Atlas / MCP servers / vorn-run / Vorn

VornBLOCK

Name: Vorn
Author: vorn-run

mcp/vorn-run/vorn

MCP server by vorn-run · ai · ai agents · claude · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Vorn - The agent command center

Verdict

BLOCK

Grade

Trust score

39 /100

Exposed tools

102 73r · 23w · 6d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The agent command center

Run agents interactively or let them work autonomously — everything local, everything yours.

Install · Features · Agents · Development

Why Vorn?

Vorn is the agent command center. How you work is up to you.

Like vibecoding interactively? Open multiple terminals and pair with several agents at once — Claude on one task, Copilot on another, Codex on a third. Every agent runs in its own PTY with full native output. No wrappers, no API keys, no reimplementation.

Prefer to stay hands-off? Define your tasks and workflows, then let agents work headlessly in the background. Set up a workflow that automatically reviews code when a task moves to "in review", spins up another agent to generate documentation, runs your test suite after every implementation.

**Chain agents

Read from source at commit 14a1de654c43OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add vorn-website --env FIXTURE_SECRET=${FIXTURE_SECRET} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env VORN_EXTENSION_TOKEN=${VORN_EXTENSION_TOKEN} -- npx -y vorn-website

claude-desktop

{
  "mcpServers": {
    "vorn-website": {
      "command": "npx",
      "args": [
        "-y",
        "vorn-website"
      ],
      "env": {
        "FIXTURE_SECRET": "${FIXTURE_SECRET}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}",
        "VORN_EXTENSION_TOKEN": "${VORN_EXTENSION_TOKEN}"
      }
    }
  }
}

Exposed tools (102)

73 read · 23 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Acme`	read	Talks to Acme
`Broken`	read	Broken
`Closed`	read	Closed
`Cursorless`	read	Cursorless
`Empty`	read	Empty
`Escaping`	read	Escaping
`Leaky`	read	Leaks
`Manual`	read	Manual
`Mislabelled`	read	Mislabelled
`Mocked`	read	Mocked
`Playwright`	read	Drive a browser
`Reaching`	read	Reaching
`Review`	read	Read the diff beside the terminal.
`Shipped`	read	Shipped
`Shut`	read	Shut
`Slack`	read	Messages and channels
`Stuck`	read	Stuck
`Unpacked`	read	Unpacked
`archive_task`	read	Archive a finished task (status must be done or cancelled). Archived tasks are hidden from default views but preserved and restorable.
`backfill_connection`	read	Pull items from a connection now and turn them into tasks, without waiting for its poll
`browser_find`	read	Find elements in your session browser pane whose accessible name contains some text.
`browser_history`	read	Step back or forward through your session browser pane
`browser_interact`	read	Act on your session browser pane: click, hover, type, press a key, or scroll. Address the
`browser_navigate`	read	Navigate your session browser pane to a URL. Opens the pane first if none is open.
`browser_screenshot`	read	Capture your session browser pane as a PNG. This is the expensive last resort — reach for
`browser_tabs`	write	List, add, close, or switch tabs in your session browser pane.
`build`	read	Build the thing
`c`	read	too deep
`create_project`	write	Create a new project
`create_task`	write	Create a new task in a project
`create_workflow`	write	Create a workflow: a graph of steps started by one trigger. Call describe_workflow_nodes
`create_workspace`	write	Create a new workspace for organizing projects
`delete_project`	destructive	Delete a project and all its tasks
`delete_task`	destructive	Delete a task by ID
`delete_workflow`	destructive	Delete a workflow
`delete_workspace`	destructive	Delete a workspace
`demo`	read	A demo tool
`describe_workflow_nodes`	read	The reference for writing a workflow: for each node type its config schema, the outputs later steps read, and the rules create_workflow checks; the edge schema; limits; the template namespaces; and a complete example workflow to adapt. Call it before create_workflow or update_workflow.
`device_claim`	read	Claim a simulator for your session, booting it if needed. Every other device tool acts on
`device_find`	read	Find elements on your claimed simulator whose label or accessibility identifier contains
`device_install`	write	Install a built .app bundle on your claimed simulator. Takes a path to an already-built
`device_interact`	read	Act on your claimed simulator: tap, swipe, type, press a hardware button, long-press, or
`device_launch`	read	Launch an installed app on your claimed simulator by bundle id.
`device_list`	read	List the iOS simulators on this machine, with their state and which session (if any) has
`device_logs`	read	Read log output captured from your claimed simulator since it was claimed.
`device_open_url`	read	Open a URL on your claimed simulator — a web URL in Safari, or a custom scheme to exercise
`device_release`	read	Release your claimed simulator so another session can use it. A simulator Vorn booted is
`device_screenshot`	read	Capture your claimed simulator as a downscaled PNG. The expensive last resort — reach for
`device_terminate`	destructive	Terminate a running app on your claimed simulator by bundle id.
`echo`	read	Says back what it was given.
`execute_workflow`	write	Run a workflow now, as if triggered manually. Supply values for any parameters the workflow declares (see the trigger node
`export_workflow`	read
`fails`	read
`get_config`	read	Get the full Vorn configuration (projects, tasks, workflows, settings)
`get_my_context`	read	Get your current task and project context. Auto-detects based on your working directory.
`get_page_text`	read	Read the visible text of your session browser pane. Use when you want to read an article
`get_task`	read	Get a task by ID
`get_workflow_schedule`	write	Get scheduler info for a workflow: execution log or next scheduled run. Requires the Vorn app to be running.
`gone`	read	Gone
`huge`	read	d
`import_workflow`	write
`inspect_connector_package`	write	Start a connector package and read what it offers — its triggers, actions and required
`install_connector`	write	Install a connector from a pack file, from the catalog, or by a launch command, creating
`keep`	read	Keep
`kill_session`	destructive	Kill a terminal or headless session. Requires the Vorn app to be running.
`launch_session`	read	Launch an AI agent session (interactive terminal or headless). Requires the Vorn app to be running.
`list_artifacts`	read	List the artifacts published by your session or in your project, newest first.
`list_connections`	read	List configured connector connections, including when each last synced and the error
`list_connector_actions`	write	List the actions a connection can execute, with their input schemas. Call this before
`list_connectors`	read	List every connector and extension: the ones built into Vorn, the ones installable from a
`list_projects`	read	List all projects, optionally filtered by workspace
`list_session_events`	write	List session lifecycle events (created, exited, renamed). Use for post-mortem analysis and multi-agent coordination.
`list_sessions`	read	List terminal sessions. Filter by status:
`list_tasks`	read	List tasks, optionally filtered by project, status, assigned agent, or workspace. Archived tasks are excluded by default; pass include_archived=true to include them.
`list_workflow_runs`	read	List workflow execution history. Filter by workflow_id or task_id; with neither, lists the runs parked on an approval gate, each waiting node saying what it asks.
`list_workflows`	read	List all workflows, optionally filtered by workspace
`list_workspaces`	read	List all workspaces
`old`	read	Old
`open_browser_pane`	read	Open the browser pane for your session, optionally at a URL. You do not need a person to
`open_device_pane`	read	Open the device pane for your session so the person can watch. You do not need this to
`publish_artifact`	write	Publish a page, doc or design for the person to review. It opens in your session browser
`read_artifact`	read	Read the source of an artifact version: Markdown for a doc, HTML for a page or design.
`read_artifact_comments`	read	Read the comments the person left on an artifact: the quoted words or point each one is
`read_console_messages`	read	Read console output captured from your session browser pane since it opened.
`read_network_requests`	read	Read network requests captured from your session browser pane since it opened.
`read_page`	read	Read your session browser pane as an accessibility tree. Interactive elements carry a
`read_screen`	read	Read your claimed simulator as an accessibility tree. Elements carry a
`read_session_output`	read	Read terminal output from a running session. Output is stored in a rolling 1000-line buffer with ANSI codes stripped.
`rename_session`	write	Rename a terminal session. Changes the display name shown in the UI.
`reorder_sessions`	read	Reorder terminal sessions in the grid. Provide session IDs in the desired display order.
`resolve_gate`	read
`run_connector_action`	write	Execute one action on a connection — create an issue, run a query, close a work item.
`search`	read	Search everything
`send_key`	write	Send a single keystroke or key combo to a terminal session without appending Enter. Use for TUI interactions like selecting menu options (1, 2, y, n), pressing Escape, Ctrl+C, arrow keys, etc.
`stop_workflow_run`	write	Stop a workflow run that is still going, including one parked on an approval gate. Kills the agents it started, marks its unfinished nodes, and closes the run as cancelled. Requires the Vorn app to be running.
`structured`	read	Answers with structured content.
`unarchive_task`	read	Restore an archived task so it shows in default views again.
`update_project`	write	Update a project
`update_task`	write	Update a task
`update_workflow`	write	Change a workflow. Only the fields you pass change; nodes and edges each replace the
`update_workspace`	write	Update a workspace
`write_to_terminal`	write	Send input to a running terminal session. Requires the Vorn app to be running.

