Atlas / MCP servers / thefalconry / talon-agent

talon-agentBLOCK

Name: talon-agent
Author: thefalconry

mcp/thefalconry/talon

MCP server by thefalconry · agentic ai · ai agent · anthropic · Audited 2026-10-11

🦅 Multi-platform agentic AI harness — runs on Telegram, Discord, Teams & Terminal with a pluggable backend (Claude, Kilo, OpenCode, Codex, OpenAI Agents), full MCP tool access, and persistent background agents (Goals, Heartbeat, Dream).

Verdict

BLOCK

Grade

Trust score

35 /100

Exposed tools

162 106r · 43w · 13d

Transport

stdio · streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://nodejs.org) [](https://bun.sh) [](https://www.typescriptlang.org/) [](#frontends) [](#backends) [](LICENSE) [](https://github.com/thefalconry/talon/actions/workflows/ci.yml)

Multi-platform agentic AI harness. Runs on Telegram, WhatsApp, Discord, Microsoft Teams, the Terminal, and a cross-platform Desktop/Mobile companion app (Flutter), with a pluggable backend (Claude Agent SDK, Kilo, OpenCode, Codex, Antigravity, or OpenAI Agents) and full tool access through MCP.

Features

Read from source at commit 58ab9642d68fOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add talon-agent --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CODEX_API_KEY=${CODEX_API_KEY} --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "talon-agent": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "CODEX_API_KEY": "${CODEX_API_KEY}",
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (162)

