Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@tenth-man-mcp Review my JWT refactor for auth module"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
When everyone agrees, someone has to disagree.
Adversarial review system for autonomous AI coding agents. Before your agent executes a critical change, 3 independent contrarian reviewers challenge the proposal — catching what a solo agent misses.
npm install -g tenth-man-mcp
claude mcp add tenth-man -- npx tenth-man-mcpThat's it. On first run, the protocol auto-injects a behavioral trigger into your CLAUDE.md and sets up .tenth-man/ in your repo (gitignored).
When your agent is about to make a critical change — touching auth, refactoring architecture, modifying 3+ files, running migrations — the protocol spawns 3 independent reviewers:
Agent | Role | What They Do |
🔴 Devil's Advocate | Break it | Finds every failure mode, race condition, security hole |
🟡 Architecture Critic | Question it | Evaluates structural impact, coupling, pattern consistency |
🟢 Pragmatist | Reality-check it | Rollback strategy, scope creep, simpler alternatives |
Each agent reads the codebase independently in an isolated context window. Zero opinion contamination between reviewers.
Related MCP server: gossipcat
The protocol uses the best available models, falling back gracefully:
Available CLIs | What Happens |
Codex + Gemini | All 3 run in parallel (~1-3 min) |
One external agent | External + 2 isolated Claude subagents (~2-4 min) |
Neither | 3 isolated Claude subagents (~3-5 min) |
Models: gpt-5.3-codex, gemini-3-pro-preview, claude-opus-4-6. Top-tier only. This is for people who need reliability over cost.
Agent detects critical change
→ Calls tenth_man_review
→ "🔟 10th Man Protocol activated — CRITICAL severity.
Spawning 3 agents... expect 2-5 minutes."
→ Review complete
→ Agent: "3 agents reviewed your JWT refactor:
🔴 Devil's Advocate BLOCKS — token refresh race condition
🟡 Architecture Critic says PROCEED — recommends adapter pattern
🟢 Pragmatist says PROCEED — wants it split into 3 phases
How would you like to proceed?"
→ You: "go ahead, address the race condition"
→ Agent creates execution plan → you confirm → agent executes
→ Everything archived to .tenth-man/history/Same review, no pauses. Agent incorporates findings into its plan and proceeds immediately. For fire-and-forget workflows.
After completion, the agent includes a one-liner:
⚠️ 10th Man: Proceed with changes. 2 critical issues addressed, 4 recommendations..tenth-man/ # Auto-added to .gitignore
config.json # Optional repo config
active/
REVIEW.md # Current review (standard mode)
PLAN.md # Current plan (after approval)
history/
2026-02-12T14-30-00Z_a3f8c2/
review.md
plan.md
outcome.json
index.json # Manifest for history queriesNode.js ≥ 20
Claude Code (host agent)
Optional: Codex CLI for cross-model review
Optional: Gemini CLI for cross-model review
If you run Claude Code with --dangerously-skip-permissions, the protocol defaults to standard mode (waits for approval) — which means the agent will pause and wait for you. If you're walking away, set auto mode once:
# In Claude Code, run:
Use tenth_man_configure with default_mode "auto"Or create .tenth-man/config.json in your repo:
{
"default_mode": "auto"
}Now the protocol reviews, plans internally, executes, and archives — no pauses. You come back to finished work + full audit trail.
Why not auto-detect? Claude Code cannot detect whether it's running in bypass mode. It always thinks it's interactive. So this is a one-time config per repo.
tenth_man_reviewMain entry point. Triggers adversarial review.
{
"task_description": "Refactor auth from session-based to JWT",
"proposed_changes": "Replace express-session with jsonwebtoken...",
"affected_files": ["src/auth/*", "src/middleware/auth.ts"],
"severity": "critical",
"mode": "standard"
}Severity levels:
high — 3+ files affected
critical — Auth, data, architecture changes
blocker — Breaking changes, migrations
Modes:
standard — Review → user approval → plan → user confirms → execute
auto — Review → agent plans internally → execute → audit trail
tenth_man_compileFinalizes review after Claude subagent results are collected. Called automatically by the host agent after spawning subagents.
tenth_man_configureView or update repo-level settings.
{
"timeout_seconds": 240,
"default_mode": "auto",
"available_agents": ["codex"]
}tenth_man_historyQuery past audits.
{
"last_n": 10,
"severity": "critical"
}Optional .tenth-man/config.json:
{
"available_agents": ["codex", "gemini"],
"timeout_seconds": 180,
"default_mode": "standard",
"auto_trigger_patterns": [
"**/auth/**",
"**/migrations/**",
"**/*.schema.*"
]
}MIT
Configure agent preferences, timeouts, and trigger patterns for the 10th Man Protocol. Auto-detects available CLI agents if not specified.
