Atlas / MCP servers / rex-codebase / fable-mode

fable-modeBLOCK

Name: fable-mode
Author: rex-codebase

mcp/rex-codebase/fable-mode

MCP server by rex-codebase · ai agents · ai safety · coding agents · Audited 2026-10-09

Open-source MCP control plane for AI coding agents: mechanical time-locks, evidence-gated proof receipts, red-team remediation, and persistent engineering memory.

Verdict

BLOCK

Grade

Trust score

68 /100

Exposed tools

—

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Agents that think before they write.

Fable Mode is an open-source control plane for AI coding agents.

It makes an agent deliberate, produce evidence, and survive adversarial review before it earns permission to write to your workspace. The gates are mechanical, not prompt advice: no timer, no proof, no write access.

Demo

KERR // ORRERY

One self-contained HTML file. Raw WebGL, zero libraries, zero external assets, and zero build step.

https://github.com/user-attachments/assets/8287bbfe-e3ee-4dcf-ba0f-f9ff22ae79bd

7 renders rejected before final · 2 bugs caught · 10/10 red-team probes passed

Fable Mode overview

https://github.com/user-attachments/assets/27f4f8a2-b1bb-4398-a08c-bc9fd93d69d7

Quick start

A session starts locked. Confidence does not unlock it.

Install the MCP server using one of the options below.
Add the optional Agent Skill if you want the full workflow.
Ask your agent to use Fable Mode for a concrete coding task and choose a time budget.

A new session starts with execution locked:

{
"action": "crea

Read from source at commit a2fcfacc4b9cOBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (pypi)

claude mcp add fable-engine -- uvx fable-engine==1.3.9

Trust audit

BLOCKgrade D · trust 68/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (6 observation(s))
Shell: declared (2 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (18)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

fable_v2/coder_fleet/sandbox_executor.py:267

exec(compile(str(init.get("source", "")), "<fable-sandbox-target>", "exec"), namespace)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

run_tests.py:83

issues.append(f"{path}:{node.lineno}: Prohibited call to eval()")

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

fable_engine/scrapers/base.py:51

if str(ip) == "169.254.169.254":

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

LOWInventory / provenance · inv.hidden_file · CWE-1104

.coderabbit.yaml

.coderabbit.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

fable_compressor.py:239

data = f"Thread-{thread_id} iteration {j}: payload content {hashlib.md5(f'{thread_id}-{j}'.encode()).hexdigest()}"

LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59

tests/test_packaging_runtime.py:50

os.symlink("/etc/passwd", source / "fable_mode" / "__init__.py")

LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319

tests/test_scrapers.py:55

"http://169.254.169.254/latest/meta-data/",

Why it matters. cloud metadata endpoint: the classic SSRF credential grab