← Back to search

mcp-coordinator

swoofer Scanned 6d ago

Embedded MQTT broker + MCP server for multi-agent coordination

? Not scanned yet

Versions

1.5.0latest
Jul 22, 2026
1.4.0
Jul 21, 2026
1.3.0
Jul 21, 2026
1.2.1
Jul 21, 2026
1.2.0
Jul 20, 2026
+ show 19 moreshow less
1.1.0
Jul 14, 2026
1.0.1
Jul 13, 2026
1.0.0
Jul 12, 2026
0.13.0
May 24, 2026
0.12.0
May 23, 2026
0.11.0
May 23, 2026
0.10.9
May 22, 2026
0.10.8
May 22, 2026
0.10.7
May 20, 2026
0.10.5
May 18, 2026
0.7.0
May 13, 2026
0.6.1
May 12, 2026
0.6.0
May 10, 2026
0.5.0
May 10, 2026
0.4.0
May 10, 2026
0.3.0
May 10, 2026
0.2.1
May 6, 2026
0.2.0
May 5, 2026
0.1.0
May 3, 2026

Tools 27

test
annotations: none low

announce_work
annotations: verified low

Open a consultation thread before starting work

readOnlyHint false destructiveHint false
post_to_thread
annotations: verified low

Post a message to a consultation thread

readOnlyHint false destructiveHint false
propose_resolution
annotations: verified low

Propose a resolution for the consultation

readOnlyHint false destructiveHint false
approve_resolution
annotations: verified low

Approve the proposed resolution

readOnlyHint false destructiveHint false
contest_resolution
annotations: verified low

Contest the proposed resolution

readOnlyHint false destructiveHint false
close_thread
annotations: verified low

Close a consultation thread

readOnlyHint false destructiveHint true
cancel_thread
annotations: verified low

Cancel a consultation thread

readOnlyHint false destructiveHint true
get_thread
annotations: verified low

Get a thread with all messages

readOnlyHint true
get_thread_updates
annotations: verified low

Get new messages since timestamp

readOnlyHint true
list_threads
annotations: verified low

List consultation threads

readOnlyHint true destructiveHint false
log_action_summary
annotations: verified low

Log a one-liner summary of an action

readOnlyHint false destructiveHint false
wait_for_message
annotations: verified low

Block until an MQTT consultation message arrives, or time out. Best-effort push: nothing is buffered before this call registers a listener, so a message published earlier is already gone. Use get_thread_updates for delivery you can rely on.

readOnlyHint false idempotentHint false
get_queued_messages
annotations: mismatch low

Drain queued MQTT messages without blocking. DESTRUCTIVE by default: messages are removed as they are returned, so a second call gets nothing and a crash mid-processing loses them. Pass require_ack:true to hold the batch instead — the result becomes {messages, batch_id}, and the next call redelivers that batch unless you hand the id back as ack. Nothing is buffered while no listener is registered, and the queue drops oldest-first when full. A coordinator restart still drops the queue either way; for delivery you can rely on, use get_thread_updates.

readOnlyHint false idempotentHint false destructiveHint true
mqtt_publish
annotations: verified low

Publish a message to an MQTT topic.

readOnlyHint false openWorldHint true destructiveHint false
set_dependency_map
annotations: verified low

Load module dependency graph

readOnlyHint false destructiveHint true
get_blast_radius
annotations: verified low

Calculate impact of changes to a module

readOnlyHint true
get_module_info
annotations: verified low

Get module dependency info

readOnlyHint true
hot_files
annotations: verified low

List files modified by multiple agents

readOnlyHint true
get_session_files
annotations: verified low

Get files modified in a session

readOnlyHint true
check_file_conflict
annotations: verified low

Check if another agent is editing a file

readOnlyHint true
coordinator_status
annotations: verified low

Full system status

readOnlyHint true
wait_for_peers
annotations: verified low

Block until at least N other online agents are registered, or timeout. Use before the first announce_work to avoid the race where one agent announces before peers have booted.

readOnlyHint true
register_agent
annotations: verified low

Register agent as online with module list

readOnlyHint false idempotentHint true destructiveHint false
list_agents
annotations: verified low

List registered agents

readOnlyHint true idempotentHint true destructiveHint false
heartbeat
annotations: verified low

Update agent activity status and last seen timestamp

readOnlyHint false idempotentHint true destructiveHint false
agent_activity
annotations: verified low

Get activity status for all online agents

readOnlyHint true

Permissions 5

network medium
Server uses network capabilities via: fetch(), http, net
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, fs/promises, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
database medium
Server uses database capabilities via: better-sqlite3
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 107

