coworkCAUTION
Multi-Agent Cowork MCP Server — cross-platform AI agent coordination with Web UI Dashboard. Ships as Cowork Pro on Gumroad.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
📬 Get AI tips & prompt templates — subscribe to the Slashman Tools newsletter: https://slashmantools.us/subscribe
## 🛍️ Cowork Pro — the production package The MCP server above is the open-source core. [Cowork Pro ($59)](https://slashmaster6.gumroad.com/l/xfhfps) adds the full production stack: advanced workflows, priority support & lifetime updates. Also included in the [AI Developer Stack Bundle ($79)](https://slashmaster6.gumroad.com/l/nulyms).
A filesystem-based MCP server + Web UI dashboard that enables multi-platform AI agents to coordinate, dispatch tasks, and share results — all through a single pane of glass.
Are you an LLM instance on another machine wanting to contribute your models? See JOIN-AS-A-BRAIN.md — zero-config, it auto-detects your model CLIs (claude/hermes/agy) and declares your brains in the registration handshake: COWORK_URL=http://:6868 HOST= node cowork/deploy/remote-brain-client.mjsScreenshots
One dark-themed single pane of glass for the whole operation: live host metrics (CPU / GPU / memory / temp), open-task and Agencies counters, the dispatcher's current role → model chains, and a real-time activity feed.
The Workflows, Task Inbox, Brains, Connections, and Chat views are shown in context throughout this README.
Supported Platforms
a24683f0fc77OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add cowork-mcp-server --env AGY_ACCESS_TOKEN=${AGY_ACCESS_TOKEN} --env AGY_CLIENT_SECRET=${AGY_CLIENT_SECRET} --env AGY_REFRESH_TOKEN=${AGY_REFRESH_TOKEN} --env AGY_TOKEN_FILE=${AGY_TOKEN_FILE} -- npx -y [email protected]{
"mcpServers": {
"cowork-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AGY_ACCESS_TOKEN": "${AGY_ACCESS_TOKEN}",
"AGY_CLIENT_SECRET": "${AGY_CLIENT_SECRET}",
"AGY_REFRESH_TOKEN": "${AGY_REFRESH_TOKEN}",
"AGY_TOKEN_FILE": "${AGY_TOKEN_FILE}"
}
}
}
}Exposed tools (17)
12 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
claim_task | read | |
complete_task | read | |
create_goal | write | Create a long-lived Goal — an objective driven toward a BINARY (Yes/No) |
create_task | write | Create a cross-platform task. Launches now by default; pass scheduled_at |
deregister_agent | destructive | Remove this worker and every brain it registered (cascading them out of all |
get_dashboard | read | |
get_goal | read | Fetch one Goal by id (phases, decision history, meeting-minutes pointers). |
get_roster | read | |
heartbeat | read | |
list_goals | read | List all Goals (newest first) with status, phases and audit history. |
list_inbox | read | |
obsidian_info | read | Report the shared Obsidian knowledge base: whether it is available, its |
obsidian_list | read | List notes in the shared Obsidian vault (title, vault-relative path, size, |
obsidian_read | read | Read one note from the shared Obsidian vault by its vault-relative path |
obsidian_search | read | Full-text search the shared Obsidian vault. Returns the top matching notes |
register_agent | write | Register this client as a worker and OPTIONALLY declare the models it can run |
update_goal_progress | write | Submit ONE Achiever move for a Goal: evaluate the binary success criterion |
Trust audit
CAUTIONgrade C · trust 78/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (9 observation(s))
- Network
- declared (9 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (23)
<div style="${codeBox}">${esc('curl -sS -X POST http://127.0.0.1:6868/api/workflows \\\n -H \'Content-Type: application/json\' -d @workflow.json\n\n# already exists? re-POST to overwrite:\n# -d \'{secret: 'test-secret-key-for-hmac-signing',
secret: 'test-secret-for-license-signing',
deregister_agent
.gitmodules
const repoTemplate = path.resolve(__dirname, '../../config.json');
exec('git add config.json && git commit -m "chore: update config via web UI" && git push', { cwd: path.resolve(__dirname, '../../') }, (err) => {const rootDir = path.resolve(__dirname, '../../');
export const PORTAL_TEMPLATE = path.resolve(__dirname, '../../../portal.json');
assert.equal(store.inputFilePath(task.id, '../../etc/passwd'), null, 'basename() defeats traversal');
🤝 Cowork MCP Server running at http://0.0.0.0:6868
MCP endpoint: http://0.0.0.0:6868/mcp
Web Dashboard: http://0.0.0.0:6868/
REST API: http://0.0.0.0:6868/api/
@modelcontextprotocol/sdk, drizzle-orm, express, glob, gray-matter, pg, uuid, zod
Two layers. (1) Share *knowledge* of environments: brains declare auto-detected env manifests (paths/tools/secret-names/net) in the existing registration handshake, tasks declare `requires`, and the r
⚠ **RC-1 (corrects the design report)**: the design claimed the payload is "free-form JSON already". **False** — `server/src/mcp/server.ts:62-69` is a closed zod object; an unknown `env` key is silent
## 2. You have full permissions
Agents have **full permissions**. Nothing here is off-limits:
> put output in `$COWORK_ARTIFACTS_DIR`, use your full permissions freely, and ask
2. **You have full permissions** — edit any file, run git, rebuild/restart services,
> put output in `$COWORK_ARTIFACTS_DIR`, use your full permissions freely, and ask
Gates applied: no_behavioural_pass, no_license.
a24683f0fc77full audit observations/trust-audit/mcp-server/slashman413__cowork.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a24683f0fc77 | CAUTION | C | 78 | first audit |
Questions
What is the cowork MCP server?
Multi-Agent Cowork MCP Server — cross-platform AI agent coordination with Web UI Dashboard. Ships as Cowork Pro on Gumroad.
What tools does cowork expose?
17 in total: 12 read-only, 4 that write, and 1 that can delete or overwrite (deregister_agent). Every one is listed on this page with its risk.
Is cowork safe to connect to an agent?
With care. The audit graded it C (78/100) and found 23 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does cowork need?
It reads AGY_ACCESS_TOKEN, AGY_CLIENT_SECRET, AGY_REFRESH_TOKEN, AGY_TOKEN_FILE, COWORK_API_KEY and POSTGRES_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does cowork run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as cowork-mcp-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (a24683f0fc77), read on 2026-10-11. The repository is watched and re-audited when it changes.