{
  "run_id": "VelvetSP--web-retrieval-mcp-claude-haiku-5-5-1792971571402393094",
  "date": "2026-10-25T23:43:27.532806+00:00",
  "repo": "VelvetSP/web-retrieval-mcp",
  "kind": "mcp",
  "source": "https://github.com/VelvetSP/web-retrieval-mcp",
  "commit": "c0ee5646d2c23ae27692d52f4c74387180c6cf24",
  "model": "claude-haiku-5-5",
  "model_version": "claude-haiku-5-5",
  "test_version": "readme-ca496ea10bb07418d1d8f1c256c2433a55547acc0fb62d8b6d86ae33c976fbfa",
  "pass": true,
  "outcome": "pass",
  "time_to_working_s": 201.5139361700276,
  "total_s": 236.13037085533142,
  "steps": [
    "cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -c 6000",
    "echo \"CDP:\"; curl -s -m 10 -w \"\\nHTTP %{http_code}\\n\" \"$CDP_URL/json/version\"; echo; cat /etc/os-release | head -3",
    "cd <guest-path> && sed -n '/## Quick start/,/## Six/p' README.md | head -c 7000; echo; echo ---; grep -n \"^## \\|^### \" README.md | head -80",
    "cd <guest-path> && sed -n '215,236p;326,344p;362,379p;402,425p' README.md",
    "cd /tmp && (python3 -m venv --help >/dev/null 2>&1 && echo venv_ok || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3-venv >/tmp/venv_install.log 2>&1; echo \"apt rc=$?\"; tail -3 /tmp/venv_install.log)); python3 -m venv <guest-path> && <guest-path> --version && <guest-path> -m pip --version",
    "cd <guest-path> && <guest-path> -m pip install --quiet '<guest-path>,cache,keyring]' > <guest-path> 2>&1; echo rc=$?; tail -5 <guest-path>; ls <guest-path> | grep -i web",
    "cd <guest-path> && sed -n '426,441p' README.md; echo ----; sed -n '286,300p' README.md; echo ----; env | grep -E \"EXA|FIRECRAWL|TAVILY|WEB_\" | sed 's/=.*/=<set>/' ; echo \"env check done\"",
    "cd <guest-path> && ls src/web_retrieval_mcp | head -50; grep -rn -i \"globally\\|not globally\\|loopback\\|private address\" src/web_retrieval_mcp/*.py | head -15; ls <guest-path> /inputs 2>&1 | head",
    "cd <guest-path> && sed -n 285,330p src/web_retrieval_mcp/server.py; grep -n \"def web_fetch\\<email>\\|def web_search\" src/web_retrieval_mcp/server.py | head",
    "mkdir -p <guest-path> && cat > <guest-path> <<'EOF'\nimport asyncio, sys, json\nfrom mcp import ClientSession, StdioServerParameters\nfrom mcp.client.stdio import stdio_client\nasync def main():\n    params = StdioServerParameters(command=\"<guest-path>\", args=[], cwd=\"<guest-path>\")\n    async with stdio_client(params) as (r, w):\n        async with ClientSession(r, w) as s:\n            await s.initialize()\n            tools = await s.list_tools()\n            print(\"TOOLS:\", [t.name for t in tools.tools])\n            res = await s.call_tool(sys.argv[1], json.loads(sys.argv[2]))\n            for c in res.content:\n                print(\"RESULT:\", getattr(c, \"text\", c))\n            print(\"isError:\", res.isError)\nasyncio.run(main())\nEOF\ncd <guest-path> && timeout 120 <guest-path> -I <guest-path> web_fetch '{\"url\":\"http://127.0.0.1:9/\",\"render\":\"never\"}' 2>&1 | tail -30",
    "cd <guest-path> && sed -i 's/res.isError/res.is_error/' <guest-path> && timeout 120 <guest-path> -I <guest-path> web_fetch '{\"url\":\"http://127.0.0.1:9/\",\"render\":\"never\"}' 2>&1 | tail -30",
    "cd <guest-path> && timeout 120 <guest-path> -I <guest-path> web_search '{\"query\":\"python package metadata\"}' 2>&1 | tail -8; timeout 120 <guest-path> -I <guest-path> web_fetch '{\"url\":\"http://localhost:8/\",\"render\":\"never\"}' 2>&1 | tail -3",
    "cd <guest-path> && timeout 120 <guest-path> -I <guest-path> web_fetch '{\"url\":\"ftp://example.com/file\",\"render\":\"never\"}' 2>&1 | tail -2; cd <guest-path> && grep -n \"Only \\`http\\` and \\`https\\` initial URLs are accepted.\\|Initial hosts must resolve exclusively to globally routable addresses.\" README.md; sed -n 1,60p <guest-path> | head -80",
