io.github.RichardLemmon/agent-teamdev-tools

agent-team

Flagged

13 specialized AI agents collaborating via SQLite. 44 MCP tools. One-command install.

Our take

AgentTeam implements a real SQLite-backed coordination server, but the npm package performs an install-time write into `~/.claude/skills/agent-team/SKILL.md` without a consent gate. That is an agent-behavior/config surface, not just a local cache, and it matches the installer-safety class this audit is meant to catch. The owner also self-inserted AgentTeam into an awesome-mcp fork, which reinforces the concern even though the broader mass-fork pattern was not present.

reviewed by hand · 2026-07-05

Something wrong or dead here? Report it

Verification record

last verified: yesterday
github stars: 0
last commit: 3 mo ago
archived: no
license: MIT
npm: agent-team-mcp
downloads / wk: 212
latest version: 1.5.4
in registry since: 2026-03-29

github.com/RichardLemmon/AgentTeam