
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@martinloop/mcp
Advanced tools
Governed MCP server for AI coding agents with budgets, verifier gates, and inspectable runs.
You give an AI agent a coding task. It runs. You get a bill.
But did it actually work? Did it pass your tests? How much did it spend? What files did it touch? Did it loop 47 times trying the same broken approach?
You don't know. And that's the problem.
MartinLoop is a governed loop for AI coding agents. You tell it what to do, set a budget, and point it at your test suite. It runs the agent, checks your tests after every attempt, and stops when either the tests pass or the money runs out.
When it's done, you get a receipt — not a vague summary, but a structured record: dollars spent, attempts made, verification results, files changed, and whether you got what you asked for.
One line to connect it:
claude mcp add martin-loop -- npx -y @martinloop/mcp
That's it. Your agent now runs governed.
We tested this against live repos with real API spend:
| What happened | Without MartinLoop | With MartinLoop |
|---|---|---|
| Budget: $1.50 task | Agent spent $28.42 | Agent stopped at $1.20 |
| Failing verifier | Retried indefinitely | Stopped after 3 attempts with diagnosis |
| CLI not on PATH | "not available on PATH" (dead stop) | Auto-discovered in AppData, kept running |
bun run lint && bun run test | Passed && as a literal arg (always fails) | Routed through shell, worked |
These aren't hypotheticals. The $28 overshoot happened in production testing. We fixed the circuit breaker in 0.3.8.
claude mcp add martin-loop -- npx -y @martinloop/mcp
Windows:
claude mcp add --transport stdio --scope user martin-loop -- cmd /c npx -y @martinloop/mcp
codex mcp add martin-loop -- npx -y @martinloop/mcp
gemini mcp add martin-loop -- npx -y @martinloop/mcp
npx -y @martinloop/mcp
You: "Fix the auth bug. Budget $3. Verify: npm test"
martin_doctor → checks CLI, auth, environment
martin_plan → scopes the task, sets constraints
martin_preflight → validates before any spend
martin_run → agent works inside budget + verifier gates
martin_dossier → receipt: $1.40 spent, 2 attempts, tests pass
Every attempt runs your verifier. Every dollar is tracked. If the agent drifts off-task, the scope contract catches it. If it blows the budget, the circuit breaker kills the subprocess mid-stream — not after the bill arrives.
Run the loop:
martin_doctor martin_plan martin_preflight martin_run martin_pause martin_continue martin_cancel
Inspect results:
martin_status martin_logs martin_dossier martin_eval martin_inspect martin_list_runs martin_get_run martin_get_attempt martin_get_verification_results martin_triage_runs
Ship the work:
martin_pr_summary martin_create_pr martin_review_pr
Your agent can pull context without side effects:
martin://runs/latest · martin://runs/latest/proof-card · martin://runs/latest/budget-status · martin://runs/latest/verifier-evidence · martin://runs/recent · martin://server/health · martin://policies/current · martin://agent/next-step · martin://guides/mcp-usage · martin://guides/agent-start · martin://repo/risk-map
Generate host config tuned to your workflow:
npx martin-loop mcp print-config --host claude --profile minimal # run + inspect
npx martin-loop mcp print-config --host claude --profile diagnostic # + doctor + triage
npx martin-loop mcp print-config --host claude --profile full-local # all local tools
npx martin-loop mcp print-config --host claude --profile github-review # + PR workflow
MartinLoop doesn't just report failures — it tries to fix them:
| Failure | Old behavior | Now |
|---|---|---|
| CLI not on PATH | Error message, dead stop | Searches npm global, homebrew, nvm, scoop — uses what it finds |
| Verifier says "command not found" | Generic "verification failed" | Tells the next attempt: "bun is missing, install with npm i -g bun" |
git restore fails mid-rollback | Throws, leaves dirty state | Retries once, falls back to git checkout, cleans up |
Invalid --profile flag | Crashes | Warns, falls back to minimal, keeps running |
Apache-2.0
FAQs
Governed MCP server for AI coding agents with budgets, verifier gates, and inspectable runs.
The npm package @martinloop/mcp receives a total of 148 weekly downloads. As such, @martinloop/mcp popularity was classified as not popular.
We found that @martinloop/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.