No red flags found in any of the 11 categories — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against the SlowMist agent-security taxonomy, refreshed every 8 hours. Full audit →
by context-labs · MCP Server · ★ 494
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
🔒 Is whip safe to install? View the security audit →
An LLM tool-use loop (bash / read / write / edit / task), an interactive bubbletea session, and provider-routable models. One binary, no runtime, config you can read. Why whip Agent harnesses should be FAST — literally as fast as possible. whip is built in Go around that constraint: parallel tool calls, streaming everything, nothing between you and the model but a loop. Defaults across other harnesses suck. They all have awesome patterns, but none of them bring them all together. whip cherry-picks the best ideas from pi, opencode, codex, and exo into one opinionated harness (see docs/roadmap.md — every feature cites its source). Go is great for networking-heavy applications, and harnesses do a whole lot of networking. whip leans on channels where the TypeScript reference designs hand-roll promises — per-path file locks and background subagents collapse into primitives the compiler checks (docs/concurrency.md). whip is focused on a future where open-source models are the preferred models.
| Stars | 494 |
| Forks | 135 |
| Language | Go |
| Category | MCP Server |
| License | Apache-2.0 |
| Quality Score | 64.7295597370214/100 |
| Open Issues | 20 |
| Last Updated | 2026-09-20 |
| Created | 2026-08-20 |
| Platforms | go, mcp |
| Est. Tokens | ~16k |
These tools work well together with whip for enhanced workflows:
Explore other popular mcp server tools:
whip is A fast coding-agent harness in Go. Tool-use loop, bubbletea TUI, provider-routable models with live catalog discovery, MCP support, background subagents. One binary, no runtime, built for open-source . It is categorized as a MCP Server with 494 GitHub stars.
whip is primarily written in Go.
You can find installation instructions and usage details in the whip GitHub repository at github.com/context-labs/whip. The project has 494 stars and 135 forks, indicating an active community.
whip is released under the Apache-2.0 license, making it free to use and modify according to the license terms.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy, covering 11 red-flag categories including credential harvesting, data exfiltration, and curl | sh installers. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: