runxBLOCK
the governed runtime for agent skill workflows, off the leash but on the record
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
runx
the governed runtime for agent skills
a skill is a URL. a graph is what unfolds. authority narrows. it does not pass through. every act produces a receipt.
A skill is expertise published as a portable SKILL.md: an operating manual that a human can understand and an agent can act from. Skills compose into graphs and real work without bespoke glue code. Runx supplies the boundary: it admits each act under explicit authority, delivers credentials without turning them into prompt material, supervises execution, and seals the result into a verifiable receipt.
Authority narrows through the chain, so agent work compounds without becoming ambient trust.
what runx is not
Runx is the governed runtime beneath agents and orchestration tools, not another agent framework. There are no prompt chains or vector stores here, and no model loop runs unless you opt into the managed agent with --managed-agent; runx sits under whatever orchestration layer you already run. Runx admits each act under explicit authority, delivers credentials without turning them into prompt material, supervises execution, and seals the result into a verifiabl
ba3b3e61d1ecOBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add extract --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env NOTES_TOKEN=${NOTES_TOKEN} --env NPM_TOKEN=${NPM_TOKEN} -- npx -y @runxhq/[email protected]{
"mcpServers": {
"extract": {
"command": "npx",
"args": [
"-y",
"@runxhq/[email protected]"
],
"env": {
"GH_TOKEN": "${GH_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"NOTES_TOKEN": "${NOTES_TOKEN}",
"NPM_TOKEN": "${NPM_TOKEN}"
}
}
}
}Exposed tools (34)
30 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
action | read | What happened outside Runx. |
args | read | Optional subcommand arguments placed before the help flag. |
artifact_ref | read | Opaque invocation-scoped reference returned by artifact.admit. |
base | write | Verified Git ref or commit to compare against. |
claim | read | Exact assertion bound into the receipt. |
command | read | Exact executable name or path; no shell expansion is performed. |
contents | write | Exact UTF-8 contents to write. |
cwd | read | Working directory relative to the project root. |
deletes | destructive | Bounded array of relative file paths to delete. |
demo.echo | read | Echo fixture. |
docs_pr | write | Run governed docs work. |
echo | read | Echo a message through the fixture MCP server. |
encoding | read | Page encoding: base64 exact bytes, character-safe utf8, or framed json_array records. |
env | read | Bounded non-secret environment values for the child process. |
evidence | read | Bounded opaque evidence references with digests and proof claims. |
expected_command_digest | read | Optional prior command.plan digest that must match before execution. |
help_flag | read | Help form: --help, -h, or help. |
issue-triage | read | Issue triage skill. |
max_bytes | read | Positive page size; defaults to one MiB and cannot exceed the four MiB runtime ceiling. |
media_type | read | Media type bound into the immutable artifact identity. |
offset | read | Exact byte offset; continue with the prior page |
on_missing | read | Unavailable-file policy: error or report. |
output_mode | read | Captured output projection: digest, text, or one JSON value. |
path | read | Contained relative source path; it is never returned in the artifact reference. |
path_scope | read | Trusted root selection: workspace or the owning skill package. |
paths | read | Up to sixteen distinct relative UTF-8 file paths. |
policy | read | Exact in-memory runx.operational_policy.v1 candidate. |
principal | read | Actor named by the attestation. |
repo_root | read | Workspace-relative root containing the immutable source file. |
resource | read | Resource to inspect. |
runner-rejects-malformed-state | read | Pins the fixture-runner ingestion error envelope for invalid but schema-shaped input; this is not a state-machine decision fixture. |
scope | read | Optional downstream reliance bounds. |
timeout_ms | read | Execution timeout from 1000 to 3600000 milliseconds. |
writes | read | Bounded array of relative-path UTF-8 text writes. |
Trust audit
BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (12 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
If a page cap makes an event window partial, narrow the requested window into disjoint smaller windows, read them under the same selected calendar authority, and merge only complete slices by event in
payload.rs
x402-v2-payment-payload.schema.json
| ".netrc"
| "id_rsa"
| "id_ed25519"
"id_ed25519",
|| normalized == "metadata.google.internal"
"http://169.254.169.254",
"http://metadata.google.internal",
"http://127.0.0.1:18081/v1/chat/completions",
"http://127.0.0.1:18081/v1/chat/completions"
Sessions::default().open(&transport, "https://127.0.0.1/mcp", None, &BTreeMap::new());
let secret = "never-print-this-secret";
let secret = "never-debug-this-secret";
let secret = "ghs_observation_secret_must_not_leak";
: jsonResponse({ token: "anonymous-pull-token" });const SECRET: &str = "ghs_cli_local_provision_secret_value";
let secret = "ghs_observation_secret_must_not_leak";
deletes
official-payment-payload.json
let docs = include_str!("../../../../docs/cli-exit-codes.md");const CORPUS_ROOT: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/../../fixtures/receipt-verify");include_str!("../../../fixtures/registry/install/echo-SKILL.md"),include_str!("../../../fixtures/registry/install/echo-run.yaml"),Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
ba3b3e61d1ecfull audit observations/trust-audit/mcp-server/runxhq__runx.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | ba3b3e61d1ec | BLOCK | F | 40 | first audit |
Questions
What is the runx MCP server?
the governed runtime for agent skill workflows, off the leash but on the record
What tools does runx expose?
34 in total: 30 read-only, 3 that write, and 1 that can delete or overwrite (deletes). Every one is listed on this page with its risk.
Is runx safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (40/100) and found 10 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does runx need?
It reads GH_TOKEN, GITHUB_TOKEN, NOTES_TOKEN, NPM_TOKEN and TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does runx run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @runxhq/extract at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (ba3b3e61d1ec), read on 2026-10-14. The repository is watched and re-audited when it changes.