Atlas / MCP servers / shrec / AIWorkHub

AIWorkHubBLOCK

Name: AIWorkHub
Author: shrec

mcp/shrec/aiworkhub

MCP server by shrec · agent orchestration · ai coding agents · claude code · Audited 2026-10-10

Open-source, local-first control plane for multi-model AI coding agents in VS Code and MCP: task DAGs, source intelligence, durable context and evidence-based review.

Verdict

BLOCK

Grade

Trust score

44 /100

Exposed tools

165 106r · 56w · 3d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The open-source control plane for multi-model AI coding agents. Plan work, delegate it to coding models, preserve project context and accept changes only when the evidence passes.

AIWorkHub is an open-source, local-first multi-model AI coding agent orchestrator for VS Code and MCP. It coordinates Codex, Claude, Copilot, DeepSeek and GLM workers through dependency-aware task graphs, durable project memory, source-code intelligence and evidence-based review. Each Git repository remains an isolated AI engineering workspace; no AIWorkHub cloud account or HTTP service is required. Visit the AIWorkHub product site or follow the getting-started guide.

The whole system

Read from source at commit e66b56bc4fd2OBSERVED · 2026-10-10

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add aiworkhub --env AIWORKHUB_CLAUDE_AUTH_STATE_FILE=${AIWORKHUB_CLAUDE_AUTH_STATE_FILE} --env AIWORKHUB_MANAGER_SEAT_TOKEN=${AIWORKHUB_MANAGER_SEAT_TOKEN} --env AIWORKHUB_SECRET_PROBE=${AIWORKHUB_SECRET_PROBE} --env AIWORKHUB_TOOLCHAIN_AUTHORITY_HMAC_KEY=${AIWORKHUB_TOOLCHAIN_AUTHORITY_HMAC_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "aiworkhub": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AIWORKHUB_CLAUDE_AUTH_STATE_FILE": "${AIWORKHUB_CLAUDE_AUTH_STATE_FILE}",
        "AIWORKHUB_MANAGER_SEAT_TOKEN": "${AIWORKHUB_MANAGER_SEAT_TOKEN}",
        "AIWORKHUB_SECRET_PROBE": "${AIWORKHUB_SECRET_PROBE}",
        "AIWORKHUB_TOOLCHAIN_AUTHORITY_HMAC_KEY": "${AIWORKHUB_TOOLCHAIN_AUTHORITY_HMAC_KEY}"
      }
    }
  }
}

Exposed tools (165)

106 read · 56 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`aiworkhub_agent_accept_preview`	read	READ-ONLY: what would block accept_review right now, before any work.
`aiworkhub_agent_collect_result`	read	READ-ONLY: collect bounded worker output and review-readiness evidence.
`aiworkhub_agent_list_processes`	read	READ-ONLY: summarize latest processes; use detail=
`aiworkhub_agent_task_status`	read	READ-ONLY: inspect one launched process and its authoritative task card.
`aiworkhub_claude_callback_ack`	write	WRITE: acknowledge one exact callback batch returned to this same
`aiworkhub_claude_callback_wait`	read	BLOCKING READ/CLAIM: wait for a callback for this verified Claude
`aiworkhub_completion_inbox`	read	READ-ONLY: combined completion-inbox facts for Codex orchestration.
`aiworkhub_contract_consistency_check`	read	READ-ONLY: detect managed provider/worker instruction drift.
`aiworkhub_dashboard_openapi`	read	return {
`aiworkhub_dashboard_snapshot`	read	return {
`aiworkhub_dashboard_static_manifest`	read	return {
`aiworkhub_dispatcher_ensure_started`	read	Idempotently ensure exactly one callback dispatcher is running for
`aiworkhub_dispatcher_health`	read	READ-ONLY: dispatcher running/stopped, selected coordinator target,
`aiworkhub_dispatcher_stop`	write	Stop and unregister the active repository
`aiworkhub_dispatcher_watchdog`	read	Detect and auto-recover a down-but-expected callback dispatcher.
`aiworkhub_environment_preflight`	read	READ-ONLY: unified repository/policy/Source Graph/provider readiness.
`aiworkhub_eval_artifact_gate`	read	READ-ONLY: recompute registered eval verdicts from retained rows.
`aiworkhub_known_bug_scan`	read	READ-ONLY: scan bounded changed paths for known bug patterns.
`aiworkhub_launch_queue_audit_summary_readonly`	read	READ-ONLY: summarize the append-only B119 launch-queue audit JSONL log.
`aiworkhub_launch_queue_describe_readonly`	read	READ-ONLY: describe a launch INTENT via the disabled B119 launch_queue_contract.
`aiworkhub_launch_queue_evaluate_readonly`	read	READ-ONLY: evaluate a launch request via the disabled B119 launch_queue_contract.
`aiworkhub_manager_ai_memory_get`	read	MANAGER READ: exact active canonical AI Memory lookup.
`aiworkhub_manager_ai_memory_related`	read	MANAGER READ: bounded related canonical AI Memory lookup.
`aiworkhub_manager_ai_memory_search`	read	MANAGER READ: bounded canonical AI Memory search.
`aiworkhub_manager_ai_memory_write`	write	MANAGER WRITE: remember, update, supersede, or archive canonical memory.
`aiworkhub_manager_ai_memory_write_intent`	write	Propose a bounded AI Memory mutation for explicit verified-manager disposition.
`aiworkhub_manager_bootstrap`	read	CALL FIRST: mandatory repository manager contract and callback workflow.
`aiworkhub_manager_context_graph_event_write`	write	MANAGER WRITE: append one exact current-thread conversation event.
`aiworkhub_manager_context_graph_range`	read	MANAGER READ: retrieve an exact bounded transcript range around one event.
`aiworkhub_manager_context_graph_rebuild`	write	MANAGER WRITE: rebuild derived graph state from the immutable ledger.
`aiworkhub_manager_context_graph_related`	read	MANAGER READ: retrieve bounded deterministic relations for one graph node.
`aiworkhub_manager_context_graph_search`	read	MANAGER READ: search exact transcript-backed Context Graph evidence.
`aiworkhub_manager_context_import`	write	MANAGER: dry-run, apply or rollback one explicit repo-local legacy context store.
`aiworkhub_manager_context_write_intent_dispose`	write	MANAGER WRITE: explicitly accept or reject one worker proposal.
`aiworkhub_manager_context_write_intents`	write	MANAGER READ: inspect authenticated worker context-write proposals.
`aiworkhub_manager_kb_get`	read	MANAGER READ: exact canonical KB entry lookup.
`aiworkhub_manager_kb_related`	read	MANAGER READ: bounded canonical KB relation lookup.
`aiworkhub_manager_kb_search`	read	MANAGER READ: bounded canonical KB search.
`aiworkhub_manager_kb_write`	write	MANAGER WRITE: upsert, ingest, supersede, or archive canonical KB data.
`aiworkhub_manager_kb_write_intent`	write	Propose a bounded KB mutation for explicit verified-manager disposition.
`aiworkhub_manager_learning_commit`	write	MANAGER WRITE: persist and project one verified Learning Commit.
`aiworkhub_manager_loop_close`	write	MANAGER WRITE: release the backend and lock at shutdown, without a model turn.
`aiworkhub_manager_loop_continue`	write	MANAGER WRITE: continue one saved manager conversation.
`aiworkhub_manager_loop_discard`	destructive	MANAGER WRITE: delete one saved manager conversation.
`aiworkhub_manager_loop_ensure`	write	MANAGER WRITE: attach to the repository
`aiworkhub_manager_loop_events`	read	MANAGER READ: bounded session events, for incremental client polling.
`aiworkhub_manager_loop_new`	write	MANAGER WRITE: close the current conversation and open a fresh passive one.
`aiworkhub_manager_loop_rename`	write	MANAGER WRITE: rename one saved manager conversation.
`aiworkhub_manager_loop_restore`	write	MANAGER WRITE: load the last manager conversation. Does not create one.
`aiworkhub_manager_loop_rotate`	write	MANAGER WRITE: close the session with a handoff, in the background.
`aiworkhub_manager_loop_send`	write	MANAGER WRITE: run one manager turn in the background.
`aiworkhub_manager_loop_start`	write	MANAGER WRITE: open the repository
`aiworkhub_manager_loop_status`	read	MANAGER READ: the active session, whether a turn is running, queued owner sends, and the last turn
`aiworkhub_manager_needfix_draft`	read	READ-ONLY: draft the NeedFixes one request
`aiworkhub_manager_needfix_markdown_commit`	write	MANAGER WRITE: commit an exact Markdown preview as captured items only.
`aiworkhub_manager_needfix_markdown_preview`	read	MANAGER READ: preview bounded captured NeedFix candidates from Markdown.
`aiworkhub_manager_recipe_list`	read	MANAGER READ: bounded identity/contract listing of persisted recipes.
`aiworkhub_manager_recipe_register`	write	MANAGER WRITE: register and persist one caller-defined tool recipe.
`aiworkhub_manager_recipe_run`	write	MANAGER EXECUTE: run one PERSISTED recipe and return a bounded digest.
`aiworkhub_manager_recipe_seed_canonical`	write	MANAGER WRITE: install the catalogue of this repository
`aiworkhub_manager_recipe_seed_plan`	read	MANAGER READ: which catalogue entries THIS project would be seeded.
`aiworkhub_manager_recipe_show`	read	MANAGER READ: one persisted recipe in its exact canonical manifest form.
`aiworkhub_manager_recipe_usage`	read	MANAGER READ: which registered recipes are actually used, and by whom.
`aiworkhub_manager_sdlc_case_create`	write	Create one repository-bound SDLC case under verified manager authority.
`aiworkhub_manager_sdlc_case_create_for_task`	write	Create the SDLC case bound to one canonical task under verified manager authority.
`aiworkhub_manager_sdlc_case_for_task`	read	READ-ONLY: bounded case packet bound to one canonical task, or a typed unknown.
`aiworkhub_manager_sdlc_case_get`	read	READ-ONLY: bounded repository-bound case packet.
`aiworkhub_manager_sdlc_outcome_metrics`	read	READ-ONLY: bounded outcome metrics from canonical task/review events.
`aiworkhub_manager_sdlc_stage_packet`	read	READ-ONLY: one bounded repository-bound stage packet.
`aiworkhub_manager_sdlc_stage_record`	read	Append one bounded stage receipt under verified manager authority.
`aiworkhub_manager_semantic_edit_apply`	write	MANAGER EDIT: replace exactly one prepared, hash-bound range.
`aiworkhub_manager_semantic_edit_prepare`	write	MANAGER EDIT: bind one verified file range before changing it.
`aiworkhub_manager_session_current_state`	read	MANAGER READ: bounded canonical Session Manager current state.
`aiworkhub_manager_session_write`	write	MANAGER WRITE: append one audited canonical Session Manager event.
`aiworkhub_manager_session_write_intent`	write	Propose a bounded Session event for explicit verified-manager disposition; never writes canonical context directly.
`aiworkhub_manager_skill_activate`	write	MANAGER WRITE: activate a proposed skill, evidence-gated and fail-closed.
`aiworkhub_manager_skill_add_evidence`	write	MANAGER WRITE: append one MANAGER evidence entry to a skill version.
`aiworkhub_manager_skill_evidence_sweep`	write	MANAGER WRITE: backfill learning-commit evidence for every recorded commit.
`aiworkhub_manager_skill_mine`	read	MANAGER READ: mine the correction record into gated skill PROPOSALS.
`aiworkhub_manager_skill_propose`	write	MANAGER WRITE: register and persist one proposed skill.
`aiworkhub_manager_skill_retirement_report`	read	MANAGER READ: measure every stored skill against its own failure class.
`aiworkhub_manager_skill_usage`	read	MANAGER READ: per-skill usage statistics, measured from the stored record.
`aiworkhub_manager_source_graph_query`	read	MANAGER CODE DISCOVERY: use first and continuously before built-in file search.
`aiworkhub_manager_task_decomposition_preview`	read	MANAGER READ: validate a Source Graph-grounded child-DAG proposal.
`aiworkhub_manager_workforce_catalog`	read	MANAGER READ: configured models joined to observed canonical outcomes.
`aiworkhub_manager_workforce_rank`	read	MANAGER READ: explainable cheapest-capable routing from current evidence.
`aiworkhub_manager_workforce_upsert`	write	MANAGER WRITE: audited bounded upsert of one repository worker model.
`aiworkhub_prompt_bundle_ab_report`	read	READ-ONLY: evaluate preregistered matched A/B provider-usage rows.
`aiworkhub_quality_calibration_report`	write	READ-ONLY: run the deterministic positive/negative gate matrix.
`aiworkhub_quality_evidence_packet`	read	READ-ONLY: full canonical evidence packet -- profile, declared
`aiworkhub_quality_gate_ratchet`	read	READ-ONLY: report new quality identities and no-net-growth overflow.
`aiworkhub_quality_profile`	read	READ-ONLY: zero-config detected languages/declared/installed tools.
`aiworkhub_quality_run_checks`	write	Run repo-declared .aiworkhub/quality.json build/test/lint/typecheck
`aiworkhub_repo_current`	read	READ-ONLY: exact current repository, binding source, and manager route.
`aiworkhub_repo_list`	read	READ-ONLY: bounded live repository identities available to this manager.
`aiworkhub_repo_switch`	read	MANAGER OPERATION: atomically switch to one live manager-owned repo_id.
`aiworkhub_review_packet`	read	READ-ONLY: ONE bounded review packet for a ``review_ready`` candidate.
`aiworkhub_risk_mode_precision_bench`	read	READ-ONLY: per-mode/language precision from adjudicated registered rows.
`aiworkhub_router_known_repositories`	read	READ-ONLY: bounded shared registry of live AIWorkHub repository routes.
`aiworkhub_runtime_coverage_import`	write	WRITE-GATED: atomically project repo-local coverage into Source Graph.
`aiworkhub_runtime_coverage_preview`	read	READ-ONLY: parse a repo-local coverage.py JSON artifact.
`aiworkhub_session_token_profile`	read	READ-ONLY: observed provider tokens plus separately-labelled prompt bytes.
`aiworkhub_source_graph_ensure_started`	read	Idempotently ensure exactly one Source Graph indexing daemon is
`aiworkhub_source_graph_health`	read	READ-ONLY: Source Graph indexing daemon health for the active
`aiworkhub_source_graph_refresh_now`	destructive	Force one bounded incremental (or first-ever full) Source Graph
`aiworkhub_source_graph_retrieval_eval`	write	READ-ONLY: run registered precision@k/MRR cases through manager MCP wrapper.
`aiworkhub_source_graph_stop`	write	Stop and unregister the active repository
`aiworkhub_storage_recover_stranded_worktrees`	read	Recover retained worktrees stranded outside every reclamation path.
`aiworkhub_suite_profile`	write	Execute one repo-declared quality check repeatedly; shell is never used.
`aiworkhub_supervisor_loop_status`	read	READ-ONLY: derive supervisor_state + error taxonomy for a task_id.
`aiworkhub_task_audit_log_read`	write	Read-only: inspect write-gate audit log summaries.
`aiworkhub_task_auto_pickup_dryrun`	read	READ-ONLY: preview which task auto_pickup WOULD claim for a runner/topic.
`aiworkhub_task_codex_handoff`	read	READ-ONLY: Codex-ready HANDOFF report for review-queue tasks.
`aiworkhub_task_codex_handoff_markdown`	read	READ-ONLY: Codex-ready HANDOFF report rendered as compact Markdown.
`aiworkhub_task_collision_guard`	write	Run the task collision guard for active cards.
`aiworkhub_task_cost_ledger`	read	READ-ONLY: bounded cost summary, with opt-in detailed dimensions.
`aiworkhub_task_health`	write	Check parent AIWorkHub task queue health and write-gate state.
`aiworkhub_task_list`	read	List task cards by status and optional topic.
`aiworkhub_task_pending_for_runner`	read	Return pending cards for a specific runner as raw output plus parsed JSONL rows.
`aiworkhub_task_plan_snapshot`	read	READ-ONLY: bounded Plan-DAG summary, or the complete DAG with ``full``.
`aiworkhub_task_queue_request`	write	WRITE-GATED: append a disabled launch-queue request.
`aiworkhub_task_review_queue`	read	List tasks waiting for Codex review.
`aiworkhub_task_review_summarize`	read	READ-ONLY: Inspect review queue, group tasks by topic/runner, return Codex review checklist.
`aiworkhub_task_show`	read	Show a single task card by task_id.
`aiworkhub_task_stale_recovery_recommend`	read	READ-ONLY: recommend recovery actions for stale processing tasks.
`aiworkhub_task_template_list`	read	MANAGER READ: list the bounded repository-bound template registry.
`aiworkhub_task_template_show`	read	MANAGER READ: show one exact short or full template ID, fail closed.
`aiworkhub_task_usage_report`	read	Return task usage report, optionally filtered.
`aiworkhub_vscode_lm_worker_tool`	write	PRIVATE BRIDGE: execute one active GLM call with worker-scoped audit authority.
`aiworkhub_worker_ai_memory_get`	read	Bounded AI Memory exact-key lookup.
`aiworkhub_worker_ai_memory_related`	read	Bounded AI Memory related-entry lookup.
`aiworkhub_worker_ai_memory_search`	read	Bounded AI Memory search.
`aiworkhub_worker_ai_memory_write_intent`	write	Submit a bounded AI Memory proposal for explicit manager review.
`aiworkhub_worker_kb_get`	read	Bounded KB exact-key lookup.
`aiworkhub_worker_kb_related`	read	Bounded KB related-entries lookup.
`aiworkhub_worker_kb_search`	read	Bounded KB full-text search.
`aiworkhub_worker_kb_write_intent`	write	Submit a bounded KB proposal for explicit manager review.
`aiworkhub_worker_quality_review_submit`	write	Submit findings for the exact bound anti-anchored packet.
`aiworkhub_worker_semantic_edit_apply`	write	Apply replacement-only code to an immutable prepared target.
`aiworkhub_worker_semantic_edit_exception_declare`	write	Record a path changed WITHOUT the semantic editor, and why.
`aiworkhub_worker_semantic_edit_prepare`	write	Bind one Source Graph-selected line range
`aiworkhub_worker_session_current_state`	read	Bounded Session Manager current-state for this task
`aiworkhub_worker_session_write_intent`	write	Submit a bounded Session proposal for explicit manager review.
`aiworkhub_worker_source_graph_query`	read	Bounded Source Graph discovery for this task.
`handle_late`	read	return True
`handle_status`	read	return True
`needfix_archive`	read	Explicitly archive (soft, audited, restorable) a NeedFix.
`needfix_convert`	write	Commit the exact previewed workforce-bound task conversion.
`needfix_count`	read	Bounded count of NeedFix entries.
`needfix_events`	read	List events for a NeedFix entry.
`needfix_link_existing_task`	read	Manager-only: atomically link a NeedFix to an existing, finished, accepted task.
`needfix_list`	read	List repo-scoped NeedFix entries (bounded).
`needfix_preview_convert`	read	Preview an explicit workforce-bound task conversion.
`needfix_purge`	destructive	Audited hard delete of an already-archived NeedFix.
`needfix_reopen_superseded_task_link`	read	Manager-only: reopen a NeedFix whose exact linked task was superseded.
`needfix_restore`	read	Explicitly restore an archived NeedFix.
`needfix_show`	read	Show one NeedFix by id.
`roadmap_add`	write	Manager-only Roadmap proposal; does not create or launch a task.
`roadmap_events`	read	List bounded audit events for one Roadmap outcome.
`roadmap_link_task`	read	Link one existing canonical task to a Roadmap outcome.
`roadmap_list`	read	List bounded repository Roadmap outcomes.
`roadmap_show`	read	Show one Roadmap outcome.
`roadmap_snapshot`	read	Join bounded Roadmap outcomes to canonical Task-DAG lifecycle.
`roadmap_transition`	read	Manager-only guarded Roadmap lifecycle transition.
`status`	read	return True

Trust audit

BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (5 observation(s))
Shell: declared (6 observation(s))
Dependencies: pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

src/aiworkhub/known_bug_scanner.py:118

"warning", "deserialization", "unserialize() requires a trusted-type boundary"),

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/aiworkhub/known_bug_scanner.py:86

re.compile(r"\beval\s*\("), "warning", "code_injection", "eval() requires a trusted-input proof"),

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/aiworkhub/known_bug_scanner.py:116

"warning", "code_injection", "eval() requires a trusted-input proof"),

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.binary · CWE-1104

.aiworkhub/kb/knowledge.sqlite

knowledge.sqlite

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

.aiworkhub/tasking/roadmap.sqlite

roadmap.sqlite

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

.aiworkhub/tasking/skills.sqlite

skills.sqlite

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

.aiworkhub/tasking/tool_recipes.sqlite

tool_recipes.sqlite

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/aiworkhub/declared_invariants.py:147

module = __import__(f"aiworkhub.{module_name}", fromlist=[module_name])

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/aiworkhub/worker_workspace.py:3625

opencode_auth = __import__(qualified, fromlist=["project_opencode_auth"])

MEDIUMObfuscation / stealth · obf.anti_debug · CWE-506, CWE-94

src/aiworkhub/worker_workspace.py:441

"ptrace",

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

tests/test_terminal_collect_truth.py:1394

"AKIAABCDEFGHIJKLMNOP",

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

tests/test_terminal_collect_truth.py:1402

"aws_access_key_id=AKIAABCDEFGHIJKLMNOP "