ModelsAtlas
Explore
Atlas / MCP servers / prjct-app / prjct-cli

prjct-cliBLOCK

mcp/prjct-app/cli
MCP server by prjct-app · agent memory · agentic workflows · ai agents · Audited 2026-10-12
⚑ Report / re-scanSource ↗

The agentic harness for AI coding agents — intelligence is rented, the harness is owned. Runs the full work cycle: intent briefs, bounded RAG context from real code intelligence, persistent memory, preventive guardrails, and performance evals. One CLI + MCP server, SQLite inside. Claude Code, Codex,

Verdict
BLOCK
Grade
F
Trust score
52 /100
Exposed tools
26 18r · 7w · 1d
Transport
—
License
MIT
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The agentic harness for AI coding agents. Intelligence is rented, the harness is owned. prjct-cli gives Claude Code, Codex, Gemini, Cursor, OpenCode — any agent — two things that are measured, not asserted:

  • Machine-verified work, in any language. prjct gauntlet runs your

project's own verify commands and records a receipt bound to git HEAD; ship refuses a red one. The work counts when the machine says so, not when the agent says so. Commands are detected from the manifest you already have (npm/yarn/pnpm/bun · Cargo · Go · Python · Maven · Gradle · Ruby · PHP · .NET · Elixir · Makefile targets) — and for anything else, declare them:

prjct gauntlet set test "swift test"
  • Lookup that beats re-deriving. Bounded, ranked project context (RRF over

BM25 + semantic, quality measured by prjct harness retrieval) instead of an agent re-reading the repo to rebuild what it already established.

Everything it claims is auditable from the CLI: prjct harness audit reports memory relevance and fails a threshold, prjct harness retrieval reports Recall@k/MRR/nDCG on a leak-free split.

[](https://www.npmjs.com/package/prjct-cli) [](./LICENSE) []() []() []()

Install / upgrade — one paste

Copy this prompt and paste it in Claude Code (works for fresh install AND upgrade — Claude picks YOUR package manager, doesn't force npm):

Install or upgrade prjct-cli on this machine. First detect which package manager I use globally (check `command -v pnpm`, `command -v bun`, `command -v yarn`, `command -v npm` in that order; also check where any existing `prjct` install lives via `command -v prjct`
Read from source at commit d382e26f576cOBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add prjct-cli --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GROK_API_KEY=${GROK_API_KEY} --env PRJCT_EMBEDDINGS_API_KEY=${PRJCT_EMBEDDINGS_API_KEY} --env PRJCT_TEST_KEY_PID=${PRJCT_TEST_KEY_PID} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "prjct-cli": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "GROK_API_KEY": "${GROK_API_KEY}",
        "PRJCT_EMBEDDINGS_API_KEY": "${PRJCT_EMBEDDINGS_API_KEY}",
        "PRJCT_TEST_KEY_PID": "${PRJCT_TEST_KEY_PID}"
      }
    }
  }
}
03

Exposed tools (26)

18 read · 7 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
Bashreadnative shell
RepositoryreadData access
apireadAPI layer
authreadAuthentication + sessions
bashwriteRun a short shell command in the project root (cwd fixed). Prefer read/edit/write for file changes. No network/sudo.
billingreadStripe billing + invoices
datareadx
deploywriteDeploy to production
deploy-localwriteremote metadata refresh
editwriteReplace an exact substring in a file once. Fails if old_string is missing or not unique. Surfaces preventive memory for the file when present.
grok-buildreadGrok as Brain, prjct as Body: multi-host skill/MCP projection, plan-mode approval gate, crew checkpoints, and SQLite memory (Grok memory is experimental). Steal patterns from the open Grok Build harness — not the Rust agent loop.
mcp__prjct__prjct_mem_savewritesave
p1readd1
prjct_guardwriteAnticipation: preventive memory for a file (gotchas/anti-patterns) before edit. Empty means clear to edit.
prjct_rememberreadPersist a durable memory in ENGLISH (decision|learning|gotcha|fact|...). Use after resolving something non-obvious.
prjct_searchreadSearch durable project memory (decisions, gotchas, learnings). Prefer this before broad codebase exploration.
prjct_workwriteStart a tracked prjct work cycle for an intent (same gates as
qareadQuality assurance checks
readreadRead a UTF-8 text file under the project root. Path is relative to project root.
repositoryreaddata access
safe-agentic-workflowreadA cautious build→review→ship rig: intent brief, dynamic review specialists, and a verify gate before ship.
solo-sovereignreadA single-agent rig for non-Claude / local models: emulated crew (one agent plays the roles) + a KB + verify gate. Maximum portability.
test-wfreadTest workflow
validate-before-parsereadSignatures checked before payload parse
writedestructiveCreate or overwrite a UTF-8 text file under the project root. Creates parent dirs. Prefer edit for small changes.
xreadd
04

