Workspace Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Workspace Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Enables coding agents to access configured repository workspaces from a single session, especially companion repos outside the current project workspace.
AI coding agents are normally confined to a single workspace. When developing cross-platform features (e.g., FlowCoordinator on both Android/Kotlin and iOS/Swift), the agent loses all context when switching platforms. This MCP server gives the agent simultaneous access to both repositories, enabling:
read_crossprojectRead a file from a configured workspace root — usually a companion repo outside the current project workspace. Prefer the IDE's built-in read/navigation tools for files in the current workspace. Returns up to 500 lines by default with line numbers and metadata (totalLines, startLine, endLine, truncated). Use offset/limit to paginate.
read_crossproject(workspace: "ios", path: "Modules/Messaging/Sources/MessagingCoordinator/StreamState.swift")
read_crossproject(workspace: "ios", path: "Modules/.../LargeFile.swift", offset: 100, limit: 50)write_crossprojectCreate or overwrite a file in a configured workspace root — typically another repo exposed through this MCP, not the current project. Prefer the IDE's built-in editing/refactoring tools for current-workspace files. If a writeAllowlist is configured, only matching paths are writable.
write_crossproject(
workspace: "ios",
path: "Modules/Messaging/Sources/MessagingCoordinator/v2/KeyReducer.swift",
content: "// Swift code here"
)list_crossprojectList files and directories in a configured workspace root, usually an external or companion repo rather than the current project workspace. Returns metadata (type, size, modified date) and supports recursive tree listing.
list_crossproject(workspace: "ios", path: "Modules/Messaging/Sources")
list_crossproject(workspace: "ios", path: "Modules", recursive: true, maxDepth: 2)search_crossprojectSearch text/regex in files inside a configured workspace root, usually a companion repo outside the current project workspace. Prefer the IDE's built-in code navigation/LSP tools in the current workspace when they apply. Supports output modes (content, files, count), context lines, path scoping (directory or file), and pagination.
search_crossproject(workspace: "ios", pattern: "FlowCoordinator", glob: "**/*.swift")
search_crossproject(workspace: "ios", pattern: "class.*Coordinator", path: "Modules/Messaging", outputMode: "files")edit_crossprojectApply search-and-replace edits to one or more files in a configured workspace root, typically for companion repos outside the current project workspace. Prefer the IDE's built-in refactoring/editing tools for typed changes in the current workspace. Supports regex with backreferences.
// Single file
edit_crossproject(
workspace: "ios",
paths: "Modules/.../MyFile.swift",
oldString: "func oldName()",
newString: "func newName()",
)
// Multiple files (same replacement applied to all)
edit_crossproject(
workspace: "ios",
paths: ["FileA.swift", "FileB.swift", "FileC.swift"],
oldString: "oldValue",
newString: "newValue",
replaceAll: true,
)
// Regex with backreferences
edit_crossproject(
workspace: "ios",
paths: "Modules/.../MyFile.swift",
oldString: "func (\\w+)\\(param: String\\)",
newString: "func $1(param: Int)",
useRegex: true,
)run_crossprojectRun a shell command in a configured workspace root. Supports pipes, redirects, and chained commands. Returns stdout, stderr, and exit code. Use for build tools, codegen, git operations, or any command that needs to run in the workspace directory.
run_crossproject(workspace: "ios", command: "git status")
run_crossproject(workspace: "ios", command: "fastlane ios codegen_messaging")
run_crossproject(workspace: "android", command: "./gradlew :messaging:impl:test")
run_crossproject(workspace: "ios", command: "git log --oneline | head -5", timeout: 10000)Create a workspace-config.json in the repo root (see workspace-config.example.json):
{
"workspaces": {
"ios": {
"root": "$HOME/git/zillow/ZillowMap",
"name": "iOS (ZillowMap)"
}
}
}By default, the agent can write to any file and run any command within the workspace root. To restrict either, add optional allowlists:
{
"workspaces": {
"ios": {
"root": "$HOME/git/zillow/ZillowMap",
"name": "iOS (ZillowMap)",
"writeAllowlist": ["Modules/**/*.swift", "Tests/**/*.swift"],
"runAllowlist": ["git", "fastlane", "xcodebuild", "swift"]
}
}
}write_crossproject and edit_crossproject.run_crossproject. When configured, the first word of the command must match one of the prefixes (e.g., "git status" matches "git").Supports $HOME and ~ expansion in root paths. There are no hardcoded defaults — all workspaces must be defined in this file. If missing, the server starts with zero workspaces and logs instructions.
npm install -g @exaudeus/workspace-mcpAdd to ~/.firebender/firebender.json:
{
"mcpServers": {
"workspace": {
"command": "npx",
"args": ["-y", "@exaudeus/workspace-mcp"]
}
}
}Alternatively, if installed globally:
{
"mcpServers": {
"workspace": {
"command": "workspace-mcp"
}
}
}read_file("libraries/illuminate/flow-coordinator/v2/KeyReducer.kt")read_crossproject("ios", "Modules/Messaging/Sources/MessagingCoordinator/SubjectCoordinator.swift").firebender/rosetta-kotlin-swift.md in Android workspace)write_crossproject("ios", "Modules/.../KeyReducer.swift", content)All in one session, no context loss.
memory-mcp — persistent codebase knowledge for AI agents (separate repo).firebender/rosetta-kotlin-swift.md in Android workspace — idiom mapping reference# Install dependencies
npm install
# Build
npm run build
# Run in dev mode
npm run dev
# Run tests
npm testThe MCP uses stateless validation instead of session tracking - no brittle state to manage:
Edit Safety:
Write Safety:
writeAllowlist restricts writes to matching paths (omit to allow all)Why Stateless?
execFile with argument arrays (no shell interpolation)git_crossproject).firebender/platform-context.md on first access)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.