Atlas / MCP servers / zpratt / Lousy Agents

Lousy AgentsBLOCK

Name: Lousy Agents
Author: zpratt

mcp/zpratt/lousy-agents

MCP server by zpratt · agent policy · ai agents · cli · Audited 2026-10-12

Bootstrap projects with pre-configured instructions, tests, and linters that guide AI coding agents to produce reliable code

Verdict

BLOCK

Grade

Trust score

53 /100

Exposed tools

22 16r · 6w · 0d

Transport

stdio

License

BSD-2-Clause-Patent

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://scorecard.dev/viewer/?uri=github.com/zpratt/lousy-agents)

Turn "lousy" AI outputs into production-grade code.

TL;DR

Lousy Agents is a set of published npm packages for agentic software development, with @lousy-agents/cli as the main entry point. Run npx @lousy-agents/cli init to create a new project with testing, linting, and GitHub Copilot configuration. Run npx @lousy-agents/cli copilot-setup in existing projects to generate a workflow that gives Copilot your environment context. Add @lousy-agents/mcp for MCP integrations and @lousy-agents/agent-shell for npm script telemetry when you need them.

Lousy Agents is an npm workspace monorepo that publishes focused packages for scaffolding, MCP integrations, and npm script telemetry. The CLI package gives you a production-ready development environment with testing, linting, and AI assistant configuration in one command.

Quick Start

# Scaffold a new webapp project (no install required)
npx @lousy-agents/cli init --kind webapp

# Or use interactive mode to choose your project type
npx @lousy-agents/cli init

# Generate GitHub Copilot setup workflow from your project configuration
npx @lousy-agents/cli copilot-setup

Start Here
Who This Is For
Why This Exists
Features
Installation
Usage
Contributing
Roadmap
Documentation
Reference Examples

Start Here

If you're adopting Lousy Agents for the first time, use this order:

Scaffold a project with npx @lousy-agents/cli init
Add repository-specific setup with npx @lousy-agents/cli copilot-setup
Add deeper integrations only if you need them:
`@lousy-agents/mc

Read from source at commit 816e4c351244OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y @lousy-agents/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@lousy-agents/[email protected]"
      ],
      "env": {
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (22)

16 read · 6 write · 0 destructive.

Tool	Risk	Description
`analyze_action_versions`	read	Analyze GitHub Action versions used across all workflow files in a target directory
`analyze_instruction_quality`	read	Analyze the structural quality of feedback loop documentation in instruction files. Assesses structural context, execution clarity, and loop completeness across all supported instruction formats.
`capture`	write	Generate a lesson capture prompt for Stop/SubagentStop Claude hooks
`context`	read	Inject relevant lessons into Claude hooks as additionalContext
`copilot-setup`	write	Generate or update the Copilot Setup Steps workflow based on detected environment configuration
`create_claude_code_web_setup`	write	Create or update Claude Code web environment setup (.claude/settings.json with SessionStart hooks and CLAUDE.md documentation) based on detected environment configuration.
`create_copilot_setup_workflow`	write	Create or update the Copilot Setup Steps workflow (copilot-setup-steps.yml) based on detected environment configuration. Returns actions needing version resolution and instructions for SHA-pinning.
`discover_environment`	read	Discover environment configuration files (mise.toml, version files like .nvmrc, .python-version, etc.) in a target directory
`discover_feedback_loops`	read	Discover npm scripts from package.json and CLI tools from GitHub Actions workflows, mapping them to SDLC feedback loop phases (test, build, lint, format, security, etc.)
`discover_workflow_setup_actions`	read	Discover setup actions used in existing GitHub Actions workflows in a target directory
`doctor`	read	Diagnose agentic configuration across harnesses: inventory, classify, and evaluate preconditions
`init`	read	Initialize a new project with lousy agents scaffolding
`init-hooks`	read	Initialize Claude Code hook configuration for lousy-agents context injection
`lessons`	read	Validate lesson files in .lousy-agents/lessons/ against the lesson schema
`lint`	read	Lint agent skills, custom agents, instruction files, and hook configurations. Validates frontmatter, instruction quality, and hook config schemas. Also supports flag-only (not default-on) subagent and MCP server config linting. Run
`new`	write	Create new resources (e.g., Copilot agents, skills). Use
`read_copilot_setup_workflow`	read	Read the existing Copilot Setup Steps workflow (copilot-setup-steps.yml or .yaml) from a target directory
`resolve_action_versions`	read	Get version resolution metadata for GitHub Actions. Returns lookup URLs and instructions for the LLM to fetch latest versions and SHA-pin them. Can be called independently of workflow creation.
`reviewer`	read	A reviewer subagent
`security`	read	A security agent
`skill`	write	Create a new GitHub Copilot Agent Skill. Example: lousy-agents new skill github-actions-debug
`validate_instruction_coverage`	read	Validate that repository instructions (.github/copilot-instructions.md and .github/instructions/*.md) document all mandatory feedback loop scripts and tools. Returns coverage percentage and suggestions for missing documentation.

Trust audit

BLOCKgrade F · trust 53/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (5 observation(s))
Shell: declared (8 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

.semgrep/node-security.ts:31

exec(cmd);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

.semgrep/node-security.yaml:144

- pattern: exec($CMD,...)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

.semgrep/node-security.yaml:257

injection risk applies to exec('git clone ' + url),

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.claude/skills/curate-release

.claude/skills/curate-release

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.claude/skills/feature-to-plan

.claude/skills/feature-to-plan

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.claude/skills/mutation-hunter

.claude/skills/mutation-hunter

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.claude/skills/plan-to-graph

.claude/skills/plan-to-graph

Why it matters. link not followed

MEDIUMInventory / provenance · inv.symlink · CWE-1104

.claude/skills/rugged-evil-tester

.claude/skills/rugged-evil-tester

Why it matters. link not followed

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

packages/cli/api/copilot-with-fastify/src/app.integration.ts:14

baseUrl = `http://127.0.0.1:${address.port}`;