Atlas / MCP servers / whykusanagi / celeste-cli

celeste-cliBLOCK

Name: celeste-cli
Author: whykusanagi

mcp/whykusanagi/celeste-cli

MCP server by whykusanagi · agentic coding · ai · blockchain · Audited 2026-10-11

Agentic terminal AI assistant with a Bubble Tea TUI, code-graph review, semantic search, multi-provider LLMs, and MCP tools.

Verdict

BLOCK

Grade

Trust score

52 /100

Exposed tools

2 2r · 0w · 0d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Character artwork by いかわさ (ikawasa23)

A premium, corruption-aesthetic command-line interface for CelesteAI

[](https://golang.org/) [](LICENSE) [](https://github.com/charmbracelet/bubbletea)

Built with [Charm's Bubble Tea](https://github.com/charmbracelet/bubbletea) for flicker-free, modern terminal experiences

✨ What is Celeste CLI?

Celeste CLI is a full standalone agentic development tool with her own persona, featuring:

🎨 Premium TUI - Flicker-free rendering with corrupted-theme aesthetics
🔮 48 Built-in Tools - File I/O, shell, web search, code graph, code review, collections search, git, crypto, subagent orchestration, and more
📖 `.grimoire` Project Context - Persona-themed project config files with auto-discovery; AGENTS.md / CLAUDE.md are read too
🧠 Code Graph + Semantic Search - MinHash + BM25 fused ranking with LSH band table for sub-linear queries, structural rerank; tree-sitter parsing (TypeScript, PHP, Python, Rust, Java, C/C++ and Ruby) for accurate call-graph edges in release binaries (a CGO_ENABLED=0 source build falls back to regex parsers); embedded celeste-stopwords v1.0.0 noise filter
🔍 Graph-Based Code Review - Structural analysis detecting stubs, lazy redirects, placeholders, error swallowing, and hardcoded values
🔌 Direct Codegraph MCP Tools - celeste_index, celeste_code_search, celeste_code_review, celeste_code_graph, celeste_code_symbols served verbatim from the cached graph (no chat-LLM round-trip, no max_tokens

Read from source at commit 8ee4b889ba98OBSERVED · 2026-10-11

Exposed tools (2)

2 read · 0 write · 0 destructive.

Tool	Risk	Description
`test`	read	a test
`weather`	read	get weather

Trust audit

BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (7 observation(s))
Network: declared (5 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

cmd/celeste/tools/builtin/bash_safety.go:226

".ssh/id_", ".ssh/authorized_keys",

Why it matters. touches a credential store

MEDIUMInventory / provenance · inv.binary · CWE-1104

cmd/celeste/prompts/persona/celeste_full.enc

celeste_full.enc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

cmd/celeste/prompts/persona/celeste_lite.enc

celeste_lite.enc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

cmd/celeste/prompts/persona/celeste_off.enc

celeste_off.enc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

cmd/celeste/prompts/persona/celeste_spine.enc

celeste_spine.enc

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

cmd/celeste/steer/gate.go:19

QExfiltration = "exfiltration"

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

cmd/celeste/tools/builtin/bash_safety.go:35

var exfilPatterns = []struct {

MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319

cmd/celeste/tools/builtin/bash_safety.go:239

for _, p := range exfilPatterns {

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

cmd/celeste/jev/jev_test.go:105

"DATABASE_URL=postgres://admin:[email protected]:5432/app": "s3cretpw",

MEDIUMHard-coded secrets · secret.github · CWE-798, CWE-321

cmd/celeste/steer/rule_log_redact_test.go:13

const key = "ghp_abcdefghijklmnopqrstuvwxyz0123"

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

cmd/celeste/compact/jev_test.go:79

key := "-----BEGIN RSA PRIVATE KEY-----\n" + strings.Repeat("MIIEowIBAAKCAQEA", 200) + "\n-----END RSA PRIVATE KEY-----"

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

cmd/celeste/jev/jev_test.go:112

"-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAtruncated":  "MIIEowIBAAKCAQEAtruncated",

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862

streamable-http

Why it matters. a network transport with no auth environment variable found

Fix. require a token

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitleaks.toml

.gitleaks.toml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.golangci.yml

.golangci.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.grimoire

.grimoire

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.release-please-manifest.json

.release-please-manifest.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

cmd/celeste/tools/builtin/escapes_test.go:24

content, isErr, err := exec()

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

.github/workflows/release.yml:445

echo "allow-loopback-pinentry" > ~/.gnupg/gpg-agent.conf

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

cmd/celeste/tools/builtin/bash_safety_test.go:43

assert.NotEmpty(t, checkDangerousCommand("cat ~/.ssh/id_rsa"))

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

cmd/celeste/tools/builtin/bash_safety_test.go:44

assert.NotEmpty(t, checkDangerousCommand("cat ~/.aws/credentials"))

Why it matters. touches a credential store

LOWFilesystem / path · fs.credential_store · CWE-22, CWE-59

cmd/celeste/tools/builtin/bash_safety_test.go:45

assert.NotEmpty(t, checkDangerousCommand("cat ~/.kube/config"))

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

cmd/celeste/agent/checkpoint_test.go:21

_, err = store.Load("../../etc/passwd")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

cmd/celeste/agent/checkpoint_within_test.go:26

{"sub/../../run1", true},

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

cmd/celeste/agent/checkpoint_within_test.go:27

{"../../etc/passwd", true},

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 8ee4b889ba98full audit observations/trust-audit/mcp-server/whykusanagi__celeste-cli.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-11	`8ee4b889ba98`	BLOCK	F	52	first audit

Questions

What is the celeste-cli MCP server?

Agentic terminal AI assistant with a Bubble Tea TUI, code-graph review, semantic search, multi-provider LLMs, and MCP tools.

What tools does celeste-cli expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is celeste-cli safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (52/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does celeste-cli need?

No credential environment variables were found in its source, so it appears to need none.

How does celeste-cli run?

It speaks streamable-http, so it runs as a service you connect to over the network.

How current is this page?

The grade is for one exact copy of the source (8ee4b889ba98), read on 2026-10-11. The repository is watched and re-audited when it changes.

Source	whykusanagi/celeste-cli
Transports	streamable-http
License	MIT
Activity	pushed 1d ago