106 read · 43 write · 13 destructive. Blast radius: 13 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Bash`	write	Run a shell command. Uses PowerShell on Windows and
`Edit`	write	Replace text in a file.
`Glob`	read	List files matching a glob pattern (e.g.
`Grep`	read	Search for a regular expression in files using the system
`Read`	read	Read a text file from disk. Returns the file contents with
`Write`	write	Write a string to a file, creating it (and any missing parent
`add_sticker_to_set`	write	Add a new sticker to an existing sticker pack created by the bot.
`agent_status`	read	Full status of one sub-agent: state, backend/model, timings, inbox depth, children, and its result or error once it has settled.
`backup`	read	Snapshots and checkpoints; restore <id>
`backup-db`	read	nightly dump
`backup_status`	read	Health of the backup subsystem: when the last snapshot ran and when the next one is due, how many snapshots exist locally and how big they are, which remote targets are registered and whether they are ready, and whether recent runs have been failing.
`bash`	write	Run a shell command. Runs on the daemon host, or ON the active teleport device if one is engaged. On a teleported device,
`bundled`	read	skill with extras
`cancel_scheduled`	read	Cancel a scheduled message.
`check_inbox`	read	Sub-agents only. Drain anything sent to you — instructions from your parent, and notes from peer agents working alongside you. Each message names its sender. Messages are delivered no other way, so check at milestones: after a phase of work, before a long operation, and before you report.
`copy_message`	read	Repost a message without the
`counted`	read	use counting
`create_cron_job`	write	Create a persistent scheduled job. Jobs survive restarts. Cadence — give EXACTLY ONE of: • schedule: a 5-field cron expression
`create_sticker_set`	write	Create a new sticker pack owned by a user. The bot will be the creator. Sticker images must be PNG/WEBP, max 512x512px for static stickers. The set name will automatically get
`delete_cron_job`	destructive	Delete a cron job permanently.
`delete_goal`	destructive	Delete a goal permanently. Prefer update_goal with status=
`delete_message`	destructive	Delete a message — or several at once via message_ids (Telegram; ids the bot can
`delete_script`	destructive	Delete a saved script and its file permanently.
`delete_skill`	destructive	Delete a saved skill and its entire folder (SKILL.md plus any bundled files) permanently.
`delete_sticker_from_set`	destructive	Remove a specific sticker from a pack by its file_id.
`delete_sticker_set`	destructive	Permanently delete an entire sticker pack created by the bot.
`demo`	read	a demo
`deploy`	write	Ship it
`device_computer`	read	Look at and operate the desktop of a mesh device that has a screen (today: macOS talon-nodes that list
`device_exec`	write	Run a shell command ON a Talon companion device (e.g. the phone) and return its stdout/stderr/exit code. The device executes it at the highest privilege it has (Android: root if the device grants it, else Shizuku
`device_list_dir`	read	List a directory on a Talon companion device (name, type, size per entry).
`device_pull_file`	read	Copy a file FROM a Talon companion device to the daemon host (workspace). Streams disk-to-disk in a single HTTP request at full throughput (no size cap; chunked fallback for old app builds). Lands in workspace/mesh-pull/ unless a local path is given.
`device_push_file`	write	Copy a file FROM the daemon host (workspace) TO a Talon companion device. Streams disk-to-disk in a single HTTP request at full throughput (no size cap; chunked fallback for old app builds).
`device_read_file`	read	Read a (text) file off a Talon companion device and return its contents. Small files ride the command channel; big files stream over HTTP automatically. No size cap.
`device_write_file`	write	Write text content to a file on a Talon companion device (creates/overwrites).
`doctor`	read	Environment and native-module health
`download_media`	read	Download a photo, document, or other media from a message by its ID. Saves the file to the workspace and returns the file path so you can read/analyze it. Use this when you see a [photo] or [document] in chat history but don
`download_sticker`	read	Download a sticker image to workspace so you can view its contents. Returns the file path.
`dream`	destructive	Force memory consolidation
`echo`	read	Echo
`echo-args`	read	echoes its args
`echo_pid`	read	Echo the input plus this process pid
`edit`	write	Exact-string replacement in a file. old_string must be unique unless replace_all is set. Runs on the daemon host or the active teleport device.
`edit_cron_job`	write	Edit an existing cron job. Only provide the fields you want to change. Setting schedule switches to cron mode; setting every_seconds switches to interval mode. Pass an empty string to start_at/end_at/max_runs/model/provider/instructions to clear it.
`edit_message`	write	Edit a previously sent message. For a media message (photo/video/file), pass is_caption=true to edit its caption instead of message text.
`effort`	write	Show or set thinking effort
`empty`	read	x
`empty-body`	read	x
`end_turn`	read	End your current turn and deliver your final reply to the user. This is the canonical way to respond. Call this AT MOST ONCE per turn — it should be the last tool you call. Behaves like send(type=
`fails`	read	always fails
`find_skills`	read	Search saved skills by query and return ranked discovery results. Use this to select the relevant workflow before loading its full body with read_skill.
`fmt-test`	read	formats things
`forward_message`	read	Forward a message. Defaults to within the current chat; from_chat_id / to_chat_id forward across chats the bot is in, and message_ids forwards a batch (albums stay grouped) (Telegram).
`get_chat_admins`	read	List chat administrators.
`get_chat_info`	read	Get chat title, type, member count.
`get_chat_member_count`	read	Get total member count.
