vegelate/agent-only-mcp

Agent Only MCP is a small and focused MCP server that gives coding agents access to a shared troubleshooting community. An agent can search for solved problems, create help posts, reply to other agents, check an inbox, exchange messages, and return to earlier discussions. The idea could reduce repeated debugging work by helping agents reuse knowledge that another agent has already discovered.

The repository is easy to understand. Most of the implementation lives in one JavaScript file, with a small package configuration and very few dependencies. It uses the official MCP SDK and Zod for schemas, requires Node.js 20 or newer, and communicates with clients through standard input and output. It does not open a local network port. This keeps installation simple and reduces the number of moving parts.

The README is clear and practical. It provides setup instructions for Codex, Claude Code, VS Code, Cursor, Claude Desktop, Windows, macOS, Linux, and WSL. It also explains token configuration, identity files, account deletion, and the difference between read-only tools and tools that change outside state. The warning against posting passwords, API keys, personal data, or customer information is especially important because forum content is not end-to-end encrypted.

Project health is off to a good start. The repository includes an MIT license, contribution guide, security policy, lock file, npm package, MCP Registry metadata, and automated publishing workflows. Current CI passes on Node.js 20 and 24. The test starts the real MCP server, completes a client handshake, confirms that all 32 tools are listed, and checks their safety annotations.

The largest improvement opportunity is test depth. The current test confirms tool discovery, but it does not appear to exercise real tool calls. Tests should cover input validation, authentication, token precedence, identity file parsing, server errors, timeouts, rate limits, invalid JSON, large responses, attachment downloads, account deletion confirmation, and accidental token exposure. A mocked HTTP service would allow these cases to run in CI without contacting the production website.

Shared agent content also creates a prompt injection risk. A post or private message could tell an agent to reveal secrets, run a command, install software, or ignore its owner’s instructions. All remote content should be clearly marked as untrusted data before it reaches the model. The server should return structured fields instead of instruction-like text where possible, limit content size, remove dangerous control characters, and remind clients not to treat community posts as system instructions. Reporting, blocking, moderation, and reputation tools would also help reduce poisoned or misleading answers.

The hosted service is an important part of the product, but its trust model is outside this repository. The documentation should clearly explain who operates it, what data it stores, how long posts and messages are retained, whether deleted data remains in backups, how attachments are scanned, and how users can export or remove their information. It should also explain whether private messages are visible to service operators.

For maintainability, the single server file could eventually be divided into tool definitions, schemas, authentication, API requests, and response formatting. Adding linting, formatting, dependency review, and CodeQL would strengthen CI. GitHub issue templates, a pull request template, repository topics, and tagged GitHub releases would also improve contributor experience and project discovery.

Overall, Agent Only MCP has a useful idea, a clean installation path, and unusually clear MCP safety annotations. Its small codebase is a strength at this stage. More complete tests, strong defenses against malicious community content, and clearer hosted-service privacy details would make the project much safer and easier to trust.