# Add to your Claude Code skills
git clone https://github.com/Get-Concord-AI/concord-mcpLast scanned: 7/25/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@eslint/config-array: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@eslint/eslintrc: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",
"severity": "high"
},
{
"type": "npm-audit",
"message": "eslint: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: Vulnerability found",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-07-25T06:20:48.870Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}concord-mcp is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Get-Concord-AI. "Google Workspace" for your AI Agents. It has 214 GitHub stars.
concord-mcp returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/Get-Concord-AI/concord-mcp" and add it to your Claude Code skills directory (see the Installation section above).
concord-mcp is primarily written in TypeScript. It is open-source under Get-Concord-AI on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh concord-mcp against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
⚠️ Early and under active development. The public surface is five workflow tools covering presence, task memory, versioned ownership, and evidence-rich handoffs.
Google Workspace gave human teams a shared place to see, create, and coordinate work. Concord brings that collaboration layer to coding agents — local-first, model-agnostic, and built around the repository.
| Without Concord | With Concord |
|---|---|
| Agents discover collisions after editing | Agents claim files and modules before work begins |
| Context disappears when a session ends | Decisions, assumptions, and findings stay attached to the task |
| Ownership is implied by chat history | Assignments and handoffs are explicit and acknowledged |
| Humans reconstruct progress from branches and diffs | A live roster and work-state show what is happening now |
| Review starts with “what changed?” | Review packets arrive with scope, tests, risks, and provenance |
Concord is not another autonomous agent. It is the shared workspace around your agents: presence, task memory, ownership, handoffs, and review state through one small MCP server.
npm install -g @concord-ai/concord-mcp
cd /path/to/your/repository
concord setup
concord setup creates the local .concord/ workspace, registers the MCP server
(.mcp.json, .cursor/mcp.json, and Codex's ~/.codex/config.toml) and writes
Concord's tool instructions into your client configs (CLAUDE.md, AGENTS.md,
.codex/, .cursor/rules/). It merges into existing config rather than
replacing it, and is safe to re-run. Pass --no-mcp to write only the
workspace and instructions while managing MCP registration yourself. Restart
your client afterwards so it picks up the new server.
In an interactive terminal, setup detects Codex, Claude, and Cursor and asks
once whether to enable their live-prompt integrations. Use
concord setup --agent-comms to approve them non-interactively.
There is no universal
/concordslash command — commands are client-specific. Concord works through MCP tools plus the installed instructions on any MCP-capable client.
When a new Concord version is available, update the global package and confirm the installed version:
npm install -g @concord-ai/concord-mcp@latest
concord --version
Concord does not auto-update. Upgrading preserves each repository's local
.concord/ workspace; any required database migrations run automatically when
the workspace is next opened. The interactive concord CLI checks npm at most
once per day and prints an update command when a newer stable release is
available. Set CONCORD_NO_UPDATE_CHECK=1 to disable this best-effort check.
| Tool | Purpose |
|---|---|
start_work |
registers presence, claims or accepts one task, and reports scope overlaps before editing |
inspect_work |
reads workspace/task state, an agent inbox/outbox, or a durable prompt/reply thread |
update_work |
records task context or immediately prompts/replies to another promptable workspace agent |
transfer_work |
assigns, accepts, declines, releases, reassigns, offers handoffs, or reopens versioned work |
finish_work |
records evidence and optionally marks a task review-ready, complete, or closed |
Writes accept an agent_id, which keeps presence live just by working.
inspect_work shows who is here and flags stale claims — an active
claim whose owning agent has gone away without handing off.
For live agent-to-agent communication, run concord setup --agent-comms (or
accept the one-time interactive setup prompt), then restart existing client
sessions once. A prompt uses update_work with operation: "prompt", the
target to_agent_id, content, and an idempotency_key; a reply uses
operation: "reply" and reply_to_message_id. Busy targets are steered into
their current turn, while idle targets start a new turn. Delivery fails
immediately when the named agent has no reachable relay; Concord does not
silently reroute it.
Concord resolves the repository workspace automatically. Operations return its
workspace_id and repository root so a client can detect a misrouted call; the
id can be passed explicitly when one server is coordinating multiple roots.
Lifecycle-changing operations use the task's monotonic version as
expected_version. If two agents act on the same version, only the first
transition succeeds. Assignment leaves work in assigned until the named agent
uses transfer_work with action: "accept"; a handoff offer likewise keeps
ownership with the sender until the recipient accepts. Every ownership change
is retained in an append-only audit history.
The five tools replace the earlier public names; there are no legacy aliases.
Update the package and re-run concord setup to refresh generated
instructions. concord doctor reports stale instruction blocks.
| Earlier tools | Replacement |
|---|---|
register_agent, claim_work |
start_work |
accept_task |
start_work or transfer_work with action: "accept" |
get_work_state, get_task_context |
inspect_work |
update_task |
update_work |
assign_task, release_task, reassign_task |
transfer_work |
offer_handoff, accept_handoff, decline_handoff |
transfer_work |
handoff, review_ready, close_task, reopen_task |
finish_work or transfer_work |
SQLite is the local source of truth, kept in the .concord/ at the root of
the repo the work is happening in. The MCP server resolves that root from
CONCORD_REPO_ROOT if set, then Claude Code's CLAUDE_PROJECT_DIR (which Claude
Code sets automatically, even for a user-scoped server), then its working
directory — so every agent in one repo shares one store. Set CONCORD_REPO_ROOT
when running the server somewhere its working directory is not inside the repo.
Linked Git worktrees follow Git's commondir metadata to the primary checkout,
so the main checkout and all linked worktrees intentionally share one Concord
database and workspace id.
To restrict explicit workspace selection, set CONCORD_ALLOWED_ROOTS to a
path-delimited list of allowed repository roots. Without an allowlist, decoded
roots must still exist and be directories.
concord setup adds .concord/ to the
repository's .gitignore, so the generated workspace stays local by default.
Teams that want selected artifacts in PRs can remove that rule or force-add the
human-readable files:
.concord/
├── concord.db local source of truth
├── HANDOFF.md human-readable handoff
├── REVIEW_PACKET.md review-ready evidence
└── WORK_STATE.json generated export (optional)
Concord supports both typed MCP tools and a regular CLI. MCP-capable agents can
call the tools directly; humans and CLI-oriented agents can work with the same
shared workspace through concord commands.
concord setup # set up local state, instructions, and MCP clients
concord status # roster, active work, overlaps, stale claims, review-ready
concord dashboard # live, keyboard-driven view of agents, tasks, alerts, and activity
concord who # which agents are present and what they