claude-grok-build-pluginBLOCK
A Claude Code plugin (MCP-server wrapper) that lets Claude delegate coding tasks to xAI's Grok Build CLI — billed via your xAI subscription, not metered API. 9 MCP tools, /grok:* commands.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
English · 한국어
[](https://github.com/xzawed/claude-grok-build-plugin/actions/workflows/ci.yml) [](LICENSE)
A Claude Code plugin that lets Claude hand coding work to the [Grok Build](https://x.ai/cli) CLI — billed to your xAI subscription, not silently to a metered API. Claude directs, Grok executes in your working tree, and you keep the quality gate: nothing is committed for you.
Goals: use Grok well · see where Grok is strong · Claude ↔ Grok collaboration — docs/00-product-vision.md. Reading as a human? Start at docs/08-getting-started-with-grok.md.
After install, run `/grok:tour` — a 15-minute guided first win, billing check included.
Quick start
Steps 1–2 run once in your terminal, and only the install command differs per OS. Step 3 runs inside Claude Code and is identical everywhere.
1. Install the Grok Build CLI (one-time)
- macOS / Linux — any shell (bash, zsh):
curl -fsSL https://x.ai/cli/install.sh | bash
- Windows — PowerShell (e.g. a Windows Terminal tab):
irm https://x.ai/cli/install.ps1 | iex
- Windows — WSL (Ubuntu, etc.): run the macOS/Linux command inside your WSL shell.
[!IMPORTANT] Windows Command Prompt (cmd.exe) is not supported by either installer — use PowerShell or WSL. Pick one side and run Claude Code on it too: a WSL install is invisible to native Windows, and vice versa.2. Log in and smoke-test (browser OAuth, one-time)
grok login grok --no-auto-update -p "Say ok."
This needs an active SuperGrok / X Premium+ subscription — or an xAI API key if you want [metered
3a56a36fc1e4OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add claude-grok-build-mcp-server --env API_KEY=${API_KEY} --env DB_PASSWORD=${DB_PASSWORD} --env GITHUB_TOKEN=${GITHUB_TOKEN} --env GROK_BUILD_AUTH_MODE=${GROK_BUILD_AUTH_MODE} -- npx -y [email protected]{
"mcpServers": {
"claude-grok-build-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"API_KEY": "${API_KEY}",
"DB_PASSWORD": "${DB_PASSWORD}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"GROK_BUILD_AUTH_MODE": "${GROK_BUILD_AUTH_MODE}"
}
}
}
}Exposed tools (9)
9 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
grok_auth_check | read | |
grok_build_delegate | read | |
grok_build_plan | read | |
grok_build_route | read | |
grok_build_status | read | |
grok_build_usage | read | |
grok_build_verify | read | |
grok_build_worktree | read | |
grok_cli | read |
Trust audit
BLOCKgrade D · trust 63/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);* A6: credentials inside a URL — `postgres://app:pw@host/db`, `https://user:[email protected]`.
DATABASE_URL=postgres://app:[email protected]:5432/prod LEAKED
DB_URL=mysql://admin:[email protected]/app LEAKED
CONNECTION_STRING: mongodb+srv://root:PW@cluster0... LEAKED
* A6: credentials inside a URL — `postgres://app:pw@host/db`, `https://user:[email protected]`.
const secret = 'xai-SECRET-VALUE-4242';
const secret = 'xai-INLINE-SECRET-777';
const secret = 'xai-PROVIDER-SECRET-51';
const secret = 'xai-HALF-WRITTEN-555';
-----BEGIN RSA PRIVATE KEY----- (종결 마커 없음) LEAKED
['private key block', '-----BEGIN RSA PRIVATE KEY-----\nMIIEow\n-----END RSA PRIVATE KEY-----', 'MIIEow'],
const pem = ['key is -----BEGIN RSA PRIVATE KEY-----','MIIEowIBAAKCAQEAx7Qk9vZ1mQ'].join(String.fromCharCode(10));
['BEGIN markers with no END', (n: number) => '-----BEGIN RSA PRIVATE KEY-----'.repeat(8_000 + n)],
const block = ['-----BEGIN RSA PRIVATE KEY-----', 'MIIEow', '-----END RSA PRIVATE KEY-----', 'then deploy'];
const SERVER = fileURLToPath(new URL('../../mcp-server/dist/index.js', import.meta.url));'/proc/thread-self/fd', '/dev/fd/5', '/proc/self/fd/5', '/proc/thread-self/fd/5', '/dev/fd/../../self/fd/5',
'/proc/self/root/dev/fd/5', '/proc/thread-self/../../fd/5', '/dev/fd/5/../..'].flatMap((dir) => [[dir, 'linux'], [dir, 'darwin'], [dir, 'freebsd']]))(
import { DEFAULT_RPC_TIMEOUT_MS, RPC_TIMEOUT_MARGIN_MS, rpcTimeoutMs, harnessCapMessage } from '../../.claude/tools/rpc-timeout.mjs';const owner = parseWorktreeOwner(`gitdir: ../../proj/.git/worktrees/${name}`, wt);atob(data);
const parsedHeader = JSON.parse(atob(header));
atob(val);
const decoded = JSON.parse(atob(base642));
@modelcontextprotocol/sdk, zod, @types/node, esbuild, typescript, vitest
Gates applied: no_behavioural_pass.
3a56a36fc1e4full audit observations/trust-audit/mcp-server/xzawed__claude-grok-build-plugin.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 3a56a36fc1e4 | BLOCK | D | 63 | first audit |
Questions
What is the claude-grok-build-plugin MCP server?
A Claude Code plugin (MCP-server wrapper) that lets Claude delegate coding tasks to xAI's Grok Build CLI — billed via your xAI subscription, not metered API. 9 MCP tools, /grok:* commands.
What tools does claude-grok-build-plugin expose?
9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is claude-grok-build-plugin safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (63/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does claude-grok-build-plugin need?
It reads API_KEY, DB_PASSWORD, GITHUB_TOKEN, GROK_BUILD_AUTH_MODE, GROK_CODE_XAI_API_KEY, OPENAI_API_KEY and XAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does claude-grok-build-plugin run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as claude-grok-build-mcp-server at 0.2.43.
How current is this page?
The grade is for one exact copy of the source (3a56a36fc1e4), read on 2026-10-12. The repository is watched and re-audited when it changes.