MCP.Market

Covalent Bond MCP server

by gopalrajsuresh·io.github.gopalrajsuresh/covalent-bond·v0.1.2
No reviews yet

Peer-to-peer, end-to-end-encrypted collaboration channel for AI coding agents over MCP.

A92/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A92/100

full report

Adoption
Growing

0 stars36 downloads/wk

Reviews

Write one

Nobody has reviewed Covalent Bond yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Covalent Bond tools (9, 3 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • bond_accept

    Accept a pending file transfer. File will be written to ~/.covalent/incoming/ and its content returned, wrapped in untrusted-data markers.

  • bond_connectwrite action

    Create a new Covalent Bond session and get a shareable session code. The other agent will use this code to join.

  • bond_decline

    Decline a pending file transfer. File will be discarded and sender will not be notified.

  • bond_end

    End the current Covalent Bond session and disconnect from relay. Clears all pending transfers.

  • bond_join

    Join an existing Covalent Bond session using a session code (format: XXXX-XXXX-XXXX Base58, e.g., "3KPz-QR7m-8WXn"). Call this when the user provides a session code from another agent. The code is a shared secret - it authenticates the encrypted channel and is never sent to the relay.

  • bond_messagewrite action

    Send a short encrypted text message to the connected agent (no file involved). Use this for agent-to-agent conversation: questions, context, summaries. Requires a confirmed session. Max 4000 characters.

  • bond_sendwrite action

    Send a file to the connected agent. File will be encrypted and delivered with an optional message. Subject to 10-second rate limit and security validation (file type whitelist, 256KB default size limit, configurable via COVALENT_MAX_FILE_KB).

  • bond_status

    Get current Covalent Bond connection status: session info, handshake state, pending file transfers, and any events (incoming transfers, peer messages) that arrived since the last tool call. Call this periodically while connected to pick up incoming transfers.

  • bond_wait

    Wait (long-poll) until the next event arrives from the peer (a message, incoming file, or disconnect) or until the timeout passes. Use this in a loop to hold a live conversation with the other agent: call bond_wait, react to what it returns, reply, call bond_wait again. Returns immediately if events are already queued. This costs tokens per call, so loop only during an active conversation; for idl

Public scan report

scanner v0.1.9 · 2026-09-25 · same rubric, same numbers if you re-run it

no findings
  • Code scan17 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 16 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 92/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Covalent Bond compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
92/100
higher than 95% of 48,255 servers
Tools
9
the typical server has 7
Tools that change things
33%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
36
more than 26% of 12,191 servers with a package

What its tools let an agent do: 6 read · 3 change

Install Covalent Bond in Claude Code, Cursor or VS Code

Runs npx -y covalent-bond on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add covalent-bond -- npx -y covalent-bond
Add to Cursor

What the publisher says

From the Covalent Bond repository's README, as published. We do not edit it. Read it on GitHub

Covalent Bond

A secure channel that lets two AI coding agents on different machines work as one.

Quick start · How it works · Tools · Security · Architecture · Contributing

= 18">

A covalent bond is two atoms sharing a pair of electrons. Covalent Bond is two coding agents on different machines sharing something just as fundamental: a private, authenticated channel, and through it, a way of working.

Picture two developers pairing across a distance. One has their agent dialed in (organized skills, sharp conventions, the right context loaded) and it produces excellent work. The other is more ad-hoc, and their agent turns out something that's just okay. Covalent Bond is the channel that closes that gap: the well-tuned side can hand over the files, context, and conventions that make its agent good, so both agents converge on the same high-quality way of working. It bonds not just two agents, but two ways of working, pulling the weaker setup up to the level of the stronger, as equal peers.

It's peer-to-peer and end-to-end encrypted: the two agents pair up and exchange messages and files through a relay that can never read the traffic. It works with any MCP-compatible agent (Claude Code, Cursor, Codex, Windsurf, Cline, and others), exposing bond_* tools over the Model Context Protocol. And it keeps a human in the loop: every incoming file waits for explicit consent before it touches disk.

  • 🤝 Bonds two ways of working: share files, context, and conventions so both agents level up together
  • 🔒 Authenticated E2EE: a malicious relay can't read or MITM the channel
  • 🌐 Cross-machine: pair agents anywhere, through a dumb relay (no inbound ports)
  • 🙋 Human-in-the-loop: consent before any file is written; full audit log
  • 🔌 Agent-agnostic: any MCP client, not tied to one vendor

It doesn't magically clone one setup onto another. It's the secure, consent-gated channel that makes deliberately sharing your working style possible between two machines that otherwise can't reach each other.

Quick start

Shortcut: let your agent set everything up. Paste docs/AGENT-SETUP.md to any coding agent and say "set up Covalent Bond". It walks the agent through install, relay config, MCP registration, and pairing, with clear stops for the parts only a human may do.

Or do it yourself on both machines (steps 1–2), then pair (step 3).

  1. Register the MCP server with your agent — no install needed, npx fetches the npm package. For Claude Code:
claude mcp add --scope user --env COVALENT_RELAY_URL=https://covalent-bond-relay.gopalrajsuresh.workers.dev covalent -- npx -y covalent-bond

(--scope user makes the bond_* tools available in every project. The env var points at the public relay; to self-host instead, see Pick a relay.)

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Covalent Bond: common questions

Is Covalent Bond MCP server safe?
Yes, by our scan: it is graded A (92/100). Read the Covalent Bond safety report
How do I install Covalent Bond?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Covalent Bond need an API key?
No secret keys are declared. It reads 3 settings from the environment.
Is Covalent Bond maintained?
The last commit was 55 days ago (2026-09-09). The latest release is v0.1.2.
What can I use instead of Covalent Bond?
Servers from other publishers that do the same job: Deja Vu MCP server.
How does Covalent Bond compare with other MCP servers?
safety score 92/100 (higher than 95% of 48,255 servers); tools 9 (the typical server has 7); tools that change things 33% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Covalent Bond

Same job from other publishers: the closest match first, then the best rated.

  • Deja Vu
    deja-vu: local memory over the session histories of forty-three coding agents.
    A