nomoreideBLOCK
AI-native service workbench: MCP server + shared daemon for Claude Code, Codex, and Gemini. CLI, TUI, and web dashboard for running services, logs, git, and databases.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The AI-native terminal workbench for the post-IDE development loop.
[](https://www.npmjs.com/package/nomoreide) [](https://www.npmjs.com/package/nomoreide) [](https://github.com/Rorogogogo/nomoreide/stargazers) [](LICENSE) [](https://nodejs.org) [](https://modelcontextprotocol.io)
Give your coding agents and yourself a shared local control surface for services, ports, logs, Git review, GitHub workflows, database work, and MCP workflows — no IDE required.
Product Tour · Download for macOS · MCP Setup · CLI Reference · Architecture
Documentation reviewed for NoMoreIDE v0.1.99 in August 2026. The canonical human and AI references are at nomoreide.com/docs.
Product Tour
An AI-native workbench connects agents, Git, services, GitHub Actions, and Vercel into one development workflow — no IDE required. Use the interface yourself or let agents use MCP tools to manage services, operate Git, read logs, and inspect
9888f12e5404OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add nomoreide --env STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY} -- npx -y [email protected]{
"mcpServers": {
"nomoreide": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"STRIPE_SECRET_KEY": "${STRIPE_SECRET_KEY}"
}
}
}
}Exposed tools (9)
8 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Described | read | why |
backup-claude | read | Snapshot of Claude Code before the last bulk change |
base | read | The one that gets published. |
beta | read | The beta plugin. |
dev-kit | read | Original description |
fullstack-dev | write | GitHub + Linear + docs MCPs with the commit-push skill |
list_services | read | List configured local services and their runtime state. |
nomoreide | read | AI-native local development workbench: services, logs, Git, databases and agent environments, over MCP, CLI, TUI and a web dashboard. |
snapshot-demo | read | Demo snapshot |
Trust audit
BLOCKgrade F · trust 33/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (17 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
"ghp_abcdefghijklmnopqrstuvwxyz0123",
"xoxb-1234567890-abcdefghij",
"sending bearer sk_live_abcdefghijklmnop",
placeholder="jobjourney-prod (an alias from ~/.ssh/config)"
placeholder="prod (an alias from ~/.ssh/config)"
"servers.emptyBody": "Add a host alias or create an explicit Host entry in ~/.ssh/config.",
"Install ssh-copy-id or add your public key to the remote ~/.ssh/authorized_keys file manually.",
"servers.security": "Credentials stay in ~/.ssh/config and ssh-agent. NoMoreIDE stores aliases and display metadata only.",
"http://169.254.169.254/latest/meta-data",
// A URL with credentials in it — `postgres://user:pw@host`.
{ name: "pg", engine: "postgres", url: "postgres://user:[email protected]:1/none" },"DATABASE_URL=postgres://user:envpassword@localhost:5432/api",
icon.icns
_runner.cpython-314.pyc
agent-env-sweep.cpython-314.pyc
context-sweep.cpython-314.pyc
database-catalog-sweep.cpython-314.pyc
return development ? "http://127.0.0.1:4317" : location.origin;
const inspectUrl = inspector.port ? `http://127.0.0.1:${inspector.port}` : undefined;return `http://127.0.0.1:${port}`;"/api": "http://127.0.0.1:4317",
url: "postgres://demo_user:demo_password@localhost:5432/app",
{ key: "DATABASE_URL", value: "postgres://demo_user:demo_password@localhost:5432/app", secret: true },vercel: { source: "stored", token: "vercel-fixture-token" },cloudflare: { source: "stored", token: "cloudflare-fixture-token" },Gates applied: critical_finding, no_behavioural_pass.
9888f12e5404full audit observations/trust-audit/mcp-server/rorogogogo__nomoreide.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 9888f12e5404 | BLOCK | F | 33 | first audit |
Questions
What is the nomoreide MCP server?
AI-native service workbench: MCP server + shared daemon for Claude Code, Codex, and Gemini. CLI, TUI, and web dashboard for running services, logs, git, and databases.
What tools does nomoreide expose?
9 in total: 8 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is nomoreide safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (33/100) and found 12 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does nomoreide need?
It reads STRIPE_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does nomoreide run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as nomoreide at 0.20.5.
How current is this page?
The grade is for one exact copy of the source (9888f12e5404), read on 2026-10-10. The repository is watched and re-audited when it changes.