callscriptBLOCK
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Code Mode, without the sandbox.
The model writes JavaScript; callscript parses it into a JSON plan instead of executing it. Plans validate before they run, suspend and resume across processes, and keep intermediate results addressable so steps aren't re-executed to recover their output. With no sandbox and no separate runtime, the only thing the code can execute is your tools.
Install
npm install callscript
Two small runtime dependencies (acorn, zod), no sandbox, no service: the engine is a library that runs wherever your JS runs. The adapter's peer (ai) is optional and only needed by its own entrypoint.
Quick start
Mount your AI SDK tools on an engine and hand the model the ready-made tools - execute runs the script it authors; search and describe let it discover mounted tools without carrying every definition in its prompt:
import { generateText } from "ai";
import { callscript } from "callscript";
import { toAISDKTools, fromAISDKTools } from "callscript/ai-sdk";
const engine = callscript({
tools: fromAISDKTools(tools, { namespace: "github" }),
});
await generateText({
model: "anthropic/claude-sonnet-5",
prompt: "Close every stale open issue in the 'api' repo.",
tools: toAISDKTools(engine), // execute + search + describe
});Why
Classic tool calling has a shape problem: one call per model round-trip. Every intermediate result travels back through the context window just so the model can look at it and decide the next call: slow
291f336b2445OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add callscript -- npx -y [email protected]
{
"mcpServers": {
"callscript": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (6)
5 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
close_issue | read | close an issue by number |
github.closeIssue | read | close an issue by number |
github.listIssues | read | list the issues of a repo |
issues.close | read | close an issue by number |
list_issues | read | list the issues of a repo |
slack.post | write | post a message to a slack channel |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
const evaluate = new Function(
const fn = new Function(
ai, next, react, react-dom, shiki, @tailwindcss/postcss, @types/node, @types/react
@biomejs/biome, bumpp, turbo
acorn, zod, @types/node, ai, tsdown, typescript, vitest
Gates applied: no_behavioural_pass.
291f336b2445full audit observations/trust-audit/mcp-server/vercel-labs__callscript.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 291f336b2445 | BLOCK | D | 69 | first audit |
Questions
What tools does callscript expose?
6 in total: 5 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is callscript safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does callscript need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (291f336b2445), read on 2026-10-08. The repository is watched and re-audited when it changes.