Atlas / MCP servers / tonnestate / MangoMe

MangoMeBLOCK

Name: MangoMe
Author: tonnestate

mcp/tonnestate/mangome

MCP server by tonnestate · agent handoffs · agent state · agentic ai · Audited 2026-10-11

Persistent multi-agent work graph and document-state machine for contracts, specs, slices, evidence, verification, handoffs, and cost-aware AI execution.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

107 83r · 24w · 0d

Transport

streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Governed work state survives the agent. Persistent truth, work-state, evidence and reconciliation for long-lived multi-agent work.

New to MangoMe? Start here

If this is your first time using MangoMe, begin with the beginner documentation before diving into the architecture and protocol references:

Start Here — MangoMe in a few minutes: what it is, what problem it solves, and the basic mental model.
Getting Started — installation, client setup, first health check, and the first governed task.
5-minute Demo — copy/paste smoke test and durable MongoDB handoff.
Compatibility — what the release suite covers, what managed clients support, and what remains deployment-dependent.
Troubleshooting — common integration and runtime errors such as STATE_NOT_FOUND, WRONG_MANGOME_DATABASE, WORKSPACE_BINDING_AMBIGUOUS, and Skill/MCP readiness issues.
Why MangoMe? — concrete agent failure modes and how MangoMe changes the operational behavior.

The rest of this README and the documents under docs/ describe the deeper architecture,

Read from source at commit 820d887625faOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mangome-mcp --env MANGOME_AGENT_CONTEXT_TOKEN_BUDGET=${MANGOME_AGENT_CONTEXT_TOKEN_BUDGET} --env MANGOME_APPROVAL_TOKEN=${MANGOME_APPROVAL_TOKEN} --env MANGOME_VERIFIER_TOKEN=${MANGOME_VERIFIER_TOKEN} -- uvx mangome-mcp

claude-desktop

{
  "mcpServers": {
    "mangome-mcp": {
      "command": "uvx",
      "args": [
        "mangome-mcp"
      ],
      "env": {
        "MANGOME_AGENT_CONTEXT_TOKEN_BUDGET": "${MANGOME_AGENT_CONTEXT_TOKEN_BUDGET}",
        "MANGOME_APPROVAL_TOKEN": "${MANGOME_APPROVAL_TOKEN}",
        "MANGOME_VERIFIER_TOKEN": "${MANGOME_VERIFIER_TOKEN}"
      }
    }
  }
}

Exposed tools (107)

83 read · 24 write · 0 destructive.

Tool	Risk	Description
`accept_slice`	write	Move VERIFIED to ACCEPTED using a trusted approved ACCEPT_SLICE decision.
`approve_override`	read	Approve using the owner runtime capability; actor strings alone are insufficient.
`assess_fast_judgment`	read	Validate and gate provider-neutral typed fast judgments without persisting them.
`attach_artifact`	read	Register a physical artifact/reference without changing its external storage.
`attest_evidence`	read	Attest evidence using a runtime verifier/owner capability. The capability is never persisted.
`audit_context`	read	Return the bounded current audit frontier, findings, assumptions, mutation boundary and PCH working-set support.
`audit_mutation_allowed`	read	Check the audit
`audit_status`	read	Return SRA/1 progress and whether impact closure reached a fixpoint or configured boundary.
`authorize_delegation`	read	Persist one bounded delegation authorization from current runtime/cost/concurrency state.
`backfill_work_identity`	read	Explicitly bind historical canonical family state to WorkIdentity without inventing user intent.
`begin_work`	write	Compose intake -> plan -> start for ordinary work without MangoMe jargon.
`bigbang_scan`	read	Pure candidate-only discovery for an explicit scan request.
`bind_contract_turn`	read	Bind the CURRENT user turn to one canonical Contract. Restore state alone never authorizes this turn.
`bind_work_turn`	read	Control-plane bind the current user turn to durable WorkIdentity. Workers cannot self-mint authority.
`bitemporal_truth_status`	read	Summarize current BTTM/1 support states for one WorkIdentity.
`build_reproduction_binding`	read	Build an RB/1 reproduction binding from current files/Git metadata without executing the command or reading environment values.
`checkpoint_work`	read	Persist PROGRESSIVE crash-recovery state. It can only reference an existing canonical WorkIdentity.
`claim_done`	read	Record DONE_CLAIMED under the slice
`close_plan`	read	Close an unbound plan so it stops generating collision traffic.
`close_scoped_audit`	read	Close only after no pending frontier remains; closure never promotes underlying work to VERIFIED.
`close_verified_slice`	read	Close an already VERIFIED Slice after all required effects are reconciled and satisfied.
`cognitive_hygiene`	write	Compute the PCH/1 thermal map and bounded active working set without mutating canonical truth.
`compile_execution_context`	write	Produce a compact deterministic execution package after PCH/1 working-set selection.
`compile_uai_context`	read	Compile canonical MangoMe truth into a versioned compact UAI/1 execution packet with semantic hash and savings metrics.
`complete_delegation`	read	Checkpoint/close a bounded delegation so recovery can continue without rediscovery.
`completion_review`	read	Build an AV/1 adversarial verification brief from persisted DONE claims, plan/spec obligations, Evidence and an optional observed change set.
`contract_state`	read	Read one logical Contract and its immutable canonical generations. Physical paths are bindings, not identity.
`create_family`	write	Administrative durable-family creation; requires control-plane authority.
`create_project`	write	Administrative identity creation; requires control-plane authority.
`create_spec`	write	Append normative Specification truth. Work-bound families require a MODIFY WorkTurn.
`decode_uai_result`	read	Validate and expand a compact UAI/1R worker result. This never mutates canonical state.
`delegation_status`	read	Return persisted delegation/checkpoint state for one family.
`discovery_scopes`	read	Return portable typed discovery scopes; this does not scan or admit content.
`effect_status`	read	Read the durable PER/1 effect ledger, optionally restricted to unresolved logical effects.
`effective_family_view`	read	Return the effective append-only contract-family view, supersession, relations, and conflicts.
`enter_work`	read	Enter governed work from ordinary user intent with no MangoMe identifiers required.
`evidence_freshness`	read	Check whether attested PASS evidence remains current under legacy hash bindings or RB/1 reproduction bindings. Never reruns commands or changes assurance state.
`execution_eligibility`	read	Evaluate CURRENT runtime eligibility for external dispatch or a capability-sensitive host action.
`expand_uai_context`	read	Round-trip a UAI/1 context packet back into its canonical semantic execution projection and verify its hash.
`fast_judgment_status`	read	Read one persisted FJD/1 progressive judgment and its confidence/fallback disposition.
`filesystem_inventory`	read	Pure read-only filesystem inventory; persists nothing to canonical MangoMe state.
`filesystem_references`	read	Targeted validation of an already-canonical identity; never use lexical references to invent recovery state.
`filesystem_scan`	read	Persistent inventory for explicit onboarding/maintenance; not a normal observation fast path.
`graph`	read	Return validated confirmed/suggested incoming and outgoing graph edges for an entity.
`health`	read	Return readiness even when backing-store initialization fails.
`import_contract_bundle`	write	Controller-authorized onboarding of historical contract/slice state.
`intake_request`	read	Persist and categorize a new assignment before execution.
`invalidate_truth_assertion`	read	Close an assertion
`link_entities`	write	Create a typed relation; normative contract evolution requires a MODIFY WorkTurn.
`list_approvals`	read	List approval requests, optionally filtered by status and subject.
`maintenance_diagnose`	read	Report stale plan candidates, collisions, approvals and unresolved graph work without auto-fixing it.
`mangome_control`	read	Perform explicit controller/router/owner operations through the advanced capability layer.
`mangome_effect`	read	Record/reconcile external effects. Unknown outcomes must not be blindly retried.
`mangome_observe`	read	Read/inspect derived or canonical context. OBSERVE never creates work identity or truth.
`mangome_query`	read	Resolve/read MangoMe identity, graph, truth and work state through an allow-listed query surface.
`mangome_status`	read	Return bounded MangoMe status without admitting or mutating work.
`mangome_verify`	read	Validate, audit and verify without allowing a worker DONE claim to become trusted completion.
`mangome_work`	read	Enter/progress governed work through deterministic allow-listed transitions.
`mark_effect_dispatched`	read	PER/1: record an actual dispatch attempt. A lost response remains UNKNOWN until observed.
`migrate_schema`	write	Dry-run or explicitly persist registered lazy schema migrations.
`model_stats`	read	Return empirical cost/verified-outcome statistics.
`prepare_assignment`	read	Prepare internal execution for an admitted assignment without exposing MangoMe orchestration to the user.
`project_overview`	read	Explain a complete project
`promote_contract_generation`	read	Promote a changed contract working copy into a new immutable canonical generation.
`publish_worker_runtime`	write	Publish a host-observed worker runtime snapshot through the router capability.
`read_context`	read	Read all relevant family context. Reading is unrestricted.
`reconcile_assignment`	read	Bridge free worker reasoning into governed MangoMe work without creating truth.
`reconcile_bigbang`	write	Explicitly reconcile a small caller-supplied candidate set without mutation.
`reconcile_bigbang_scan`	read	Explicit server-side scan + advisory reconciliation with no canonical mutation.
`reconcile_effect`	read	PER/1: reconcile durable intent against observed reality; positive satisfaction requires verifier authority.
`record_audit_finding`	read	Persist one scoped audit finding; EXPAND follows the configured graph frontier without expanding mutation authority.
`record_effect_intent`	read	PER/1: persist durable intent before a governed external side effect is dispatched.
`record_effect_observation`	read	PER/1: record observed external reality without turning observation into reconciliation.
`record_execution_receipt`	read	Record model/agent cost and durable outcome economics, including optional UAI/1 transport telemetry.
`record_fast_judgment`	read	Persist an FJD/1 result as PROGRESSIVE WORKER_JUDGMENT bound to WorkIdentity.
`record_truth_assertion`	write	Record one canonical BTTM/1 assertion under a VERIFY or MODIFY work turn.
`recovery_context`	read	Return compact authoritative recovery state; never derive admitted work state from path discovery.
`refresh_views`	read	Refresh all deterministic family views without LLM use.
`register_contract`	write	Append normative Contract truth; work-bound families require a MODIFY WorkTurn.
`register_model`	read	Register a model/access-path identity for empirical execution comparisons.
`register_playbook`	read	Register procedural Playbook metadata. Playbooks never become normative project truth.
`reject_override`	read	Reject using the owner runtime capability.
`release_contract_generation_grant`	write	Release an unused contract-generation write grant owned by the current actor.
`render_uai_result`	read	Render a structured UAI/1R worker result into deterministic human-readable English or German.
`repository_locations`	read	Return observed physical Git checkout/worktree locations without inferring project truth.
`request_override`	write	Create an explicit approval request; requesting approval does not grant it.
`resolve`	read	Resolve a family, declared contract id, or slice id without semantic guessing.
`select_playbook`	read	Select a replaceable procedural Playbook for a WorkIdentity; selection is PROGRESSIVE/non-normative.
`session_bootstrap`	read	Bounded read-only bootstrap: bind cheaply, then read canonical restore state.
`session_restore`	read	Restore canonical session/work state without discovery or state creation.
`set_gate`	write	Set a gate. PASS requires attested PASS evidence; WAIVED requires approved owner decision.
`set_gate_controlled`	write	Compatibility alias for v0.1.1 controlled gate updates.
`slice_closure_status`	read	Return execution, validation, assurance, closure and required-effect blockers for one Slice.
`start_scoped_audit`	write	Start SRA/1 bounded recursive audit from a local scope. Scope may expand; mutation authority never does.
`start_slice`	write	Start a slice and bind it to the actor
`status`	read	Return deterministic materialized state for one family.
`submit_evidence`	write	Persist evidence. New evidence is UNATTESTED until a trusted verifier/owner attests it.
`submit_plan`	write	Record a plan. v0.3 work requires WorkIdentity + controller-minted EXECUTE/CONTINUE turn + current baseline.
`submit_verification_observation`	write	Persist an independent AV/1 verifier observation. REPLAY requires an intact RB/1 binding; MangoMe does not execute the check itself.
`trust_boundary_status`	read	Report MangoMe
`truth_assertion_status`	read	Evaluate one assertion
`truth_at`	read	Query BTTM/1 independently by represented-world time and MangoMe-known time.
`update_slice_progress`	write	Persist slice progress; the same active plan that started the slice is mandatory.
`validate_slice`	read	Validate a DONE_CLAIMED Slice as VALIDATED, REWORK_REQUIRED, or INCONCLUSIVE. Validation is not verification.
`verify_slice`	read	Verify a VALIDATED DONE_CLAIMED Slice; close only when requested and required effects are reconciled.
`work_context`	read	Read identity-bound canonical/progressive/volatile context without filesystem reconstruction.
`workspace_status`	read	Return workspace state, or a bounded display-only folder summary when ``human`` is true.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: none-observed
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (12)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/mangome/importer.py:80