low
Tool 'test' has no annotations annotation_checker · 100%
info
Tool 'announce_work' annotations are consistent annotation_checker · 80%
info
Tool 'post_to_thread' annotations are consistent annotation_checker · 80%
info
Tool 'propose_resolution' annotations are consistent annotation_checker · 80%
info
Tool 'approve_resolution' annotations are consistent annotation_checker · 80%
info
Tool 'contest_resolution' annotations are consistent annotation_checker · 80%
info
Tool 'close_thread' annotations are consistent annotation_checker · 80%
info
Tool 'cancel_thread' annotations are consistent annotation_checker · 80%
info
Tool 'get_thread' annotations are consistent annotation_checker · 80%
info
Tool 'get_thread_updates' annotations are consistent annotation_checker · 80%
info
Tool 'list_threads' annotations are consistent annotation_checker · 80%
info
Tool 'log_action_summary' annotations are consistent annotation_checker · 80%
info
Tool 'wait_for_message' annotations are consistent annotation_checker · 80%
medium
Tool 'get_queued_messages' claims destructive but name implies read-only operation annotation_checker · 80%
info
Tool 'mqtt_publish' annotations are consistent annotation_checker · 80%
info
Tool 'set_dependency_map' annotations are consistent annotation_checker · 80%
info
Tool 'get_blast_radius' annotations are consistent annotation_checker · 80%
info
Tool 'get_module_info' annotations are consistent annotation_checker · 80%
info
Tool 'hot_files' annotations are consistent annotation_checker · 80%
info
Tool 'get_session_files' annotations are consistent annotation_checker · 80%
info
Tool 'check_file_conflict' annotations are consistent annotation_checker · 80%
info
Tool 'coordinator_status' annotations are consistent annotation_checker · 80%
info
Tool 'wait_for_peers' annotations are consistent annotation_checker · 80%
info
Tool 'register_agent' annotations are consistent annotation_checker · 80%
info
Tool 'list_agents' annotations are consistent annotation_checker · 80%
info
Tool 'heartbeat' annotations are consistent annotation_checker · 80%
info
Tool 'agent_activity' annotations are consistent annotation_checker · 80%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/integration/health-ready-encryption.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/unit/boot-deps-injection.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/unit/oidc-provider.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/unit/boot.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in swoofer-mcp-coordinator-b341906/tests/unit/channel-harness-self-test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/unit/github-app-provider.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/unit/boot-di-wiring.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/unit/google-provider.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in swoofer-mcp-coordinator-b341906/tests/e2e/helpers/coordinator-fixture.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: tar@7.5.19 (GHSA-r292-9mhp-454m) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/client@2.0.0 (GHSA-6qxp-vccf-f47h) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.1.10 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.1.0 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: github.com/eclipse/paho.mqtt.golang@1.5.0 (GHSA-32fw-gq77-f2f2) dependency_analyzer · 95%
medium
Vulnerable dependency: github.com/eclipse/paho.mqtt.golang@1.5.0 (GO-2025-4173) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GHSA-5cv4-jp36-h3mw) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GHSA-qxp5-gwg8-xv66) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GHSA-vvgc-356p-c3xw) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2024-3333) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2025-3503) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2025-3595) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-4440) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-4441) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-4918) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-5025) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-5026) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-5027) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-5028) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-5029) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-5030) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-5942) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-6603) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-6610) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-6611) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-6612) dependency_analyzer · 95%
medium
Vulnerable dependency: golang.org/x/net@0.27.0 (GO-2026-6617) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in swoofer-mcp-coordinator-b341906/tests/unit/master-key.test.ts:268 entropy_analyzer · 70%
medium
Buffer.from base64 in swoofer-mcp-coordinator-b341906/tests/unit/rotate-jwt-secret.test.ts:31 entropy_analyzer · 75%
medium
Buffer.from base64 in swoofer-mcp-coordinator-b341906/tests/unit/rotate-jwt-secret.test.ts:130 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: test manifest_parser · 75%
info
Tool: announce_work manifest_parser · 85%
info
Tool: post_to_thread manifest_parser · 85%
info
Tool: propose_resolution manifest_parser · 85%
info
Tool: approve_resolution manifest_parser · 85%
info
Tool: contest_resolution manifest_parser · 85%
info
Tool: close_thread manifest_parser · 85%
info
Tool: cancel_thread manifest_parser · 85%
info
Tool: get_thread manifest_parser · 85%
info
Tool: get_thread_updates manifest_parser · 85%
info
Tool: list_threads manifest_parser · 85%
info
Tool: log_action_summary manifest_parser · 85%
info
Tool: wait_for_message manifest_parser · 85%
info
Tool: get_queued_messages manifest_parser · 85%
info
Tool: mqtt_publish manifest_parser · 85%
info
Tool: set_dependency_map manifest_parser · 85%
info
Tool: get_blast_radius manifest_parser · 85%
info
Tool: get_module_info manifest_parser · 85%
info
Tool: hot_files manifest_parser · 85%
info
Tool: get_session_files manifest_parser · 85%
info
Tool: check_file_conflict manifest_parser · 85%
info
Tool: coordinator_status manifest_parser · 85%
info
Tool: wait_for_peers manifest_parser · 85%
info
Tool: register_agent manifest_parser · 85%
info
Tool: list_agents manifest_parser · 85%
info
Tool: heartbeat manifest_parser · 85%
info
Tool: agent_activity manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (95) manifest_parser · 80%
medium
Hardcoded OAuth client ID in swoofer-mcp-coordinator-b341906/tests/unit/channel-harness-self-test.ts oauth_scope_analyzer · 80%
high
High-risk OAuth scope: admin oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
medium
Permission: database access detected permission_analyzer · 90%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 111 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%