Atlas / MCP servers / zz-plant / ambit

ambitBLOCK

Name: ambit
Author: zz-plant

mcp/zz-plant/ambit

MCP server by zz-plant · agent infrastructure · ai agents · ai governance · Audited 2026-10-11

See what you and your AI agents can do, and what one more step would unlock. Ambit maps Claude Code, Cursor, OpenCode and nine more agent configs into one local graph: what works, what to set up next, and what breaks if a piece goes.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

63 51r · 12w · 0d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

What you, your agents, and your machines can jointly do — and where your own time is going.

That is your ambit. Ambit reads the configs of Claude Code, Cursor, OpenCode and the other agent runtimes it knows into one local map of it, and shows how to widen it: what you can do now, what one more step would unlock, and which pieces are configured but not working.

[](https://github.com/zz-plant/ambit/actions/workflows/ci.yml) [](https://github.com/zz-plant/ambit/releases/latest) [](https://nodejs.org) [](./LICENSE)

**Try the live demo** · Get started · Connect it to your agent · FAQ · Docs

One setup, mapped. Pick a next step and Ambit shows what it would open: four more capabilities. Pick one you rely on and switch it off, and it counts the nine working things that would stop with it. Then which tools interrupt you most, and a change waiting on your approval.

npx ambit-cli, or `brew install z

Read from source at commit ba7b27ef4798OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)

claude mcp add ambit-cli -- npx -y [email protected] mcp

Exposed tools (63)

51 read · 12 write · 0 destructive.

Tool	Risk	Description
`NUC`	read	homelab host
`Payments`	read	Take payments
`actions`	read	The actions a capability confers and whether each may be performed: read a repository yes, merge to its default branch no. Omit capId for all. To ask before acting, use ambit_can.
`affordances`	read	The domain of each capability, from the graph: institutional (needs an authority holder), economic (a budget), cognitive (a person), physical (a device).
`audit`	write	The audit trail: a run end to end, a proposal
`authority`	write	Which reached capabilities may run unattended and which need approval. Being able to act is not permission to. Pass detail: true for every grant.
`blocked`	read	Record that a task was blocked by a missing capability. The same deficit hit repeatedly is a capability or workflow worth investigating.
`bottlenecks`	read	The capabilities the most others depend on: where an improvement pays most and a loss costs most.
`briefing`	read	What this environment is, before you touch it: reached and proven, failing, waiting on a person, recently blocked, worth reaching next, and what changed since the last briefing. Read once at session start. Also ambit://briefing.
`budgets`	read	Standing budgets: what may be spent, on what, and what is left this period. A spend past a ceiling is refused until the period turns over. A person sets one.
`can`	write	Ask before running a tool you have not used this session. yes: act. ask: put it to the person. no: do not retry it under another name. Also returns the reason, what is missing and the budget left. Probes nothing. A no files the deficit.
`cap`	read	Find capabilities by domain or name. Returns the ids the other tools take.
`catalog`	read	The ways to acquire a capability (build, buy, subscribe, delegate, hire) compared by setup, one-time and recurring cost, privacy, verification and rollback.
`combos`	read	Combos the graph can already support: every prerequisite in place, with a confidence.
`context`	read	The session briefing as one block of prose, the text ambit_briefing returns with text: true.
`council`	read	The first next step read five ways: what it opens, rests on, has cost and may do once reached, and whether its foundation works. Per seat a sentence, a command and a stance, and whether they split.
`credentials`	read	What revoking each credential would end. Providers that present the same credential fail together.
`decay`	read	Capabilities not touched for long enough to doubt, with days since the last config change.
`deficits`	write	Recurring capability deficits, worst first: which missing capabilities keep stopping different work.
`diff`	read	Per domain, what was recently practiced, improved or regretted, from the last 50 outcomes.
`digest`	read	How much work still runs through the human, and which interventions are reducible: recurring approvals and permission blocks could become a bounded grant or automation. days: window (default 7).
`economics`	read	Declared costs and goal values: attention value per hour, recurring and purchase costs, what each goal is worth.
`evidence`	read	Verification history of one capability: what was tried, when, and whether it passed.
`goal`	read	Route a goal, in words, to the capabilities that cover it: ranked, each with its plan delta.
`goal_value`	read	One goal
`health`	read	Domain health scores.
`impact`	write	What would stop, and what would only lose a provider, if a capability went away.
`incident_resolve`	write	Close the open incident run for a service with its outcome. MTTR is the ledger
`incidents`	read	Probe the hosts the infrastructure manifest names, record each answer as a check run, and open an incident run per offline service, with the authority decision for recovery (restart ALLOW, CONFIRM or DENY).
`ledger`	read	Every recorded frontier observation: how the system
`near`	read	Near-miss combos: one or two prerequisites away, with high existing maturity.
`next`	read	The capabilities worth reaching next: why, cost, and the command that proposes each. Ranked by what has blocked work once the ledger has data, by leverage per setup hour before.
`objects`	read	What may be done to a particular thing, and what is proved about doing it there. Evidence about one repository says nothing about another.
`opportunities`	read	Ranked changes worth making, from recurring human burden priced by attention. by: attention (default), cash, roi, reliability, frontier. budget (dollars): the best combination within it.
`opportunity`	read	One ranked opportunity in full: burden, proposed capability, acquisition, expected effect, payback, confidence.
`paths`	read	The ways to reach a capability compared by setup time, risk and lock-in: which steps are config changes that can be undone, and which are installers that cannot.
`pending`	read	Drafts waiting on a person, each with its cost, what it bills and what it unlocks. Surface them together: a batch is one interruption.
`plan`	write	What is missing for a capability, in the order it must be closed, and which steps need a person.
`portfolio`	read	Across imported federation receipts: burden recurring across environments, person-specific single points of failure, and (with budget) where spend gains most. Never merges.
`preferences`	read	What each person prefers, and which plans would fight it (local or hosted, one-off or recurring). Pass who for one person.
`preferences_observed`	read	What this person has approved and refused, by trait: local or hosted, one-off or recurring. Three decisions make a trait; one that went both ways is contested.
`promotions`	read	Authority thresholds: which grants may widen on evidence, how much each still needs, what was promoted or put back. A person sets one; an agent only reads this.
`proposal`	read	One proposal in full, with its steps and simulated frontier.
`proposals`	read	Every proposal drafted so far, newest first.
`propose`	read	Draft a reviewable acquisition: ordered steps, the alternative chosen and its trade-offs, the simulated result. Nothing runs until a person approves it, and then only reversible config patches apply.
`record_failure`	read	Report a tool failure you just hit as the runtime reported it: exit code, error text or kind. Ambit classifies it and attributes it to a capability where it can.
`register_skill`	write	Put a skill you wrote on the map: an id, the capability it supplies, and a read-only command that proves it works. The check runs at once, so it arrives proven or failing.
`reversible`	read	Which unreached capabilities could be acquired without a person and which need hands. apply refuses a step with no inverse, so this is also what an agent cannot do alone.
`roi`	read	Realized ROI of an applied proposal: interventions, hours, attention dollars and reliability before and after, against its prediction. Writes the observation back.
`roi_summary`	read	Every applied proposal
`run_begin`	write	Start a work run. Returns the run id every later telemetry call attaches to. The run stays open until run_end.
`run_end`	write	Close a work run with its outcome, and the value of that outcome in cents when known.
`scope`	read	What a scope covers and what it does not. For a target (repo:owner/name, device:nuc, svc:ollama): every grant, whether it covers the target, and the effective mode.
`signals`	read	Failures seen in the window that no one recorded, by class and tool, including those no capability could be attributed to: a gap in the model.
`simulate`	read	The frontier as it would be if a capability were acquired, including what it unblocks. A preview: changes nothing.
`since`	read	What entered the reachable frontier between two ISO timestamps (default: earliest observation to now), split into acquired and emerged through composition.
`skills`	read	Skills registered this way, and what each check last said.
`spof`	read	Capabilities with exactly one provider, where redundancy is absent. Bottlenecks rank leverage; this ranks fragility.
`stats`	read	Counts of capabilities: total, reached, verified and failing, and reached per domain.
`usage`	read	Where effort went over a window in days (default 30): times exercised, duration and interventions per capability. unmapped: tools used that no node covers. windows: tokens per five-hour window, and time left in this one.
`verify`	write	Run a capability
`work`	read	Recent work runs and what each cost: elapsed time, events, capabilities exercised, human interventions, resources.
`work_event`	write	Record one observation into a run. kind: event, use, intervention, resource or outcome. interventionKind: judgment, authority, knowledge, physical, clerical or exception.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (8 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (23)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/engine/migrate.ts:24

