Is io.github.asklokesh/loki-mode safe to use?

io.github.asklokesh/loki-mode has 4 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "loki-mode". Review the Security section above for details before installing.

How do I install io.github.asklokesh/loki-mode?

io.github.asklokesh/loki-mode supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.asklokesh/loki-mode do?

io.github.asklokesh/loki-mode provides 8 tools: Facts, Assessments, VERIFIED, Architecture, Dashboard and 3 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.asklokesh/loki-mode?

io.github.asklokesh/loki-mode is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.

Is io.github.asklokesh/loki-mode actively maintained?

io.github.asklokesh/loki-mode is actively maintained — last commit was 3 days ago. It has 1,045 GitHub stars.

io.github.asklokesh/loki-mode

loki-mode

Autonomous spec-to-product coding-agent CLI with an MCP server exposing 34 tools over stdio.

1.0k 3.3k/wk 8 tools GitHub npm PyPI

2 open CVEs

No license

Actively maintained

Last commit 3d ago

Works with most clients

Transport: stdio, sse

8 tools · ~318 tok

Grade A · 0.2% of 200K ctx

MCPpedia last refreshed this data 17h ago

Edit this pageView history

io.github.asklokesh/loki-mode is an MCP server that autonomous spec-to-product coding-agent CLI with an MCP server exposing 34 tools over stdio. Its tool list has not been published yet over stdio and sse, requires no API key, and scores 83/100 on MCPpedia's security, maintenance and efficiency rubric.

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-asklokesh-loki-mode": {
      "args": [
        "-y",
        "loki-mode"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-asklokesh-loki-mode)](https://mcppedia.org/s/io-github-asklokesh-loki-mode)

Read me

What io.github.asklokesh/loki-mode does

The free, source-available autonomous coding agent by Autonomi. Same Loki CLI, SDK, and MCP for everyone; the commercial editions for teams and enterprises are sold under the Autonomi brand (Autonomi Cloud, Autonomi Enterprise).

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'loki-mode' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

83/100across 5 weighted dimensions

How we score →

0255075100

−17

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

2 open

CVE-2026-10177mediumCVSS 6.3

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

A security vulnerability has been detected in Aider-AI Aider 0.86.3.dev. This affects the function requests.get of the file api_docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. It is suggested to install a patch to address this issue. The pull request to fix this issue awaits acceptance.

Affected: >= 0source →

CVE-2026-10175mediumCVSS 6.3

Aider is vulnerable to Code Injection via editor_coder.run function

A security flaw has been discovered in Aider-AI Aider 0.86.3.dev. Affected by this vulnerability is the function editor_coder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected: >= 0source →

Inventory

Tools (8)

Click any tool to inspect its schema.

~318 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.asklokesh/loki-mode safe to use?: io.github.asklokesh/loki-mode has 4 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "loki-mode". Review the Security section above for details before installing.
How do I install io.github.asklokesh/loki-mode?: io.github.asklokesh/loki-mode supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.asklokesh/loki-mode do?: io.github.asklokesh/loki-mode provides 8 tools: Facts, Assessments, VERIFIED, Architecture, Dashboard and 3 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.asklokesh/loki-mode?: io.github.asklokesh/loki-mode is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.
Is io.github.asklokesh/loki-mode actively maintained?: io.github.asklokesh/loki-mode is actively maintained — last commit was 3 days ago. It has 1,045 GitHub stars.

Similar servers

Others in other

View all →

Transport Stdio95

Transport for TMCP using STDIO

197 14

Flare95

The graph based agentic IDE

123 3

Headroom95

Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.

67.2k 3

app.fojin/fojin-mcp94

Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.

329 8

MCP Security Weekly

Get CVE alerts and security updates for io.github.asklokesh/loki-mode and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Other

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-asklokesh-loki-mode": {
      "args": [
        "-y",
        "loki-mode"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-asklokesh-loki-mode)](https://mcppedia.org/s/io-github-asklokesh-loki-mode)

Read me

What io.github.asklokesh/loki-mode does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'loki-mode' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Loki Mode

The spec-driven autonomous builder with verified completion.

The free, source-available autonomous coding agent by Autonomi. Same Loki CLI, SDK, and MCP for everyone; the commercial editions for teams and enterprises are sold under the Autonomi brand (Autonomi Cloud, Autonomi Enterprise).

Hand it a spec. It does not accept "done" on an empty diff or failing tests.

Website | Documentation | Installation | Changelog

Current release: v9.16.0

Install

bun install -g loki-mode          # recommended (npm, Homebrew, Docker below)

Other install methods

Method	Command	Notes
Bun (recommended)	`bun install -g loki-mode`	Fastest startup for CLI commands.
npm	`npm install -g loki-mode`	Works without Bun (bash fallback). Migrate any time with `loki self-update --to bun`.
Homebrew	`brew tap asklokesh/tap && brew install loki-mode`	Auto-installs Bun as a dep.
Docker	`docker pull asklokesh/loki-mode:latest`	Bun + Claude CLI pre-installed. See DOCKER_README.md.

Upgrade with loki self-update. Long form: Installation Guide.

Use it

loki quickstart                   # guided first build: asks a few questions, quotes cost, builds

That is the whole happy path. It asks for a one-line idea, picks a template, shows the real cost and time estimate before spending anything, then builds. Press Enter through every step and you get a sample Todo app.

One command, no prompts (CI, scripts, containers, any shell without a terminal):

loki quickstart "a todo app with user accounts" --yes

Both halves are required with no terminal: an idea (or a path to a PRD file) and an explicit --yes. Given both, Loki picks the top-ranked template automatically, prints the same honest cost and time estimate, and starts the build without asking anything. Missing either half exits 2 with the needs-a-terminal message and writes nothing, so an ambient LOKI_AUTO_CONFIRM or a stray argument in CI can never start a paid build on its own. Existing files are never overwritten: if prd.md is present the PRD lands at prd-quickstart.md, then numbered suffixes as needed.

Choose an exact shipped starter when the top-ranked match is not the one you want:

loki quickstart --list-templates
loki quickstart --list-templates --json       # schema-v1 automation output
loki quickstart "an internal reporting workspace" --template dashboard --yes

Template discovery works without a terminal or provider and lists every shipped starter's stable name and purpose in catalog order. It returns before estimation, consent, PRD writes, or build execution. Positional input and execution/preview flags are intentionally incompatible; --json is the only optional modifier.

--template accepts an exact template name for idea inputs and works the same way with interactive use or --dry-run (including JSON preview). Unknown templates, duplicate flags, and combinations with a PRD path refuse before provider discovery, estimation, writes, or build execution.

Preview the same deterministic templa

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

83/100across 5 weighted dimensions

How we score →

0255075100

−17

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

2 open

CVE-2026-10177mediumCVSS 6.3

Aider has an SSRF vulnerability through its AWS EC2 Metadata Endpoint

Affected: >= 0source →

CVE-2026-10175mediumCVSS 6.3

Aider is vulnerable to Code Injection via editor_coder.run function

Affected: >= 0source →

Inventory

Tools (8)

Click any tool to inspect its schema.

~318 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.asklokesh/loki-mode safe to use?: io.github.asklokesh/loki-mode has 4 known CVEs tracked by MCPpedia. You can verify these on OSV.dev by searching for "loki-mode". Review the Security section above for details before installing.
How do I install io.github.asklokesh/loki-mode?: io.github.asklokesh/loki-mode supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.asklokesh/loki-mode do?: io.github.asklokesh/loki-mode provides 8 tools: Facts, Assessments, VERIFIED, Architecture, Dashboard and 3 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.asklokesh/loki-mode?: io.github.asklokesh/loki-mode is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.
Is io.github.asklokesh/loki-mode actively maintained?: io.github.asklokesh/loki-mode is actively maintained — last commit was 3 days ago. It has 1,045 GitHub stars.