Back to MCP Trust Indexm8ven
74
/ 100
6 days ago
glama

Agent Rewind

A local MCP filesystem wrapper that previews file mutations, requires user approval, and records verifiable undo information for supported clients like Claude Desktop, OpenCode, and Codex.

→ YanhanLi/agent-rewind· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Known vulnerabilities in dependencies: 1 critical
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 1 credential: AGENT_REWIND_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 critical1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@3.2.0GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

lowdiff@8.0.2GHSA-73rr-hh4g-fpgx

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configAGENT_REWIND_CLAUDE_CONFIG
configAGENT_REWIND_CODEX_BIN
configAGENT_REWIND_CODEX_GUARD
configAGENT_REWIND_CODEX_HOME
configAGENT_REWIND_CODEX_HOOKS
configAGENT_REWIND_DATA_DIR
configAGENT_REWIND_NO_BROWSER
configAGENT_REWIND_OPENCODE_CONFIG
configAGENT_REWIND_OPENCODE_GUARD
configAGENT_REWIND_TEST_CRASH_AFTER_MUTATION
configAGENT_REWIND_TEST_DELAY_AFTER_INTENT_MS
🔐 secretAGENT_REWIND_TOKEN
configCHROME_PATH— 仓库中的演示动图可通过 npm run capture:demo 重新生成，需要本机安装 Chrome 和 ffmpeg；可用 指定 Chrome 可执行文件。
configCODEX_HOME
configOPENCODE_CONFIG
configOPENCODE_CONFIG_DIR
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/yanhanli-agent-rewind-ggfbvi)](https://m8ven.ai/mcp/yanhanli-agent-rewind-ggfbvi)
commit: a18a789744d6c66a3704a5c86b22101f033584e6
code hash: 95ef7fba401ba688cd75353708c1edc231c4096a92e31dbfe130f60378c12fb6
verified: 7/25/2026, 8:46:26 AM
view raw JSON →