Atlas / MCP servers / sinameraji / kimiflare

kimiflareBLOCK

Name: kimiflare
Author: sinameraji

mcp/sinameraji/kimiflare

MCP server by sinameraji · agents · ai · harness · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Autopilot (previously Kimiflare) is an open source harness inspired by claude code. works with open router

Verdict

BLOCK

Grade

Trust score

51 /100

Exposed tools

83 69r · 11w · 3d

Transport

—

License

MIT

Stars

177

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

autopilot (formerly kimiflare)

= 20">

A terminal coding agent that runs any model on OpenRouter with your own key. One key, 400+ models, per-turn billed cost.

How it works

autopilot sends every model call to [OpenRouter](https://openrouter.ai) using your own OpenRouter API key — bring-your-own-key, nothing proxied, nothing marked up. On first run you paste the key once (it's checked against OpenRouter before it's saved) and pick a model. That's the whole setup.

Any model, one key. The model picker is OpenRouter's live catalog — Claude, GPT, Gemini, Grok, Qwen, GLM, Kimi, DeepSeek, free models and more — opening on the best & latest by benchmark score, with fuzzy search over everything. Switch any time with /model.
Real cost, per turn. OpenRouter

Read from source at commit bcd81423b58bOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add kimiflare-remote-agent --env API_TOKEN=${API_TOKEN} --env ARTIFACTS_TOKEN=${ARTIFACTS_TOKEN} --env CF_API_TOKEN=${CF_API_TOKEN} --env CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "kimiflare-remote-agent": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "API_TOKEN": "${API_TOKEN}",
        "ARTIFACTS_TOKEN": "${ARTIFACTS_TOKEN}",
        "CF_API_TOKEN": "${CF_API_TOKEN}",
        "CLOUDFLARE_API_TOKEN": "${CLOUDFLARE_API_TOKEN}"
      }
    }
  }
}

Exposed tools (83)