Trust audit

BLOCKgrade F · trust 39/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (16 observation(s))
Network: declared (14 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/core/crates/vornd/src/native/credential.rs:264

key_type("-----BEGIN OPENSSH PRIVATE KEY----- ED25519"),

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/core/crates/vornd/src/native/credential.rs:267

assert_eq!(key_type("-----BEGIN RSA PRIVATE KEY-----"), Some("rsa"));

CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/core/crates/vornd/src/native/sessions.rs:2404

const KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY----- never-shown";

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/core/crates/remote/src/lib.rs:195

pub fn exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

packages/core/crates/vorn-git/src/repo.rs:147

fn exec(

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/renderer/components/settings/SSHSettings.tsx:457

placeholder="~/.ssh/id_ed25519"

Why it matters. touches a credential store

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/core/crates/recovery/transcripts/claude.rec

claude.rec

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/core/crates/recovery/transcripts/htop.rec

htop.rec

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

packages/core/crates/recovery/transcripts/vim.rec

vim.rec

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

resources/icon.icns

icon.icns

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

bench/suites/renderer.ts:131

const url = `http://127.0.0.1:${(server.address() as AddressInfo).port}/`

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/crates/connectors/src/install.rs:955

Source::parse(&json!({ "kind": "url", "url": "http://127.0.0.1:9/a.tgz" })).is_ok()

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/crates/extensions/src/bridge.rs:405

Some("http://127.0.0.1:1"),

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/core/crates/extensions/src/page.rs:238

"http://127.0.0.1:1",

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

packages/core/crates/term-proto/src/row.rs:411

Cell::wide("👩👩👧"),

MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321

tests/fixtures/js-reference/connector-functions.json:9864

"input": "AKIAqnxn5cKLQDIIJ9Xs",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/native-server-connectors.test.ts:198

secret: 'sealed-by-the-desktop'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/vornd-size.test.ts:20

const TOKEN = 'desktop-launch-token'

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

tests/native-server-credentials.test.ts:28

const KEY = '-----BEGIN OPENSSH PRIVATE KEY----- ED25519 never-in-a-row'

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_project, delete_task, delete_workflow, delete_workspace, device_terminate, kill_session

Why it matters. 6 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius