new user
`decide_ticket_duplicate`	read	Resolve an ambiguous chat-ticket match. Link it to a listed canonical candidate, or keep it independent so it is worked normally.
`delete_account`	destructive	Delete an ownership account and its tickets and projects (cannot delete the last account)
`delete_action`	destructive	Delete an action and all its run history (rooms + messages + runs).
`delete_api_key`	destructive	Permanently delete an API key from your account
`delete_automation_schedule`	destructive	Delete a account schedule. Does NOT touch the chat rooms it already opened.
`delete_channel`	destructive	Delete a notification channel
`delete_chat_message_attachment`	destructive	Discard a chat attachment that has NOT been sent yet. Mirrors DELETE
`delete_child_ticket`	destructive	Delete a child ticket
`delete_function`	destructive	Delete a account-authored Function. Built-in Functions cannot be deleted.
`delete_qa_scenario`	destructive	Delete a QA scenario and cascade-delete all its runs (and the chat room each run created).
`delete_qa_schedule`	destructive	Delete a QA schedule. Does NOT touch the QaRunBatches it already started.
`delete_resource`	destructive	Delete a resource by ID. Also removes its vector embedding if one exists.
`delete_security_profile`	destructive	Delete a security-inspection profile and cascade-delete all its runs (and the chat room each run created).
`delete_security_schedule`	destructive	Delete a security schedule. Does NOT touch the SecurityRunBatches it already started.
`delete_ticket`	destructive	Delete a ticket and all its children and comments
`delete_ticket_attachment`	destructive	Remove a file attachment from a ticket. The ticket itself is left unchanged.
`delete_user`	destructive	Delete a user
`dirty-flag-check`	write	primary write
`embed_resources`	write	Trigger embedding generation for all resources in a account that do not yet have embeddings.
`example_one_line_tool`	read	desc
`execute_function`	write	Execute a Function by stable key or ID and persist an auditable run. Use idempotency_key when the Function requires it.
`fake-repo`	read
`fetch_github_info`	read	Fetch metadata about a GitHub repository (description, README, file tree, topics).
`find_unity_logs`	read	Resolve canonical Unity log paths for the host OS (Editor.log, Editor-prev.log, crash dir, Hub log). When
`flush-independence`	read	primary
`focus_window`	read	Bring the first visible window matching
`foo`	read
`get_account`	read	Get an ownership account with its settings and open-ticket counts per status
`get_action`	read	Get a single action by ID with the full prompt template.
`get_api_key`	read	Get details of a single API key by ID (must belong to your account)
`get_automation_schedule`	write	Get a single account schedule by id (target agent, task prompt, cadence, next/last run, last room id).
`get_chat_room_messages`	read	Read the message history of a chat room the agent participates in.
`get_function`	read	Get a Function definition by ID, including executor config and JSON input/output schemas.
`get_latest_artifact`	read	Freshness read for the build registry: does an
`get_my_tickets`	read	Tickets assigned to the calling agent (its runtime identity), newest first. Archived tickets are excluded.
`get_orchestration_mission`	read	Read the live state of an orchestration mission you orchestrate: objective, current plan with every
`get_orchestration_step`	write	Re-read a step assigned to you: the work order, the mission objective it serves, and the reported
`get_privileged_command_result`	read	Fetch the outcome of a
`get_project`	read	Get one project: repository url, default branch, use_pr, instructions, default assignee and
`get_qa_batch`	read	Get a sequential QA batch: ordered scenario_ids + run_ids, current_index/total progress, status
`get_qa_run`	write	Get a single QA run with its step_results and accumulated artifact_resource_ids.
`get_qa_scenario`	read	Get a single QA scenario by id (includes its step definitions).
`get_qa_schedule`	write	Get a single QA schedule by id (scope, cadence, next/last run, last batch id).
`get_recent_activity`	read	Get the global recent activity feed across all tickets
`get_resource`	read	Get one inherited resource by ID with full content (including file_data if present).
`get_security_batch`	read	Get a sequential security batch: ordered profile_ids + run_ids, current_index/total progress,
`get_security_profile`	read	Get a single security-inspection profile by id (includes its checklist + incremental baseline).
`get_security_run`	write	Get a single security run with its findings and accumulated artifact_resource_ids.
`get_security_schedule`	write	Get a single security schedule by id (scope, cadence, next/last run, last batch id).
`get_ticket`	read	Get a single ticket with its children, comments, project (incl. main clone folder per host), assignee and prerequisites.
`get_ticket_activity`	read	Get activity log for a specific ticket
`get_ticket_attachment`	read	Fetch a single ticket attachment INCLUDING the base64 file_data so the caller can decode the binary.
`get_user`	read	Get a single user by ID
`gh-bot`	read
`graph_blast_radius`	read	Bounded reverse reachability from a node in an Ontology Graph (
`graph_call_path`	read	Shortest confidence-floored path between two nodes in an Ontology Graph, via application-orchestrated
`graph_find_symbol`	read	Resolve a symbol by name inside an Ontology Graph — exact name, then exact qualified_name, then a bounded
`graph_module_summary`	read	Compact, aggregated summary of one directory/module/file in an Ontology Graph: top symbols by centrality
`graph_neighbors`	read	Bounded forward reachability from a node in an Ontology Graph (src->dst, depth-capped, confidence-floored).
`graph_refresh`	read	현재 작업 중인 티켓의 기존 온톨로지 그래프를 비동기로 1회 재빌드합니다.
`graph_status`	read	Resolve (or auto-provision) the Ontology Graph for a (resource_id, folder_path) and report its build status.
`id`	read	Target agent ID
`keep_chat_session_alive`	read	Declare that THIS agent\
`kill_process`	destructive	Kill a process by pid or by name regex. Default uses SIGTERM (graceful); pass
`launch_process`	read	Launch a program on the host. Returns the pid (when available). The launched process is detached by default so it outlives the agent-manager; pass
`list_accounts`	read	List all accounts
`list_action_runs`	read	List runs for an action (most recent first), capped at limit.
`list_actions`	read	List reusable Actions in a account.
`list_api_keys`	read	List API keys in your account (key values are masked). Shows name, scope, agent, status, usage stats.
`list_archived_tickets`	read	List archived (soft-deleted) tickets of a account. Pagination via cursor + limit; optional q filters by title / id / tag (case-insensitive).
`list_automation_schedules`	read	List reusable Account schedules.
`list_channels`	read	List all notification channels (Discord etc.)
`list_chat_room_participants`	read	List the participants of a chat room the agent participates in, with the exact mention token
`list_chat_rooms`	read	List the chat rooms the agent actively participates in, scoped to the caller\
`list_claude_backend_profiles`	read	List safe Claude backend profile metadata. Profiles are instance-global — there is no per-account assignment or default. Credential references and secrets are omitted. DB-backed, full-scope Agent MCP only.
`list_function_runs`	read	List auditable Function execution records for a account, optionally filtered by Function or ticket.
`list_functions`	read	List executable Functions resolved by Account → Global key precedence.
`list_my_orchestration_steps`	read	List orchestration steps currently assigned to you that have not been reported yet. Use this to recover
`list_orchestration_graph_templates`	read	List the built-in execution-graph templates you can pass to submit_orchestration_plan as
`list_orchestration_missions`	read	Teams and their rosters are authored by humans in the AWB UI; this tool only reads missions. List
`list_orchestration_teams`	read	Teams and their rosters are authored by humans in the AWB UI — this tool only reads them. List the
`list_pending_session_requests`	read	${WHO} Lists the permission requests and questions that Agent Sessions driven by the user you are talking with are
`list_processes`	read	List running processes on the host (pid, name, cpu, mem_kb, ppid, user when available).
`list_projects`	read	List the projects (repositories) of a account, each with its main clone folder per Runtime Host (
`list_qa_runs`	write	List runs for a QA scenario, newest first (history). Each run carries status, step_results,
`list_qa_scenarios`	read	List reusable QA scenarios in a account.
`list_qa_schedules`	read	List reusable QA schedules in a account.
`list_repo_branches`	read	List branches of a Project\
`list_resources`	read	List inherited Global and Account resources.
`list_screens`	read	Enumerate attached monitors with their virtual-desktop position, size, scale, and primary flag. Coordinates are in the same space
`list_security_profiles`	read	List reusable security-inspection profiles in a account.
`list_security_runs`	write	List runs for a security-inspection profile, newest first (history). Each run carries status,
`list_security_schedules`	read	List reusable security schedules in a account.
`list_session_prompt_proposals`	read	${WHO} Lists your own proposals that are still open (pending = waiting for the user, queued = approved and
`list_ticket_attachments`	read	List all file attachments on a ticket. Returns metadata only (no file_data) — call get_ticket_attachment to download the bytes.
`list_ticket_prerequisites`	read	List the prerequisite tickets blocking a ticket. Each row carries the prereq\
`list_tickets`	read	List root tickets of a account, filtered by status / tags (AND) / project / assignee / text. Returns
`list_users`	read	List all registered users
`list_windows`	read	List visible windows on the host with their pid, title, and geometry.
`lost`	read	never flushed
`manager`	read
`mouse_click`	read	Click at absolute screen coordinates (x, y). Use with prior
`mouse_move`	write	Move the mouse cursor to absolute screen coordinates without clicking. Useful to hover before screenshotting (some IDE/editor surfaces only render tooltips on hover).
`move_ticket`	write	Change a root ticket
`nested-inner`	read	nested
`nested-outer`	read	nested
`nonblocking-probe`	write	concurrent primary write during ontology population
`os_info`	read	Report basic info about the host the agent-manager is running on (platform, hostname, user, OS release, arch, cpu count, memory, DISPLAY / WAYLAND_DISPLAY).
`patch_orchestration_graph`	write	Change part of the execution graph of a running mission you orchestrate, without resubmitting the whole
`path`	read	Absolute path on the agent machine
`pend_ticket`	read	Use ONLY when human input is required AND no registered Action can resolve the blocker.
