codomyrmex (docxology/codomyrmex) is an MCP server listed on the M8ven Trust Index. It scores 70 out of 100, grade C. It declares 520 tools. No publisher has claimed this listing.

C
Caution
70/100

codomyrmex

Modular Python 3.11+ coding and agent platform — 130 modules spanning LLM agents (13+ providers), graph RAG, static analysis, git ops, cloud and container deployment, all exposed as 612 Model Context Protocol tools. uv-managed, 36k tests with a zero-mock policy.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

docxology

Source: github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Tool descriptions don’t match what handlers do
3 tools describe read intent but their handlers mutate — pi_status (line 58: result = subprocess.run(); pi_list_models (line 120: result = subprocess.run(); pi_list_packages (line 210: result = subprocess.run()
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: GOOGLE_REFRESH_TOKEN, GOOGLE_CLIENT_SECRET, OPENROUTER_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes520 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

memory_put

Store a new memory entry with content, optional type, and importance.

memory_get

Retrieve a memory by its ID.

memory_search

Search across stored memories using semantic similarity. Returns top-k results.

obsidian_sync

Synchronize an Obsidian vault with agentic memory.

execute_agent

Execute an agent conversation with the given prompt.

list_agents

Return a list of all available AI agents.

get_agent_memory

Retrieve the interaction logs and memory for a specific agent session.

gateway_complete

Route a completion request through the AI Gateway with load balancing and failover.

gateway_health

Check the health status of all configured AI Gateway providers.

aider_check

Check if aider is installed and return version + configured model.

aider_edit

Edit one or more files using aider with a code-mode instruction.

aider_ask

Ask aider about code in ask mode (no file changes made).

aider_architect

Run aider in architect mode for complex tasks requiring planning.

aider_config

Return current aider configuration from environment.

api_list_endpoints

list API endpoints discovered from source code.

api_get_spec

Generate an API specification from source code.

api_health_check

Check the health and availability of the API module.

audio_get_capabilities

Return available audio processing capabilities.

audio_list_voices

list available text-to-speech voices for a given provider.

audio_transcribe

Transcribe speech from an audio file to text using Whisper.

audio_detect_language

Detect the language of speech in an audio file.

audio_synthesize

Generate speech from text using text-to-speech.

audio_batch_transcribe

Transcribe multiple audio files in batch.

auth_authenticate

Authenticate and return a token representation.

auth_validate_token

Validate a token string.

auth_list_providers

Return the names of available auth provider classes.

autograd_compute

Evaluate a simple expression and compute its gradient.

autograd_gradient_check

Numerically verify that analytic gradients match finite differences.

bio_simulation_run_colony

Run an ant colony foraging simulation and return statistics.

bio_simulation_colony_stats

Get current statistics from an ant colony simulation.

bio_simulation_evolve_population

Evolve a population of genomes using a genetic algorithm.

cache_get

Retrieve a cached value by key.

cache_set

Store a value in the cache.

cache_delete

Delete a key from the cache.

cache_stats

Return cache statistics as a serializable dict.

calendar_list_events

list upcoming events from the calendar.

calendar_create_event

Create a new event in the Google Calendar.

calendar_get_event

Get details of a specific calendar event by ID.

calendar_delete_event

Delete a calendar event by ID.

calendar_update_event

Replace all fields of an existing calendar event (PUT semantics).

query_knowledge_base

Perform semantic retrieval from the CaseBase.

add_case_reference

Store intelligence context directly into the CaseBase.

evaluate_surprise_signal

Evaluate prediction-error 'surprise' (Free Energy) to trigger swarm deployment.

cerebrum_run_free_energy_loop

Run a free-energy minimization loop with an active inference agent.

pipeline_list

list all configured CI/CD pipelines and their current status.

pipeline_run

Execute a named CI/CD pipeline.

build_status

Get the current health and status of a CI/CD pipeline.

cli_list_commands

List all available CLI commands.

cli_run_command

Execute a CLI command by name.

list_cloud_instances

list virtual machine instances currently running in the Infomaniak OpenStack cloud.

list_s3_buckets

list S3 buckets available in the Infomaniak storage.

upload_file_to_s3

Upload a local file to Infomaniak S3 storage.

gws_sdk_drive_list_files

list Google Drive files via SDK.

gws_sdk_gmail_list_messages

list Gmail messages via SDK.

gws_sdk_calendar_list_events

list Google Calendar events via SDK.

gws_sdk_sheets_get_values

Get Google Sheets values via SDK.

code_execute

Execute code in a sandboxed environment. Supports Python, JavaScript, and more.

code_list_languages

list all supported programming languages for code execution.

code_review_file

Analyze a Python file for quality metrics, complexity, and issues.

code_review_project

Analyze a project directory for code quality metrics and architecture violations.

code_debug

Analyze an error and suggest fixes using the Debugger.

swarm_submit_task

Submit a task to the agent swarm for distributed execution.

pool_status

Get the current status of the collaboration swarm pool.

collaboration_list_agents

list available agent capabilities and coordination protocols.

collaboration_attest_task

Create a cryptographic attestation proving an agent completed a task.

collaboration_verify_attestation

Verify a cryptographic task attestation against result data.

colony_propose_action

Create an ActionProposal and run it through the Colony actuation gate.

colony_record_outcome

Record a caller-reported consequence without execution attestation.

colony_agent_profile

Return the trust profile for an agent (role, trust_score, history length).

colony_status

Return the current colony status snapshot.

colony_pheromone_query

Sense pheromone signals at a location.

colony_falsify_plan

Adversarially evaluate a plan using FalsificationWorker.

colony_pruning_report

Run the pruning daemon against the current pheromone field.

colony_tick

Advance the colony by one time-step.

compression_compress

Compress data using gzip, zlib, or zip format and return base64-encoded result.

compression_detect_format

Detect compression format from base64-encoded data using magic bytes.

compression_compare_formats

Compare compression ratios and speed across all supported formats.

concurrency_pool_status

Report the status of the async worker pool.

concurrency_list_locks

list all currently tracked distributed locks.

config_audits_audit_file

Audit a configuration file for security issues, secrets, and compliance violations.

config_audits_audit_directory

Audit all configuration files in a directory for security and compliance.

config_audits_generate_report

Generate a human-readable audit report from directory scan results.

get_config

Retrieve a configuration value by key.

set_config

set a configuration value.

validate_config

Validate configuration consistency and completeness.

config_monitoring_detect_changes

Detect changes in configuration files by comparing current hashes to stored baselines.

config_monitoring_summary

Get a summary of the configuration monitoring state including snapshots, changes, and audits.

config_monitoring_hash_file

Calculate the SHA-256 hash of a configuration file for change detection.

container_optimization_analyze

Analyze a Docker image for optimization opportunities including size, layers, and security.

container_optimization_report

Get a complete optimization report for a Docker image with analysis and actionable suggestions.

container_optimization_tune_resources

Analyze resource usage of a running container and suggest optimal limits.

container_runtime_status

Check availability of container runtimes (Docker, Kubernetes).

container_build

Build container images using Docker.

container_list

list running containers managed by Docker.

container_security_scan

Scan a container image for security vulnerabilities.

get_cost_summary

Retrieve a summary of costs for the given period.

check_budgets

Check all active budgets and return their utilization status and any alerts.

mcp_get_cost_summary

Retrieve a summary of costs for the given period.

mcp_check_budgets

Check all active budgets and return their utilization status and any alerts.

hash_data

Compute a cryptographic hash of the input data.

420 further tools are not listed here. The complete surface is in the source.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCODOMYRMEX_CALENDAR_ATTENDEE
🔐 secretGOOGLE_REFRESH_TOKEN
configGOOGLE_CLIENT_ID
🔐 secretGOOGLE_CLIENT_SECRET
configCODOMYRMEX_COST_STORE
🔐 secretOPENROUTER_API_KEY
configTERM
configSHELL
configCOLORTERM
configTERM_PROGRAM
configCORS_ALLOWED_ORIGINS
configPAPERCLIP_BASE_URL
// quality suggestions

Dependencies

1 runtime dependency, 1 flagged: playwright

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

520/520 tools missing one or more hints — memory_put (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); memory_get (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); memory_search (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +517 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Descriptions match behaviour

3 tools describe read intent but their handlers mutate — pi_status (line 58: result = subprocess.run(); pi_list_models (line 120: result = subprocess.run(); pi_list_packages (line 210: result = subprocess.run()

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool handlers catch errors

376/520 tool handlers wrap calls in try/catch (72%)

Wrap each tool handler body in try/catch and return a structured error response.

Tool description accuracy

3 tools have description/behavior mismatches: pi_status: description implies read-only but handler writes/deletes/executes; pi_list_models: description implies read-only but handler writes/deletes/executes; pi_list_packages: description implies read-only but handler writes/deletes/executes

Update tool descriptions to accurately reflect all capabilities — especially write, delete, or execute operations.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/docxology/codomyrmex?variant=verified)](https://m8ven.ai/mcp/docxology/codomyrmex)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 44bdb86d557f9ff5745d9fc8fb3b508f3407da07
code hash: 6a730b51339d4291a67bc1b966a15d481542ac88f0d86f20c0d7fd67fa62d404
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client