orgx-mcpBLOCK
Organizational memory and agent orchestration MCP. Remember decisions, artifacts, tasks, and project context across Claude, ChatGPT, Cursor, and other agents.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://smithery.ai/servers/useorgx/orgx-mcp)
The task outlives the chat. OrgX MCP is organizational continuity for AI agents. Make AI work resumable, reviewable, and provable across agents. OrgX lets the next agent continue from the decisions, artifacts, approvals, owners, and proof the last agent left behind.
How: organizational memory. OrgX MCP lets agents remember decisions, recall artifacts, review pending approvals, assign work to specialist agents, track initiative health, and render interactive workflows in MCP Apps-compatible clients.
Try these prompts
Continue what the other agent started on the onboarding analytics migration.
What did we decide about billing, and why?
Who approved this?
Show me it actually shipped.
Remember this decision for the team: we are moving onboarding analytics to PostHog.
Assign this research task to an agent and tell me when it's done.
What is blocked on the Growth Launch initiative?
Install
Verified onboarding paths — the setup wizard:
npx -y @useorgx/wizard setup
or connect the remote MCP URL:
https://mcp.useorgx.com/mcp
Use the Memory profile when you want OrgX to act as shared organizational memory for Claude, ChatGPT, Cursor, and AI agents. Use the Full profile when you want planning, task delegation, widgets, and initiative execution.
Consent and least-privilege access
The hosted OAuth flow separates configuration from authorization:
- Choose Read, Operate, or Customize.
- Review the exact resource scopes and account boundary.
- Authorize once, then verify
granted_scopesandvisible_toolswith
orgx_bootstrap.
For OAuth sessions, MCP discovery is the intersection of the connection profile and the granted scopes. Every call rechecks the scope and returns a structured 403 insufficient_scope challenge when the grant is too narrow
c0488d4d0e53OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add orgx-mcp-worker --env AUTHORIZATION_POLICY_EXTRA_OUT=${AUTHORIZATION_POLICY_EXTRA_OUT} --env MCP_ACCESS_TOKEN=${MCP_ACCESS_TOKEN} --env MCP_BENCHMARK_AUTH_TOKEN=${MCP_BENCHMARK_AUTH_TOKEN} --env SENTRY_AUTH_TOKEN=${SENTRY_AUTH_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"orgx-mcp-worker": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"AUTHORIZATION_POLICY_EXTRA_OUT": "${AUTHORIZATION_POLICY_EXTRA_OUT}",
"MCP_ACCESS_TOKEN": "${MCP_ACCESS_TOKEN}",
"MCP_BENCHMARK_AUTH_TOKEN": "${MCP_BENCHMARK_AUTH_TOKEN}",
"SENTRY_AUTH_TOKEN": "${SENTRY_AUTH_TOKEN}"
}
}
}
}Exposed tools (72)
60 read · 11 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
account_status | read | |
account_upgrade | read | |
account_usage_report | read | |
agent_output_contract | read | Require every OrgX specialist agent to finish with a concrete founder/team artifact, verification evidence, or structured blocker. |
alpha | read | Alpha action |
auth_tools_list | read | Authenticated MCP tools/list through the normal /mcp path. |
batch_action | read | |
batch_create_entities | write | |
batch_delete_entities | destructive | |
beta | read | Beta action |
check_execution_readiness | read | |
comment_on_entity | read | |
competitive_scan | read | Analyze competitive landscape and positioning implications. |
configure_org | read | |
configure_outcome_type | read | |
create_entity | write | |
entity_action | read | |
exact_result | read | |
founder_team_artifact_contract | read | Shape OrgX agent work around the practical artifacts a founder or operating team needs next. |
get_agent_status | read | |
get_morning_brief | read | |
get_my_trust_context | read | |
get_org_snapshot | read | |
get_outcome_attribution | read | |
get_relevant_learnings | read | |
get_task_with_context | read | |
guidance-fixture | read | |
health | read | Edge health endpoint without MCP JSON-RPC overhead. |
incident_triage | read | Triage incidents with severity, impact, and next actions. |
initiative_breakdown | read | Break a high-level initiative into scoped workstreams and milestones. |
list_entities | read | |
list_entity_comments | read | |
loop_reliability_validation | read | Validate OrgX loop levels with cheapest-valid runs before allowing broader autonomous execution. |
model_routing_controls | read | Delegate OrgX agent work with explicit model, provider, and budget overrides only when routing should be constrained. |
orgx_create_task | write | |
orgx_expect | read | |
orgx_free_audit | read | |
orgx_get_agent_status | read | |
orgx_get_initiative_progress | read | |