69 read · 11 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Auto`	read	Autonomous — auto-approves every tool call (use with care)
`Bash`	read	Bash shell script support
`CSS`	read	CSS/SCSS/Less language support
`Custom`	read	Enter your own language server command
`Dockerfile`	read	Dockerfile language support
`ESLint`	read	JavaScript/TypeScript linting
`Edit`	write	Default mode — prompts for permission before mutating tools
`Go`	read	Go language server (gopls)
`HTML`	read	HTML language support
`JSON`	read	JSON language support
`Lua`	read	Lua language support
`Plan`	read	Read-only research — blocks writes/edits/mutating bash
`Rust`	read	Rust analyzer for Rust code
`TypeScript`	read	TypeScript and JavaScript support
`YAML`	read	YAML language support
`agents`	read	Browse background agents and jobs
`bash`	write	Run a shell command. On Unix the default shell is bash; on Windows it falls back to cmd.exe. Prompts the user for permission before executing. stdout and stderr are captured and combined. Large outputs are reduced to a compact summary by default; use expand_artifact to retrieve the full log.
`browser_fetch`	read	Fetch a URL using a headless Chromium browser via Playwright.
`changelog_image`	read	Generate a beautiful changelog image for a GitHub repository.
`checkpoints`	read	List checkpoints in current session
`clear`	destructive	Clear current conversation
`compact`	read	Summarize old turns to free context
`counted_action`	read	side effect
`do_thing`	read	Does a thing
`echo`	read	test
`edit`	write	Replace an exact string in a file. If replace_all is false (default), the old_string must appear exactly once or the call fails. Prompts the user for permission first and shows a diff preview.
`execute_code`	write	Write and execute TypeScript code to accomplish your task.\n\n
`exit`	read	Exit autopilot (formerly kimiflare)
`expand_artifact`	read	Retrieve the full raw content of a previously reduced tool output by its artifact ID. Use this when the compact summary is insufficient and you need the complete original output.
`fake_action`	read	test action
`fake_failure`	read	test failure
`fix`	read	Quick fixer
`fresh`	write	Start a fresh session with a summarized plan or continuation context
`get_secret_number`	read	Returns the secret number. Always call this when asked for the secret number.
`github_create_pr`	write	Create a pull request on GitHub. Provide the owner, repo, title, and the head branch
`github_list_merged_prs`	read	List merged pull requests for a repository within the last N days.
`github_list_releases`	read	List recent GitHub releases for a repository.
`github_read_code`	read	Read file contents from a GitHub repository at a specific path and optional ref (branch, tag, or commit SHA).
`github_read_issue`	read	Read a GitHub issue by owner, repo, and issue number. Returns title, body, state, author,
`github_read_pr`	read	Read a GitHub pull request by owner, repo, and PR number. Returns title, body, state, author,
`glob`	read	Find files matching a glob pattern (e.g.
`good`	read	Rate the last turn as good (recorded in the local session trace)
`grep`	read	Search file contents for a regular expression. Shells out to ripgrep if available, otherwise uses a JavaScript fallback. Output is capped at 30KB.
`guarded`	read	Needs permission.
`hello`	write	Send a voice note to the creator
`help`	read	Show keybindings and command list
`init`	write	Scan repo and write AGENTS.md
`job_cancel`	read	Cancel a running background job by sending SIGTERM, then SIGKILL if needed, to its entire process group. Completed jobs are left unchanged.
`job_logs`	read	Read a background job
`job_status`	read	Get the durable status of one background job, or list recent jobs in this working directory. Startup reconciliation uses wrapper exit files and PID plus process start-time checks; an ambiguous job is reported as unknown and never relaunched.
`jobs`	read	Browse background jobs and agents
`logout`	destructive	Clear stored credentials
`lsp_codeAction`	read	Get available quick fixes or refactorings for a diagnostic range.
`lsp_definition`	read	Go to definition.
`lsp_diagnostics`	read	Get current errors, warnings, and hints for a file.
`lsp_documentSymbols`	read	List all symbols defined in a file (classes, functions, variables).
`lsp_hover`	read	Show type signature and documentation for a symbol at a file:line:column.
`lsp_implementation`	read	Find implementations of an interface or abstract method.
`lsp_references`	read	Find all references to a symbol across the workspace.
`lsp_rename`	write	Rename a symbol and return the workspace edits.
`lsp_typeDefinition`	read	Jump to the type definition of a symbol.
`lsp_workspaceSymbol`	read	Search symbols across the entire workspace by name.
`memory`	read	Manage memory
`memory_forget`	read	Mark a memory as forgotten. Use when the user explicitly says something is no longer true
`memory_recall`	read	Search your cross-session memory for relevant context.
`memory_remember`	read	Store a persistent fact, instruction, or preference for future sessions.
`model`	read	Show current model
`n`	read	d
`now`	write	Run your latest queued message now instead of after the current turn
`probe`	read	Test probe.
`read`	read	Read a file.
`resume`	read	Pick a past conversation to resume
`review`	read	Review changes
`search_web`	read	Search the web using DuckDuckGo. Returns a list of results with titles, URLs, and snippets.
`ship`	read	Ship it
`skill`	read	desc
`spawn_worker`	read	fake isolated worker
`subagent`	read	delegate
`test-skill`	read	A test skill
`update`	write	Check for updates
`wait_for`	read	wait
`web_fetch`	read	Fetch a web page.
`write`	destructive	Create a file or overwrite an existing one with the given contents. Prompts the user for permission first and shows a diff preview.

Trust audit

BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (2 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/commands/renderer.ts:21

/^\.netrc$/,

Why it matters. touches a credential store

MEDIUMInventory / provenance · inv.binary · CWE-1104

feedback-worker/.wrangler/state/v3/cache/miniflare-CacheObject/metadata.sqlite

metadata.sqlite

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

feedback-worker/.wrangler/state/v3/cache/miniflare-CacheObject/metadata.sqlite-shm

metadata.sqlite-shm

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

feedback-worker/.wrangler/state/v3/cache/miniflare-CacheObject/metadata.sqlite-wal

metadata.sqlite-wal

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.symlink · CWE-1104

camouflage-tui

camouflage-tui

Why it matters. link not followed

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

src/index.tsx:123

console.log(created.token);

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

src/models/openrouter-oauth.ts:49

if (opts.callbackUrl) params.set("callback_url", opts.callbackUrl);

MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321

src/server/aster-tools.test.ts:40

"sk-ant-api03-AbCdEf0123456789GhIjKl_mnOpQr",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/cost-attribution/reconcile.test.ts:56

apiKey: "sk-or-test-key-123456",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/server/hotcell-provider.test.ts:15

apiKey: "control-plane-test-key",

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

src/trace/redact.test.ts:21

const pem = "-----BEGIN RSA PRIVATE KEY-----\nMIIEow\nAAAA\n-----END RSA PRIVATE KEY-----";

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

src/trace/redact.test.ts:23

const plain = "-----BEGIN PRIVATE KEY-----\nabc\n-----END PRIVATE KEY-----";

MEDIUMPrompt injection · review.instruction_override · CWE-94, CWE-1427

<tool:get_secret_number>

Returns the secret number. Always call this when asked for the secret number.

Why it matters. A tool description embedded in the package instructs the agent to always call it when asked for a secret number, overriding the agent's normal judgment about when to disclose or retrieve secrets.

Fix. rewrite it so the instruction says plainly what it does, and asks the user before it acts

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

clear, logout, write

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.release-please-manifest.json

.release-please-manifest.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/eval/workspace.ts:45

const slug = `${repo.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(-60)}-${createHash("sha1").update(repo).digest("hex").slice(0, 8)}`;

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/commands/renderer.test.ts:107

const result = await renderCommand(cmd("@~/.ssh/id_rsa", { files: true }), "");

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/commands/renderer.test.ts:171

it("blocks id_rsa secret file pattern even with files: true", async () => {

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/commands/renderer.test.ts:173

await writeIn(dir, "id_rsa", "KEY");

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/commands/renderer.test.ts:174

const result = await renderCommand(cmd("@id_rsa", { files: true }), "", { cwd: dir });

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

evals/tasks/autopilot-bench/files/hotcell-chunked-control-writes/src/server/aster-cell-runtime.test.ts:455

for (const path of ["../etc/passwd", "/etc/passwd", ".git/config", "a/../../b", "", "x\ny"]) {

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

evals/tasks/autopilot-bench/files/hotcell-migrate-runtime-bundles/src/server/aster-cell-runtime.test.ts:495

for (const path of ["../etc/passwd", "/etc/passwd", ".git/config", "a/../../b", "", "x\ny"]) {

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

remote/agent/src/remote-agent.ts:11

import { runAgentTurn } from "../../../src/agent/loop.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

remote/agent/src/remote-agent.ts:12

import { buildSystemPrompt } from "../../../src/agent/system-prompt.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

remote/agent/src/remote-agent.ts:13

import { ToolExecutor, ALL_TOOLS } from "../../../src/tools/executor.js";

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha bcd81423b58bfull audit observations/trust-audit/mcp-server/sinameraji__kimiflare.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-12	`bcd81423b58b`	BLOCK	F	51	first audit

Questions

What is the kimiflare MCP server?

Autopilot (previously Kimiflare) is an open source harness inspired by claude code. works with open router

What tools does kimiflare expose?

83 in total: 69 read-only, 11 that write, and 3 that can delete or overwrite (clear, logout, write). Every one is listed on this page with its risk.

Is kimiflare safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (51/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does kimiflare need?

It reads API_TOKEN, ARTIFACTS_TOKEN, CF_API_TOKEN, CLOUDFLARE_API_TOKEN, GH_TOKEN, GITHUB_TOKEN, KIMIFLARE_API_KEY, KIMIFLARE_COAUTHOR, KIMIFLARE_COAUTHOR_EMAIL, KIMIFLARE_COAUTHOR_NAME, KIMIFLARE_OPENROUTER_KEY and KIMIFLARE_SERVER_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (bcd81423b58b), read on 2026-10-12. The repository is watched and re-audited when it changes.

Source	sinameraji/kimiflare
npm	`kimiflare-remote-agent@0.1.0`
Credentials it reads	`API_TOKENARTIFACTS_TOKENCF_API_TOKENCLOUDFLARE_API_TOKENGH_TOKENGITHUB_TOKENKIMIFLARE_API_KEYKIMIFLARE_COAUTHORKIMIFLARE_COAUTHOR_EMAILKIMIFLARE_COAUTHOR_NAMEKIMIFLARE_OPENROUTER_KEYKIMIFLARE_SERVER_PASSWORD`
License	MIT
Activity	pushed 0d ago