MCP.Market

bundlebox MCP server

by blackswanalpha·io.github.blackswanalpha/bundlebox·v0.8.0·2 stars
No reviews yet

Where the work is, packed before the agent reads: brief, symbol tables, findings, token bill.

B80/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B80/100

full report

Adoption
Growing

2 stars70 downloads/wk

Reviews

Write one

Nobody has reviewed bundlebox yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

bundlebox tools (10, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • bb_context

    Does this set of files fit in one session? Returns FITS / TIGHT / SPLIT / HEAVY with the token parts (overhead, payload, churn, reserve) and, when SPLIT, the cut.

  • bb_explain

    One finding in full: evidence, fix hint, actuator, and the triage derivation (why it was or was not promoted).

  • bb_findings

    Open findings from the last `bb scan`: id, severity, detector, title, primary file. Filter by detector or minimum severity.

  • bb_oversight_brief

    What is already known about these files from the last oversight scan: god-shaped, duplicated, bloated, vibe-coded marks, and the guideline to apply while editing. About 300 tokens.

  • bb_pinpoint

    One problem -> one focused brief: the files and symbol regions located already (quoted with line numbers), the scope that fits one window, evidence already on file, the acceptance command, traps and guidelines. Call this BEFORE searching the tree.

  • bb_scanwrite action

    Run the zero-token detectors now (seconds) and return the per-detector counts. Use bb_findings to read the results.

  • bb_session

    What the current or last session used (measured from the transcript) and what it was spared (cache: measured; automation: estimate range).

  • bb_situation

    Where this work stands, in one call: branch and what is uncommitted, what proves a change here, which artefacts are missing or stale, the work already packed, and what the last echos run saw. Call this instead of git status + git diff + bb env + bb findings + bb echos.

  • bb_snapgen

    Reference tables built from the tree and kept fresh by fingerprint: layout, symbols-<dir> (name file:line), routes, docs, commands, hot, tests, deps. With no `table` returns the INDEX with each table's token cost so you can choose. Read a table instead of grepping.

  • bb_tokens_estimate

    Estimated tokens per file and in total, with the calibrated estimator (not chars/4).

Public scan report

scanner v0.1.10 · 2026-11-02 · same rubric, same numbers if you re-run it

1 medium
  • Code scan263 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 32 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    src/frames/index.js: …gth ? 1 : 0; } out(` ${all.length} eval(s) — ${bad.length ? "REFUSED" : "ok"} (n…
Overall 80/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How bundlebox compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
80/100
higher than 60% of 4,460 AI and agents servers
Tools
10
the typical AI and agents server has 6
Tools that change things
10%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
2
more than 65% of 2,711 AI and agents servers
Downloads a week
70
more than 54% of 1,538 AI and agents servers with a package

What its tools let an agent do: 9 read · 1 change

Release history: 2 versions in the registry since 2026-09-22, latest 2026-09-22, typically several a day.

Install bundlebox in Claude Code, Cursor or VS Code

Runs npx -y bundlebox on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add bundlebox -- npx -y bundlebox
Add to Cursor

What the publisher says

From the bundlebox repository's README, as published. We do not edit it. Read it on GitHub

bundlebox The zero-token software factory for AI coding agents. Scan, pack, route and run work across Claude Code, Codex, Gemini CLI, Cursor, Copilot, OpenCode, Aider and any custom agent, and measure every token a session used and was spared.

An AI coding agent is billed for what it reads, and most of what it reads is orientation, not judgement: where a symbol lives, whether two tables agree, which command proves a change, what changed since last week. bundlebox answers every question a parse, a count, a path check or a set difference can answer before the agent opens, packs the answers into a brief sized to the agent's window, opens the agent under a measured-minimal flag stack, and measures afterwards what the session used and what it was spared. It never calls a model itself.

bb genesis   ->  a world     a doc becomes surfaces, rules and capabilities  0 tokens
bb scan      ->  findings    what is wrong, with evidence                    0 tokens
bb fix       ->  patches     local actuators close what they can             0 tokens
bb cookbook  ->  a board     what the RUNNING system does, run by the kernel 0 tokens
bb simulate  ->  limits      what it does at a hundred callers               0 tokens
bb compile   ->  units       what to do about the rest, packed to one window
bb pinpoint  ->  a brief     where the work is, quoted and budgeted, before a model opens
bb arc       ->  an index    every declaration in one file, read in microseconds  0 tokens
bb route     ->  lanes       who does it, where, in what wave
bb run       ->  sessions    the only verb that spends
bb finish    ->  a ledger    what proves this done, declared first and run after   0 tokens
bb git       ->  PRs         commit, push, draft PR, review, gated merge     0 tokens
bb runbook   ->  the system  is it up, is it ANSWERING, what broke since    0 tokens
bb recom     ->  an answer   what was already driven, and whether it holds   0 tokens
bb recom gate->  a decision  and therefore whe

Measured on the reference workspace (regenerate with bb session, bb tokens profile --probe, bb buckmaster episodes):

Install

npm i -g bundlebox
# or
curl -fsSL https://raw.githubusercontent.com/blackswanalpha/bundlebox/main/scripts/install.sh | sh

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-11-02downgradeA → Bscore 80: eval / new Function used

bundlebox: common questions

Is bundlebox MCP server safe?
Mostly: it is graded B (80/100). Read the bundlebox safety report
How do I install bundlebox?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does bundlebox need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is bundlebox maintained?
The last commit was 34 days ago (2026-10-01). The latest release is v0.8.0.
What can I use instead of bundlebox?
Servers from other publishers that do the same job: Commonly MCP server, Decionis MCP server and mcptoon MCP server.
How does bundlebox compare with other AI and agents MCP servers?
safety score 80/100 (higher than 60% of 4,460 AI and agents servers); tools 10 (the typical AI and agents server has 6); tools that change things 10% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to bundlebox

Same job from other publishers: the closest match first, then the best rated.

  • Commonly
    Read Commonly pods and post as a Commonly agent you create, with a token from your Commonly account.
    A
  • Decionis
    Authorize consequential AI agent actions before execution
    A
  • mcptoon
    MCP tools + agent skills in one zero-dependency CLI: 71,929 -> 581 tokens (-99.2%, measured).
    A
  • llmtrim
    MCP server and proxy that compresses LLM prompts, tool output, and replies to cut token cost.
    A
  • Agent Lsp
    Orchestrates language servers into 65 code-intelligence tools across 32 languages, token-optimized.
    A