Skip to main content
mcpSource-backed

Overture MCP

MCP server that turns an AI coding agent's plan into a local interactive flowchart, approval workflow, execution tracker, branch selector, and plan history before code changes proceed.

by Sixth · submitted by oktofeesh1·added 2026-06-06·
Review first review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Source URLs
https://github.com/SixHq/Overture/blob/main/README.md, https://github.com/SixHq/Overture
Brand
Overture
Brand domain
github.com
Safety notes
Overture is an approval and visualization layer; it does not replace code review, tests, access controls, or human judgment., The server starts a local web UI and WebSocket service for plan review and execution tracking., Plan approval, pause, rerun, branch selection, and node-status tools affect what the agent is instructed to do next, but they do not sandbox the agent's other tools., File attachments and node metadata can influence later agent steps, so review attached context and secret fields before approval., If local UI ports are exposed beyond trusted local clients, plan data and attachments could be visible to unintended users.
Privacy notes
Plans can include workspace paths, task descriptions, risks, expected outputs, user inputs, selected branches, node outputs, and agent execution status., Overture stores project history in a project `.overture.json` file when possible and falls back to local user-level storage., Uploaded attachments are saved under local Overture attachment storage and can include code, documents, images, or secrets if the user provides them., The UI includes file-reading and attachment endpoints for local plan review, so use it only with trusted local clients and approved workspaces., The marketplace panel can fetch remote MCP marketplace data, so network policy should account for that optional UI feature.
Author
Sixth
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

63

Baseline

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Needs review

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done
  • Source provenance statusRequired

    Marked as source-backed.

    Done
  • Metadata reviewed

    No reviewed flag detected in metadata.

    Pending

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done
  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done
  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done
  • Package verification flag

    No package verification flag provided.

    Pending
  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending
  • Baseline comparison available

    No baseline peer selected yet.

    Pending
  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

10 minutes

Adoption plan

Balanced adoption plan

Current risk score 24/100. Use staged verification before broader rollout.

Risk 24

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done
  • Confirm metadata review state

    No review metadata found; increase manual validation.

    Pending
  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done
  • Review privacy notesRequired

    Privacy notes are present.

    Done
  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending
  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending
  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Missing required evidence: Metadata review. Risk score 31.

Risk 31

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Missing

Review metadata is missing.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required gaps: Metadata review

Decision timeline

Decision timeline · balanced

Blocking gaps: Check metadata review status. Risk 28.

Risk 28

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is missing.

Pending

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

Blockers: Check metadata review status

Prerequisite readiness

Prerequisite readiness

3 prerequisites to line up before setup. Have accounts and credentials ready first.

0/3 ready
Account & credentials1Install & runtime1General110 minutes

Safety & privacy surface

Safety & privacy surface

5 safety and 5 privacy notes across 7 risk areas. Review closely: credentials & tokens, permissions & scopes, network access.

7 areas
  • SafetyPermissions & scopesOverture is an approval and visualization layer; it does not replace code review, tests, access controls, or human judgment.
  • SafetyTelemetryThe server starts a local web UI and WebSocket service for plan review and execution tracking.
  • SafetyExecution & processesPlan approval, pause, rerun, branch selection, and node-status tools affect what the agent is instructed to do next, but they do not sandbox the agent's other tools.
  • SafetyCredentials & tokensFile attachments and node metadata can influence later agent steps, so review attached context and secret fields before approval.
  • SafetyGeneralIf local UI ports are exposed beyond trusted local clients, plan data and attachments could be visible to unintended users.
  • PrivacyLocal filesPlans can include workspace paths, task descriptions, risks, expected outputs, user inputs, selected branches, node outputs, and agent execution status.
  • PrivacyLocal filesOverture stores project history in a project `.overture.json` file when possible and falls back to local user-level storage.
  • PrivacyCredentials & tokensUploaded attachments are saved under local Overture attachment storage and can include code, documents, images, or secrets if the user provides them.
  • PrivacyNetwork accessThe UI includes file-reading and attachment endpoints for local plan review, so use it only with trusted local clients and approved workspaces.
  • PrivacyNetwork accessThe marketplace panel can fetch remote MCP marketplace data, so network policy should account for that optional UI feature.

