Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add arikw/claude-code-matrix-bridge/plugin install rx-claude-matrix-bridgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/mcp/arikw/claude-code-matrix-bridge/matrix-bridge)<a href="https://agentmods.dev/mcp/arikw/claude-code-matrix-bridge/matrix-bridge"><img src="https://agentmods.dev/badge/mcp/arikw/claude-code-matrix-bridge/matrix-bridge.svg" alt="Measured on agentmods" height="20"></a>Grade B, and why
matrix-bridge scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
"valid() { [ -n \"$1\" ] && [ -f \"$1/.mcp.json\" ] && [ -d \"$1/bin\" ] && { [ -f \"$1/dist/server.js\" ] || [ -f \"$1/server.ts\" ]; }; }; ROOT=\"$CLAUDE_PLUGIN_ROOT\"; valid \"$ROOT\" || ROOT=\"\"; if [ -z \"$ROOT\" ] What it actually says
{
"matrix-bridge": {
"command": "bash",
"args": [
"-c",
"valid() { [ -n \"$1\" ] && [ -f \"$1/.mcp.json\" ] && [ -d \"$1/bin\" ] && { [ -f \"$1/dist/server.js\" ] || [ -f \"$1/server.ts\" ]; }; }; ROOT=\"$CLAUDE_PLUGIN_ROOT\"; valid \"$ROOT\" || ROOT=\"\"; if [ -z \"$ROOT\" ]; then STALE=$(cat \"$HOME/.claude/channels/rx-claude-matrix-bridge/plugin-root\" 2>/dev/null); valid \"$STALE\" && ROOT=\"$STALE\"; fi; if [ -z \"$ROOT\" ]; then for v in \"$HOME\"/.claude/plugins/cache/*/rx-claude-matrix-bridge/*/; do valid \"${v%/}\" && ROOT=\"${v%/}\"; done; fi; if [ -z \"$ROOT\" ] && valid \"$PWD\"; then ROOT=\"$PWD\"; fi; if [ -f \"$ROOT/dist/server.js\" ]; then exec node \"$ROOT/dist/server.js\"; elif [ -f \"$ROOT/server.ts\" ]; then cd \"$ROOT\" && exec npx --yes tsx server.ts; else echo \"matrix-bridge: cannot locate plugin root (tried CLAUDE_PLUGIN_ROOT env, plugin-root state file, plugin cache scan, PWD). Reinstall: claude plugin install rx-claude-matrix-bridge@arikw\" >&2; exit 1; fi"
]
}
}What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 9 lines scan B 9be1e49c30a9
matrix-bridge is an MCP server published in the GitHub repository arikw/claude-code-matrix-bridge (2 stars, last pushed 3mo ago), licensed MIT. Its token cost is not measured: an MCP server costs its tool schemas, not its config file. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other mcp servers, from other repositories
matrix
MCP server "matrix" as configured in nazbav/claude-code-matrix-channel. Launched with bun run --cwd ${CLAUDE_PLUGIN_ROOT} --silent start.
ffmpeg-mcp
MCP server "ffmpeg-mcp" as configured in vikisingh23/neuraforge-ai. Runs locally from the ffmpeg-mcp npm package.
docs-langchain
MCP server "docs-langchain", hosted remotely at docs.langchain.com, as configured in langchain-ai/langchain.
reference-langchain
MCP server "reference-langchain", hosted remotely at reference.langchain.com, as configured in langchain-ai/langchain.
playwright-test
A high-level API to automate web browsers. Runs locally from the playwright npm package.
supabase
Supabase's hosted MCP server: lets the agent manage projects, tables, SQL and migrations. Remote server at mcp.supabase.com.