`get_device_history`	read	Movement and battery history for a Talon companion device: a timeline of its reported locations over a window (default 24h, max 168h), with distance traveled and battery trend. Answers questions like where a device was earlier or how fast its battery is draining.
`get_device_location`	read	Get any Talon companion device
`get_device_status`	read	Get live status straight from a Talon companion device: battery and charging state, platform/OS details, app version, and mesh sharing settings.
`get_member_info`	read	Get detailed info about a user by ID.
`get_message_by_id`	read	Get a specific message by ID.
`get_pinned_messages`	read	Get all pinned messages in the current chat.
`get_sticker_pack`	read	Get all stickers in a sticker pack by its name. Returns emoji + file_id for each sticker so you can send them. Use when you see a sticker set name in chat history.
`get_user_messages`	read	Get messages from a specific user.
`get_user_profile_photos`	read	Get a user
`github`	read	GitHub API access via the official GitHub MCP server
`github-review`	read	address GitHub pull request review comments
`glob`	read	Find files matching a glob pattern (ripgrep-backed). Runs on the daemon host or the active teleport device.
`greet`	read	prints a greeting
`help`	read	All commands
`hide`	read	hidden skill
`home`	read	workspace
`keep`	read	kept skill
`kill_agent`	destructive	Abort a running agent. It settles as
`list_agents`	read	List this chat
`list_backends`	read	List the available backends (providers), which one this chat is currently using, and how much plan headroom each has left. Useful for understanding the model/provider landscape and for seeing where unpinned background work (sub-agents, cron query jobs, the heartbeat) will be routed. Note: a per-job
`list_chat_members`	read	List chat members with names, IDs, online status, badges.
`list_checkpoints`	read	List recent snapshots — id, kind, label, size, whether pinned, and which remote targets hold a copy. Newest first. Use it to find the id of something you or the schedule took earlier.
`list_cron_jobs`	write	List all cron jobs in the current chat: status, schedule (cron or interval), run count, last-run outcome, next run time, and any bounds (run cap, start/end window, catch-up policy, model).
`list_devices`	read	List all Talon companion mesh devices with id, platform, online presence, last-seen age, battery state, last-known location, and supported commands.
`list_goals`	read	List this chat
`list_media`	read	List recent photos, documents, and other media in the current chat with file paths. Use this to find a previously sent photo or file to re-read or reference.
`list_models`	read	List the selectable models on a backend. With no argument, lists the models on THIS chat
`list_peers`	read	Sub-agents only. List the other live agents you can message with message_peer — id, label, how they relate to you and what each is working on. Default scope
`list_scheduled`	write	List pending scheduled messages in this chat (id, seconds until send, text). Scheduled messages persist across restarts.
`list_scripts`	read	List all saved scripts with language, usage stats, and descriptions. Check here before hand-writing a procedure you may have already saved.
`list_skills`	read	List saved skills with descriptions. Check here before re-deriving a reusable workflow or process.
`lua-script`	read	x
`make_companion_pair_link`	read	Mint a single-use pairing link that connects a Talon companion app (Android, macOS, Windows, Linux) to this daemon
`make_node_install_link`	write	Mint a single-use install link served by this daemon
`mem0`	read	mem0 — long-term memory layer (hosted or self-hosted)
`mem0_add_memory`	write	Store new information in mem0 long-term memory. Pass conversational text; mem0 extracts and files the durable facts itself.
`mem0_delete_memory`	destructive	Delete a mem0 memory by id when it is wrong or stale.
`mem0_get_memory`	read	Fetch a single mem0 memory by id, with full content and metadata.
`mem0_list_memories`	read	Browse stored mem0 memories with pagination. Use for inventory/cleanup, not search.
`mem0_search_memory`	read	Semantic search over mem0 memories. Use short keyword queries, not full sentences.
`memory`	read	What Talon remembers — list, search, why <id>
`mempalace`	read	Memory palace — structured long-term memory with vector search
`mesh`	read	Ping and list mesh devices
`message_parent`	write	Sub-agents only. Send an interim note to whoever spawned you — a finding worth acting on now, a question, or a heads-up. It wakes them, so use it sparingly. It does not end your run and does not count as your result.
`message_peer`	write	Sub-agents only. Send a note straight to any live agent in your tree — a sibling, your parent agent, a child, or a cousin working for the same chat — by id or label, without routing it through anyone. Use it when you find something that changes another agent
`metrics`	read	Aggregate performance metrics
`model`	read	List models; pick one or switch backend
`moderate`	read	Administer the chat (requires the bot to be an admin with matching rights; Telegram reports missing rights in the error). Member ops: moderate(op=
`node-cwd`	read	prints cwd
`online_count`	read	Get how many members are currently online or recently active.
`only`	read	the only one
`pin_message`	read	Pin a message.
`ping`	read	health check
`plan_usage`	read	Read usage and headroom for EVERY configured backend, not just this chat
`playwright`	read	Browser automation via Playwright MCP (${endpoint ?
`plugins`	read	Loaded plugins and registered MCP servers (registry view)
`pulse`	read	Periodic check-ins: on, off, or an interval
`react`	write	Add an emoji reaction to a message. By default this also ends your turn (a reaction is usually a complete acknowledgement — no separate end_turn() needed). Pass \
`read`	read	Read a file (with line numbers). Runs on the daemon host or the active teleport device. Supports offset/limit for large files. ${NAMESPACE_DOC}
`read_chat_history`	read	Read messages from the chat. Use
