Atlas / MCP servers / stanislavbg / claude-code-session-manager

claude-code-session-managerBLOCK

Name: claude-code-session-manager
Author: stanislavbg

mcp/stanislavbg/claude-code-session-manager

MCP server by stanislavbg · ai agents · anthropic · claude · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Local cockpit for Claude Code CLI sessions — schedule routines, monitor token budget, manage long-running plans

Verdict

BLOCK

Grade

Trust score

40 /100

Exposed tools

79 70r · 8w · 1d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Local cockpit for the Claude Code CLI — multi-tab terminal, configuration surface, scheduler, voice dictation, and live observability, all in one Electron desktop app.

The 30-second pitch

You already use the claude CLI. This wraps it in a cockpit so you can run multiple sessions at once, edit every config file Claude Code reads, queue overnight work as PRDs, talk to it with your microphone, and watch transcripts in real time — without ever leaving the window.

New tabs open as a lightweight chat box and stay dormant — no PTY, no claude process — until you actually send a message, so a window full of tabs costs almost nothing. Prefer a single bare terminal? Launch with --simple.

Single-author hobby project. Linux and macOS only. Free, MIT, anonymous opt-out telemetry (see Privacy).

Features tour

Dormant tabs + chat box — every new tab opens as a chat box and stays dormant (no PTY, no claude process) until you send the first message. The headless chat-run engine drives it through claude -p with stream-json, session resume, and a stop signal, so a tab is a real conversation without holding a live terminal open. Hydrate into a full terminal whenever you need one.
Simple mode — npx claude-code-session-manager@latest --simple boots a chrome-free, single-terminal cockpit: no nav, no tabs, no config surface, just one claude session in the launch directory.
Cmd-K command palette — commands organised into bands (session, voice, scheduler, config, nav). Fuzzy filter, emit-only dispatch so commands stay decoupled from views.
Sidebar groups — the left nav is organised into three groups: Workspace (where you do the work), Configure (how Claude behaves), and Tools (one-off utilities).
Scheduler / PRD queue — PRDs live under /session-manager-operations/scheduler/epics//prds/ and the scheduler picks them up as headless claude -p jobs. Author them through the `sch

Read from source at commit 94e3af245357OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add app --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET} --env MAX_THINKING_TOKENS=${MAX_THINKING_TOKENS} --env RELAY_SECRET=${RELAY_SECRET} -- npx -y @session-manager/[email protected]

claude-desktop

{
  "mcpServers": {
    "app": {
      "command": "npx",
      "args": [
        "-y",
        "@session-manager/[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "GOOGLE_CLIENT_SECRET": "${GOOGLE_CLIENT_SECRET}",
        "MAX_THINKING_TOKENS": "${MAX_THINKING_TOKENS}",
        "RELAY_SECRET": "${RELAY_SECRET}"
      }
    }
  }
}

Exposed tools (79)

70 read · 8 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`AWS`	read	AWS services access and best-practice guidance
`Cloudflare`	read	Manage Cloudflare Workers, KV, R2, D1, and Workers AI
`Context7`	read	Up-to-date version-specific library docs injected into prompts
`DOCX`	write	Create and edit Microsoft Word documents
`Debugger`	read	Diagnose a failing test or runtime error from a stack trace
`Everything`	read	Reference/test server with prompts, resources, and tools
`Fetch`	read	Web content fetching and conversion for efficient LLM usage
`Filesystem`	read	Secure file operations with configurable access controls
`Git`	read	Tools to read, search, and manipulate Git repositories
`GitHub`	read	Official GitHub repository, issues, and PR management
`GitLab`	write	GitLab API integration for projects, issues, and merge requests
`Hexagonal`	read	Organizes code around ports and adapters.
`Hookify`	read	Utilities and templates for authoring Claude Code hooks
`Linear`	read	Issue tracking and project management for Linear
`Memory`	read	Knowledge graph-based persistent memory system
`Notion`	read	Notion workspace page and database management
`Obsidian`	read	Read and search notes in an Obsidian vault
`PDF`	write	Create, edit, and extract content from PDF documents
`PPTX`	write	Create and edit PowerPoint presentations
`Perplexity`	read	Answer-engine search with deep research and reasoning
`Playwright`	read	Cross-browser automation for navigation, screenshots, and data extraction
`PostgreSQL`	read	Read-only database access with schema inspection
`Puppeteer`	read	Browser automation and web scraping via Puppeteer
`Read-only`	read	Research / analysis only — no edits, no bash, no writes
`Redis`	read	Interact with Redis key-value stores
`Refactorer`	read	Propose structural refactors without changing behavior
`SQLite`	read	Database interaction and business intelligence over SQLite
`Sandboxed`	read	Block writes outside cwd; allow reads everywhere; deny network and sudo
`Security-paranoid`	read	Treat every input as hostile; never trust external data
`Sentry`	read	Retrieve and analyze Sentry error tracking issues
`Slack`	read	Channel management and messaging for Slack workspaces
`Socratic`	read	Ask clarifying questions before implementing anything ambiguous
`Strict`	read	Deny all network + dangerous bash; ask before edits; no auto-accept
`Stripe`	read	Payment processing, customers, and invoices via Stripe API
`Supabase`	read	Manage Supabase projects, tables, and SQL queries
`TDD-first`	write	Write a failing test before any production code change
`Tavily`	read	AI-optimized web search with clean structured results
`Terse`	read	One-sentence answers, minimal preamble, no summaries
`Time`	read	Time and timezone conversion capabilities
`XLSX`	write	Create and edit Excel spreadsheets with formulas and formatting
`YAGNI`	read	Builds only what is needed right now.
`architect`	read	Owns overall plan and decomposition.
`asana`	read	Asana task and project ops.
`atlassian`	read	Jira / Confluence search and updates.
`builder`	write	Drives the next publish.
`carry-agent`	read	d
`clangd-lsp`	read	C/C++ diagnostics via clangd. Requires clangd on $PATH.
`clear-agent`	destructive	d
`code-reviewer`	read	Reviews diffs for correctness and style.
`csharp-lsp`	read	C# diagnostics. Requires OmniSharp or Roslyn LSP on $PATH.
`debugger`	read	Diagnoses failures.
`dev-lead`	read	d
`figma`	read	Figma file inspection for UI work.
`firebase`	read	Firebase project + Firestore ops.
`fresh-agent`	read	A new persona.
`github`	read	GitHub PRs, issues, gh-style flows.
`gitlab`	read	GitLab MRs, issues, pipelines.
`jdtls-lsp`	read	Java diagnostics via Eclipse JDT LS. Requires jdtls on $PATH.
`kotlin-lsp`	read	Kotlin diagnostics. Requires kotlin-language-server on $PATH.
`linear`	read	Linear issue tracking — pairs with the Tasks tab.
`lua-lsp`	read	Lua diagnostics. Requires lua-language-server on $PATH.
`minimal-agent`	read
`my-agent`	read	Does a thing.
`new-agent`	read
`new.md`	read	A short description
`notion`	read	Notion document lookup and edits.
`p`	read	d
`page-alpha`	read	Steward for Alpha
`php-lsp`	read	PHP diagnostics. Requires intelephense or phpactor on $PATH.
`pinned-model-agent`	read	Pinned to a concrete model id outside the standard list.
`project-home-builder`	read	Generates pages.
`rich`	read	Has every optional field.
`scout`	read	Looks around.
`sentry`	read	Sentry bug triage and event lookup.
`slack`	read	Slack DM / channel posting from agents.
`stamped-agent`	read	Edited via the UI.
`supabase`	read	Supabase database operations.
`swift-lsp`	read	Swift diagnostics via sourcekit-lsp. Requires sourcekit-lsp on $PATH.
`vercel`	write	Vercel deploy diagnostics.

Trust audit

BLOCKgrade F · trust 40/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (9 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.stripe · CWE-798, CWE-321

web/remote-app/src/App.tsx:16

'pk_live_Y2xlcmsuYmlsa28ucnVuJA';

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/main/lib/feedback-remote/projectHomeAdminRoutes.cjs:62

{ re: /\beval\s*\(/i, message: 'eval(...) is not allowed' },

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/main/files.cjs:50

throw new Error('Write inside ~/.ssh denied');

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/renderer/data/catalog.ts:224

{ id: 'block-secret-writes', name: 'Block Writes to Secrets', description: 'Deny edits to .env, credentials, key files', event: 'PreToolUse', matcher: 'Write|Edit', command: `path=$(jq -r '.tool_input

Why it matters. touches a credential store

MEDIUMInventory / provenance · inv.binary · CWE-1104

src/main/promptSessionTranscript.cjs

promptSessionTranscript.cjs

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

web/promo-video/vo/cameo-bot-check-1.wav

cameo-bot-check-1.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

web/promo-video/vo/cameo-bot-check-2.wav

cameo-bot-check-2.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

web/promo-video/vo/cameo-bot-check-3.wav

cameo-bot-check-3.wav

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

scripts/scheduler-mcp-server.cjs:109

res = await fetch(`http://127.0.0.1:${port}${urlPath}`, {

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/main/lib/feedback-remote/__tests__/customerFeedbackInbox.test.cjs:14

const TOKEN = 'sekrit-owner-token-123';

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

clear-agent

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

src/main/__tests__/promptSessionTranscript.test.cjs

promptSessionTranscript.test.cjs

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.ignore

.ignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.suspicious_name · CWE-1104

src/main/__tests__/scheduler-heartbeat-payload.test.cjs

scheduler-heartbeat-payload.test.cjs

Why it matters. member named after an attack tool

Fix. remove or justify

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/main/__tests__/projectHomeAdminRoutes.test.cjs:253

['Function(', `<html><head><meta name="sm-demo-duration" content="10"></head><body><script>new Function("return 1")()</script></body></html>`],

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/main/lib/git/gitWorktree.cjs:310

return crypto.createHash('sha1').update(input).digest('hex').slice(0, 16);

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/main/lib/scheduler/definitionOfDone.cjs:43

.createHash('sha1')

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/main/__tests__/files-reject-credentials.test.cjs:20

test('denies writes anywhere inside ~/.ssh (keys, authorized_keys, config)', () => {

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/main/__tests__/files-reject-credentials.test.cjs:21

for (const p of ['authorized_keys', 'authorized_keys2', 'id_ed25519', 'config']) {

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/main/__tests__/files-reject-credentials.test.cjs:22

assert.throws(() => rejectCredentials(under('.ssh', p)), /\.ssh denied/, `~/.ssh/${p} should be denied`);

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/__tests__/check-epic-transcripts.test.cjs:13

const { encodeCwd } = require('../../src/main/lib/util/encodeCwd.cjs');

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/__tests__/move-modules.test.cjs:19

[`${L}/alpha.cjs`]: "const b = require('./beta.cjs')\nconst c = require('./gamma')\nconst p = require('../../../package.json')\nmodule.exports = { b, c, p }\n",

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/__tests__/move-modules.test.cjs:59

expect(read(`${L}/core/alpha.cjs`)).toContain("require('../../../../package.json')");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/__tests__/move-modules.test.cjs:62

expect(read(`${L}/core/__tests__/alpha.test.cjs`)).toContain("require('../../gamma.cjs')");

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/__tests__/package-files.test.cjs:57

const { GUARD_NAMES } = require('../../src/main/lib/guardShims.cjs');

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 94e3af245357full audit observations/trust-audit/mcp-server/stanislavbg__claude-code-session-manager.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-12	`94e3af245357`	BLOCK	F	40	first audit

Questions

What is the claude-code-session-manager MCP server?

Local cockpit for Claude Code CLI sessions — schedule routines, monitor token budget, manage long-running plans

What tools does claude-code-session-manager expose?

79 in total: 70 read-only, 8 that write, and 1 that can delete or overwrite (clear-agent). Every one is listed on this page with its risk.

Is claude-code-session-manager safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (40/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does claude-code-session-manager need?

It reads ANTHROPIC_API_KEY, GOOGLE_CLIENT_SECRET, MAX_THINKING_TOKENS, RELAY_SECRET, SM_ADMIN_TOKEN_PATH, SM_BEACON_KEY and SM_GATE_AUTHORITATIVE_DISABLE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does claude-code-session-manager run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @session-manager/app at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (94e3af245357), read on 2026-10-12. The repository is watched and re-audited when it changes.

Source	StanislavBG/claude-code-session-manager
npm	`@session-manager/app@0.1.0`
Transports	streamable-http
Credentials it reads	`ANTHROPIC_API_KEYGOOGLE_CLIENT_SECRETMAX_THINKING_TOKENSRELAY_SECRETSM_ADMIN_TOKEN_PATHSM_BEACON_KEYSM_GATE_AUTHORITATIVE_DISABLE`
License	MIT
Activity	pushed 0d ago