    "cd <guest-path> && grep -rn -i \"cron\\|schedul\\|--once\\|--now\\|while True\" src/ | head; echo ---; cat run-tests.sh | head -60",
    "cd <guest-path> && cat > probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"web-retrieval-mcp\"],\"cwd\":\"<guest-path>\",\"env\":{\"PATH\":\"<guest-path>\"},\"tool\":\"web_fetch\",\"arguments\":{\"url\":\"http://127.0.0.1:9/\",\"render\":\"never\"},\"expected_text\":\"refused non-public address for '127.0.0.1'\"}\nEOF\npython3 -m json.tool probe.json >/dev/null && echo probe_ok",
    "cd <guest-path> && cat > claims.json <<'EOF'\n[\n{\"kind\":\"claim\",\"claim\":\"Only http and https initial URLs are accepted; an ftp URL is refused\",\"source\":\"README.md\",\"source_file\":\"README.md\",\"quote\":\"Only `http` and `https` initial URLs are accepted.\",\"input\":\"ftp://example.com/file\",\"expected\":\"refused non-http(s) URL scheme\",\"probe_kind\":\"mcp\",\"argv\":[\"web-retrieval-mcp\"],\"env\":{\"PATH\":\"<guest-path>\"},\"tool\":\"web_fetch\",\"arguments\":{\"url\":\"ftp://example.com/file\",\"render\":\"never\"},\"expected_text\":\"refused non-http(s) URL scheme: ftp\",\"cwd\":\"<guest-path>\"},\n{\"kind\":\"claim\",\"claim\":\"Initial hosts must resolve to globally routable addresses; localhost is refused\",\"source\":\"README.md\",\"source_file\":\"README.md\",\"quote\":\"Initial hosts must resolve exclusively to globally routable addresses.\",\"input\":\"http://localhost:8/\",\"expected\":\"refused non-public address\",\"probe_kind\":\"mcp\",\"argv\":[\"web-retrieval-mcp\"],\"env\":{\"PATH\":\"<guest-path>\"},\"tool\":\"web_fetch\",\"arguments\":{\"url\":\"http://localhost:8/\",\"render\":\"never\"},\"expected_text\":\"refused non-public address for 'localhost'\",\"cwd\":\"<guest-path>\"},\n{\"kind\":\"claim\",\"claim\":\"Tools resolve credentials lazily and report what a selected route is missing\",\"source\":\"README.md\",\"source_file\":\"README.md\",\"quote\":\"Tools resolve credentials lazily and report what a selected route is missing.\",\"input\":\"python package metadata with no provider keys\",\"expected\":\"search reports the missing EXA_API_KEY credential\",\"probe_kind\":\"mcp\",\"argv\":[\"web-retrieval-mcp\"],\"env\":{\"PATH\":\"<guest-path>\"},\"tool\":\"web_search\",\"arguments\":{\"query\":\"python package metadata\"},\"expected_text\":\"no usable credential for EXA_API_KEY\",\"cwd\":\"<guest-path>\"}\n]\nEOF\npython3 -m json.tool claims.json >/dev/null && echo claims_ok",
    "cd <guest-path> && cat > claims.json <<'EOF'\n[\n{\"kind\":\"claim\",\"claim\":\"Only http and https initial URLs are accepted; an ftp URL is refused\",\"source\":\"Only `http` and `https` initial URLs are accepted.\",\"input\":\"ftp://example.com/file\",\"expected\":\"refused non-http(s) URL scheme\",\"probe_kind\":\"mcp\",\"argv\":[\"web-retrieval-mcp\"],\"env\":{\"PATH\":\"<guest-path>\"},\"tool\":\"web_fetch\",\"arguments\":{\"url\":\"ftp://example.com/file\",\"render\":\"never\"},\"expected_text\":\"refused non-http(s) URL scheme: ftp\",\"cwd\":\"<guest-path>\"},\n{\"kind\":\"claim\",\"claim\":\"Initial hosts must resolve to globally routable addresses; localhost is refused\",\"source\":\"Initial hosts must resolve exclusively to globally routable addresses.\",\"input\":\"http://localhost:8/\",\"expected\":\"refused non-public address\",\"probe_kind\":\"mcp\",\"argv\":[\"web-retrieval-mcp\"],\"env\":{\"PATH\":\"<guest-path>\"},\"tool\":\"web_fetch\",\"arguments\":{\"url\":\"http://localhost:8/\",\"render\":\"never\"},\"expected_text\":\"refused non-public address for 'localhost'\",\"cwd\":\"<guest-path>\"},\n{\"kind\":\"claim\",\"claim\":\"Tools resolve credentials lazily and report what a selected route is missing\",\"source\":\"Tools resolve credentials lazily\",\"input\":\"python package metadata with no provider keys\",\"expected\":\"search reports the missing EXA_API_KEY credential\",\"probe_kind\":\"mcp\",\"argv\":[\"web-retrieval-mcp\"],\"env\":{\"PATH\":\"<guest-path>\"},\"tool\":\"web_search\",\"arguments\":{\"query\":\"python package metadata\"},\"expected_text\":\"no usable credential for EXA_API_KEY\",\"cwd\":\"<guest-path>\"}\n]\nEOF\npython3 -m json.tool claims.json >/dev/null && echo claims_ok; cd <guest-path> && grep -c \"Tools resolve credentials lazily\" README.md",
    "cd <guest-path> && PYTHONPATH=<guest-path> timeout 280 <guest-path> test_ssrf_guard.py > <guest-path> 2>&1; echo rc=$?; tail -5 <guest-path>",
    "cd <guest-path> && cat > examples.json <<'EOF'\n[\n{\"kind\":\"example\",\"claim\":\"Offline SSRF guard tests pass against the installed source tree\",\"source\":\"test_ssrf_guard.py\",\"input\":\"no arguments\",\"expected\":\"ALL  TESTS PASS\",\"argv\":[\"<guest-path>\",\"test_ssrf_guard.py\"],\"cwd\":\"<guest-path>\",\"env\":{\"PYTHONPATH\":\"<guest-path>\"},\"expected_text\":\"ALL  TESTS PASS\"},\n{\"kind\":\"example\",\"claim\":\"Release gate ./run-tests.sh runs all suites and package build\",\"source\":\"README.md Install from source / For development\",\"reason\":\"Not run: the gate requires pip install -e '.[all,dev]' (the all extra runs camoufox fetch, which downloads a browser that is not permitted here) and provisions a Valkey fixture via tests/fixtures/valkey/install.sh. Only the offline test_ssrf_guard.py was run instead.\"},\n{\"kind\":\"example\",\"claim\":\"Live SSRF redirect check with a browser\",\"source\":\"README.md Install from source\",\"reason\":\"Needs a local browser (render extra / Camoufox), which was not installed; the shared CDP endpoint is not wired to this product's render path.\",\"deferred\":true}\n]\nEOF\ncat > cycles.json <<'EOF'\n{\"detected\":false,\"reason\":\"Entry points inspected (src/web_retrieval_mcp/server.py, __main__.py, install.py). The server runs as a request/response MCP stdio or Streamable HTTP service with no cron, scheduler, --once/--now flag, loop, or webhook; the only while True loop is a transport/serve loop. No product cycle to trigger.\",\"checks\":[]}\nEOF\npython3 -m json.tool examples.json >/dev/null && python3 -m json.tool cycles.json >/dev/null && echo ok",
    "cd <guest-path> && cat > report.json <<'EOF'\n{\"outcome\":\"needs_credentials\",\"fault_owner\":\"prerequisite\",\"operation\":\"Run the web-retrieval-mcp stdio MCP server and call its tools (web_fetch / web_search)\",\"operation_scope\":\"Python 3.12 venv with the base package plus tavily, cache and keyring extras; no provider API keys (EXA_API_KEY, FIRECRAWL_API_KEY, TAVILY_API_KEY) and no local Camoufox browser. Verified offline: server starts, lists six tools, web_fetch refuses non-http(s) schemes and loopback/localhost hosts (SSRF guard), web_search reports the missing EXA_API_KEY and FIRECRAWL_API_KEY credentials. Not verified: real web search results or fetching a public page, which need provider keys.\",\"steps\":[\"python3 -m venv <guest-path>\",\"<guest-path> -m pip install '<guest-path>,cache,keyring]'\",\"web-retrieval-mcp (stdio MCP server, driven with an MCP client)\",\"web_fetch url=http://127.0.0.1:9/ -> RETRIEVAL_FAILED refused non-public address\",\"web_search query=python package metadata -> SEARCH_FAILED no usable credential for EXA_API_KEY\",\"PYTHONPATH=src python test_ssrf_guard.py -> ALL  TESTS PASS\"],\"deviations\":[\"Did not run pip install '.[all]' or 'python -m camoufox fetch' because the all extra's camoufox fetch downloads a browser, which is not permitted; installed the non-render extras instead.\",\"Did not run ./run-tests.sh (release gate): needs '.[all,dev]' and a Valkey fixture install; ran only test_ssrf_guard.py.\",\"Workspace is not a git checkout, so the pinned commit c0ee5646d2c23ae27692d52f4c74387180c6cf24 could not be verified; the provided snapshot was used as is.\",\"Did not set any provider key or obtain credentials.\"],\"stuck_step\":null,\"main_blocker\":\"No EXA_API_KEY or FIRECRAWL_API_KEY is configured in the guest, so web_search cannot return results and public-page fetches cannot be completed.\",\"plain_failure\":null,\"suggested_fix\":\"Provide EXA_API_KEY and FIRECRAWL_API_KEY (optional TAVILY_API_KEY) through the environment or keys.env, then re-run web_search and web_fetch on a public URL. Unrelated to the product code: the server itself starts and its guards work.\"}\nEOF\npython3 -m json.tool report.json >/dev/null && echo report_ok",
    "cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; tail -c 4000 <guest-path>",
    "cd <guest-path> && grep -o '\"problems\": \\[[^]]*\\]' validate.log | head -c 1500; echo; grep -o '\"ok\": [a-z]*\\|\"status\": \"[a-z_]*\"\\|\"verdict\": \"[a-z_]*\"' validate.log | sort | uniq -c; head -c 600 validate.log",
    "pgrep -af \"web-retrieval-mcp|client.py\" || echo \"no leftover processes\"; ls <guest-path>"
  ],
  "stuck_step": null,
  "error_excerpt": null,
  "what_it_did": "Run the web-retrieval-mcp stdio MCP server and call its tools (web_fetch / web_search)",
  "suggested_fix": null,
  "tokens_in": 582001,
  "tokens_out": 13986,
  "cost_usd": 0.020673079999999996,
  "usage_complete": true,
  "checks": [
    {
      "check": "operation",
      "status": "PASS",
      "details": {
        "working": true,
        "argv": [
          "web-retrieval-mcp"
        ],
        "kind": "mcp",
        "serverInfo": {
          "name": "web-retrieval",
          "version": "0.2.0"
        },
        "tools": [
          "web_search",
          "web_fetch",
          "research_papers",
          "research_paper",
          "research_similar",
          "research_github"
        ],
        "tool_schema_bytes": 18936,
        "tool_result": {
          "content": [
            {
              "text": "RETRIEVAL_FAILED: http://127.0.0.1:9/ \u2014 refused non-public address for '127.0.0.1': 127.0.0.1",
              "type": "text"
            }
          ],
          "isError": false,
          "structuredContent": {
            "result": "RETRIEVAL_FAILED: http://127.0.0.1:9/ \u2014 refused non-public address for '127.0.0.1': 127.0.0.1"
          }
        },
        "tool_result_checked": true,
        "scope": "product operation"
      }
    }
  ],
  "safety": {
    "version": "z2x-1",
    "rules_version": "z2x-1",
    "summary": "No problems traced to this repository code in these checks. 2 static matches retained as context.",
    "expected": "Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.",
    "findings": [],
    "context": [
      {
        "kind": "hardcoded-secret",
        "count": 2,
        "note": "Gitleaks found a possible hardcoded secret; value withheld.",
        "location_count": 1,
        "path": "tests/fixtures/valkey/manifest.env"
      }
    ],
    "limitations": [
      "A short run cannot establish that code is safe.",
      "Connections show IP addresses; proxies can hide the final hostname.",
      "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing."
    ],
    "static": {
      "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check."
    },
    "evidence_url": "/safety/?run=VelvetSP--web-retrieval-mcp-claude-haiku-5-5-1792971571402393094",
    "evidence_file": "/data/safety/VelvetSP--web-retrieval-mcp-claude-haiku-5-5-1792971571402393094.json.gz"
  },
  "agent_execution": "native_agent",
  "agent_runtime": "claude-code",
  "agent_runtime_version": "2.1.310 (Claude Code)",
  "tool_transport": "mcp-assigned-vm",
  "platform": "linux",
  "reasoning": "low",
  "service_tier": null,
  "resources": {
    "cpus": 2,
    "memory_mib": 4096,
    "disk_mib": 32768
  },
  "native_tool_calls": 23,
  "native_bundle": null,
  "architecture": null,
  "backend": "hyperv",
  "platform_details": {
    "backend": "hyperv",
    "os": "linux"
  },
  "platform_conflicts": null,
  "sandbox_source": null,
  "source_pin": {
    "commit": "c0ee5646d2c23ae27692d52f4c74387180c6cf24",
    "url": "https://github.com/VelvetSP/web-retrieval-mcp"
  },
  "purpose": "initial",
  "profile": {
    "model": "claude-haiku-5-5",
    "reasoning": "low"
  },
  "fault": {
    "owner": "prerequisite",
    "status": "diagnosed",
    "reason": "No EXA_API_KEY or FIRECRAWL_API_KEY is configured in the guest, so web_search cannot return results and public-page fetches cannot be completed."
  },
  "fix_id": null,
  "verifies_run_id": null,
  "hosting": null,
  "operation_scope": "product operation",
  "tool_calls": 23,
  "guest_setup": null,
  "runtime": null,
  "runtime_version": null,
  "runtime_revision": null,
  "source_revision": null,
  "evidence_version": null,
  "failure_origin": null,
  "evidence_strength": "readme_checked",
  "works": "yes",
  "install_s": null,
  "first_use_s": null,
  "mcp": "local",
  "needs": [],
  "needs_which": null,
  "agent_interface": [
    "mcp"
  ],
  "license": "MIT",
  "repo_url": "https://github.com/VelvetSP/web-retrieval-mcp",
  "cost_to_try": "free",
  "hardware": null,
  "what_failed": null,
  "local_or_hosted": "local",
  "cycle_checks": [
    {
      "kind": "cycle",
      "claim": "Scheduled or looping main behavior",
      "source": "repository entry points",
      "input": "source inspection",
      "expected": "identify the product trigger",
      "verdict": "yes",
      "outcome": "Entry points inspected (src/web_retrieval_mcp/server.py, __main__.py, install.py). The server runs as a request/response MCP stdio or Streamable HTTP service with no cron, scheduler, --once/--now flag, loop, or webhook; the only while True loop is a transport/serve loop. No product cycle to trigger.",
      "evidence": "Entry points inspected (src/web_retrieval_mcp/server.py, __main__.py, install.py). The server runs as a request/response MCP stdio or Streamable HTTP service with no cron, scheduler, --once/--now flag, loop, or webhook; the only while True loop is a transport/serve loop. No product cycle to trigger.",
      "command": ""
    }
  ],
  "claims": [
    {
      "kind": "claim",
      "claim": "Only http and https initial URLs are accepted; an ftp URL is refused",
      "source": "Only `http` and `https` initial URLs are accepted.",
      "input": "{\"tool\": \"web_fetch\", \"arguments\": {\"url\": \"ftp://example.com/file\", \"render\": \"never\"}}",
      "expected": "refused non-http(s) URL scheme",
      "command": "web-retrieval-mcp tools/call {\"tool\": \"web_fetch\", \"arguments\": {\"url\": \"ftp://example.com/file\", \"render\": \"never\"}}",
      "verdict": "yes",
      "outcome": "Real input produced the expected result: refused non-http(s) URL scheme: ftp",
      "evidence": "refused non-http(s) URL scheme: ftp\", \"type\": \"text\"}], \"isError\": false, \"structuredContent\": {\"result\": \"RETRIEVAL_FAILED: ftp://example.com/file \u2014 refused non-http(s) URL scheme: ftp\"}}",
      "source_checked": true,
      "source_file": "README.md"
    },
    {
      "kind": "claim",
      "claim": "Initial hosts must resolve to globally routable addresses; localhost is refused",
      "source": "Initial hosts must resolve exclusively to globally routable addresses.",
      "input": "{\"tool\": \"web_fetch\", \"arguments\": {\"url\": \"http://localhost:8/\", \"render\": \"never\"}}",
      "expected": "refused non-public address",
      "command": "web-retrieval-mcp tools/call {\"tool\": \"web_fetch\", \"arguments\": {\"url\": \"http://localhost:8/\", \"render\": \"never\"}}",
      "verdict": "yes",
      "outcome": "Real input produced the expected result: refused non-public address for 'localhost'",
      "evidence": "refused non-public address for 'localhost': ::1\", \"type\": \"text\"}], \"isError\": false, \"structuredContent\": {\"result\": \"RETRIEVAL_FAILED: http://localhost:8/ \u2014 refused non-public address for 'localhost': ::1\"}}",
      "source_checked": true,
      "source_file": "README.md"
    },
    {
      "kind": "claim",
      "claim": "Tools resolve credentials lazily and report what a selected route is missing",
      "source": "Tools resolve credentials lazily",
      "input": "{\"tool\": \"web_search\", \"arguments\": {\"query\": \"python package metadata\"}}",
      "expected": "search reports the missing EXA_API_KEY credential",
      "command": "web-retrieval-mcp tools/call {\"tool\": \"web_search\", \"arguments\": {\"query\": \"python package metadata\"}}",
      "verdict": "yes",
      "outcome": "Real input produced the expected result: no usable credential for EXA_API_KEY",
      "evidence": "no usable credential for EXA_API_KEY; set EXA_API_KEY, add it to <guest-path>, or configure the optional keyring/OS secret store | firecrawl: no usable credential for FIRECRAWL_API_KEY; set FIRECRAWL_API_KEY, add it to <guest-path>, or configure the optional keyring/OS secret store\", \"type\": \"text\"}], \"isError\": false, \"structuredContent\": {\"result\": \"SEARCH_FAILED: python package metadata \u2014 exa: no usable credential for EXA_API_KEY; set EXA_API_KEY, add it to <guest-path>, or configure ",
      "source_checked": true,
      "source_file": "README.md"
    }
  ],
  "claims_note": null,
  "example_checks": [
    {
      "kind": "example",
      "claim": "Offline SSRF guard tests pass against the installed source tree",
      "source": "test_ssrf_guard.py",
      "input": "no arguments",
      "command": "<guest-path> test_ssrf_guard.py",
      "evidence": "['<resolve-error>'] want=['<resolve-error>']\nOK    flush: forbidden host -> blocked url: got=['http://127.0.0.1/x'] want=['http://127.0.0.1/x']\nOK    flush: public host not blocked: got=False want=False\nOK    flush: 127.0.0.1 cached False: got=False want=False\nOK    flush: 8.8.8.8 cached True: got=True want=True\nOK    flush: drains pending: got=[] want=[]\n== network-layer residual disclosure ==\nOK    observer docstring still discloses the issued-before-teardown residual: got=True want=True\nOK    web_fetch docstring still discloses the Camoufox SSRF residual: got=True want=True\n\nALL  TESTS PASS",
      "deferred": false,
      "expected": "ALL  TESTS PASS",
      "returncode": 0,
      "verdict": "yes",
      "outcome": "command completed successfully"
    },
    {
      "kind": "example",
      "claim": "Release gate ./run-tests.sh runs all suites and package build",
      "source": "README.md Install from source / For development",
      "input": "",
      "command": "",
      "evidence": "Not run: the gate requires pip install -e '.[all,dev]' (the all extra runs camoufox fetch, which downloads a browser that is not permitted here) and provisions a Valkey fixture via tests/fixtures/valkey/install.sh. Only the offline test_ssrf_guard.py was run instead.",
      "deferred": false,
      "expected": "documented command completes successfully",
      "verdict": "blocked",
      "outcome": "Not run: the gate requires pip install -e '.[all,dev]' (the all extra runs camoufox fetch, which downloads a browser that is not permitted here) and provisions a Valkey fixture via tests/fixtures/valkey/install.sh. Only the offline test_ssrf_guard.py was run instead."
    },
    {
      "kind": "example",
      "claim": "Live SSRF redirect check with a browser",
      "source": "README.md Install from source",
      "input": "",
      "command": "",
      "evidence": "Needs a local browser (render extra / Camoufox), which was not installed; the shared CDP endpoint is not wired to this product's render path.",
      "deferred": true,
      "expected": "documented command completes successfully",
      "verdict": "deferred",
      "outcome": "Needs a local browser (render extra / Camoufox), which was not installed; the shared CDP endpoint is not wired to this product's render path."
    }
  ],
  "does_what_it_says": "yes",
  "maintenance": {
    "last_commit_at": "2026-09-01T18:32:38Z",
    "commits_90d": 4,
    "merged_prs_90d": 2,
    "open_issues": 0,
    "open_prs": 1,
    "reply_share": 0.67,
    "reply_threads": 3,
    "median_reply_hours": 2042.2,
    "last_release_at": "2026-09-01T16:25:52Z",
    "archived": false,
    "verdict": "maintained",
    "note": "actively maintained: last commit 54 days ago; 4 commits and 2 merged PRs in 90 days; 0 open issues, 1 open PRs; 2 of 3 recent threads got a maintainer reply, median first reply 2042.2h; latest release 2026-09-01"
  },
  "maintenance_verdict": "maintained",
  "maintenance_note": "actively maintained: last commit 54 days ago; 4 commits and 2 merged PRs in 90 days; 0 open issues, 1 open PRs; 2 of 3 recent threads got a maintainer reply, median first reply 2042.2h; latest release 2026-09-01",
  "maintained": "active",
  "maintained_note": "last commit 54 days ago",
  "last_commit_at": "2026-09-01T18:32:39Z",
  "last_release_at": "2026-09-01T16:25:52Z",
  "open_issues": null,
  "answered_issues": null,
  "platforms_claimed": [
    "linux",
    "mac",
    "windows"
  ],
  "topic": "mcp-server",
  "agent_interfaces": [
    {
      "interface": "mcp",
      "evidence": "independent checker",
      "observed": true,
      "operation_checked": true
    }
  ],
  "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.",
  "mcp_context": {
    "tool_count": 6,
    "schema_bytes": 18936,
    "tokens_approx": 4734,
    "estimate_method": "ceil(compact UTF-8 tools/list JSON bytes / 4)",
    "scope": "returned tools/list page only; excludes client framing and tool results"
  },
  "tested_at": "2026-10-25T23:43:27.532806+00:00",
  "tested_commit": "c0ee5646d2c23ae27692d52f4c74387180c6cf24",
  "tested_with": {
    "agent": "claude-code",
    "agent_version": "2.1.310 (Claude Code)",
    "model": "claude-haiku-5-5",
    "model_route": "claude-haiku-5-5",
    "reasoning": "low",
    "os": "linux",
    "backend": "hyperv",
    "transport": "mcp-assigned-vm"
  },
  "setup_identity": {
    "repo": "VelvetSP/web-retrieval-mcp",
    "source": "https://github.com/VelvetSP/web-retrieval-mcp",
    "commit": "c0ee5646d2c23ae27692d52f4c74387180c6cf24",
    "source_revision": null,
    "os": "linux",
    "architecture": null,
    "backend": "hyperv",
    "model": "claude-haiku-5-5",
    "model_version": "claude-haiku-5-5",
    "agent_execution": "native_agent",
    "agent_runtime": "claude-code",
    "agent_runtime_version": "2.1.310 (Claude Code)",
    "tool_transport": "mcp-assigned-vm",
    "runtime": null,
    "runtime_version": null,
    "runtime_revision": null,
    "sandbox_source": null,
    "guest_setup": null,
    "source_pin": {
      "commit": "c0ee5646d2c23ae27692d52f4c74387180c6cf24",
      "url": "https://github.com/VelvetSP/web-retrieval-mcp"
    },
    "platform_details": {
      "os": "linux",
      "backend": "hyperv"
    },
    "platform_conflicts": null,
    "reasoning": "low",
    "service_tier": null,
    "resources": {
      "cpus": 2,
      "memory_mib": 4096,
      "disk_mib": 32768
    },
    "operation": "Run the web-retrieval-mcp stdio MCP server and call its tools (web_fetch / web_search)",
    "operation_scope": "product operation",
    "hosting": null,
    "kind": "mcp",
    "test_version": "readme-ca496ea10bb07418d1d8f1c256c2433a55547acc0fb62d8b6d86ae33c976fbfa",
    "evidence_version": null
  },
  "other_model": null,
  "other_run_id": null,
  "models_agree": null,
  "furthest_model": null,
  "transcript_url": "/transcripts/VelvetSP--web-retrieval-mcp-claude-haiku-5-5-1792971571402393094.txt",
  "report_url": "/reports/VelvetSP--web-retrieval-mcp-claude-haiku-5-5-1792971571402393094.json"
}