Trust audit

BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (3 observation(s))
Network
declared (2 observation(s))
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
core/services/analysis-payload-builder.ts
analysis-payload-builder.ts
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
core/storage/database/sqlite-compat.ts:195
exec(sql: string): void
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
core/agent/paths.ts:10
/^(?:\.env(?:\..+)?|.*\.(?:pem|key|p12|pfx)|id_rsa|id_ed25519|credentials\.json|auth\.json)$/i
Why it matters. touches a credential store
MEDIUMInventory / provenance · inv.binary · CWE-1104
core/eval/ab-report.ts
ab-report.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
core/utils/prompt-injection.ts:44
name: 'system-prompt-exfil',
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
core/commands/analysis.ts:317
? ` · purged: hardΔ${v.softDeletedPurged ?? 0} distillΔ${v.distilledDiscarded ?? 0} digests+${v.digestsWritten ?? 0} archΔ${v.archivesPruned ?? 0}`
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
core/services/memory-dream.ts:447
: `Dream complete: archived=${phases.consolidate.archived} deleted=${phases.consolidate.deleted} inboxΔ=${inboxMerged + inboxArchived} · L0 index live=${index?.live ?? 0}`
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
core/__tests__/daemon/source-inspection-routing.test.ts:9
const TOKEN = '0123456789abcdef01234567'
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
core/__tests__/services/comment-discipline-detector.test.ts:6
const secret = 'customer-secret-should-never-persist'
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
write
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.bun-version
.bun-version
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.suspicious_name · CWE-1104
core/__tests__/services/analysis-payload-builder.test.ts
analysis-payload-builder.test.ts
Why it matters. member named after an attack tool
Fix. remove or justify
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
core/__tests__/hooks/prompt-delta-emission.test.ts:285
const cwd = createHash('sha1')
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
core/daemon/protocol.ts:27
const id = crypto.createHash('sha1').update(path.resolve(cliHome)).digest('hex').slice(0, 16)
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
core/hooks/prompt.ts:708
const key = createHash('sha1').update(path.resolve(projectPath)).digest('hex').slice(0, 16)
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
core/hooks/prompt.ts:713
const cwd = createHash('sha1').update(path.resolve(projectPath)).digest('hex').slice(0, 12)
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
core/mcp/tools/files.ts:61
const argsKey = createHash('sha1')
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
core/__tests__/services/agent-loop.test.ts:47
expect(() => resolveSafePath(root, 'secrets/id_rsa')).toThrow(PathDeniedError)
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
core/__tests__/workflow-engine/git-commit-staging.test.ts:54
await write('deploy/id_rsa', PEM)
Why it matters. touches a credential store
LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59
core/__tests__/workflow-engine/git-commit-staging.test.ts:65
expect(skippedPaths).toContain('deploy/id_rsa')
Why it matters. touches a credential store
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
core/__tests__/_setup/path-manager-mock.ts:17
import pathManager from '../../infrastructure/path-manager'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
core/__tests__/_setup/reset-singletons.ts:18
import { resetCircuitBreakers } from '../../utils/retry'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
core/__tests__/agent/bash-tool-policy.test.ts:9
import { bashCommandDenied, scrubbedChildEnv } from '../../agent/tools'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
core/__tests__/commands/analysis-save-llm.test.ts:5
import { saveLlmAnalysis } from '../../commands/analysis/llm'
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
core/__tests__/commands/analysis-save-llm.test.ts:6
import configManager from '../../infrastructure/config-manager'

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha d382e26f576cfull audit observations/trust-audit/mcp-server/prjct-app__cli.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12d382e26f576cBLOCKF52first audit
06

Questions

What is the prjct-cli MCP server?

The agentic harness for AI coding agents — intelligence is rented, the harness is owned. Runs the full work cycle: intent briefs, bounded RAG context from real code intelligence, persistent memory, preventive guardrails, and performance evals. One CLI + MCP server, SQLite inside. Claude Code, Codex,

What tools does prjct-cli expose?

26 in total: 18 read-only, 7 that write, and 1 that can delete or overwrite (write). Every one is listed on this page with its risk.

Is prjct-cli safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (52/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does prjct-cli need?

It reads GEMINI_API_KEY, GROK_API_KEY, PRJCT_EMBEDDINGS_API_KEY, PRJCT_TEST_KEY_PID and XAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (d382e26f576c), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement