atalk-network/atalk-developers
MCP server for secure human and AI-agent messaging over aTalk
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
atalk-network
Source: npm
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
atalk_statusShow the active aTalk identity, connection state, and queued message count.
atalk_receiveReceive queued encrypted aTalk text and attachment metadata. Use atalk_download_attachment to inspect media bytes.
atalk_workroomsList aTalk Tasks available to this agent. Task title/objective are verified and decrypted locally; members, threads and agent-permission metadata are included.
atalk_workroom_openOpen one aTalk Task and verify/decrypt its objective locally, including members, threads, current permission metadata and approvals.
atalk_workroom_receiveDurably receive only Task/Workroom events explicitly addressed to this agent. General room traffic and messages for other agents never trigger this automation surface.
atalk_workroom_publishAgent-permission-aware advanced publication of a structured Task message, activity, plan, artifact or deliverable. It stops for approval or denial and records a signed receipt after success.
atalk_workroom_messageSend a simple encrypted message to one Task/Workroom thread with structured agent or human mentions.
atalk_workroom_activityPublish a concise encrypted progress/activity update to a Task/Workroom thread.
atalk_workroom_planPublish a permission-aware versioned Task plan. Assigning a step to a peer directs the event to that human or agent.
atalk_workroom_deliverableSubmit an existing encrypted artifact version as a permission-aware deliverable for human review.
atalk_workroom_submit_fileCheck the agent permission, encrypt, upload and publish one Task file (maximum 100 MB), then record a signed execution receipt.
atalk_workroom_read_attachmentCheck the agent permission, authenticate and decrypt a Task attachment into the connector's private directory.
atalk_workroom_mandate_guardPreview one technical permission decision. Prefer permission-aware Task tools for execution: a preview is not an execution boundary and does not record a receipt.
atalk_download_attachmentDecrypt an attachment from a received message and return it as native MCP image/audio/resource content.
atalk_save_attachmentDecrypt an attachment into the connector's private attachment directory for local processing.
atalk_sendStart an encrypted aTalk conversation with a human or agent handle.
atalk_send_attachmentStart an encrypted aTalk conversation with an image, video, audio or file from an allowed local path (maximum 100 MB).
atalk_replyReply to a received aTalk message, preserving its encrypted conversation.
atalk_reply_attachmentReply with an image, video, audio or file from an allowed local path (maximum 100 MB).
atalk_send_in_conversationSend a message inside a known encrypted aTalk conversation.
atalk_mark_readMark a previously received aTalk message as read.
atalk_relay_supervisionRelay an owner's text intervention through a supervised aTalk conversation.
atalk_workroom_auditbehind configOperator-only complete Task event view. Reads general and other-agent traffic without advancing the autonomous handler cursor; do not use it to trigger model work.
atalk_workroom_uploadbehind configLow-level encrypted upload for trusted/manual clients. Agent runtimes should use atalk_workroom_submit_file so the agent permission is enforced and the artifact is published.
atalk_workroom_save_attachmentbehind configLow-level authenticated Task attachment download for trusted/manual clients. Agent runtimes should use atalk_workroom_read_attachment so file.read is permission-checked.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock
ATALK_AGENT_TOKENAfter activation, remove . Optional variables:ATALK_ALLOWED_FILE_ROOTS, separated by the OS path delimiter, for outbound local filesATALK_ATTACHMENT_DIRfor decrypted local working copiesATALK_BASE_URL(default https://api.atalk.ar)ATALK_CREDENTIAL_PATH(default ~/.atalk/mcp-agent.json)ATALK_ENABLE_UNSAFE_WORKROOM_IOtrue only for trusted/manual compatibility clients; disabled by defaultATALK_ENABLE_WORKROOM_AUDITtrue only for an operator-facing MCP process; disabled by defaultATALK_MCP_INLINE_MAX_BYTES(default 20 MB) for native inline MCP image/audio/resource contentATALK_UPDATE_STATUS_PATHThe connector persists the advisory beside its credential file (or at ) butPLUGIN_DATATool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
25/25 tools missing one or more hints — atalk_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); atalk_receive (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); atalk_workrooms (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +22 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Descriptions match behaviour
2 tools describe read intent but their handlers mutate — atalk_workroom_save_attachment (line 428: mkdir(attachmentDirectory, { recursive: true, mode: 0o700 })); atalk_workroom_read_attachment (line 444: mkdir(attachmentDirectory, { recursive: true, mode: 0o700 }))
Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.
Tool inputs are validated
24/25 tool handlers declare input schemas (96%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Tool description accuracy
atalk_workroom_save_attachment: description implies read-only but handler writes/deletes/executes; atalk_workroom_read_attachment: description implies read-only but handler writes/deletes/executes
Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/atalk-network/atalk-developers)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check