← Back to search

@heretyc/subagent-mcp

GitHub Actions Scanned 25d ago

MCP server that launches Claude Code/Codex sub-agents and routes tasks to Claude Messages or OpenAI-compatible API providers.

npm
C
73.3 / 100

Versions

3.2.0latest
Jul 23, 2026
3.2.0-beta.1
Jul 23, 2026
3.1.12
Jul 23, 2026
3.1.12-beta.1
Jul 23, 2026
3.1.11
Jul 22, 2026
+ show 68 moreshow less
3.1.11-beta.0
Jul 22, 2026
3.1.10
Jul 22, 2026
3.1.10-beta.0
Jul 22, 2026
3.1.9
Jul 22, 2026
3.1.8
Jul 22, 2026
3.1.8-beta.0
Jul 22, 2026
3.1.7
Jul 22, 2026
3.1.6
Jul 21, 2026
3.1.6-beta.1
Jul 21, 2026
3.1.5
Jul 21, 2026
3.1.5-beta.1
Jul 20, 2026
3.1.4
Jul 20, 2026
3.1.3
Jul 20, 2026
3.1.3-beta.1
Jul 20, 2026
3.1.2
Jul 20, 2026
3.1.1
Jul 17, 2026
3.1.0
Jul 17, 2026
3.0.3
Jul 17, 2026
3.0.2
Jul 17, 2026
3.0.1
Jul 16, 2026
3.0.0
Jul 15, 2026
2.15.0
Jul 15, 2026
2.14.0
Jul 15, 2026
2.13.0
Jul 15, 2026
2.12.21
Jul 14, 2026
2.12.20
Jul 13, 2026
2.12.19
Jul 13, 2026
2.12.18
Jul 13, 2026
2.12.17
Jul 13, 2026
2.12.16
Jul 13, 2026
2.12.15
Jul 13, 2026
2.12.14
Jul 12, 2026
2.12.13
Jul 12, 2026
2.12.12
Jul 11, 2026
2.12.11
Jul 10, 2026
2.12.10
Jul 10, 2026
2.12.9
Jul 10, 2026
2.12.8
Jul 9, 2026
2.12.7
Jul 9, 2026
2.12.5
Jul 8, 2026
2.12.5-beta.2
Jul 8, 2026
2.12.5-beta.1
Jul 8, 2026
2.12.5-beta.0
Jul 7, 2026
2.12.4
Jul 7, 2026
2.12.3
Jul 6, 2026
2.12.2
Jul 3, 2026
2.12.1
Jul 3, 2026
2.10.4
Jul 1, 2026
2.10.3
Jun 29, 2026
2.10.2
Jun 26, 2026
2.10.1
Jun 26, 2026
2.10.0
Jun 24, 2026
2.9.2
Jun 23, 2026
2.9.0
Jun 17, 2026
2.8.9
Jun 17, 2026
2.8.8
Jun 16, 2026
2.8.7
Jun 15, 2026
2.8.6
Jun 15, 2026
2.8.5
Jun 14, 2026
2.8.3
Jun 13, 2026
2.8.2
Jun 13, 2026
2.8.1
Jun 12, 2026
2.8.0
Jun 11, 2026
2.7.1
Jun 11, 2026
2.7.0
Jun 11, 2026
2.6.2
Jun 11, 2026
2.6.1
Jun 11, 2026
2.6.0
Jun 11, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 16

launch_agent
annotations: none low

Spawn a sub-agent session. CONTRACT: `prompt` states objective + output format + tools/sources + boundaries; the server auto-upserts \

cwd string prompt string deadlock boolean
get_status
annotations: none low

Return live in-memory MCP session state. `session_start_time` is the MCP server process boot time because smcp-activate runs as a separate hook process and cannot update this server

poll_agent
annotations: none low

Get an agent

verbose boolean agent_id string
kill_agent
annotations: none low

Terminate a live agent/session (status `processing`, `stalled`, or turn-finished but still interactive) by immediately force-killing its managed driver. A finished agent is force-killed automatically after 6 minutes of no `send_message`/`poll_agent` activity; call `kill_agent` sooner to free resources immediately. No-op for already-terminal closed agents.

agent_id string
respond_permission
annotations: none low

Answer a parked permission request for an agent. One-time only; does not create session-wide approvals. If request_id is omitted, answers the agent

reason string agent_id string request_id string
send_message
annotations: none low

Enqueue a user message for an open interactive agent session. Observe output with poll_agent or wait.

message string agent_id string
list_agents
annotations: none low

List all agents with token-efficient core metrics (status, `alive`, `idle_seconds`). `stalled` is ALIVE-but-quiet, NOT dead (full status semantics on poll_agent). Use `poll_agent` for per-agent stream items, hints, and final output.

wait
annotations: none low

Blocks until one or more sub-agents reach a reportable state (turn-finished, errored, stopped, or zombie_killed), returning exit code when known + local-time timestamp; or returns the live-job list after a 15-minute timeout. This is how you learn an agent finished — do NOT poll-loop. A `finished` agent with null exit_code is still alive and accepts `send_message`; `send_message`/`poll_agent` activity keeps it alive, and 6 minutes idle auto-kills it. A `stalled` agent is still ALIVE and does NOT end the wait. `verbose: true` adds each finished agent

verbose boolean
__test_park_yolo_wait_permission
annotations: none low

Test-only yolo wait pending-permission fixture.

agent_id string
orchestration-mode
annotations: none low

Toggle or query per-project ORCHESTRATION MODE. `enabled`: true = ON, false = OFF for THIS session only, omit = query. SOLE CHANNEL holds in BOTH states: subagent-mcp is the only sanctioned way to launch sub-agents; toggling OFF does not lift that. WHAT: when ON act as a delegate-ONLY orchestrator; delegate every step, inline-by-right does not exist, a non-delegable atomic step needs a one-time user-approved exception via the structured-question tool. Default is OFF each session; setup writes no orchestration state. enabled:true explicitly turns ON or re-enables mid-session; enabled:false is a session-keyed 2h-TTL opt-out, HONORED even after the 15% latch or metering fail-safe forces ON. PERSISTENCE: a permitted disable applies only to THIS keyed session; after the 2h backstop the current session may latch/fail-safe ON, while each new keyed session returns to default OFF. Keyless or undetectable metering remains fail-safe ON; a hookless host may use only the one-time non-persisted conversational opt-out. DISABLE: never on your own initiative; you may PROPOSE OFF on task-fit mismatch, but only EXPLICIT user permission may set enabled:false. Per-turn injection fires only in CLI hosts that load the bundled hook; desktop hosts toggle the marker but inject nothing.

enabled boolean
model-selection-mode
annotations: none low

Set or query per-project MODEL SELECTION MODE, which gates launch_agent

handoff-write
annotations: none low

Write a handoff for this working directory so the NEXT session can resume cleanly. UNLOCKS only at >=20% context utilization with readable metering (voluntary from 20%; a fresh write becomes MANDATORY at >=80%); below 20%, or if context size is undetectable, this tool returns an affirmative unavailable error (never silent). BEFORE calling, ask the user 10 clarifying questions via the structured-question tool to build a /goal prompt for the next session. content <=4000 chars; use overflow (<=8000 more chars) for anything beyond that, referenced by full path inside content. A successful fresh write creates a prepared handoff record; it does NOT mandate an immediate new session -- keep working. On success, relay the tool

content string overflow string
handoff-read
annotations: none low

Read the saved handoff for this working directory (if any). Call this first; after reading any saved handoff, confirm the user

handoff-clear
annotations: none low

Delete the saved handoff for this working directory, including any overflow file. The voluntary write/read/clear cycle reopens at each successor session

configure
annotations: none low

List, read, or update subagent-mcp configuration by canonical key. `action=list` enumerates settings; `action=get` requires `key`; `action=set` requires `key` and, for settable keys, string `value`. Secrets are always redacted. Machine-global and mode-owned settings are read-only here: edit the reported global file as a human or use `orchestration-mode`/`model-selection-mode`. Provider and .env writes are validated, backed up, and atomic; responses report `restart_required`.

key string value string
subagent-mcp
annotations: none low

Launches local Claude and Codex sub-agent sessions and can route configured tasks to direct Claude Messages or OpenAI-compatible API providers.

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 45

low
Tool 'launch_agent' has no annotations annotation_checker · 100%
low
Tool 'get_status' has no annotations annotation_checker · 100%
low
Tool 'poll_agent' has no annotations annotation_checker · 100%
low
Tool 'kill_agent' has no annotations annotation_checker · 100%
low
Tool 'respond_permission' has no annotations annotation_checker · 100%
low
Tool 'send_message' has no annotations annotation_checker · 100%
low
Tool 'list_agents' has no annotations annotation_checker · 100%
low
Tool 'wait' has no annotations annotation_checker · 100%
low
Tool '__test_park_yolo_wait_permission' has no annotations annotation_checker · 100%
low
Tool 'orchestration-mode' has no annotations annotation_checker · 100%
low
Tool 'model-selection-mode' has no annotations annotation_checker · 100%
low
Tool 'handoff-write' has no annotations annotation_checker · 100%
low
Tool 'handoff-read' has no annotations annotation_checker · 100%
low
Tool 'handoff-clear' has no annotations annotation_checker · 100%
low
Tool 'configure' has no annotations annotation_checker · 100%
low
Tool 'subagent-mcp' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.0.0 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: launch_agent manifest_parser · 70%
info
Tool: get_status manifest_parser · 70%
info
Tool: poll_agent manifest_parser · 70%
info
Tool: kill_agent manifest_parser · 70%
info
Tool: respond_permission manifest_parser · 70%
info
Tool: send_message manifest_parser · 70%
info
Tool: list_agents manifest_parser · 70%
info
Tool: wait manifest_parser · 70%
info
Tool: __test_park_yolo_wait_permission manifest_parser · 70%
info
Tool: orchestration-mode manifest_parser · 70%
info
Tool: model-selection-mode manifest_parser · 70%
info
Tool: handoff-write manifest_parser · 70%
info
Tool: handoff-read manifest_parser · 70%
info
Tool: handoff-clear manifest_parser · 70%
info
Tool: configure manifest_parser · 70%
info
Tool: subagent-mcp manifest_parser · 75%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (57) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 131 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%