| Name | Required | Description | Default |
|---|---|---|---|
| default_mode | No | Default review mode. 'auto' for bypass/YOLO mode (proceeds without asking). 'standard' for interactive (waits for approval). Default: standard | |
| timeout_seconds | No | Max time per agent before timeout. Default: 180 | |
| available_agents | No | Which external CLI agents are installed. Auto-detected if omitted. | |
| auto_trigger_patterns | No | Glob patterns that always trigger the protocol, e.g. '**/auth/**' |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description alone must disclose behavioral traits. While it lists configuration goals, it omits important details such as whether changes persist, require restart, or affect ongoing operations. The description is insufficient for a configuration tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. It front-loads the purpose and provides a useful auto-detection note. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description covers the essential configuration aspects. It explains what can be configured and mentions auto-detection. It could mention return value or persistence, but for a lightweight configuration tool it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with each parameter having a clear description. The tool description maps parameters to categories ('preferences, timeouts, trigger patterns'), adding context but not significant new meaning beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Configure agent preferences, timeouts, and trigger patterns for the 10th Man Protocol.' It uses a specific verb ('configure') and resource ('10th Man Protocol settings'), clearly distinguishing from sibling tools like 'tenth_man_history' and 'tenth_man_review'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when changing settings, but does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternatives. The line 'Auto-detects available CLI agents if not specified' offers some context but no formal guidelines.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Query past 10th Man audit reports from this repository. Returns recent reviews with verdicts, issues found, and agents used.
| Name | Required | Description | Default |
|---|---|---|---|
| last_n | No | Number of recent audits to return | |
| verdict_filter | No | Filter by consensus verdict | |
| severity_filter | No | Filter by severity level |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses return content (verdicts, issues, agents) but doesn't mention if read-only, side effects, or authentication requirements. Bare minimum.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise and directly conveys purpose. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, description adequately summarizes return values (verdicts, issues, agents). Lacks mention of pagination or limits, but last_n parameter covers count. Good for a simple query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. Description does not add extra meaning beyond the schema's parameter descriptions (e.g., last_n, filters). No compensation needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Query', the resource 'past 10th Man audit reports', and what it returns. It distinguishes from siblings by focusing on history retrieval vs configuration or review.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus its siblings (tenth_man_configure, tenth_man_review) or when not to use it. The description only states what it does.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Triggers the 10th Man Protocol — spawns 3 contrarian agents to independently challenge proposed code changes before execution.
Use when:
Changes touch 3+ files across modules
Architecture decisions (new patterns, major refactors)
Auth, security, or data model changes
DB migrations or schema changes
Any change where a mistake would be costly
The protocol takes 2-5 minutes depending on agent availability. External agents (Codex, Gemini) run in parallel; Claude subagents run sequentially in isolated context windows.
In STANDARD mode: writes a review file and waits for your verbal approval. After approval, you MUST create an execution plan. In AUTO mode: returns findings directly — incorporate them into your plan and proceed.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | standard = writes review file, waits for approval + plan. auto = returns results, agent proceeds. Default: from config (standard unless changed via tenth_man_configure). | |
| severity | Yes | high = 3+ files cross-module. critical = architecture/auth/data. blocker = breaking change or data loss risk. | |
| context_files | No | Additional files the contrarians should read for context | |
| affected_files | Yes | File paths being modified | |
| proposed_changes | Yes | The diff, plan, or description of proposed changes | |
| task_description | Yes | What the main agent is about to do |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses key traits: spawns 3 agents, 2-5 minute duration, parallel vs sequential execution, standard vs auto mode behaviors, and required post-approval step. No annotations provided so description carries full burden; missing auth or rate limit details but still strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five well-structured sentences with bullet points, no wasted words. Front-loaded purpose, then usage, then behavioral details. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given six parameters (four required), two enums, no output schema, and no annotations, the description covers purpose, usage, modes, time estimate, and post-action steps comprehensively. Leaves no critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3). Description adds value by explaining severity levels in context (e.g., 'high = 3+ files cross-module') and mode semantics beyond enum values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool triggers the 10th Man Protocol with 3 contrarian agents, using specific verbs and resource. It distinguishes from sibling tools (tenth_man_configure and tenth_man_history) which are for configuration and history, respectively.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage scenarios (3+ file cross-module, architecture, auth/security, data model, costly mistakes) and explains standard vs auto modes. Lacks explicit when-not-to-use but sibling tools imply this is the sole review action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0tenth_man_configuretenth_man_historytenth_man_reviewScored across 3 tools
Each tool serves a distinct purpose: configuration, history query, and triggering a review. There is no ambiguity or overlap between them.
All tool names follow the same pattern: 'tenth_man_' followed by a verb (configure, history, review). This is consistent and predictable.
With only 3 tools, the server is tightly scoped to its core functionality (configure, review, history). This is appropriate for a focused protocol like the 10th Man.
The tools cover the essential lifecycle: configuration, triggering a review, and querying history. A minor gap is the lack of a tool for approval or execution plan creation, but these are described as manual steps outside the tool surface.
Guardian agent for AI coding: four frontier models review risky diffs and commits before they ship.
Multi-reviewer AI code review: surfaces findings the reviewers agree on, disputes flagged.
Agentic code review, no signup to try: reality gates + frontier-model review, with veto.
Deterministic AI code review, with an audit record. Governance inside the agent loop.