`persisted`	read	flushed
`propose_session_prompt`	read	${WHO} Proposes a prompt for another Agent Session to work on next — e.g. after a work report says a session
`propose_skill_change`	write	Create a pending, human-reviewed AWB skill proposal. This never publishes, assigns, approves, or mutates a skill version.
`qa_run_heartbeat`	write	Emit a lightweight liveness heartbeat for a running QaRun — SEPARATE from record_qa_step.
`read_file_tail`	read	Read the tail of a text file (default last 8 KiB, max 1 MiB). Use to inspect Unity Editor.log, build logs, error logs, etc., without paging through the whole file.
`record_decision`	read	Record a decision on a ticket — creates a comment with type=decision. Use this for resolved trade-offs, scope choices, or anything future readers should be able to find without scrolling the full discussion. Decisions render with a distinctive style and survive comment-filter toggles by default.\n\n
`record_outreach_classification`	read	Report the classification result for one outreach inbound item back to the dispatch
`record_qa_step`	write	Record one step result on a running QaRun. Upload the step\
`record_security_finding`	read	Record one finding on a running SecurityRun. Re-recording the same finding id overwrites it.
`refresh_security_checklist`	read	Refresh a security profile\
`register_build_artifact`	write	Record a build in the registry so the next run (any scenario on the same repo+commit) can
`release_ticket`	read	Compatibility verb from the lock era — tickets are no longer locked. Always returns { released: false }.
`remove_ticket_prerequisite`	destructive	Remove a single prerequisite link from a ticket. When the last open link is removed, the ticket auto-unblocks (
`reopen_orchestration_mission`	read	Bring a FINISHED mission (completed / failed / cancelled) back to life so you can continue it.
`report_build_failure`	read	Report a build FAILURE as a first-class event. Records a
`report_deployment`	write	Tell AWB that an ENVIRONMENT is now live on a specific commit — the
`report_orchestration_progress`	read	Heartbeat for a long-running step assigned to you. Records a progress line on the mission timeline and
`report_orchestration_step`	read	Report the FINAL result of a step assigned to you. This is what unblocks every step that depends on
`request_privileged_command`	write	Ask a human operator to run ONE command as root on the Runtime Host that supervises you.
`request_ticket_unpend_approval`	write	Post a Resume (Unpend) approval card to a chat room. This tool never clears pending_user_action.
`review`	read	Review the working tree
`review-branch`	read	Review a branch
`revoke_api_key`	destructive	Revoke (deactivate) an API key in your account. The key remains in DB but can no longer authenticate.
`run_action`	write	Dispatch a Run for an action. Creates a new chat room with the target agent,
`run_automation_schedule_now`	write	Manually dispatch a account schedule\
`run_qa_schedule_now`	write	Manually dispatch a QA schedule\
`run_security_schedule_now`	write	Manually fire a security schedule right now (ignores enabled; does NOT disturb the automatic
`save_action`	write	Create or update an action. Provide
`save_function`	write	Create or update a Account Function. Global Functions are managed by authenticated admins from the Functions menu. Provide id to update.
`save_project`	write	Create (omit project_id) or update a project.
`save_resource`	write	Create or update a resource. If
`screenshot`	read	Capture a full-screen screenshot of the host the agent-manager is running on.
`search_actions`	read	Text search across action name, description, and prompt template within a account.
`search_chat_messages`	read	Full-text search chat messages across the account, scoped to rooms the agent actively participates in.
`search_github`	read	Search GitHub for repositories, code, or issues using the GitHub Search API.
`search_resources`	read	Search resources using semantic vector similarity (when embedding API configured) or text matching (fallback).
`send_chat_room_message`	write	Send a message to a chat room. The agent must be an active participant in the room.
`send_keys`	write	Send keystrokes to the currently-focused window (or focus a window first by passing
`send_session_prompt_proposal`	write	${WHO} Sends a proposal the user just approved by talking to you (

Trust audit

BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (12 observation(s))
Network: declared (11 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

apps/server/src/common/ssrf-guard.ts:80

['169.254.0.0', 16],    // link-local — 클라우드 메타데이터(169.254.169.254) 포함

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

apps/server/src/modules/security/security-seed-profiles.ts:135

'URLs. An attacker-controlled URL can target internal services (169.254.169.254, localhost, ' +

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

MEDIUMInventory / provenance · inv.binary · CWE-1104

apps/client/android/gradle/wrapper/gradle-wrapper.jar

gradle-wrapper.jar

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInsecure crypto · crypto.weak_random · CWE-327, CWE-338

apps/server/src/modules/security/security-seed-profiles.ts:197

'flag Math.random() for anything security-relevant — and secret comparisons should be ' +

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

Dockerfile:141

CMD wget -qO- http://127.0.0.1:7701/api/health | grep -q '"status":"ok"' || exit 1