GofannonBLOCK
A web app for rapidly prototyping AI agents and the lightweight web UIs that wrap them—build flows, preview interactions, and share agent-driven experiences without lock-in.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://pypi.org/project/gofannon/) [](LICENSE) [](https://github.com/The-AI-Alliance/gofannon/issues)
Gofannon is a provider- and model-agnostic toolkit and web application for prototyping AI agents and the lightweight web UIs that wrap them. Subject matter experts compose tools, data sources, and decision paths through a guided interface, preview agent interactions in real time, and hand off working agent-driven experiences without committing to a single AI framework or model provider.
What you can do
- Prototype agents quickly. Compose tools, data sources, and decision paths through a guided interface, and iterate with real-time feedback.
- Design lightweight web UIs. Pair agents with forms, chat surfaces, and dashboards to validate user journeys; export or embed prototypes to share with stakeholders.
- Stay flexible. Gofannon supports multiple model providers (OpenAI, Anthropic, Gemini, and others via LiteLLM) and is designed to keep your work portable across them.
Quickstart
git clone https://github.com/The-AI-Alliance/gofannon.git cd gofannon/webapp/infra/docker docker-compose up --build
See the quickstart guide for details, including required environment configuration.
Documentation
Full documentation lives in docs/ and is published at . Highlights:
- Quickstart
- Developer quickstart
- API reference
- LLM provider configuration
- [Testing](docs/testing
f12f7046d4d7OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add website --env ADMIN_PANEL_PASSWORD=${ADMIN_PANEL_PASSWORD} --env AUTH_CONFIG_PATH=${AUTH_CONFIG_PATH} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} -- npx -y [email protected]{
"mcpServers": {
"website": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ADMIN_PANEL_PASSWORD": "${ADMIN_PANEL_PASSWORD}",
"AUTH_CONFIG_PATH": "${AUTH_CONFIG_PATH}",
"AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
"AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}"
}
}
}
}Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Anthropic | read | Claude models |
OpenAI | read | GPT-4, GPT-3.5, and other OpenAI models |
OpenRouter | read | Unified access to xAI Grok, DeepSeek, Qwen, Llama, and many other models |
Perplexity | read | Perplexity AI models |
Trust audit
BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (9 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(code_obj, exec_globals, local_scope)
module = importlib.import_module(module_path)
module = importlib.import_module(override_module)
"-----BEGIN PRIVATE KEY-----",
"-----BEGIN RSA PRIVATE KEY-----",
"-----BEGIN EC PRIVATE KEY-----",
"-----BEGIN OPENSSH PRIVATE KEY-----",
.dev-auth.yaml
.firebaserc
.coveragerc
.env.firebase.example
.nojekyll
context: ../../
context: ../../packages/api/user-service
dockerfile: ../../../infra/docker/Dockerfile.api
- ../../packages/api/user-service:/app
- ../../../.dev-auth.yaml:/auth-config/auth.yaml:ro
http://127.0.0.1:3000/
firebase, react-split-pane, @playwright/test, pnpm
fastapi, uvicorn, boto3, python-dotenv, litellm, fastmcp, google-auth, pytest
@emotion/react, @emotion/styled, @mui/icons-material, @mui/material, axios, prop-types, react, react-dom
@mdx-js/react, clsx, prism-react-renderer, react, react-dom, typescript
// Allow service account full access (for backend)
// Service account has full access
# Attach DynamoDB full access policy
Gates applied: no_behavioural_pass.
f12f7046d4d7full audit observations/trust-audit/mcp-server/the-ai-alliance__gofannon.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | f12f7046d4d7 | BLOCK | F | 56 | first audit |
Questions
What is the Gofannon MCP server?
A web app for rapidly prototyping AI agents and the lightweight web UIs that wrap them—build flows, preview interactions, and share agent-driven experiences without lock-in.
What tools does Gofannon expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Gofannon safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (56/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Gofannon need?
It reads ADMIN_PANEL_PASSWORD, AUTH_CONFIG_PATH, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, COUCHDB_PASSWORD and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (f12f7046d4d7), read on 2026-10-07. The repository is watched and re-audited when it changes.