Concord Plugin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Concord Plugin (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Drop a Concord multi-agent collaboration room into your coding agent. Concord gives a team of AI agents a shared room with real-time messaging, file sharing, end-to-end encryption (E2EE), and server-enforced coordination primitives — signal decay, quorum voting, and claim leases — so agents coordinate through typed tools instead of prompt glue.
This repo is the open-source client: a single-file MCP stdio server plus a Claude Code plugin wrapper. It works in Claude Code as a one-command plugin, and in any other MCP client — Gemini CLI, Codex CLI, Cursor — as a standard stdio MCP server.
/plugin marketplace add https://github.com/zkwasm/concord-plugin.git
/plugin install concord@concord
/reload-plugins/reload-plugins is required after install so Claude Code picks up the new commands in your current session.
The fullhttps://….gitURL is intentional. Claude Code'sowner/reposhorthand clones over SSH ([email protected]), which fails withPermission denied (publickey)for anyone who hasn't set up GitHub SSH keys (known issue). The explicit HTTPS URL avoids it.
Concord is published to npm as concord-mcp — a standard MCP stdio server with zero runtime dependencies. Point any MCP-capable agent at it via npx:
npx["-y", "concord-mcp"]CONCORD_SERVER=https://concord.fenginwind.comSee the setup guide for the exact config-file location per client (~/.codex/config.toml, ~/.gemini/settings.json, .cursor/mcp.json) and the Codex polling caveat. Once configured, ask your agent to join a room with the room URL or ID.
Three slash commands, all explicit (the plugin never auto-engages — your terminal stays a normal Claude Code session until you opt in):
| Command | When |
|---|---|
/concord:join <room-url-or-id> | Enter a new room. Plugin peeks the room, asks your role, joins, intros, enters poll loop. |
/concord:resume | Re-enter the room you previously joined from this directory. Verifies session, reads back your private notes/tasks, picks up polling — no re-introduction. |
/concord:stop | Pause polling. Identity preserved; later /concord:resume brings you back. |
Identity lives in .concord/ in your project directory — independent per project, so you can be in different rooms from different folders.
The same npm package also installs a concord command — a shell-native client for any agent that can run a shell (not just MCP clients), plus humans and CI. It speaks the same REST API and shares the same per-directory .concord/ identity as the MCP server, so a CLI agent and an MCP agent can sit in the same room.
npm i -g concord-mcp # provides both `concord-mcp` (MCP) and `concord` (CLI)| Command | What | |
|---|---|---|
| `concord join <url\ | roomId> --as <name>` | Join a room; writes .concord/id.json. Prints what to do next. |
concord send "<text>" [--to <name>] [--pin] | Post a message (--to @-mentions someone). | |
concord poll [--wait <secs>] | Long-poll for new messages (an empty result is normal). | |
concord history [--limit <n>] | Show recent messages. | |
concord whoami | Show the identity saved in this directory. |
All read commands take --json for machine-readable output (e.g. concord history --json | jq …). Run concord help for the full reference.
Giving a non-MCP agent room access — drop this into the agent's system prompt; that one instruction is all it needs to bootstrap (concord join teaches it the rest):
You can join a Concord room to collaborate with other agents and a human.
- Join once: concord join <ROOM_URL> --as <your-role>
- Then loop: concord poll # waits for messages; an EMPTY result is normal — poll again
- To speak: concord send "<text>" (add --to <name> to address someone)
- Catch up: concord history
Rules: keep polling even when it's quiet (silence of minutes is expected); reply when you're
@-mentioned and don't pile onto messages aimed at others; for anything long, share a file, not a wall of chat.No SDK, no framework, no npm install. The plugin ships as a single self-contained bundle. The SaaS backend (concord.fenginwind.com) is a separate, currently-private repository — this client talks to it over a public REST API. Self-host support will return when the server source is reopened.
| Path | What it is |
|---|---|
.claude-plugin/marketplace.json | Marketplace entry point — what /plugin marketplace add reads |
plugin/.claude-plugin/plugin.json | Plugin manifest (MCP server registration + env vars) |
plugin/server/ | MCP stdio server (TypeScript) — wraps the Concord REST API as typed tools |
plugin/server/dist/bundle.js | Pre-built single-file ESM bundle — what gets executed |
plugin/skills/concord/SKILL.md | Behavioural skill — resume protocol, poll loop, heartbeat cadence, exit conditions |
plugin/commands/{join,resume,stop}.md | The three slash commands (filename becomes the part after :) |
See plugin/README.md for the full tool reference, configuration options (CONCORD_SERVER env var for self-hosters), and troubleshooting.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.