BizarharnessBLOCK
Guarded multi-agent harness for Claude Code: model aliases, OpenKan planning, isolated worktrees, and evidence-led verification.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Archived and retired. Development has moved to BizarHarness-OMP. This repository is retained for historical reference and is no longer maintained.
[](https://www.npmjs.com/package/@polderlabs/bizar) [](LICENSE) [](https://github.com/Untrivial-ai/agent-orchestrator) [](https://github.com/PolderLabsVOF/BizarHarness/releases) [](https://www.npmjs.com/package/@polderlabs/openkan)
Maximum autonomy for Agent Orchestrator workers
Run focused Codex workers under Agent Orchestrator. Bizar supplies their repository policy, guardrails, skills, and verification evidence.
85 agents · 85 skills · 37 commands · 21-tool MCP server
Why Bizar?
Agent Orchestrator is built to coordinate parallel coding sessions. Bizar makes each worker's implementation and verification discipline explicit. AO owns multi-agent coordination, worktrees, branches, PR/review/CI feedback, previews, and browser state; Bizar does not duplicate those surfaces.
It records evidence and rollback context for high-impact actions while keeping execution autonomous by default. AO model choices live in the registered project's AO configuration. Standalone Claude aliases live in global Claude configuration.
c5c6a57625b8OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add bizar-sdk --env BIZAR_AUTONOMY_SECRET=${BIZAR_AUTONOMY_SECRET} --env BIZAR_EVIDENCE_SECRET=${BIZAR_EVIDENCE_SECRET} --env BRAINSTORM_TOKEN=${BRAINSTORM_TOKEN} --env BRAINSTORM_TOKEN_FILE=${BRAINSTORM_TOKEN_FILE} -- npx -y @polderlabs/[email protected]{
"mcpServers": {
"bizar-sdk": {
"command": "npx",
"args": [
"-y",
"@polderlabs/[email protected]"
],
"env": {
"BIZAR_AUTONOMY_SECRET": "${BIZAR_AUTONOMY_SECRET}",
"BIZAR_EVIDENCE_SECRET": "${BIZAR_EVIDENCE_SECRET}",
"BRAINSTORM_TOKEN": "${BRAINSTORM_TOKEN}",
"BRAINSTORM_TOKEN_FILE": "${BRAINSTORM_TOKEN_FILE}"
}
}
}
}Exposed tools (10)
9 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
A | read | D |
bizar-debug | read | Root-cause a bug with bounded loop-until-dry: RCA hypothesis, adversarial verification, smallest fix, regression test |
bizar-implement | write | Implement one bounded change in one worktree, or run explicitly supplied disjoint lanes concurrently |
bizar-research | read | Research, plan, audit, and implement a bounded task across disjoint lanes with sequential pipeline verification |
probe | read | x |
todd | read | Tests and verifies implementation. |
ultracode | read | Research, design, implement, review, and verify a substantial engineering task with bounded multi-agent orchestration |
ultracode-research | read | Research a technical question with independent repository, documentation, architecture, and adversarial passes |
ultracode-review | read | Review a change across independent dimensions and adversarially verify every finding |
wrong | read | x |
Trust audit
BLOCKgrade F · trust 45/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (11 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
| File upload endpoint | Authenticated | User data → Server storage |
| File upload endpoint | Authenticated | User data → Server storage |
fingerprint.ts
`E2B_API_URL=${values.E2B_API_URL || 'http://127.0.0.1:3000'}`,--url http://127.0.0.1:3000 \
--url http://127.0.0.1:3000 \
writeFileSync(join(root, 'token.txt'), 'ghp_1234567890abcdefghijklmnopqrstuvwxyzAB\n');
const gh = apply("github token: ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "permissive");'-----BEGIN RSA PRIVATE KEY-----\nMIIE...\n-----END RSA PRIVATE KEY-----\n',
const priv = apply("-----BEGIN RSA PRIVATE KEY-----", "permissive");return new Function(`return (${source.slice(open, end + 1)});`)();const fn = new Function(
return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64');test('cat ~/.aws/credentials → allow (F-200 — secret guard moved to git)', () => {const r = runHook('cat ~/.aws/credentials');test('cat ~/.ssh/id_rsa → allow (F-200)', () => {const r = runHook('cat ~/.ssh/id_rsa');manifest.paths.find((entry) => entry.label === 'project-state').src = '../../victim';
} from '../../packages/sdk/dist/autonomy/evidence-bundle.js';
const malicious = { ...bundle, objectiveRunId: '../../../etc/passwd' };const EVIDENCE_MOD = await import('../../config/workflows/lib/dispatch.js');} from '../../packages/sdk/dist/learning/behavior-capture.js';
const r = runHook('curl 169.254.169.254/latest/meta-data');const r = runHook('curl metadata.google.internal/');writeSandboxEnv({ E2B_API_URL: 'http://127.0.0.1:3000', E2B_API_KEY: 'secret', CUBE_TEMPLATE_ID: 'tpl-1' }, path);Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
c5c6a57625b8full audit observations/trust-audit/mcp-server/polderlabsvof__bizarharness.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c5c6a57625b8 | BLOCK | F | 45 | first audit |
Questions
What is the @polderlabs/bizar MCP server?
Guarded multi-agent harness for Claude Code: model aliases, OpenKan planning, isolated worktrees, and evidence-led verification.
What tools does @polderlabs/bizar expose?
10 in total: 9 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @polderlabs/bizar safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (45/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @polderlabs/bizar need?
It reads BIZAR_AUTONOMY_SECRET, BIZAR_EVIDENCE_SECRET, BRAINSTORM_TOKEN and BRAINSTORM_TOKEN_FILE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (c5c6a57625b8), read on 2026-10-12. The repository is watched and re-audited when it changes.