exec(sql: string): void;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

bootstrap.sh:11

curl -s http://127.0.0.1:11434/api/tags >/dev/null 2>&1 && echo "  Ollama: running" || echo "  Ollama: not detected"

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

cli.js:246

const url = `http://127.0.0.1:${port}/`;

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/adapters/claude-code.ts:27

import { readClaudeCode, claudeCodeSeedInput } from '../../src/engine/claude-code.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/adapters/hermes.ts:28

import { authorityBlock } from '../../src/shared/authority.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/adapters/hermes.ts:30

import { defaultMapping } from '../../src/engine/seed/writers.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/adapters/surface.ts:23

import { defaultMapping } from '../../src/engine/seed/writers.ts';

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/adapters/surface.ts:96

const engine = new URL('../../src/engine/engine.ts', import.meta.url).pathname;

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

AGENTS.md:469

4. **No egress you did not type** — the graph is a local SQLite file and there is no telemetry. Five commands open a socket from Ambit's own code: `ambit notify` and `ambit notify-approvals`, each of

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

CHANGELOG.md:404

`ambit goal "<sentence>" --judge` closes the gap the roadmap named for goal routing: a goal that names none of the tree's words had no route in. When the vocabulary cannot recommend, the sentence goes

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/faq.md:53

| `ambit goal "<sentence>" --judge` (and `goal --spec <path> --judge`) | The sentence you typed, and the name and one-line description of every node in the curated tree, as one Choice question. Only w

LOWNetwork egress · net.tls_off · CWE-200, CWE-319

src/engine/cli.test.ts:256

run(dir, 'record', 'skill:breaks', '--verify=false');

Why it matters. certificate verification is disabled

Fix. leave verification on

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@biomejs/biome, @fontsource-variable/hubot-sans, @fontsource-variable/mona-sans, @fontsource/monaspace-neon, @types/bun, @types/node, @types/react, @types/react-dom

Why it matters. 19 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

AGENTS.md:469

4. **No egress you did not type** — the graph is a local SQLite file and there is no telemetry. Five commands open a socket from Ambit's own code: `ambit notify` and `ambit notify-approvals`, each of