ai-team-syncBLOCK
Coordinate multiple AI coding agents (Claude Code, Cursor, Codex) on one repo — declared sessions, file scope locks (advisory/exclusive), and shared decisions, surfaced in VS Code, a browser dashboard, a CLI, and natively via MCP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Stop AI agents (and humans) from stepping on each other's work.
When two devs both tell their AI agents to change the same files, nobody knows until conflicting PRs appear. ai-team-sync gives instant visibility — who's working on what, and why — through declared sessions, file scope locks (advisory or exclusive), and logged decisions. It surfaces in VS Code, a browser dashboard, a CLI, and natively in Claude Code via MCP.
Status: experimental. A multi-agent coordination service for coding agents — shared sessions, advisory locks, durable decisions, bounded delegation, authority inspection, and context/preflight support. Built as a personal tool and used daily. Small, dependency-light, MIT-licensed. It coordinates agents that are already cooperating; it is not a security boundary and not an autonomous orchestrator.
The live dashboard: each agent/developer's open files at a glance, color-coded — so nobody edits the same file blind.
Quickstart
# 1. install + run the server (API + dashboard on :8400) pip install -e . ats-server & # 2. announce what you're working on — teammates/agents see it instantly ats session start -s "src/auth/**" -d "Refactoring auth to JWT" # 3. claim a path so others get blocked/warned, with a reason they can see ats lock add "src/auth/**" --mode exclusive --reason "JWT migration, #1234" # 4. before you touch a file, check it's free ats lock check src/auth/middleware.py # exits non-zero if locked # 5. see who's working on what ats team # 6. record a decision so it outlives the chat session ats decision log "Chose JWT over sessions" -c JWT -r "session cookies" \ --reason "stateless auth for horizontal scaling" # 7. wrap up — releases locks, notifies the team ats session complete -m "Done"
Dashboard: http://localhost:8400/dashboard. For Claud
5367dd07a19bOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add ai-team-sync --env ATS_APPROVAL_TOKEN=${ATS_APPROVAL_TOKEN} --env CURSOR_ADMISSION_AUTHORIZED=${CURSOR_ADMISSION_AUTHORIZED} -- npx -y [email protected]{
"mcpServers": {
"ai-team-sync": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ATS_APPROVAL_TOKEN": "${ATS_APPROVAL_TOKEN}",
"CURSOR_ADMISSION_AUTHORIZED": "${CURSOR_ADMISSION_AUTHORIZED}"
}
}
}
}Exposed tools (23)
18 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
acknowledge_message | read | Confirm that you received one message addressed to your current ATS session. |
check_git_changes | read | Check uncommitted files in your session scope. Helps verify what will be committed. |
check_locks | read | Check if files are locked by other team members before editing. Returns lock status and who owns locks. |
check_my_override_requests | read | Check status of override requests you |
check_pending_requests | read | Check if anyone is requesting permission to override your locks. Call this periodically to respond to requests. |
delete_lock | destructive | Remove a specific lock without completing the session. Use carefully. |
get_decision_history | read | Read cross-agent decisions on your ticket or repo by default; override with team_wide, ticket, repo, or session filters. |
get_override_request_details | read | Get detailed information about a specific override request. |
get_session_details | read | Get detailed information about your current session including locks, decisions, and commits. |
list_all_locks | read | List all active locks across the team. Shows overall coordination landscape. |
log_decision | read | Log a design decision made during your session. Helps team understand why choices were made. |
message_inbox | read | Read messages addressed to your current ATS session; messages remain pending until you acknowledge them. |
message_status | read | Check whether the recipient has acknowledged a message sent by your current ATS session. |
pause_session | read | Pause your current session while keeping locks. Use when switching tasks temporarily. |
pre_commit_check | write | Check if staged files have lock conflicts before committing. |
readdress_message | write | As the original sender, move an unread direct message from an ended session to one active session. Preserves its ID and delivery history. |
request_override | read | Request permission to work on files locked by another session. An exclusive lock requires its owner |
respond_to_request | read | Approve or deny an override request from another team member. |
resume_session | read | Resume a paused session. Reactivates your locks and session. |
send_message | write | Send a durable message to one active session or the first later session on your ticket. Receipt needs acknowledgement. |
start_session | write | Start a new working session with scope locks. Announces your work to the team and creates locks to prevent conflicts. |
team_status | read | See what team members are currently working on. Shows active sessions and their scope. |
whos_editing | read | Before editing, check who else is ACTIVELY editing these files right now (live presence + their intent). Use to self-coordinate: if someone is already in a file, pick another, wait, or coordinate. Distinct from check_locks (declared scope locks) — this is real-time |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (13 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (15)
dict(os.environ) ... httpx.
ats_url: str = "http://127.0.0.1:8400"
echo_url: str = "http://127.0.0.1:8309"
ats_url=os.getenv("ATS_URL", "http://127.0.0.1:8400").rstrip("/"),echo_url=os.getenv("ECHO_BRAIN_URL", "http://127.0.0.1:8309").rstrip("/"),"AKIAABCDEFGHIJKLMNOP ghp_abcdefghijklmnopqrstuvwxyz\x00"
delete_lock
.ai-team-sync.toml.example
digest = hashlib.sha1(str(result.get("content") or "").encode()).hexdigest()[:12]@pytest.mark.parametrize("path", ["../etc/passwd", "src/../../x", "src/../src/a.py", f"{ROOT}/src/a.py",spoofed = httpx.get(f"http://127.0.0.1:{port}/who",raw = bytes.fromhex(addr_hex)
ws, @types/node, @types/vscode, @types/ws, typescript, @vscode/vsce
endpoint, `X-ATS-Session-Id` / `X-ATS-Agent` headers and `POST /api/presence`
config/hook mounts read-only; no host credentials, SSH agent, devices/GPU,
Gates applied: no_behavioural_pass.
5367dd07a19bfull audit observations/trust-audit/mcp-server/pvestal__ai-team-sync.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 5367dd07a19b | BLOCK | D | 69 | first audit |
Questions
What is the ai-team-sync MCP server?
Coordinate multiple AI coding agents (Claude Code, Cursor, Codex) on one repo — declared sessions, file scope locks (advisory/exclusive), and shared decisions, surfaced in VS Code, a browser dashboard, a CLI, and natively via MCP.
What tools does ai-team-sync expose?
23 in total: 18 read-only, 4 that write, and 1 that can delete or overwrite (delete_lock). Every one is listed on this page with its risk.
Is ai-team-sync safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does ai-team-sync need?
It reads ATS_APPROVAL_TOKEN and CURSOR_ADMISSION_AUTHORIZED from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ai-team-sync run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as ai-team-sync at 0.3.0.
How current is this page?
The grade is for one exact copy of the source (5367dd07a19b), read on 2026-10-12. The repository is watched and re-audited when it changes.