Safety notes

  • Overture is an approval and visualization layer; it does not replace code review, tests, access controls, or human judgment.
  • The server starts a local web UI and WebSocket service for plan review and execution tracking.
  • Plan approval, pause, rerun, branch selection, and node-status tools affect what the agent is instructed to do next, but they do not sandbox the agent's other tools.
  • File attachments and node metadata can influence later agent steps, so review attached context and secret fields before approval.
  • If local UI ports are exposed beyond trusted local clients, plan data and attachments could be visible to unintended users.

Privacy notes

  • Plans can include workspace paths, task descriptions, risks, expected outputs, user inputs, selected branches, node outputs, and agent execution status.
  • Overture stores project history in a project `.overture.json` file when possible and falls back to local user-level storage.
  • Uploaded attachments are saved under local Overture attachment storage and can include code, documents, images, or secrets if the user provides them.
  • The UI includes file-reading and attachment endpoints for local plan review, so use it only with trusted local clients and approved workspaces.
  • The marketplace panel can fetch remote MCP marketplace data, so network policy should account for that optional UI feature.

Prerequisites

  • Node.js 18 or newer and npx available to the MCP client runtime.
  • A coding-agent workflow that will call Overture planning tools before making changes.
  • Review of local browser, file attachment, and plan-history storage behavior before using it with private workspaces.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
10 minutes
Difficulty
intermediate
Full copyable content
{
  "mcpServers": {
    "overture": {
      "command": "npx",
      "args": ["-y", "overture-mcp"]
    }
  }
}

About this resource

Content

Overture MCP is a Model Context Protocol server for visualizing and approving AI coding-agent plans before execution. It lets an agent submit plan XML, opens a local interactive graph UI, waits for human approval, tracks node status, handles branches, supports plan updates, and records plan history for later review.

It is most useful when the user wants a structured checkpoint between "the agent has a plan" and "the agent starts editing." Overture can make the plan more inspectable, but the actual safety still depends on approvals, tests, review, and the permissions of the coding agent's other tools.

Source Review

These sources were reviewed on 2026-06-06. Prefer the live repository, README, npm registry metadata, MCP package metadata, server source, local HTTP server source, storage source, and license file for current install commands, tool behavior, UI behavior, storage paths, and licensing.

Features

  • npm package overture-mcp.
  • Stdio MCP server launched with npx -y overture-mcp.
  • Local visual plan canvas with plan nodes, branches, complexity, risks, and status.
  • Approval workflow through submit_plan and get_approval.
  • Execution tracking tools for node status, plan completion, failures, pause, rerun, resume information, and plan updates.
  • Node detail update tools for titles, descriptions, expected outputs, and risks.
  • Local project history and global fallback history storage.
  • Local UI, WebSocket updates, attachment saving, and file viewing endpoints.
  • MIT license.

Installation

Configure the MCP server in your client:

{
  "mcpServers": {
    "overture": {
      "command": "npx",
      "args": ["-y", "overture-mcp"]
    }
  }
}

After restarting the MCP client, ask Claude to create a plan in Overture before editing, then review the local plan graph and approve only the steps and branch you want executed.

Use Cases

  • Review an AI coding agent's plan before it edits files.
  • Compare branches in a proposed implementation approach.
  • Attach context files or meta-instructions to specific plan nodes.
  • Pause, resume, rerun, or mark execution progress during long tasks.
  • Persist plan history for a project.
  • Track which plan nodes produced outputs, failures, or follow-up work.
  • Add a human approval checkpoint to high-risk coding workflows.

Safety and Privacy

Overture improves visibility into an agent plan, but it does not sandbox the agent or guarantee that approved steps are correct. Keep normal safeguards in place: scoped tool permissions, tests, code review, and careful handling of destructive operations.

Plan data can contain private task details, workspace paths, attached files, secret fields, node outputs, and execution history. Overture stores history and attachments locally and exposes them through a local UI. Use it only with trusted local clients, avoid attaching secrets unless needed, and review project-level Overture files before committing or sharing a repository.

Duplicate Check

Existing MCP content includes code assistants, review tools, and workflow helpers, but no dedicated entry for SixHq/Overture or the overture-mcp npm package was found in content/mcp. This entry is distinct because it focuses on visual plan approval, branch selection, execution tracking, and plan history for AI coding agents.

Source citations

Add this badge to your README

Show that Overture MCP is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/overture-mcp.svg)](https://heyclau.de/entry/mcp/overture-mcp)

How it compares

Overture MCP side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field

MCP server that turns an AI coding agent's plan into a local interactive flowchart, approval workflow, execution tracker, branch selector, and plan history before code changes proceed.

Open dossier

MCP server for spec-driven development workflows, requirements, design docs, task breakdowns, approvals, implementation logs, and a real-time dashboard.

Open dossier

Webiny's MCP server for exposing Webiny-specific skills and development instructions to Claude, Cursor, Copilot, Windsurf, opencode, and other AI coding agents over stdio.

Open dossier

Visualization MCP server for generating charts, diagrams, maps, graphs, spreadsheets, and data-analysis visuals with AntV.

Open dossier
Next steps
Trust
Review statusNot reviewedNot reviewedNot reviewedNot reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backedSource-backed
Submitteroktofeesh1oktofeesh1oktofeesh1oktofeesh1
Install riskReview firstReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandWebiny logoWebiny
Categorymcpmcpmcpmcp
SourceSource-backedSource-backedSource-backedSource-backed
AuthorSixthPimzinoWebiny LtdAntV
Added2026-06-062026-06-052026-06-062026-06-05
Platforms
Harness
Source repo
Safety notesOverture is an approval and visualization layer; it does not replace code review, tests, access controls, or human judgment. The server starts a local web UI and WebSocket service for plan review and execution tracking. Plan approval, pause, rerun, branch selection, and node-status tools affect what the agent is instructed to do next, but they do not sandbox the agent's other tools. File attachments and node metadata can influence later agent steps, so review attached context and secret fields before approval. If local UI ports are exposed beyond trusted local clients, plan data and attachments could be visible to unintended users.Spec Workflow MCP writes requirements, design, task, steering, approval, archive, and implementation-log files under `.spec-workflow`. The dashboard uses a local web server and WebSocket updates; keep it bound to localhost unless you add external authentication, TLS, and network restrictions. The README documents rate limiting, audit logging, security headers, default localhost binding, and CORS restrictions, but also notes that built-in HTTPS/TLS and user authentication are not yet implemented. Task and approval tools can make an agent appear to advance project state; require human review before accepting specs, completing tasks, or using generated implementation prompts. Docker deployment should be reviewed for volume mounts, writable directories, and dashboard exposure before using it in shared environments.Webiny MCP is a guidance and skill-loading server; it does not directly manage a Webiny CMS deployment or execute Webiny admin actions. The configure command can update supported agent configuration, so review generated MCP config changes before committing or sharing them. The --skills and --additional-skills flags make the server recursively discover SKILL.md files from local directories; point them only at trusted project guidance. Agent-loaded skills can strongly steer code changes, architecture decisions, and generated commands; review outputs before applying them to production Webiny projects.AntV MCP Server Chart can generate visual outputs from provided data, so review charts before using them in reports, dashboards, or customer-facing material. Geographic visualization tools may depend on external map services and have regional limitations described by the upstream project. Disable unsupported or unwanted chart tools with `DISABLED_TOOLS` when an MCP client has compatibility issues or a workflow should expose fewer visualization actions. Use private rendering infrastructure through `VIS_REQUEST_SERVER` when sensitive datasets should not be sent to the default chart generation service.
Privacy notesPlans can include workspace paths, task descriptions, risks, expected outputs, user inputs, selected branches, node outputs, and agent execution status. Overture stores project history in a project `.overture.json` file when possible and falls back to local user-level storage. Uploaded attachments are saved under local Overture attachment storage and can include code, documents, images, or secrets if the user provides them. The UI includes file-reading and attachment endpoints for local plan review, so use it only with trusted local clients and approved workspaces. The marketplace panel can fetch remote MCP marketplace data, so network policy should account for that optional UI feature.Requirements, designs, task lists, steering documents, approval comments, implementation logs, filenames, project paths, prompts, and task progress may be visible to the MCP client and model provider. Persistent global state may be stored under `SPEC_WORKFLOW_HOME`, including active project registry, dashboard session data, settings, job history, and migration logs. The `.spec-workflow` directory can contain unreleased product plans, architecture decisions, customer requirements, and implementation details. Review generated specs, logs, approval files, and dashboard screenshots before committing, sharing, or uploading them.Skill files can contain internal coding conventions, project architecture, extension patterns, package notes, and proprietary implementation guidance. Loaded skill content may be sent to MCP clients, model providers, chat transcripts, and logs when an agent requests it. Custom skill directories can reveal local repository structure and file paths through tool output or error messages. Keep credentials, customer data, private deployment details, and unpublished roadmap notes out of SKILL.md files exposed through the MCP server.Chart data, labels, prompts, generated images, service identifiers, and rendering requests may contain business metrics, personal data, locations, or customer information. Default chart rendering can involve AntV-hosted services; review data sensitivity before sending private datasets. Protect custom rendering endpoints, service identifiers, and any generated record links in client configs, logs, screenshots, and shared prompts.
Prerequisites
  • Node.js 18 or newer and npx available to the MCP client runtime.
  • A coding-agent workflow that will call Overture planning tools before making changes.
  • Review of local browser, file attachment, and plan-history storage behavior before using it with private workspaces.
  • Node.js and npx available to the MCP client runtime.
  • A project workspace you are authorized to organize with generated specs and steering documents.
  • A writable `.spec-workflow` project directory and, for sandboxed runtimes, a writable `SPEC_WORKFLOW_HOME`.
  • Optional dashboard process started separately before using visual approvals or project tracking.
  • Node.js and npx available for running the @webiny/mcp package.
  • A Webiny project or Webiny-related repository where the agent should use Webiny guidance.
  • Review of the built-in skills and any custom SKILL.md directories before exposing them to a model.
  • Agreement on whether project conventions, extension architecture, package internals, or private implementation notes may be sent to the MCP client and model provider.
  • Node.js and npm available to the MCP client runtime.
  • Structured data or a clear visualization request.
  • Optional private chart rendering service if default remote rendering is not appropriate for the data.
  • Optional tool filtering plan for chart types that should not be exposed to a given agent workflow.
Install
npx -y overture-mcp
claude mcp add spec-workflow npx @pimzino/spec-workflow-mcp@latest -- PROJECT_PATH
npx @webiny/mcp serve
npx -y @antv/mcp-server-chart
Config
{
  "mcpServers": {
    "overture": {
      "command": "npx",
      "args": ["-y", "overture-mcp"],
      "env": {
        "OVERTURE_AUTO_OPEN": "false",
        "OVERTURE_HTTP_PORT": "3031",
        "OVERTURE_WS_PORT": "3030"
      }
    }
  }
}
{
  "mcpServers": {
    "spec-workflow": {
      "command": "npx",
      "args": ["-y", "@pimzino/spec-workflow-mcp@latest", "PROJECT_PATH"],
      "env": {
        "SPEC_WORKFLOW_HOME": "WRITABLE_SPEC_WORKFLOW_HOME"
      }
    }
  }
}
{
  "mcpServers": {
    "webiny": {
      "command": "npx",
      "args": [
        "@webiny/mcp",
        "serve"
      ],
      "type": "stdio"
    }
  }
}
{
  "mcpServers": {
    "mcp-server-chart": {
      "command": "npx",
      "args": ["-y", "@antv/mcp-server-chart"],
      "env": {
        "DISABLED_TOOLS": "generate_fishbone_diagram,generate_mind_map"
      }
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimedUnclaimed
Open 4 picks in the interactive comparison tool

Related guides

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.