Atlas / MCP servers / tickernelz / omp-fabric

omp-fabricBLOCK

mcp/tickernelz/omp-fabric

Fabric for OMP: deterministic, LLM-free orchestration of the Oh My Pi host toolchain

Verdict
BLOCK
Grade
F
Trust score
53 /100
Exposed tools
118 88r · 22w · 8d
Transport
—
License
MIT
Stars
7
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A programmable tool and agent runtime for [OMP](https://github.com/can1357/oh-my-pi)

One type-checked program for tools, MCP, agents, workflows, actors, mesh, councils, and recursion.

[](https://www.npmjs.com/package/omp-fabric) [](https://arcprize.org/scorecards/d4c56c67-136b-4643-b648-62ae28fe2a54) [](https://github.com/tickernelz/omp-fabric/actions/workflows/test.yml) [](https://github.com/can1357/oh-my-pi) [](LICENSE)

🏆 100% on ARC-AGI-3. A Fabric-powered agent won all 25 environments in one 22.4-hour session with 4 minutes of human time ($1,349 in model spend).

Fabric gives OMP one programmable tool called fabric_exec, which composes core tools and MCP servers with captured extension tools in a checked TypeScript program. That program can call agents or actors, use durable coordination, and run inside QuickJS. Trusted workloads that exceed WASM32 memory may use the unsafe Node process. After execution, the conversation receives the result of the program's branches, loops, fan-out, and data flow.

Why Fabr

Read from source at commit 27c09dd951a7OBSERVED · 2026-10-11
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add omp-fabric --env JOINED_PASS=${JOINED_PASS} --env TYPESAFE_API_KEY=${TYPESAFE_API_KEY} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "omp-fabric": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "JOINED_PASS": "${JOINED_PASS}",
        "TYPESAFE_API_KEY": "${TYPESAFE_API_KEY}"
      }
    }
  }
}
03

Exposed tools (118)

88 read · 22 write · 8 destructive. Blast radius: 8 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
Inspectreadphase-description-secret
Lifecyclereadconfigure-description-secret
Probereadcheck
abortreadAbort an uncommitted same-invocation hypothesis and optionally its active certificate
activereadActive workflow
actorStatusreadRead one persistent actor
actorsreadList persistent actors. Default scope
agentsreadTest agents
askwriteSend a message to a persistent actor through its live owner and wait for its next response. Optional model/thinking values apply only to this activation.
bashwriteExecute a shell command
callreaddemo call
canceldestructiveClear a pending compaction intent before the host commits it
cascadereadRank files by how often they historically changed in the same commits as the seed files, normalised so ubiquitous files (lockfiles, changelogs) do not dominate. Answers which files a change will drag along, which text search cannot.
checkGoalwriteRun the goal predicate and report pass/fail; publishes state.goal.met when it passes
classify_resultwriteReport whether the exact Fabric action may run without human approval
cleanupdestructiveRemove a completed agent
clearMessagesdestructiveClear a persistent actor
commitwriteConsume one same-invocation certificate and atomically attempt bounded declared-file operations with rollback and postconditions
commutereadCommutative effects
compactreadRequest an advisory compaction of a running OMP-runner child agent
complexityreadCount current structural decision points and compare them with the complexity ledger
createwriteCreate a persistent actor with independently selected session or project storage. Use scope
debug-flakereadDiagnose a test that passes alone and fails in a suite.
deletedestructiveDelete shared mesh state, optionally with compare-and-swap version checking
demoreadDemo provider
dependencyreadRequired dependency
docs.searchreadsearch indexed documentation
echoreadEcho a string
echo-valuereadEcho a value
effectsreadEffect conflicts
emitreadEmission provider
examplereadexample
expandreadexpand
exportreadExport a live project actor
extensionsreadfake extensions
externalreadExternal provider
filesreadfiles
flaky-pingreadPing from a serve-once fixture
followUpreadQueue a follow-up for Main or a running one-shot agent, or enqueue a persistent actor mailbox message. The stable id alias main targets the root user-facing OMP session. Non-local targets route over the project mesh.
getreadRead a versioned value from shared mesh state
get-model-schemareadReturn a model schema
github.get_reporeadGet a GitHub repository
goalwriteSet the executable goal predicate (Schema
graphreadInspect component requirement/provision edges and detected dependency cycles.
grepreadSearch source files for matching text
handoffwriteSchedule an OMP trajectory handoff after the current outer fabric_exec result, then wait for implementation at that boundary
historyreadFold the transition log from its representation archive boundary into an ordered label graph
hypothesizereadDurably bind a falsifiable hypothesis and nonempty typed evidence to the current state and workspace
importwriteImport a project-independent template from the global registry into the current project as a fresh live actor with no inherited history (no messages, session, or run logs). Identify the template by id or name; optionally rename the imported actor with \
inspectreadInspect stored records
leasereadLease provider
legacyreadLegacy provider
listreadList agent participants locally, across the current lineage, or across the project
logwriteRead an actor or agent run
mainreadReturn the root user-facing Main OMP agent target. The stable alias main is also accepted by agents.steer and agents.followUp.
manual-onlywriteRun only when explicitly invoked.
mcpreadMock MCP provider
membersreadList the unified project topology of roots, agents, and actors
memoryreadMemory provider
messagesreadRead a persistent actor
misleadingreadclaims read
modelsreadList models exposed by the selected runner. Claude models are enumerated from the installed Claude Code runtime, not hard-coded.
mutablereadMutable catalog
mutatereadmutate one value
ompreadOMP tools
openreadopen
peersreadList other live root OMP sessions sharing this project mesh. The dashboard-owning session remains Main; these targets are named peers.
pickreadPick a session
pingreademit rapid progress
probereadProbe normalization stages
project_statusreadReport project status
prune-diskreadReclaim disk safely on a dev box.
publishwriteAppend a durable event to a mesh topic, optionally addressed to one actor
putwriteWrite shared mesh state, optionally with compare-and-swap version checking
readreadRead a local file
recallreadSearch historical session memory
release-riskreadReview launch plans for operational risk.
reloadwriteRestart one component, or all loaded components, with rollback to the previous revision on activation failure.
removedestructiveStop and remove a persistent actor. Default scope
requestreadRequest an advisory compaction of the host session
reviewreadReview <plans> &
runwriteDelegate work to a background agent
scanreadScan
schemareadapproval probe
selfreadReturn this caller
sessionsreadList all live root OMP session agents in the project, including the current lineage root and peers, with symmetric participant identities.
setDeliveryPolicyreadReplace a project actor or global template delivery policy. steer/followUp require an explicit triggerTurn choice; mailbox/nextTurn require false.
setEventsreadReplace a persistent actor
setFollowUpModewriteSet how queued follow-up messages are delivered to a one-shot agent: all when it finishes, or one per completion (default). Local agent only.
setInstructionsreadReplace an actor\
setModeldestructiveChange or clear a persistent actor model binding. Session scope is the default; project scope explicitly pins the shared definition default.
setSteeringModewriteSet how queued steer messages are delivered to a running one-shot agent: all at once after the current turn, or one per turn (default). Local agent only.
setThinkingdestructiveChange or clear a persistent actor reasoning-effort binding. Session scope is the default; project scope explicitly pins the shared definition default.
setToolsreadReplace a persistent actor
ship-releasereadCut and verify a tagged npm release.
slowreadslow call
slowextreadcaptured extension stub
spawnwriteStart a child agent through OMP or Claude Code and return a handle immediately. Detached runs send Main a follow-up on terminal completion when agents.notifyOnComplete is enabled; use wait when this Fabric program needs the result and status only for progress inspection.
specreadSpeculation observability provider
statsreadCounters for this session
statusreadGet the latest status of any known project participant
steerreadSteer Main, a running one-shot agent between turns, or a persistent actor through its mailbox. The stable id alias main targets the root user-facing OMP session. Non-local targets route over the project mesh.
stopwriteStop a local or remotely owned agent or actor that advertises the stop capability
storagereadFilesystem discovery capabilities
streamreademit progress on demand
subagentreadcaptured extension stub
subscribewriteCreate a durable source-qualified participant lifecycle subscription. Events are delivered to Main by default or to another participant through steer/follow-up routing.
subscriptionsreadList durable participant lifecycle subscriptions, optionally filtered by source or target
svcreadLaw-test service
switchModelreadSwitch Main
tellreadQueue a message through a persistent actor
transitionreadAppend a labeled, validated state transition and compare-and-swap advance the head
unsubscribedestructiveRemove a participant lifecycle subscription
verifyreadFail-closed verification that may issue one fresh invocation-bound single-use certificate
waitreadWait for a previously spawned child agent
web_searchreadcaptured host web search
writewriteWrite a file
write-docswriteWrite a developer guide from working code.
04

