CLI Bridge MCP server
io.github.JoaoBerne/cli-bridge-mcp·v0.3.0·2 starsOther AI CLIs (Gemini, GPT, Claude, opencode, Ollama) as a council — ban-safe, no API keys.
2 stars49 downloads/wk
Reviews
Write oneNobody has reviewed CLI Bridge yet.
If you have run it, two minutes of your experience saves the next person an afternoon.
CLI Bridge tools
No tool declarations could be read from the package source. They show once the server is installed.
Public scan report
scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it
- Code scan31 source files scanned15/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 2 days ago15/15
- Maintainer identityregistry namespace matches repository owner6/10
Findings (2)
- mediumsubprocess with shell=True
exec.shell-truecli_bridge_mcp-0.3.0/src/cli_bridge/workflows.py: …*=\s*True"), "medium", "subprocess with shell=True", "shell=True invites command inje…
- mediumeval / new Function used
exec.evalcli_bridge_mcp-0.3.0/src/cli_bridge/workflows.py: …ompile(r"\beval\s*\("), "high", "Use of eval()", "eval on untrusted input is arb…
How CLI Bridge compares
Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 74/100
- higher than 40% of 48,243 servers
- GitHub stars
- 2
- more than 75% of 28,706 servers
- Downloads a week
- 49
- more than 39% of 12,306 servers with a package
Install CLI Bridge in Claude Code, Cursor or VS Code
claude mcp add cli-bridge-mcp -- uvx cli-bridge-mcp
What the publisher says
From the CLI Bridge repository's README, as published. We do not edit it. Read it on GitHub
<!-- mcp-name: io.github.JoaoBerne/cli-bridge-mcp -->
cli-bridge
A Model Context Protocol server that lets the AI assistant you're talking to consult the other AI CLIs installed on your machine — Claude Code, Codex, Gemini, Mistral, opencode, Ollama, Apple fm, … Each lane spawns the official CLI as a subprocess: no API keys, no token extraction, read-only by default.
Dependencies: the Python stdlib and mcp (1.x or 2.x). No daemon.
What it does
ask_gemini(task="find the bug across ./src", cwd="path/to/repo") # one lane (1M-token context)
ask_apple(task="what's wrong in this UI?", images=["shot.png"]) # vision, on-device, $0
ask_all(task="…") # every free lane in parallel + disagreement score
ask_cascade(task="…") # cheapest→strongest, skips cooled-down lanes
ask_best(task="…", mode="deep") # router picks; rate_lane teaches it
ask_build(lane="opencode", task="add retry with backoff") # build in a throwaway worktree → diff
review_diff(base="origin/main", focus="security") # multi-model review, severity-ranked
debate(task="which migration strategy?", vote="borda") # N blind answers, peer-ranked
workflow(preset="converge", task="is this migration safe?") # author → blind arbiter → cross-family peers
git_text(kind="commit") # Conventional Commit from the staged diffEvery ask_ returns a thread id; reuse it (even on another lane) for a multi-model conversation that survives /compact. conversations lists or replays threads.
Tools
15 fixed tools + one ask_ per installed CLI:
- Consult: ask, askall, askcascade, askbest, conversations, list_models
- Build: ask_build (mode=isolated → diff, mode=direct → zone-guarded writes; with mode=direct, async=true → steerable via job)
- Review: reviewdiff (focus=code|security), debate (vote=judge|borda), workflow (presets: refineplan, mapreview, researchverify, fanoutcompare, converge, premortem, testplan, challenge), git_text (kind=commit|pr)
- Operate: job (action=status|result|cancel|list|tail|steer), ratelane, setlane_cost, doctor, setup
CLIBRIDGETOOLS=all adds batchrun (journaled fan-out) and resetlanestate; CLIBRIDGETOOLS=default,batchrun extends the default; a plain comma list is exactly those. Usage and lane health are MCP resources (cli-bridge://usage-summary, cli-bridge://lane-stats). Full reference: docs/TOOLS.md.
There is also a human CLI, cli-bridge doctor|ask|ask-all|ask-best|build|review-diff|security-review|test-plan|premortem|stats|usage|jobs|set-cost (--json where it makes sense). cli-bridge build "" prints the worktree diff; --apply lands it as unstaged changes.
Writing code safely
- isolated (default): the delegate edits a throwaway git worktree and you get a diff. Your tree is untouched.
- direct: writes real files, but only inside the zone you declare, behind a per-zone lock with a post-turn zone-violation check; undo is zone-scoped. async=true makes it steerable (job action=tail|steer) with an executable Definition-of-Done (dod_cmd).
CLIBRIDGEVERIFYPLANREADONLY=1 flags (never reverts) a read-only delegate that wrote files anyway. Re-entry is depth-capped (CLIBRIDGEMAXDEPTH, default 1). Delegates run in the caller's cwd, else CLIBRIDGEDEFAULTCWD, else the host's MCP workspace root.
Install
Prerequisites: Python 3.12+, uv, and at least one AI CLI installed and logged in.
Shortened. The full README is on GitHub.
Nothing above is checked by us. What we check is on the safety report.
Grade history
- 2026-09-19restoreD → Bscore 74: subprocess with shell=True; eval / new Function used
CLI Bridge: common questions
- Is CLI Bridge MCP server safe?
- Mostly: it is graded B (74/100). Read the CLI Bridge safety report
- How do I install CLI Bridge?
- It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
- Does CLI Bridge need an API key?
- No secret keys are declared. It reads 3 settings from the environment.
- Is CLI Bridge maintained?
- The last commit was 23 days ago (2026-10-13). The latest release is v0.3.0.
- How does CLI Bridge compare with other MCP servers?
- safety score 74/100 (higher than 40% of 48,243 servers); github stars 2 (more than 75% of 28,706 servers); downloads a week 49 (more than 39% of 12,306 servers with a package). Full comparison.