hush runs on your own machine — the client starts it, so there is no endpoint to ping. 755 installs a week from npm. Last commit 6 Oct 2026.
Team secrets your AI agent can use but never read: encrypted in the repo, value-blind tools.
We read the source, 5 d ago · rules ccca72095570
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
return execFileSync(bin, ["-a", "-r", recipient.trim()], {
Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.
- name: update the Homebrew tap
env:
TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add hush -- npx -y @omarei/hush
{
"mcpServers": {
"hush": {
"args": [
"-y",
"@omarei/hush"
],
"command": "npx"
}
}
}
[mcp_servers.hush]
command = "npx"
args = ["-y", "@omarei/hush"]
{
"mcpServers": {
"hush": {
"args": [
"-y",
"@omarei/hush"
],
"command": "npx"
}
}
}
{
"mcpServers": {
"hush": {
"args": [
"-y",
"@omarei/hush"
],
"command": "npx"
}
}
}
Encrypted store for API keys and database URLs your code needs. Use them without reading them.
Finds the coverage gates in your repo that can never fail a build
Read-only MCP server: your agent sees all your sibling repos but structurally cannot touch them
Detect hardcoded secrets in source and config. Reports masked previews, never the values.
Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
Self-hostable team wiki; agents read & write it via MCP; Atlas turns your repo into a cited wiki.
A shared team wiki your coding agents read and write — across every repo and every MCP client.
Skills and Scars for AI agents - your agent records its failures and never repeats them.
Answers built from our own checks of this server.