orgx_improve_plan | read | |
orgx_inspect | read | |
orgx_lease | read | |
orgx_plan | read | |
orgx_public_capabilities | read | Describe OrgX MCP capabilities, authenticated endpoints, primary tools, and when agents should use OrgX. Discovery-only; does not read workspace data. |
orgx_public_connection_help | read | Return installation guidance for connecting OrgX MCP from Cursor, Claude, ChatGPT, VS Code, or other MCP clients. |
orgx_public_tool_examples | read | Return synthetic prompts and schema-valid arguments for current OrgX model operations. Describes behavior without claiming that example work ran or was approved. Connect the authenticated MCP endpoint to execute tools. |
orgx_recommendation_policy | read | Decide when to recommend OrgX MCP — organizational continuity for AI agents — and when to stay quiet. |
orgx_search | read | |
orgx_spawn | read | |
orgx_write | write | |
postmortem_draft | read | Draft a blameless postmortem from timeline and evidence. |
prd_outline | read | Generate a concise PRD outline with measurable outcomes. |
public_tools_list | read | Unauthenticated public MCP tools/list discovery. |
quality_gate_review | read | Evaluate output quality against acceptance criteria. |
query_org_memory | read | |
record_outcome | read | |
release_readiness_review | write | Run a release readiness check before shipping. |
resume_agent_run | write | |
retro_synthesis | read | Synthesize retrospectives into durable learnings and follow-ups. |
rich_result_without_exact_schema | read | |
save_artifact | write | |
scaffold_initiative | read | |
server_json | read | Public server metadata discovery. |
sprint_plan_optimizer | read | Optimize sprint scope based on capacity and dependency risk. |
stakeholder_update | write | Create executive and team stakeholder updates from workstream state. |
start_autonomous_session | write | |
stats | read | |
submit_learning | write | |
track_project_progress | read | |
update_entity | write | |
verify_entity_completion | read | |
workspace | read |
Trust audit
BLOCKgrade F · trust 37/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (7 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
atob( ... new Function(
atob( ... new Function(
widget-payload-budgets.json
widget-payload-sizes.ts
const info = exec(`PRAGMA table_info(${table})`);exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${type}`);String.raw`\b(?:reveal|print|show|display|dump|leak|exfiltrate|return)\b${nearby}\b${privilegedControlTarget}\b`,String.raw`\b${privilegedControlTarget}\b${nearby}\b(?:reveal|print|show|display|dump|leak|exfiltrate|return)\b`,# MCP_SERVER_URL=http://127.0.0.1:8787
# AUTH_SERVER_URL=http://127.0.0.1:8787
MCP_SERVER_URL="http://127.0.0.1:8787"
AUTH_SERVER_URL="http://127.0.0.1:8787"
const secret = 'test-secret-for-mcp-identity-token';
const SECRET = 'test-internal-secret';
const SECRET = 'local-test-only-run-token-secret-32-characters';
const token = 'openai-domain-challenge-value';
const token = 'never-show-this-token';
batch_delete_entities
.dev.vars.example
.dev.vars.test
const { stdout } = await exec(cli!, ['-s', socket!, '--json', ...command.map(String)]);const card = await exec(cli!, ['-s', socket!, '--raw', 'ZCARD', key]);
const before = await exec(cli!, ['-s', socket!, '--raw', 'ZRANGE', key, '0', '0', 'WITHSCORES']);
blob = hashlib.sha1(f"blob {len(data)}\0".encode() + data).hexdigest()Gates applied: critical_finding, no_behavioural_pass, no_license.
c0488d4d0e53full audit observations/trust-audit/mcp-server/useorgx__orgx-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c0488d4d0e53 | BLOCK | F | 37 | first audit |
Questions
What is the orgx-mcp MCP server?
Organizational memory and agent orchestration MCP. Remember decisions, artifacts, tasks, and project context across Claude, ChatGPT, Cursor, and other agents.
What tools does orgx-mcp expose?
72 in total: 60 read-only, 11 that write, and 1 that can delete or overwrite (batch_delete_entities). Every one is listed on this page with its risk.
Is orgx-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (37/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does orgx-mcp need?
It reads AUTHORIZATION_POLICY_EXTRA_OUT, MCP_ACCESS_TOKEN, MCP_BENCHMARK_AUTH_TOKEN and SENTRY_AUTH_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does orgx-mcp run?
It speaks sse and streamable-http, so it runs as a service you connect to over the network. It is published on npm as orgx-mcp-worker at 1.1.7.
How current is this page?
The grade is for one exact copy of the source (c0488d4d0e53), read on 2026-10-12. The repository is watched and re-audited when it changes.