Atlas / MCP servers / trailhq / Trail-Code

Trail-CodeBLOCK

Name: Trail-Code
Author: trailhq

mcp/trailhq/trail-code

MCP server by trailhq · ai agents · anthropic · claude code · Audited 2026-10-23

Turbocharge Claude Code, Cursor, Codex, Gemini & every coding agent: faster, cheaper, with contextual understanding specific to your codebase.

Verdict

BLOCK

Grade

Trust score

47 /100

Exposed tools

27 24r · 3w · 0d

Transport

—

License

MIT

Stars

10,675

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The self-learning context layer for coding agents.

Trail-code gives Claude Code, Cursor, Codex and other coding agents a map of your code, and what your team has learned about it.

Read from source at commit bb72cf81f312OBSERVED · 2026-10-23

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add graft --env API_KEY=${API_KEY} --env GH_TOKEN=${GH_TOKEN} --env GRAFT_POSTHOG_KEY=${GRAFT_POSTHOG_KEY} --env TRAIL_API_KEY=${TRAIL_API_KEY} -- npx -y @nanonets/[email protected]

claude-desktop

{
  "mcpServers": {
    "graft": {
      "command": "npx",
      "args": [
        "-y",
        "@nanonets/[email protected]"
      ],
      "env": {
        "API_KEY": "${API_KEY}",
        "GH_TOKEN": "${GH_TOKEN}",
        "GRAFT_POSTHOG_KEY": "${GRAFT_POSTHOG_KEY}",
        "TRAIL_API_KEY": "${TRAIL_API_KEY}"
      }
    }
  }
}

Exposed tools (27)

24 read · 3 write · 0 destructive.

Tool	Risk	Description
`a`	read	d
`b`	read	d
`demo-kit`	read
`draw_diagram`	read	d
`get_context`	read	The rules from your Trail workspace
`get_rules`	read	Every rule in one of your Trail workspace
`graft-fingerprint-cache-bug`	read	deleting fingerprint..json triggers a full re-parse (46s); prune extract..json only
`graft_check_freshness`	write	Report whether the committed graph is in sync with the code (drift check).
`graft_file_api`	read	Signatures-only view of one file — every definition
`graft_find_all`	read	Regex search over the graph\
`graft_find_code`	read	Query the repo context graph in plain words. Returns ranked nodes with exact file:line spans and the relevant source inlined — usually the full answer, no file reads needed.
`graft_repo_map`	read	Token-budgeted repo orientation — directory clusters, per-directory hubs, and global hotspots computed purely from the wiring graph ($0, no LLM). Use this to get oriented in an unfamiliar repo before diving into files.
`graft_trace_calls`	write	Structural edges for a symbol, over call/reference/import/implements/extends ($0, no LLM). Defaults to direct callers (who depends on it). Set direction:
`late-name`	read	too late
`list_agents`	read	Remote: agents.
`list_brains`	read	Your Trail workspace
`publish-acme-cli`	write	Publish acme-cli to npm—then check it with npm view.
`record_graph`	read	d
`record_names`	read	Record one name per cluster.
`release-npm`	read	Publishes the package to npm
`search_rules`	read	Search the rules in your Trail workspace
`ship-beta-then-prod`	read	Ships storefront to beta, then fast-forwards prod, from the steps that worked on Oct 27. Use when asked to push to beta, ff to prod, fast-forward prod, promote to prod, deploy to prod, update prod or ship it.
`ship-prod`	read
`stray-item`	read	not asked for
`tests-cli`	read	Runs the tests.
`workflow-release`	read	fine
`x`	read

Trust audit

BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (6 observation(s))
Shell: declared (5 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/skills/never-save.ts:87

const CREDENTIAL = /(?:\.npmrc|\.netrc|\.aws\/(?:credentials|sso\/cache|cli\/cache)|(?<![\w.])\.ssh\/|\.git-credentials|\.docker\/config\.json|gh\/hosts\.yml|com\.vercel\.cli\/auth\.json|\.config\/gcl

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/skills/never-save.ts:130

const writes = CREDENTIAL_WRITE.test(c) || />>?\s*\S*(?:\.npmrc|\.netrc|credentials|\.ssh\/|config\.json|hosts\.yml|auth\.json|\.kube\/config|\.pypirc|\.pgpass)|\b(?:cp|mv|tee|ln)\b|security\s+add-/i.