Trust audit

BLOCKgrade F · trust 53/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryFAIL
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (11 observation(s))
Network
none-observed
Shell
declared (4 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104
src/actors/host-event-payload.ts
host-event-payload.ts
Why it matters. member named after an attack tool
Fix. remove or justify
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/storage/sqlite.ts:10
exec(sql: string): void;
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/storage/sqlite.ts:29
exec(sql: string): void { this.database.exec(sql); }
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
scripts/certification/run-context.mjs:30
const RARE_FACT = "Pinned fact: quasarneedle_7f91 maps to Ωmega雪 and port 43117.";
MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
scripts/certification/run-context.mjs:501
const coldRareFact = "cold_exact_quasar_7f91 Ωmega雪 address=43117";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
tests/ui-transcript.test.ts:174
apiKey: "sk_test_secret_value",
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
cancel, cleanup, clearMessages, delete, remove, setModel, setThinking, unsubscribe
Why it matters. 8 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/speculation-guest-args.test.ts:13
const bridgeNormalize = new Function(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/storage/lcm-ledger.test.ts:187
const base = sqliteDriver() as unknown as { new (target: string, options?: unknown): { exec(sql: string): void } };
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
tests/storage/lcm-ledger.test.ts:188
setSqliteDriver(class extends base { exec(sql: string) { if (/using\s+fts5/i.test(sql)) throw new Error("no such module: fts5"); return super.exec(sql); } } as unknown as SqliteDriver);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/memory/index.ts:72
const hash = crypto.createHash("sha1").update(sessionFile).digest("hex").slice(0, 16);
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/prewalk/fs-drift.ts:254
sha1 = createHash("sha1").update(await readFile(path.join(root, file))).digest("hex");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/certification/omp-compaction.mjs:7
import { registerCompactionHook } from "../../dist/compaction/hook.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/certification/omp-compaction.mjs:28
fs.readFileSync(fileURLToPath(new URL("../../package.json", import.meta.url)), "utf8"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/certification/run-context.mjs:6
import { normalizeSession, readSessionHeader } from "../../dist/memory/normalize.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/certification/run-context.mjs:9
import { MemoryProvider } from "../../dist/providers/memory-provider.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
scripts/certification/run-entropy.mjs:10
import { resolveAgentDir } from "../../src/core/agent-dir.ts";
LOWObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
tests/memory-cache-v6.test.ts:92
const rare = index === 0 ? " rarelexeme_000 Ωmega雪" : "";
LOWObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
tests/memory-cache-v6.test.ts:135
{ scope: "project", query: "ΩMEGA雪" },
LOWObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94
tests/memory-cache-v6.test.ts:287
expect(tokenizeLexical("CAFÉ café Ωmega雪 snake_case 42")).toEqual([
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
tests/fabric-render.test.ts:56
"🏳️🌈".repeat(60),
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
tests/fabric-ui.test.ts:2443
expect(wrapPlainText("👩💻x", 2)).toEqual(["👩💻", "x"]);
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
tests/ui-transcript.test.ts:166
const long = `${"a".repeat(9_000)}secret-tail👩💻`;
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
tests/ui-transcript.test.ts:202
expect(assistant?.text).toContain("👩💻");
LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
tests/word-diff.test.ts:38
const before = "const icon = '👩💻-old';";

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 27c09dd951a7full audit observations/trust-audit/mcp-server/tickernelz__omp-fabric.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1127c09dd951a7BLOCKF53first audit
06

Questions

What is the omp-fabric MCP server?

Fabric for OMP: deterministic, LLM-free orchestration of the Oh My Pi host toolchain

What tools does omp-fabric expose?

118 in total: 88 read-only, 22 that write, and 8 that can delete or overwrite (cancel, cleanup, clearMessages, delete, remove). Every one is listed on this page with its risk.

Is omp-fabric safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (53/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 8 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does omp-fabric need?

It reads JOINED_PASS and TYPESAFE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (27c09dd951a7), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement