AgentArmorHQ
Sign in

concord-mcp

MCP server · npm · ★ 743 · graded 2026-10-27Source linked

Live messaging for coding agents

No outside reports on file

Concord-MCP creates a live communication channel that could leak sensitive code and credentials if not properly secured, and could be exploited to trick AI agents into harmful actions.

Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Concord MCP helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachConnects to outside service APINOTED
  • CredentialsRequires API key or tokenREVIEW
  • Package sourcenpm (@concord-ai/concord-mcp)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y @concord-ai/concord-mcp

All setup options ↓

Check this skillWatch it in my stackCompareAdd to allowlistREADME badgeView project

About Concord MCP

Concord-MCP is a connector that lets AI coding agents send and receive live messages while they work on code. It appears designed to enable real-time communication between AI assistants and development environments or other tools.

Who it’s for

This tool is built for developers who want their AI coding agents to communicate live during tasks. It may appeal to teams using Claude or similar AI assistants in their development workflow.

Alternatives

  • Anthropic MCP (official connectors): Vetted messaging tools for Claude integration.
  • LangChain integrations: Other frameworks for AI agent communication.
  • Custom REST APIs: Building direct integration without a third-party connector.
  • Slack/Discord bots: Alternative messaging platforms with AI assistant support.

Setup

Check these steps against the project’s own instructions before running anything.

Follow the project's README. The GitHub repository should contain installation instructions specific to your setup (likely npm-based or Claude Desktop configuration).

Why this grade

CC — Moderate risk signals

Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.

Popularity and upkeep

40/100
GitHub stars
743
Listing last refreshed
2026-10-28

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Security reports

No reports found for this package in our research (last checked 2026-10-29).

Check a specific version →

Risks to watch for

  • Message interception: Live messaging could expose code snippets, API keys, or secrets if transmitted without encryption.
  • Malicious message injection: Attackers could send crafted messages to trick the AI into running harmful commands or modifying code incorrectly.
  • Credential exposure: If the connector accesses development tools, it may gain access to stored tokens or authentication credentials.
  • Unvalidated input: Messages from external sources might contain prompts designed to manipulate AI behavior or bypass safety guidelines.
  • Third-party dependencies: The tool's dependencies could contain vulnerabilities that compromise the entire setup.

How to lower the risk

Least-privilege permissions

  • Run the connector with minimal access to repositories and tools.
  • Restrict which projects and credentials it can reach.

Network isolation

  • Use VPN or firewall rules to limit who can send messages to the agent.
  • Encrypt all message traffic if possible.

Monitoring

  • Log all messages and commands the AI executes.
  • Review logs regularly for suspicious activity or unexpected code changes.

Red flags to watch for

  • Messages containing unusual commands or requests to disable security features.
  • Sudden access to repositories or services the agent shouldn't use.
  • Unexpected outbound network connections from the connector.

Questions

How do I install Concord MCP?

Run npx -y @concord-ai/concord-mcp in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/Get-Concord-AI/concord-mcp.

Are there security reports about Concord MCP?

No reports found for this package in our research (last checked 2026-10-29). Concord MCP currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include message interception, malicious message injection, credential exposure.

Is Concord MCP actively maintained?

Concord MCP has 743 GitHub stars. Our directory data was last refreshed on 2026-10-28. Check recent commit activity, release tags, and open issues at github.com/Get-Concord-AI/concord-mcp before pinning it in production.

What are alternatives to Concord MCP?

Notable alternatives to Concord MCP include Anthropic MCP (official connectors) (Vetted messaging tools for Claude integration), LangChain integrations (Other frameworks for AI agent communication), Custom REST APIs (Building direct integration without a third-party connector), Slack/Discord bots (Alternative messaging platforms with AI assistant support). You can also compare Concord MCP side by side with other MCP servers in the Related tools section on this page.

README badge and team notes

Maintain or use Concord MCP? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade C for Concord MCP

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Concord MCP](https://agentarmorhq.com/api/badge/get-concord-ai-concord-mcp)](https://agentarmorhq.com/skills/get-concord-ai-concord-mcp)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/get-concord-ai-concord-mcp"><img src="https://agentarmorhq.com/api/badge/get-concord-ai-concord-mcp" alt="AgentArmorHQ Risk Grade for Concord MCP" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "get-concord-ai-concord-mcp"

Share with your security lead

Need sign-off to use concord-mcp? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: concord-mcp
- **Listing URL:** https://agentarmorhq.com/skills/get-concord-ai-concord-mcp
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 743 GitHub stars

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** npm (@concord-ai/concord-mcp)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts @concord-ai/concord-mcp`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Publisher
Get-Concord-AI
Source code
github.com/Get-Concord-AI/concord-mcp
Install command
npm install @concord-ai/concord-mcp
Est. context load
~500 tokens / turn (~3 tool schemas, 0.25% of 200k context)
Popularity
743 GitHub stars
Last updated
2026-10-28
Last graded
2026-10-27

Community

Discussions for Concord MCP

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Concord MCP helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude