About

LibreModular-MCP is a Hub written in Rust and a set of Python bridges that let a language model drive desktop applications by running scripts in them. This page says who did which part as the work was done, under which licence the code is published, how to report a vulnerability and how a change is checked.

Who did what

One person and several models worked on the project. The roles are written down as they were played; the repository keeps the same list in CONTRIBUTORS.md and adds to it on the day somebody works.

• Ronan Davalan: architect and arbiter. Initiative, priorities, security requirements, validation and testing. Sole human of the project.
• Claude Code (Anthropic, Opus 5.5 and Sonnet 5.5): systems engineer and lead developer, from 3 October 2026. Working framework, review and integration of the code, technical documentation, packages, website and translations. It is also the first user of the tool: driving GIMP, Blender, LibreOffice, Krita and Inkscape from a model is the use case the project started from.
• Claude Cloud (Anthropic): wrote the code on branches from prompts, without access to the working framework. Its work was reviewed before every merge.
• Gemini (Google): architectural advisor and synthesizer. Wrote the founding note and proposed the name.
• Muse Spark 1.3 (Meta): graphic designer. Drew the logo and the favicons, adopted on 20 October 2026.
• DeepSeek V4.1 Flash and MiMo V2.6 Flash (free models, run through opencode): pilot models of the Windows trial and visitors with no context in the first-contact test; the frictions they reported are corrected in the README and the guides.

The working method comes from earlier projects by the same author; CONTRIBUTORS.md names them, with the people and models credited there.

Licence

The code is under the MIT licence. The licence file opens with MIT License and Copyright (c) 2026 LibreModular-MCP contributors; it is LICENSE in the repository.

Report a vulnerability

Report it privately, through the private vulnerability reporting of the repository: its Security tab, then Report a vulnerability. Do not open a public issue for it. SECURITY.md promises an acknowledgement within 7 days and a first assessment, saying whether the report is accepted as a vulnerability, within 30 days. It also lists the supported versions, what is in scope and the good-faith rules for research.

The limits of the Hub are on the Security page: a report about one of those limits is outside the scope of SECURITY.md.

Contribute

A change to the Hub or to a bridge is checked by the commands of the repository’s CI, listed with how to run them in CONTRIBUTING.md; the Security page replays them with their counts.

A new application needs a module on the Hub side and a bridge on the application’s side; Architecture shows how the existing ones are built. Whoever contributes is credited in CONTRIBUTORS.md with the role actually played.