NetaBLOCK
A leader agent that delegates to tiered worker agents behind the coding-agent CLI you already use — Claude Code, Codex, or OpenCode.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/sudhanshug16/neta/actions/workflows/ci.yml) [](https://www.npmjs.com/package/@intervene/neta)
Neta is the interface, engine, and machine service for running persistent agent teams across workspaces. You talk to the workspace leader for a workspace on a machine; sustained work becomes missions with mission leads and agents, isolated in worktrees, visible on a spine canvas.
v3 is in progress. This checkout is being rebuilt from scratch against MANIFESTO.md; the engineering plan is docs/plan/README.md. The last v2 release is 2.2.x on npm, and there is no migration: v2 sessions are not imported.
Install
npm install -g @intervene/neta
One bundled file, no runtime dependencies. Neta needs Node 22+.
Native terminal migration
The development TUI now uses our OpenCode fork with OpenTUI and SolidJS. See setup, controls and validation. Claude SDK integration is deferred. This development migration is not an npm release.
Documentation
- MANIFESTO.md — the product: workspaces, leaders, missions,
agents, assigned access, the spine.
- How it works — the architecture as it ships today.
- Settings — providers, leader defaults, models.
Development
The toolchain is Bun:
bun install bun test # tests use fake providers and no paid APIs bun run check # biome + tsc --noEmit bun run build # dist/main.js — one file, targets Node
The supported interactive client is the OpenCode/OpenTUI terminal. Navigate its workspace leader, filter, coordinator and mission conversations from the left spine. Help · actions contains workspace, machine, archive, delivery, and reset actions. See model routing for Jev or fi
6f7415576af6OBSERVED · 2026-10-12Exposed tools (10)
7 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
artifacts | read | Inspect metadata or open a bounded text range for an artifact published for the workspace leader in this workspace. This does not publish or alter artifacts. |
change_model | read | Change an existing mission lead or worker |
dispatch_mission | write | Create and start a mission with a separate mission lead. Supply the lead |
list_models | read | Search connected models and supported thinking levels; results are paged. |
mission | read | Read one mission |
mission_state | read | Compact open-mission state, paged newest first. Supply missionId for one mission |
missions | read | Read compact mission summaries in this workspace, newest number first. Use the cursor for more and mission for details. |
send_message | write | Send one useful update from the completed Coordinator reply to the Workspace leader. |
setup_diagnostic | read | Read a redacted page of a failed worktree setup diagnostic by mission number. |
spawn_agent | write | Add a worker to an existing mission. Coordinators pass its mission number; mission leads default to their own mission. For a new delegation, use dispatch_mission with a lead task instead. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (7 observation(s))
- Network
- declared (9 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (21)
/^(?:id_rsa|id_ed25519|credentials|secrets?)(?:\.|$)/i.test(part),
{"id":"state","type":"response","command":"get_state","success":true,"data":{"model":{"id":"proof-model","name":"proof-model","api":"openai-completions","provider":"proof","baseUrl":"http://127.0.0.1:{"id":"state","type":"response","command":"get_state","success":true,"data":{"model":{"id":"proof-model","name":"proof-model","api":"openai-completions","provider":"proof","baseUrl":"http://127.0.0.1:{"id":"state","type":"response","command":"get_state","success":true,"data":{"model":{"id":"proof-model","name":"proof-model","api":"openai-completions","provider":"proof","baseUrl":"http://127.0.0.1:await writeFile(join(hostConfig,'models.json'),JSON.stringify({providers:{proof:{baseUrl:`http://127.0.0.1:${model.address().port}/v1`,api:'openai-completions',apiKey:'local-proof',models:[{id:'proof-await writeFile(join(agentDir, "models.json"), JSON.stringify({ providers: { proof: { baseUrl: `http://127.0.0.1:${port}/v1`, api: "openai-completions", apiKey: "local", models: [{ id: "proof-model",const TOKEN = "cli-client-test-token";
await expect(tools.request("routing.auth.save", { apiKey: "fixture-agent-secret" })).rejects.toThrow(.gitmodules
.nojekyll
install -m 600 /keys/authorized_keys /root/.ssh/authorized_keys
assert.equal(JSON.parse(await readFile(resolve(root,'../../node_modules/@earendil-works/pi-coding-agent/package.json'),'utf8')).version,'0.85.0');
const cli = resolve(root,'../../node_modules/@earendil-works/pi-coding-agent/dist/bundle/cli.js');
const cli = resolve(root, "../../node_modules/@earendil-works/pi-coding-agent/dist/bundle/cli.js");
const piCli = resolve(root, "../../node_modules/@earendil-works/pi-coding-agent/dist/bundle/cli.js");
import { createInteractiveTui } from '../../node_modules/@earendil-works/pi-coding-agent/dist/modes/interactive/tui-renderer.js';design/canvas-directions/neta-desktop-canvas.html
docs/plan/shots/navigator-hidden.png
docs/plan/shots/spine-closed-nodes.png
docs/plan/shots/spine-now.png
Open `/routing`, paste your TypeSafe/Jev API key into the masked field, and
Gates applied: no_behavioural_pass.
6f7415576af6full audit observations/trust-audit/mcp-server/sudhanshug16__neta.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 6f7415576af6 | BLOCK | D | 69 | first audit |
Questions
What is the @intervene/neta MCP server?
A leader agent that delegates to tiered worker agents behind the coding-agent CLI you already use — Claude Code, Codex, or OpenCode.
What tools does @intervene/neta expose?
10 in total: 7 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @intervene/neta safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does @intervene/neta need?
It reads NETA_ACTOR_TOKEN, NETA_LEADER_TOKEN and TYPESAFE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (6f7415576af6), read on 2026-10-12. The repository is watched and re-audited when it changes.