5dive-mcp is the MCP (Model Context Protocol) server for 5dive, used to expose 5dive's agent-fleet CLI as MCP tools. 5dive itself is a CLI and control plane for running a fleet of autonomous coding agents, with the goal of letting agents operate like an autonomous company. This server is a lightweight, honest adapter: each tool calls the local 5dive binary's machine-readable --json interface and returns the result, so it automatically inherits the CLI's authentication, permissions, and audit logging, and never handles secrets itself.
Purpose and main capabilities It provides the task-, agent-, and digest-related functionality of the 5dive CLI as stdio MCP tools. Any MCP client (Claude Desktop, Cursor, Cline, or a custom client) can point at this stdio server, allowing tasks to be submitted, agents to be viewed and messaged, and fleet digests to be read directly in the model context. It mirrors only a curated slice of the CLI (tasks, agents, digest); it is not the complete interface, nor a new API, but rather a distribution and convenience layer. Other functionality requires using the 5dive CLI directly (5dive --help).
How to use Prerequisite is that the 5dive CLI is installed and on PATH; the install command is: curl https://install.5dive.ai | sudo bash. Client configuration (Claude Desktop / Cursor / Cline): point the MCP client at this stdio server. Remote mode: 5dive-mcp serve. Clients running in someone else's cloud cannot start a stdio process on your machine; serve puts the same six tools on MCP's Streamable HTTP transport, bound to the loopback address, for your reverse proxy to publish over HTTPS. If you use the hosted version of 5dive, you do not need this server: just connect to https://api.5dive.com/mcp and log in. How clients connect: clients that can send headers (Claude Code, MCP inspector, most SDKs) use https://agents.example.com/mcp with Authorization: Bearer <token>. ChatGPT developer mode offers only OAuth or "no authentication", so the token must be put in the URL and "no authentication" selected:https://agents.example.com/mcp/<token>. You can view tokens with 5dive-mcp token list, and revoke one with 5dive-mcp token revoke --name=chatgpt; a running server will reject that token starting from the next request.
Security and limitations Permissions: a read-only token can list agents and tasks, read tasks, and read digests; a token with --write can also submit tasks (task_create) and send messages to agents (agent_send). No token can answer gates, change settings, spend money, or run anything other than these six CLI calls, each of which is built with a fixed argv and does not go through a shell. The sender claimed by a remote client is discarded: its messages are marked as mcp-<token name>, and its tasks state in the body which connection submitted them. Runtime identity: tools execute with the permissions of the user running serve, and with sudo's root privileges when FIVEDIVE_SUDO=1. The server only runs those six subcommands, but a compromised server process holds that user's privileges, so it should be run as a dedicated user whose sudo authorization covers only the 5dive binary. Rate limiting: by default 60 calls per minute per token (--rate), counted by JSON-RPC message; batch requests are rejected before execution. Bodies over 1 MiB are rejected. Auditing: every tool call, whether allowed or denied, appends a line to audit.jsonl: time, token name, tool, result, client IP (taken from X-Forwarded-For when the proxy is on loopback), and the id and name involved. Message text and task bodies are never written. Static storage: tokens.json (permissions 0600) stores the SHA-256 of each token, not the token itself. Both files are located in $FIVEDIVE_MCP_HOME, by default ~/.config/5dive-mcp. A token in a URL is a password in a URL. A reverse proxy's access log records the request path, so path logging should be disabled for /mcp/*, or header authentication should be used when the client supports it. Whoever holds the URL holds the token. Plaintext HTTP is limited to loopback: serve rejects public binding by default, because tokens would travel across the network unencrypted. If you do not want to open any inbound port, OpenAI's Secure MCP Tunnel runs a small client alongside the server and connects outward to OpenAI. Its tunnel-client can directly start a stdio server (--mcp-command "npx -y @5dive/mcp"), but it requires an OpenAI Platform organization with tunnel permissions.
Configuration Arguments are passed to the CLI as an argv array, without going through a shell, so tool input is never interpreted as shell syntax. The server never touches secrets: the CLI reads its own credentials from the local machine.
Use cases Suitable for users who already use 5dive to manage a fleet of autonomous coding agents and want to operate tasks, agents, and digests directly in the model context through an MCP client. Also suitable for scenarios that need to securely expose such capabilities to remote MCP clients through a reverse proxy.
Limitations Covers only a curated slice of tasks, agents, and digest, not the full CLI interface; requires the 5dive CLI to be installed in advance; remote mode requires configuring a reverse proxy and token management yourself; the default rate limit is 60 calls per minute per token; the body limit is 1 MiB; plaintext HTTP is limited to loopback.
License: MIT.
