Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

Refact MCP server

by smallcloudai/refactBSD-3-Clause licenceAudited 22 Sep 2026 · source 7f8594f70b4a

npm refact-chat-js 8.0.4stdiostreamable-http★ 3,541
✕BLOCKGrade F · 37/100 · 22 Sep 2026 · 7f8594f
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (37/100). It exposes 12 tools: 8 read, 3 write and 1 destructive. The audit recorded 48 findings (2 critical, 7 high, 16 medium, 18 low). Maintainer's description: AI Agent that handles engineering tasks end-to-end: integrates with developers’ tools, plans, executes, and iterates until it achieves a successful result.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Refact MCP server (smallcloudai/refact)”. Retrieved 22 Sep 2026. https://modelsatlas.com/mcp/smallcloudai/refact

Why this is BLOCK. The audit found 2 critical and 7 high findings; the most severe is Hard-coded secrets at refact-agent/engine/src/buddy/user_activity.rs:355. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 22 Sep 2026

Trust score37/100✕BLOCK F
2 critical7 high16 medium18 low5 info

48 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared11 observations
  • NetworkDeclared13 observations
  • ShellDeclared6 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (48)

Sorted by severity · the 25 most severe of 48 are listed

CRITICALHard-coded secretssecret.aws · refact-agent/engine/src/buddy/user_activity.rs:355
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
CRITICALHard-coded secretssecret.aws · refact-agent/engine/src/buddy/user_activity.rs:361
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
HIGHCode injectioncode.eval_exec · plugins/vscode/assets/hl.min.js:133
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
}),!0),this.lastIndex=0}exec(e){this.matcherRe.lastIndex=this.lastIndex
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · plugins/vscode/assets/hl.min.js:143
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
this.rules.push([e,n]),"begin"===n.type&&this.count++}exec(e){
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · refact-agent/engine/src/integrations/integr_cmdline.rs:683
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
fn exec(message: &ChatMessage) -> &Value {
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · refact-agent/engine/src/integrations/integr_cmdline.rs:776
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
let exec = exec(&message);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · refact-agent/engine/src/integrations/integr_cmdline.rs:816
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
let exec = exec(&message);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHNetwork egressnet.tls_off · plugins/vscode/src/launchRust.ts:120
F-04 Network egressCWE-200 · CWE-319Layer L1
new_cmdline.push("--insecure");
Why
certificate verification is disabled
Fix
leave verification on
HIGHHard-coded secretssecret.db_uri · refact-agent/engine/src/yaml_configs/mcp_marketplace_index.json:1683
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMInventory / provenanceinv.binary · plugins/intellij/gradle/wrapper/gradle-wrapper.jar
F-13 Inventory / provenanceCWE-1104Layer L0
gradle-wrapper.jar
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMNetwork egressnet.beacon_words · refact-agent/gui/src/features/Buddy/buddyWorldDirector.ts:436
F-04 Network egressCWE-200 · CWE-319Layer L1
speech: "Snack beacon detected.",
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · plugins/intellij/src/main/kotlin/com/smallcloud/refactai/lsp/LSPProcessHolder.kt:432
F-04 Network egressCWE-200 · CWE-319Layer L1
val startupUrl = URI("http://127.0.0.1:${newConfig.port}/")
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · plugins/intellij/src/main/kotlin/com/smallcloud/refactai/lsp/LSPProcessHolder.kt:576
F-04 Network egressCWE-200 · CWE-319Layer L1
InferenceGlobalContext.connection.get(URI("http://127.0.0.1:$port/v1/graceful-shutdown")).get()?.get()
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · plugins/intellij/src/main/kotlin/com/smallcloud/refactai/lsp/LSPProcessHolder.kt:652
F-04 Network egressCWE-200 · CWE-319Layer L1
return URI("http://127.0.0.1:${debugPort}/")
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · refact-agent/gui/src/__fixtures__/chat.ts:888
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"/9j/4AAQSkZJRgABAQAAAQABAAD/4gHYSUNDX1BST0ZJTEUAAQEAAAHIAAAAAAQwAABtbnRyUkdCIFhZWiAH4AABAAEAAAAAAABhY3NwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA9tYAAQAAAADTLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · refact-agent/gui/src/__fixtures__/some_chrome_screenshots.ts:63
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"/9j/4AAQSkZJRgABAgAAAQABAAD/wAARCAGYAyADAREAAhEBAxEB/9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/9sAQwEJCQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjI
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · refact-agent/gui/src/__fixtures__/some_chrome_screenshots.ts:68
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"/9j/4AAQSkZJRgABAgAAAQABAAD/wAARCAMfAXEDAREAAhEBAxEB/9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/9sAQwEJCQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjI
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · refact-agent/gui/src/__fixtures__/some_chrome_screenshots.ts:181
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"/9j/4AAQSkZJRgABAgAAAQABAAD/wAARCAGYAyADAREAAhEBAxEB/9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/9sAQwEJCQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjI
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.base64_blob · refact-agent/gui/src/__fixtures__/some_chrome_screenshots.ts:198
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"/9j/4AAQSkZJRgABAgAAAQABAAD/wAARCAMfAXEDAREAAhEBAxEB/9sAQwAIBgYHBgUIBwcHCQkICgwUDQwLCwwZEhMPFB0aHx4dGhwcICQuJyAiLCMcHCg3KSwwMTQ0NB8nOT04MjwuMzQy/9sAQwEJCQkMCwwYDQ0YMiEcITIyMjIyMjIyMjIyMjIyMjIyMjIyMjI
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.homoglyph · refact-agent/engine/src/buddy/chat_reactions.rs:1635
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
let analysis = "please debug ProjectΔ import while keeping the identifier private";
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.homoglyph · refact-agent/engine/src/buddy/chat_reactions.rs:1636
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
let generated = "Tiny alarm: ProjectΔ import is doing suspicious parkour.";
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.homoglyph · refact-agent/engine/src/buddy/chat_reactions.rs:1641
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
assert!(!text.to_lowercase().contains("projectδ import"));
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · docs/src/components/Search.astro:18
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · refact-agent/engine/src/buddy/tests.rs:1294
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
delete_repo
Why
1 tool(s) can delete or overwrite
Fix
prefer a read-only mode or scoped tokens; the page states the blast radius

Tools it exposes

12 declared in source · 1 destructive

8 read3 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

ToolWhat it doesRisk
delete_repoDelete a repositorydestructive
commit_messageGenerate a commit messagewrite
create_issueCreate a GitHub issuewrite
reviewRun reviewwrite
DefinitionFind definition of a symbol in the project using ASTread
RepositoryRepository contentread
code-reviewReview coderead
existing-skillExistingread
local_skillA local project skillread
my-pluginA useful pluginread
my_skillExisting descriptionread
plugin_skillA plugin skillread

Safer alternatives

All memory & knowledge servers →
Graphiti✓SAFE

getzep/graphiti

Build Real-Time Knowledge Graphs for AI Agents

3 destructiveGrade B
Needle✓SAFE

needle-ai/needle-mcp

Needle MCP Server for easy RAG.Long-term memory for LLMs.

2 writeGrade B
Apple Notes✓SAFE

rafalwilinski/mcp-apple-notes

Talk with your notes in Claude. RAG over your Apple Notes using Model Context Protocol.

2 writeGrade B

Audit history

  1. ✕BLOCK F 37 / 100

    Source changed, verdict held · 7f8594f70b4a

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Refact MCP server

What is the Refact MCP server?
AI Agent that handles engineering tasks end-to-end: integrates with developers’ tools, plans, executes, and iterates until it achieves a successful result.
What tools does Refact expose?
12 in total: 8 read-only, 3 that write, and 1 that can delete or overwrite (delete_repo). Every one is listed on this page with its risk.
Is Refact safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (37/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Refact need?
It reads HF_TOKEN, OPENAI_API_KEY and REFACT_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Refact run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as refact-chat-js at 8.0.4.
How current is this page?
The grade is for one exact copy of the source (7f8594f70b4a), read on 2026-09-22. The repository is watched and re-audited when it changes.
I already installed Refact. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • smallcloudai/refact on GitHub — the source we read, its licence, stars and activityObserved · 22 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 7f8594f70b4aObserved · 22 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.