Atlas / MCP servers / vercel-labs / callscript

callscriptBLOCK

mcp/vercel-labs/callscript
Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
6 5r · 1w · 0d
Transport
—
License
Apache-2.0
Stars
118
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Code Mode, without the sandbox.

The model writes JavaScript; callscript parses it into a JSON plan instead of executing it. Plans validate before they run, suspend and resume across processes, and keep intermediate results addressable so steps aren't re-executed to recover their output. With no sandbox and no separate runtime, the only thing the code can execute is your tools.

Install

npm install callscript

Two small runtime dependencies (acorn, zod), no sandbox, no service: the engine is a library that runs wherever your JS runs. The adapter's peer (ai) is optional and only needed by its own entrypoint.

Quick start

Mount your AI SDK tools on an engine and hand the model the ready-made tools - execute runs the script it authors; search and describe let it discover mounted tools without carrying every definition in its prompt:

import { generateText } from "ai";
import { callscript } from "callscript";
import { toAISDKTools, fromAISDKTools } from "callscript/ai-sdk";

const engine = callscript({
tools: fromAISDKTools(tools, { namespace: "github" }),
});

await generateText({
model: "anthropic/claude-sonnet-5",
prompt: "Close every stale open issue in the 'api' repo.",
tools: toAISDKTools(engine), // execute + search + describe
});

Why

Classic tool calling has a shape problem: one call per model round-trip. Every intermediate result travels back through the context window just so the model can look at it and decide the next call: slow

Read from source at commit 291f336b2445OBSERVED · 2026-10-08
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add callscript -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "callscript": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (6)

5 read · 1 write · 0 destructive.

ToolRiskDescription
close_issuereadclose an issue by number
github.closeIssuereadclose an issue by number
github.listIssuesreadlist the issues of a repo
issues.closereadclose an issue by number
list_issuesreadlist the issues of a repo
slack.postwritepost a message to a slack channel
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (2 observation(s))
Shell
declared (2 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (5)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/web/components/playground.tsx:202
const evaluate = new Function(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/web/components/playground.tsx:1229
const fn = new Function(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
apps/web/package.json
ai, next, react, react-dom, shiki, @tailwindcss/postcss, @types/node, @types/react
Why it matters. 11 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@biomejs/biome, bumpp, turbo
Why it matters. 3 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
packages/callscript/package.json
acorn, zod, @types/node, ai, tsdown, typescript, vitest
Why it matters. 7 dependency range(s) float
Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 291f336b2445full audit observations/trust-audit/mcp-server/vercel-labs__callscript.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08291f336b2445BLOCKD69first audit
06

Questions

What tools does callscript expose?

6 in total: 5 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is callscript safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does callscript need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (291f336b2445), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement