BOSS Console — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Follow desktop or hosted agent integrations as the console evolves

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Operating multiple coding/research agents with governed local tools

What we know

Cross-platform agent operator console with plugin-based browser, files, Git, shell, secrets, automation and a governed MCP tool surface.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC)📝 Add release notes for v9.5.38

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Per-user tool access and plugin permissions. Writes: Shell commands; File/Git writes; Docker/Kubernetes operations; RPA flows.
RBAC and user-scoped access.
Sensitive access: Secrets, Source code, Browser sessions, Infrastructure

BOSS intentionally gives agents real operator tools; RBAC, kill switches and secret scoping are essential.

Security source · repository notice ↗Security source · policy file ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

804 repository stars

Stars observed Sep 25, 2026.

Preserve any already-reviewed adoption metrics in MCP100. Batch 4 did not refresh package downloads because the package-stats provider had insufficient credits.

All limitations / Review context

Which MCP tools and workspace actions are currently supported?

The bounded assessment reviewed the official README, repository notices, security policy path, and security page for known material public-tracking blockers. No such blocker was identified. This is a public-tracking assessment, not an installation safety certification.

BOSS intentionally gives agents real operator tools; RBAC, kill switches and secret scoping are essential.
Per-user tool access and plugin permissions.
RBAC and user-scoped access.
Can access workstation files, terminals, browser state, secrets and infrastructure through enabled plugins.
Reviewed write actions: Shell commands; File/Git writes; Docker/Kubernetes operations; RPA flows
Sensitive access: Secrets, Source code, Browser sessions, Infrastructure
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Large tool surface can confer broad workstation/infrastructure authority.
Shared/remote terminal features require strong access controls.

Original activity observations

2026-10-05T12:24:20Z: 📝 Add release notes for v9.5.38

Technical identity

github.com/risa-labs-inc/bossconsole

Exact implementation source: https://github.com/risa-labs-inc/bossconsole ↗
Reviewed resource type: Host
Repository identity: risa-labs-inc/bossconsole
Service endpoint: http://127.0.0.1:7677

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 6, 2026

GitHub repository ↗
risa-labs-inc/bossconsole
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Host / Desktop app setup

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Download / install
Publisher instructions
BOSS Console is a desktop agent host with its own MCP/tool management.
package install · Publisher instructions
brew install --cask boss
Configure application / integrations
MCP100 setup guide
Install app with publisher releases or Homebrew, then use Toolbox → MCP to enable only tools you need. Refer to publisher Agents and MCP wiki for full host-specific workflow.
Check connection
Suggested check
Launch BOSS Console and inspect Toolbox → MCP switches; do not run agent tools.
Disconnect / uninstall / revoke
MCP100 setup guide
In BOSS Toolbox disable the installed tool/plugins and remove their integration from the workspace. To remove BOSS on macOS installed by Homebrew use `brew uninstall --cask boss`. This desktop agent host is not itself a standalone MCP server.
Client unregistration, program uninstall, persistent-data deletion, and credential revocation must be treated separately.
Package / application uninstall · matching installation environment · MCP100 composed guide
brew uninstall --cask boss

Official Documentation & Sources

What it does

Cross-platform agent operator console with plugin-based browser, files, Git, shell, secrets, automation and a governed MCP tool surface.

Capability: Developer Tools
Resource type: Host
Industry: Software & Technology
Best fit: Operating multiple coding/research agents with governed local tools

Representative uses

Run Claude/Codex/Gemini/OpenCode in shared terminals
Expose browser/file/Git/shell tools
Manage plugins and secrets
Operate Docker/Kubernetes tools

Limitations

Large tool surface can confer broad workstation/infrastructure authority.
Shared/remote terminal features require strong access controls.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: RBAC and user-scoped access.
Permissions: Per-user tool access and plugin permissions.
Data handling: Can access workstation files, terminals, browser state, secrets and infrastructure through enabled plugins.
Cost: unknown
Risk and cautions: BOSS intentionally gives agents real operator tools; RBAC, kill switches and secret scoping are essential.

Access scope and cautions

Write actions: Shell commands File/Git writes Docker/Kubernetes operations RPA flows
Sensitive access: Secrets Source code Browser sessions Infrastructure
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-06. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Run Claude/Codex/Gemini/OpenCode in shared terminals; Expose browser/file/Git/shell tools; Manage plugins and secrets; Operate Docker/Kubernetes tools.

What setup and authentication are documented?

A complete connection procedure is not verified. Recorded endpoint: http://127.0.0.1:7677. Recorded transport: sse. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Server-enforced RBAC and authenticated IPC are documented.

Can it modify data or perform write operations?

Documented write actions include: Shell commands; File/Git writes; Docker/Kubernetes operations; RPA flows. Recorded permission boundary: Per-user tool access and plugin permissions.

What data-handling boundary should I consider?

Can access workstation files, terminals, browser state, secrets and infrastructure through enabled plugins. Recorded sensitive-access context: Secrets; Source code; Browser sessions; Infrastructure.

What limitations and risks should I check before use?

BOSS intentionally gives agents real operator tools; RBAC, kill switches and secret scoping are essential. Large tool surface can confer broad workstation/infrastructure authority. Shared/remote terminal features require strong access controls. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

RISA Labs is listed as First-party MCP in MCP100’s current evidence.