sensitive_names = {".npmrc", ".pypirc", ".netrc", "id_rsa", "id_dsa", "credentials", "secrets"}

Why it matters. touches a credential store

MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

skill/mangome/SKILL.md:45

Explicit task opt-out takes precedence. If the current user says the task must run without MangoMe or MangoMe is out of scope, do not call MangoMe for that task and do not treat MangoMe unavailability

MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

src/mangome/skill/SKILL.md:45

Explicit task opt-out takes precedence. If the current user says the task must run without MangoMe or MangoMe is out of scope, do not call MangoMe for that task and do not treat MangoMe unavailability

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

tests/test_filesystem.py:19

(tmp_path / ".ssh" / "id_rsa").write_text("secret\n", encoding="utf-8")

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

tests/test_filesystem.py:30

assert str((tmp_path / ".ssh" / "id_rsa").resolve()) not in indexed_paths

Why it matters. touches a credential store

LOWPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

README.md:137

- If the current user explicitly says a task should run without MangoMe, MangoMe stays out of that task.

LOWPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

docs/v0.3.21-release-notes.md:24

MangoMe is not a universal execution dependency. If the current user explicitly says a task should run without MangoMe or that MangoMe is out of scope, the task must not be routed through MangoMe.

LOWPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

docs/zero-touch-operability.md:45

If the current user explicitly says a task should run without MangoMe or MangoMe is out of scope, MangoMe is not an execution dependency for that task. A MangoMe-specific failure must not be promoted

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

CHANGELOG.md:46

- Moves zero-touch adoption into the managed runtime itself: first canonical database access now invokes the bounded credential-adoption/bootstrap path automatically, so a successful installation no l

Why it matters. asks the agent to read credentials

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

README.md:427

Managed-runtime readiness is also zero-touch: the first canonical database access automatically runs the bounded credential-adoption/index-bootstrap path when the MCP process is launched from a manage

Why it matters. asks the agent to read credentials

LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427

docs/v0.3.12-release-notes.md:56

For the evaluation host this fixes the configuration path that previously fell back to unauthenticated `mongodb://127.0.0.1:27017`. A production trust boundary still requires MangoMe to run under a se

Why it matters. asks the agent to read credentials

INFOInventory / provenance · inv.oversize · CWE-1104

docs/mangome-banner.png

docs/mangome-banner.png

Why it matters. 2062062 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 820d887625fafull audit observations/trust-audit/mcp-server/tonnestate__mangome.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-11	`820d887625fa`	BLOCK	D	69	first audit

Questions

What is the MangoMe MCP server?

Persistent multi-agent work graph and document-state machine for contracts, specs, slices, evidence, verification, handoffs, and cost-aware AI execution.

What tools does MangoMe expose?

107 in total: 83 read-only, 24 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is MangoMe safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does MangoMe need?

It reads MANGOME_AGENT_CONTEXT_TOKEN_BUDGET, MANGOME_APPROVAL_TOKEN and MANGOME_VERIFIER_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does MangoMe run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as mangome-mcp.

How current is this page?

The grade is for one exact copy of the source (820d887625fa), read on 2026-10-11. The repository is watched and re-audited when it changes.

Source	tonnestate/MangoMe
PyPI	`mangome-mcp`
Transports	streamable-http
Credentials it reads	`MANGOME_AGENT_CONTEXT_TOKEN_BUDGETMANGOME_APPROVAL_TOKENMANGOME_VERIFIER_TOKEN`
License	Apache-2.0
Activity	pushed 0d ago