Atlas / MCP servers / spitfire-products / nexus-cortex

nexus-cortexBLOCK

Name: nexus-cortex
Author: spitfire-products

mcp/spitfire-products/nexus-cortex

MCP server by spitfire-products · agent framework · ai · ai agent · Audited 2026-10-12

A headless, multi-provider AI agent harness — embed it as a library, script it from the CLI, or run it as a stateful agent server. One orchestrator drives every major LLM provider.

Verdict

BLOCK

Grade

Trust score

57 /100

Exposed tools

149 114r · 29w · 6d

Transport

streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A headless, multi-provider AI agent harness — embed it as a library, script it from the CLI, or run it as a stateful agent server.

[](https://www.npmjs.com/package/@nexus-cortex/cli) [](./LICENSE) [](https://nodejs.org)

Nexus Cortex is the engine underneath the agent — not another interactive terminal app, but the harness you build on. One orchestrator drives many models across many providers through a pluggable adapter layer, with sub-agents, MCP, sandboxed artifacts, a permission engine, context management, and append-only session history built in.

Run it three ways: as a library (import { CortexOrchestrator }), as a headless CLI (cortex "..."), or as a stateful HTTP agent server.

Release 1 is the headless harness — core, executors, server, cli. The interactive React/Ink terminal UIs (@nexus-cortex/tui) land in Release 2.

Driving it from your own agent harness? Cortex is built to run as an autonomous sub-agent that another agent configures and prompts headlessly — often more precisely than a human at a UI can. The bundled `cortex-subagent` skill is the operational formula: the three headless entry points, the config levers worth setting, how to write a self-contained autonomous brief, budgets, and orchestrator-side verification.

Quick Start

npm install -g nexus-cortex

That puts the cortex command on your PATH. Now give it one provider key — three ways, pick whichever fits:

# 1. Set a key in the global config file (created for you automatically)
cortex config set DEEPSEEK_API_KEY sk-...        # w

Read from source at commit c326587c44b3OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add types --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_METHOD=${ANTHROPIC_AUTH_METHOD} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} --env CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN} -- npx -y @nexus-cortex/[email protected]

claude-desktop

{
  "mcpServers": {
    "types": {
      "command": "npx",
      "args": [
        "-y",
        "@nexus-cortex/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_AUTH_METHOD": "${ANTHROPIC_AUTH_METHOD}",
        "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}",
        "CLAUDE_CODE_OAUTH_TOKEN": "${CLAUDE_CODE_OAUTH_TOKEN}"
      }
    }
  }
}

Exposed tools (149)

114 read · 29 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`AddonTool1`	read	test
`AddonTool2`	read	test
`AskForAdvice`	read	Consult a senior engineer for a hint when stuck.
`AskUserQuestion`	read	Present structured multiple-choice questions to the user. Use to gather preferences, clarify ambiguous instructions, get decisions on implementation choices, or offer direction options. Users can always select
`Bash`	write	Run a shell command.
`BashOutput`	read	Retrieve output from a running or completed background bash shell started with run_in_background: true. - Returns only NEW output since your last check (incremental reads) - Shows process status: Running or Exited with exit code - Use filter to search output with regex (e.g., filter:
`CanonPullSession`	read	Materialize one canon-store session into the local session directory — the cross-harness
`CodeExecute`	write	Execute JavaScript code for token-efficient tool chaining. Only console.log() output enters the context window. Write code that calls multiple tools in sequence, processes results, and outputs only what matters. Top-level await supported.
`ComplexTool`	read	A complex tool
`ConfigureMcpServer`	write	Update configuration for an existing MCP server (args, env, timeout, auto-start, etc.). Server will need to reconnect for changes to take effect.
`CreateArtifactTool`	write	Create artifacts in ANY language with flexible execution - the ultimate workspace for self-development and validation. NOTE:
`DisableMcpServer`	write	Disable an MCP server by setting its status to disabled in MCP_CONFIG.md. This disconnects the server and removes its tools from availability.
`Edit`	write	edit
`EnableMcpServer`	write	Enable an MCP server by adding it to MCP_CONFIG.md. This makes the server\
`GetConversationSegment`	read	Retrieve a specific segment of conversation history at different detail levels
`GetMcpConfig`	read	Get current MCP configuration showing enabled servers, their settings, connection status, and available tools. Use this to see what MCP servers are currently configured.
`Glob`	read	Find files matching a pattern. BEST PRACTICES: - Accept user
`Grep`	write	Search for patterns in files using grep. SEARCH STRATEGY — start narrow, broaden only on zero results: 1. First grep: exact string, current directory, no flags. If matches appear, Read those files — do not keep searching. 2. Match file types to the project language. TypeScript repo → glob:
`InitMcpConfig`	read	Analyzes the current project and creates a tailored MCP_CONFIG.md with recommended MCP servers based on detected project characteristics (Node.js, Python, database, etc.)
`KillShell`	write	Stop a running background bash shell by its ID. Use when a background process hangs, takes too long, or is no longer needed. The shell ID is the same bash_id returned by Bash with run_in_background: true.
`ListAvailableMcpServers`	read	List all MCP servers available in the community registry with their descriptions, capabilities, and requirements. Use this to discover what tools are available to enable.
`ListCompactionBoundaries`	read	List all compaction boundaries (conversation summaries) with IDs
`ListSessions`	read	List all available conversation sessions with metadata for discovery
`LoadSession`	read	Load messages from a specific previous session to access full conversation context
`MemoryRecall`	read	Load a memory\
`NotebookEdit`	write	Edit Jupyter notebook (.ipynb) cells. Supports replacing, inserting, or deleting cells. Read the notebook first to get cell IDs.
`PRAgent`	write	Manage GitHub pull requests — review, create, list, and post reviews. MODES: - review: Fetch a PR
`Read`	read	read
`ReadFile`	read	Read a file from the filesystem
`ReadImage`	read	Load an image file (PNG, JPEG, GIF, or WebP) so you can SEE it. Vision-capable models get the image attached as visual input on the next message; text-only models get an exact transcription/description from the vision helper (the image is read on your behalf — pass \
`RequestHistoricalContext`	read	Request historical context using cheap helper model. Cost-effective for accessing archived context.
`SandboxComponentTree`	read	Return the React component hierarchy of a running sandbox (host elements collapsed, components only). Equivalent to a DevTools-style component-tree view. WHEN TO USE: understand a React artifact
`SandboxRenderTrace`	read	Trace React re-renders in a running sandbox — react-scan
`SandboxTransfer`	write	Run a command in a remote sandbox (via MCP run_command) and save its stdout to a local file. Use for transferring PDFs, images, or data generated in the sandbox to the local filesystem.
`SearchConversationHistory`	read	Search through conversation history including compacted boundaries
`SearchMcpServers`	read	Search for MCP servers by capability, keyword, or get recommendations for project type. Use this to find specific servers that meet your needs.
`SearchTools`	read	Search the tool registry to discover available tools by name, description, or category. Use when you need a capability not in the current tool list — deferred tool loading means not all tools are immediately visible. Query forms: keyword search (
`Skill`	write	List or invoke specialized skills. Skills are text instruction files that provide step-by-step guidance for specific tasks. Use command
`SlashCommand`	write	Execute a registered slash command. Slash commands are user-defined or built-in shortcuts invoked with /name syntax. Only invoke commands that are listed as available — do not guess or invent command names.
`Task`	read	Launch a sub-agent or list available agents. Use subagent_type
`TestTool`	read	Test tool
`TodoCreate`	write	Create a task for tracking multi-step work. All start as pending. Follow lifecycle: TodoUpdate(in_progress) -> work -> TodoUpdate(completed).
`TodoList`	read	List all tasks with their current status. Use to check progress, find task IDs, or review what is pending.
`TodoUpdate`	write	Update task status or details by ID. Lifecycle: in_progress before work, completed after. Batch: comma-separated IDs (e.g.,
`ValidTool`	read	ok
`WebFetch`	read	Fetch and read content from a specific URL. Returns the page
`Write`	destructive	Writes a file to the local filesystem. This tool will overwrite the existing file if there is one at the provided path. If this is an existing file, you MUST use the Read tool first to read the file
`WriteFile`	write	Write file contents
`WriteFileContents`	read	Test
`aa`	read	old desc
`abort-test`	read	Test abort
`already_snake_case`	read	Test
`api-server`	read	Persistent API server
`auth`	read	Authenticate with GitHub
`bad-category`	read	test
`bad-tool`	read
`bash`	write	run
`browse-agent`	read	test
`calculate`	read	Performs basic arithmetic calculations
`clear`	destructive	Clear memory/context
`code_execution`	write	Execute Python code for calculations and analysis
`code_interpreter`	write	Execute Python code in a sandboxed container
`complex_tool`	read	A complex tool
`config`	read	Open interactive configuration menu
`connect`	read	Connect to IDE
`custom-linter`	read	Custom code linter
`deps-tool`	read	Tool with dependencies
`disable`	write	Disable an MCP server
`disconnect`	read	Disconnect from IDE
`docker-sandbox-tool`	read	Tool with Docker sandbox
`edit`	write	Edit profile settings
`enable`	write	Enable an MCP server
`explore`	read	test agent
`failing-tool`	read	Tool with intentional error
`file_search`	read	Retrieve relevant chunks from pre-uploaded vector stores
`format-test`	read	Test output formatting
`general-purpose`	read	Complex multi-step tasks, code generation, research — any task.
`get`	read	Get configuration value
`get_weather`	read	Get weather for a location
`gone`	read	d
`grant`	read	Grant permission to a tool or path
`hello-world`	read	A simple hello world script
`history`	read	Show chat history
`image_generation`	read	Generate images from a text prompt
`info`	read	Show current session info
`install`	write	Install an extension
`js-calculator`	read	Simple calculator
`list_files`	read	List files in a directory
`local-sandbox-tool`	read	Tool with local sandbox
`login`	read	Login or switch authentication
`logout`	destructive	Clear authentication
`mentorship`	read	AI-to-AI mentorship system
`metadata-tool`	read	Test metadata
`metrics`	read	Show cache metrics
`model`	read	Show model usage statistics
`multiline-tool`	read	Tool with multiline code
`new`	write	Start a new chat session
`nexus-browser__browse`	read	MCP tool
`nexus-browser__wait_for_challenge_resolution`	read	MCP tool
`no-deps-tool`	read	Tool without dependencies
`no-tests-tool`	read	Tool without tests
`ok`	read
`persist-a`	read	Persist A
`persist-tool`	read	Persistent
`persistent-tool`	read	Persistent tool
`picker`	read	Open visual model selection dialog
`py-calculator`	read	Python calculator
`py-json-tool`	read	JSON manipulation tool
`readFileContents`	read	Read file
`read__file`	read	Test
`read_file`	read	Read a file from the filesystem
`read_file_v2`	read	Test
`removable`	read	Will be removed
`repo`	read	Configure repository settings
`report`	read	Generate cache report
`reset`	destructive	Reset all settings to benchmark-proven optimal defaults (preserves API keys)
`resume`	read	Resume from a checkpoint
`revoke`	destructive	Revoke permission
`search_history`	read	Search conversation history
`session`	read	Show session statistics
`set`	write	Interactive browser, or /config set <key> <value> for direct set
`setup`	write	Run terminal setup wizard
`show`	read	Show current directory
`sim-monitor`	read	long-running monitor
`special-chars-tool`	read	Tool with special characters
`status`	read	Show MCP server status
`temp-a`	read	Temp A
`temp-tool`	read	Temporary
`test`	read	test
`test-server`	read	Test server for auth module
`test-tool`	read
`test_tool`	read	Test tool
`test_tool_one`	read	First test tool for format validation
`test_tool_two`	read	Second test tool for format validation
`tested-tool`	read	Tool with tests
`timing-tool`	read	Test timing
`tool_name`	read	Invalid tool
`tools`	read	Show tool usage statistics
`uninstall`	destructive	Uninstall an extension
`unique-tool`	read	First
`unknown_tool`	read	Unknown server-side tool
`update`	write	Update extensions
`valid_tool_name`	read	Valid tool
`web-app`	read	Interactive web application
`web_search`	read	Search the web for information
`writeFile`	read	Test
`write_file_contents`	write	Test
`x`	read	Test
`x_search`	read	Search X (Twitter)

Trust audit

BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (8 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/core/src/orchestrator/HerdrSubAgentRunner.ts:257

const call = (args: string[], timeoutMs = EXEC_GRACE_MS) => exec(bin!, [...sessionArgs, ...args], { timeoutMs, env });

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

packages/cli/bin/cortex.js:457

'.env' ... fetch(

Why it matters. reads secrets in the same file that sends data out

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/canon/src/canonCognition.ts

canonCognition.ts

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/core/src/adapters/servedModelDrift.ts

servedModelDrift.ts

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/core/src/orchestrator/APIClient.ts:3843

if (process.env.DEBUG === 'true') console.log(`[DEBUG APIClient SDK] Token usage: ${JSON.stringify(lastChunk.usageMetadata)}`);

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

packages/core/src/orchestrator/CortexOrchestrator.ts:7964

console.log(` Token reduction: ${currentTokens} -> ${newTokenCount} tokens (removed ${currentTokens - newTokenCount})`);

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

packages/cli/src/commands/autoresearch/loop.ts:100

'hallucinated APIs, contains unsafe operations or anything resembling a backdoor or exfiltration, ' +

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/core/src/config/__tests__/subscription-token-gate.test.ts:26

const API_KEY = 'sk-ant-api03-FAKE-KEY';

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

Write, clear, logout, reset, revoke, uninstall

Why it matters. 6 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.env.defaults

.env.defaults

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose