Atlas / MCP servers / sudocode-ai / Sudocode

SudocodeBLOCK

Name: Sudocode
Author: sudocode-ai

mcp/sudocode-ai/sudocode

MCP server by sudocode-ai · agents · ai · automation · Audited 2026-10-05

⚑ Report / re-scan Source ↗

Lightweight agent orchestration dev tool that lives in your repo

Verdict

BLOCK

Grade

Trust score

55 /100

Exposed tools

11 8r · 3w · 0d

Transport

stdio

License

Apache-2.0

Stars

293

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

sudocode

npm install -g sudocode

Automate the logistics of managing context and agents. Direct the work instead of babysitting agents.

sudocode is a lightweight agent orchestration system that lives in your repo. Adding sudocode into your repo adds instant organizational capabilities to your coding agents. They'll gain the ability to track context over long-horizon tasks and work collaboratively on complex tasks.

Key capabilities

Automate context handoff for complex tasks with sudocode's git-native agent memory system
Bring order to chaos by organizing your requirements, background context, and implementation plans into structured, executable issue graphs
Visualize outputs and execution feedback in real-time
Run as many Claude Co

Read from source at commit 7d9363245950OBSERVED · 2026-10-05

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add types --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y @sudocode-ai/[email protected]

claude-desktop

{
  "mcpServers": {
    "types": {
      "command": "npx",
      "args": [
        "-y",
        "@sudocode-ai/[email protected]"
      ],
      "env": {
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (11)

8 read · 3 write · 0 destructive.

Tool	Risk	Description
`await_events`	read	Pause execution and wait for specific events. Your session will end here.
`escalate_to_user`	read	Request user input for a decision. Returns immediately with
`execute_issue`	write	Start an execution for an issue. Returns immediately with execution ID.
`execution_cancel`	read	Cancel a running execution.
`execution_changes`	read	Get code changes made by an execution including files modified and commits.
`execution_status`	read	Get status of an execution including exit code, summary, and files changed.
`execution_trajectory`	read	Get agent actions and tool calls from an execution.
`merge_branch`	write	Merge a branch into the workflow
`notify_user`	write	Send a non-blocking notification to the user. Does not wait for response.
`workflow_complete`	read	Mark workflow as complete or failed with a summary.
`workflow_status`	read	Get current workflow state including steps, active executions, and ready issues.

Trust audit

BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (6 observation(s))
Shell: declared (7 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

cli/src/yaml-converter.ts:103

return yaml.load(yamlString, {

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

cli/src/remote/spawn-service.ts:63

exec(command, (error) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

cli/src/auth/status.ts:106

console.log(`  Token: ${maskToken(credentials.claudeToken)}`);

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

cli/src/auth/status.ts:129

console.log(`  API Key: ${maskToken(credentials.litellmCredentials.api_key)}`);

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

cli/src/remote/spawn-service.ts:101

console.log(chalk.gray(`  Token length: ${claudeToken.length} characters\n`));