One dashboard for all your local AI coding agents. Switch providers, manage sessions, and orchestrate tasks across Codex, Claude Code, Gemini CLI, CodeBuddy Code, Pi, OpenCode, KiloCode, and OpenClaw. Zero cloud, local-first control plane.
- capability exposure inferred + 35
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 9m ago · see ecosystem CVEs →
- B · 32 → C · 44
- A · 0 → B · 32
No known CVEs for this server.
- high dangerous code
obfuscated payload: dynamic require()/import()
analyzed commit 8aebc6b · analyzer v33 · 1d ago
skills & prompt files 1
danger signals1
- suspicious endpoint 169.254.169.254 (cloud metadata) SakuraByteCore-codexmate-8aebc6b/tests/unit/prompt-presets.test.mjs :159
`http://169.254.169.254/latest/meta-data/`,
[](https://mcpobservatory.com/servers/github:SakuraByteCore/codexmate/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of SakuraByteCore.