Overture
Overture is an open-source, locally running web interface delivered as an MCP (Model Context Protocol) server that visually maps out the execution plan of any AI coding agent as an interactive flowchart/graph before the agent begins writing code.
Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
SixHq
Source: Glama · also listed on github_topic
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
submit_planSubmit a complete plan XML to Overture. IMPORTANT: Call get_usage_instructions first to learn the correct XML format and workflow. Use this if you have the entire plan ready at once. The plan will be parsed and displayed on the canvas.
get_approvalWait for user approval of the plan in the Overture UI. Returns status: "approved" (with field values and selected branches), "cancelled" (user rejected), or "pending" (still waiting). If status is "pending", call this tool again to continue waiting - the user may need up to 15-30 minutes to review a…
update_node_statusUpdate the status of a node during execution. Use this to show progress as you work through the plan. The node will visually update on the canvas.
plan_completedMark the plan as successfully completed. Call this after all nodes have been executed.
plan_failedMark the plan as failed. Call this if an unrecoverable error occurs during execution.
check_rerunCheck if the user has requested to re-run any nodes. Call this after plan_completed to allow users to re-run specific nodes or re-run from a node to the end. Returns immediately if there's a pending request, otherwise waits briefly.
check_pauseCheck if the user has paused execution. Call this before starting each node to respect user pause requests. If wait=true, blocks until the user resumes.
get_resume_infoGet detailed information about a paused or failed plan to help resume execution. Returns the current node where execution stopped, list of completed/pending/failed nodes, user-configured field values, selected branches, and other metadata. Use this when resuming a plan that was paused, failed, or lo…
request_plan_updateUpdate an existing plan with incremental operations. Pass an array of operations to insert, delete, or replace nodes. Operations are applied in order with smooth animations. After calling this, call get_approval to confirm changes with the user.
create_new_planSignal that you are creating a completely new, unrelated plan. IMPORTANT: Call get_usage_instructions first if you haven't already. Call this BEFORE submitting a new plan when the user asks for something unrelated to the current plan (e.g., "let's work on something else", "forget that, build X inste…
get_usage_instructionsGet detailed usage instructions for Overture MCP. CALL THIS FIRST before using any other Overture tools. Returns comprehensive documentation on how to structure plans, use XML format, handle approvals, and execute nodes. Pass your agent type to get agent-specific instructions.
get_node_infoGet detailed information about a specific node in the plan. Returns the node's title, type, status, description, field values, attachments, MCP servers, and branch information.
update_node_detailUpdate the details of a specific node in the plan. Use this to modify the title, description, complexity, expected output, or risks of a node. The UI will update in real-time.
update_nodes_detailUpdate details for multiple nodes at once (batch operation). Use this to efficiently modify title, description, complexity, expected output, or risks for multiple nodes in a single call. More efficient than calling update_node_detail multiple times.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
ws affected by a DoS when handling a request with many HTTP headers
ws: Memory exhaustion DoS from tiny fragments and data chunks
express vulnerable to XSS via response.redirect()
Express.js Open Redirect in malformed URLs
OVERTURE_AUTO_OPENSet to false to prevent auto-opening browserOVERTURE_HTTP_PORTPort for the web UIOVERTURE_WS_PORTPort for WebSocket communicationTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
14/14 tools missing one or more hints — submit_plan (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_approval (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); update_node_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +11 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), ws@8.16.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sixhq/overture)?variant=verified to the badge URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check