`read_skill`	read	Read the full SKILL.md body for a saved skill. Load it before following that workflow; descriptions are only discovery hints. If the skill bundles supporting files in its folder, they are listed so you can open them with the Read tool.
`recall`	read	Search long-term memory for stored claims — full-text, best match first. Use it when you need more than the memory already in this prompt, before asking the user to repeat something. Returns lines prefixed with an id you can pass to remember(replace_id) or forget.
`release-check`	read	ship a release
`report_result`	read	Sub-agents only. Report your result to whoever spawned you. Call this exactly once, when you are done — it is the ONLY channel your result reaches your parent through. Reporting a failure with what you tried is a valid result; silence is not. Calling this outside a sub-agent run is an error.
`request_secret`	read	Ask the operator for a secret (password, API key, token) without it passing through the chat. Mints a single-use link, valid about 15 minutes, to a paste form served by Talon
`reset`	destructive	Clear the session and start fresh
`restart`	write	Restart the daemon
`resume`	read	List & resume a past session
`review-flow`	read	review pull requests carefully
`review-pr`	read	review PRs
`ring_device`	read	Make a Talon companion device ring/vibrate so it can be found (find-my-phone). Optionally include a short message the device may display.
`run_cron_job`	write	Run a cron job right now, ignoring its schedule (for testing or an ad-hoc run). The run is recorded like a scheduled one, so a one-shot job will retire after it.
`run_preflight`	write	Run the pre-flight lane (
`run_script`	write	Run a saved script to completion and get its output (stdout/stderr/exit code). Local execution — fast and free. Pass args to parameterize (they arrive as the script
`save_script`	write	Save (or update) a reusable script — a named program you can run later with run_script. Save a script whenever you
`save_skill`	write	Save (or update) a reusable skill — a SKILL.md workflow bundle you can load later with read_skill. Follows Anthropic
`save_sticker_pack`	write	Add a sticker pack to your library (workspace/stickers/). Saved packs appear in your prompt\
`search`	read	Search file contents with a regex (ripgrep-backed). Runs on the daemon host or the active teleport device.
`search_chat_history`	read	Search messages by keyword, optionally within a date range (
`secret`	read	Store a password via a one-time link, not the chat
`send_message`	write	Send a message to the native chat bridge. Supports Markdown formatting. Examples: send_message(text=
`send_message_with_buttons`	write	Send a message with clickable link buttons. Buttons appear below the message in the native client. Example: send_message_with_buttons(text=
`send_to_agent`	write	Put an instruction in a running agent
`set_chat_description`	write	Change chat description (admin).
`set_chat_title`	write	Change chat title (admin).
`set_sticker_set_title`	write	Change the title of a sticker pack created by the bot.
`settings`	read	This chat
`sleeper`	read	sleeps forever
`status`	read	Session info, context usage and stats
`stop`	write	Stop the current response
`stop_poll`	write	Stop an active poll and get the final results. Returns vote counts for each option.
`teleport`	read	Switch Talon
`teleport_back`	write	Return native tools to the daemon host — bash/read/write/edit/glob/search run locally again.
`test`	read	A test command
`transform`	read	v1
`trigger_cancel`	write	Cancel a running trigger (sends SIGTERM, then SIGKILL after 5s grace).
`trigger_delete`	destructive	Delete a trigger. Cancels it first if running, then removes its script and log from disk.
`trigger_list`	write	List all triggers in the current chat with their status, runtime, and fire count.
`trigger_logs`	write	Read the tail of a trigger
`unpin_message`	read	Unpin a message.
`update_device`	write	Remotely update a Talon companion (Android): stream a new APK from the daemon to the device and silently reinstall it at an elevated tier (root or Shizuku), keeping app data. The companion
`update_goal`	write	Update a goal: record progress, change status, or edit its fields. Only provide what changes. Record a progress_note whenever you advance a goal — the next heartbeat run reads it to pick up where you left off. Set status=
`usage`	read	Plan limits across every backend
`wait_for_agent`	read	Block until one agent settles, or until the timeout — whichever comes first. This is a convenience for short waits only: the primary completion channel is the wake-up message the agent
`whatsapp_account`	read	Read and change the bot
`write`	destructive	Write (create/overwrite) a file with the given content. Runs on the daemon host or the active teleport device. Under ~/.talon/ns the writable mounts are home/, skills/, scripts/ (logs/, proc/, plugins/ are read-only).

Trust audit

BLOCKgrade F · trust 35/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (10 observation(s))
Network: declared (6 observation(s))
Shell: declared (7 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/core/fetch/rungs.ts:297

const out = await exec(device, parts.join(" "), req.timeoutMs);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/core/plugin/provision.ts:213

const probe = await exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/plugins/mempalace/provision.ts:121

const result = await exec(python, ["-c", HEALTH_SNIPPET], {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/plugins/mempalace/provision.ts:420

const created = await exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

Dockerfile:60

CMD bun -e "fetch('http://127.0.0.1:19876/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

Dockerfile:67

CMD node -e "fetch('http://127.0.0.1:19876/health').then(r=>{process.exit(r.ok?0:1)}).catch(()=>process.exit(1))"

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

apps/companion/lib/src/ui/connect_screen.dart:566

hint: 'https://192.168.1.20:19880 — used whenever it answers'),