Why it matters. touches a credential store

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/skills/risk-delta.ts:19

export const RISKY_FLAG = /^(?:--no-verify|--no-gpg-sign|--no-sign|-n|-f|--force(?:-[\w-]+)?|--dangerously[\w-]*|--permission-mode|--allow(?:ed)?-?tools|--privileged|--cap-add|--security-opt|--registr

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHContainer / deploy · priv.container · CWE-250, CWE-16

src/skills/anchors-wide.ts:140

'--privileged', '-y', '--yes', '--dry-run', '-q', '--quiet']);

HIGHContainer / deploy · priv.container · CWE-250, CWE-16

src/skills/risk-delta.ts:19

export const RISKY_FLAG = /^(?:--no-verify|--no-gpg-sign|--no-sign|-n|-f|--force(?:-[\w-]+)?|--dangerously[\w-]*|--permission-mode|--allow(?:ed)?-?tools|--privileged|--cap-add|--security-opt|--registr

HIGHContainer / deploy · priv.container · CWE-250, CWE-16

src/trace/walls.ts:54

const DOCKER_ENV = 'DOCKER_HOST=unix://$HOME/.colima/default/docker.sock TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE=/var/run/docker.sock TESTCONTAINERS_RYUK_DISABLED=true';

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250

src/init/prefs.ts:217

'ls', 'cat', 'echo', 'cd', 'rm', 'cp', 'mv', 'mkdir', 'chmod', 'sh', 'bash', 'zsh', 'fish', 'sudo', 'env', 'timeout', 'eslint', 'prettier',

Why it matters. asks for elevated privileges

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250

src/skills/never-save.ts:57

const SUDO = /(?:^|[^\w./-])(?:[\w./-]*\/)?(?:sudo|doas|pkexec)(?![\w-])/i;

Why it matters. asks for elevated privileges

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250

src/skills/never-save.ts:58

const SHELL_WORD = String.raw`(?:sudo\s+(?:-\S+\s+)*)?(?:env\s+(?:\S+=\S*\s+)*)?(?:[\w./-]*\/)?`;

Why it matters. asks for elevated privileges

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250

src/skills/never-save.ts:113

['runs sudo', (c) => SUDO.test(c)],

Why it matters. asks for elevated privileges

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250

src/trace/repairs.ts:108

const WRAPPERS = new Set(['sudo', 'doas', 'nice', 'nohup', 'time', 'exec', 'command', 'caffeinate', 'stdbuf', 'ionice', 'chrt']);

Why it matters. asks for elevated privileges

MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250

src/skills/risk-delta.ts:28

String.raw`\bxattr\s+-[a-z]*[dc]`, String.raw`\b(?:spctl|csrutil|systemsetup|dscl|nvram|crontab|chown)\b`, String.raw`\bdefaults\s+write\b`,

MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59

src/trace/guard-fast.ts:39

'/etc/profiles/per-user/$USER/bin',

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

Dockerfile:74

CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/viz/serve.ts:140

url: `http://127.0.0.1:${port}`,

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

src/skills/skill-file.ts:43

const lines = text.replace(/^/, "").split(/\r?\n/);

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

test/trail-cold-start.test.ts:132

const out = scrub("use ghp_abcdefghijklmnopqrstuvwxyz1234 and password: hunter2 for [email protected], key AKIAABCDEFGHIJKLMNOP");

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

test/trace-redact.test.ts:26

assert.deepEqual(redactSecrets(`export API_KEY="sk-abc123def456ghi789jkl012" && node x.js`),