ModelsAtlas
Explore
Atlas / MCP servers / solomon2773 / Nora

NoraBLOCK

mcp/solomon2773/nora
MCP server by solomon2773 · agent management · agent ops · agent orchestration · Audited 2026-10-08
⚑ Report / re-scanSource ↗

Open-source, self-hosted control plane for OpenClaw and Hermes AI-agent fleets on Docker/Kubernetes — REST, CLI, and MCP.

Verdict
BLOCK
Grade
F
Trust score
28 /100
Exposed tools
40 32r · 7w · 1d
Transport
stdio
License
Apache-2.0
Stars
57
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Nora Run OpenClaw and Hermes fleets on your own infrastructure — from one control plane.

OpenClaw + Hermes · Docker + Kubernetes GA · 69 provider connections · Apache-2.0

📚 Documentation · Self-Hosting · Architecture · How Nora Compares

Read from source at commit 13bbfde7fb78OBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add mcp-server --env NORA_API_KEY=${NORA_API_KEY} -- npx -y @noraai/[email protected]
03

Exposed tools (40)

32 read · 7 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
1passwordreadManage 1Password vaults.
1password-originalreadOriginal description.
AdminreadPlatform-administrator diagnostics.
AgentswriteAgent lifecycle: deploy, start/stop, versions.
AlertsreadWorkspace alert rules and delivery tests.
AuthreadSession endpoints (JWT + HttpOnly cookie).
BackupswriteAgent backup, schedule, download, and copy-restore flows.
BudgetsreadPer-agent LLM spend caps with auto-pause.
ChannelsreadAgent communication-channel configuration and actions.
GitHubreadManage issues.
HermesreadHermes-runtime specific operations.
IntegrationsreadIntegration catalog and agent credentials/tools.
MonitoringreadMetrics, events, cost, and the fleet roll-up.
PresetreadOperations preset
SchedulesreadRecurring cron triggers for agent prompts and lifecycle actions.
Snapshotreadtest
Testreadtest
WorkspacesreadWorkspace metadata, members, invitations, and agents.
X-Agent-Hub-Api-KeyreadInstallation key (
delete_agentdestructive
deploy_agentwrite
gateway_native_toolreadNative gateway tool.
get_agentread
get_agent_costread
get_agent_metricsread
get_agent_metrics_summaryread
get_agent_statsread
get_agent_versionsread
get_fleet_statusread
get_platform_metricsread
github_list_repositoriesreadList repositories.
k8sreadOperate Kubernetes clusters.
list_agentsread
list_monitoring_eventsread
notionwriteRead and write Notion pages.
redeploy_agentread
restart_agentwrite
skill-0readSkill number 0.
start_agentwrite
stop_agentwrite
04

Trust audit

BLOCKgrade F · trust 28/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (9 observation(s))
Network
declared (7 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94
backend-api/hermesUi.ts:634
b64decode( ... `exec(
Why it matters. decodes a payload and executes it
CRITICALObfuscation / stealth · obf.decode_then_exec · CWE-506, CWE-94
workers/provisioner/worker.ts:1497
b64decode( ... `exec(
Why it matters. decodes a payload and executes it
CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321
admin-dashboard/components/remote-hosts/RemoteHostConfigForm.tsx:272
: "-----BEGIN OPENSSH PRIVATE KEY-----"
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
backend-api/hermesUi.ts:634
`exec(base64.b64decode(${JSON.stringify(encoded)}).decode('utf-8'), __nora_globals)`,
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
workers/provisioner/worker.ts:1497
`exec(base64.b64decode(${JSON.stringify(encoded)}).decode('utf-8'), __nora_globals)`,
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
cli/src/commands/login.js:33
console.log(`Token:     ${token.slice(0, 16)}...`);
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
backend-api/agentPayloads.ts:228
- Never exfiltrate secrets or take destructive actions without approval.`;
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
.env.test:20
NEXTAUTH_URL=http://127.0.0.1:18080
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
.env.test:32
CORS_ORIGINS=http://127.0.0.1:18080,http://localhost:18080
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
agent-runtime/lib/server.ts:467
const gatewayUrl = `http://127.0.0.1:${GATEWAY_PORT}/v1/chat`;
MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321
e2e/scripts/capture-operator-screenshots.mts:1228
apiKey: "sk-ant-demo-abcdef1234567890",
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
.github/workflows/ci-compose.yml:78
TEST_POSTGRES_URL: postgres://nora:[email protected]:5432/nora_migration_test
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
backend-api/__tests__/agentHubHermes.test.ts:540
apiKey: "sk-secret-camel-000000",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
backend-api/__tests__/agentHubHermes.test.ts:541
api_key: "sk-secret-snake-000000",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
backend-api/__tests__/agentHubSafety.test.ts:174
{ line: 'api_key: "live_production_secret_key_8888"', label: "api_key colon string" },
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
backend-api/__tests__/agentHubSafety.test.ts:175
{ line: "apiKey = 'live_production_secret_key_8888'", label: "apiKey equals string" },
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
backend-api/__tests__/gatewayProxy.test.ts:927
token = "gateway-token-v2-with-a-different-length";
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
backend-api/__tests__/agentHubSafety.test.ts:96
"-----BEGIN PRIVATE KEY-----",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
backend-api/__tests__/agentHubSafety.test.ts:97
"-----BEGIN RSA PRIVATE KEY-----",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
backend-api/__tests__/agentHubSafety.test.ts:98
"-----BEGIN EC PRIVATE KEY-----",
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
backend-api/__tests__/agentHubSafety.test.ts:99
"-----BEGIN OPENSSH PRIVATE KEY-----",
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
docs/api/integrations.mdx:227
-d '{"provider":"slack","token":"xoxb-your-slack-bot-token","config":{"channel":"#alerts"}}'
MEDIUMHard-coded secrets · secret.slack · CWE-798, CWE-321
e2e/scripts/capture-operator-screenshots.mts:2198
'xoxb-readme-redacted',
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
delete_agent
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.codex
.codex
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 13bbfde7fb78full audit observations/trust-audit/mcp-server/solomon2773__nora.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-0813bbfde7fb78BLOCKF28first audit
06

Questions

What is the Nora MCP server?

Open-source, self-hosted control plane for OpenClaw and Hermes AI-agent fleets on Docker/Kubernetes — REST, CLI, and MCP.

What tools does Nora expose?

40 in total: 32 read-only, 7 that write, and 1 that can delete or overwrite (delete_agent). Every one is listed on this page with its risk.

Is Nora safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (28/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Nora need?

It reads AUTH_RATE_LIMIT_MAX, AUTH_RATE_LIMIT_WINDOW_MS, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, COST_PER_1K_TOKENS, DEFAULT_ADMIN_PASSWORD, EMAIL_ACCESS_TOKEN, EMAIL_PASSWORD, ENCRYPTION_KEY, GITHUB_CLIENT_SECRET and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Nora run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as platform-api at 0.1.4.

How current is this page?

The grade is for one exact copy of the source (13bbfde7fb78), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement