{ "run_id": "achromat-ai--achromat-mcp-server-claude-haiku-5-5-1793104599444575845", "date": "2026-10-27T12:40:08.551025+00:00", "repo": "achromat-ai/achromat-mcp-server", "kind": "mcp", "source": "https://github.com/achromat-ai/achromat-mcp-server", "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "model": "claude-haiku-5-5", "model_version": "claude-haiku-5-5", "test_version": "readme-d5b140d3c0f8b95c2dd6fe6fc381a303cacb92679582c22317d8e78b572f0cf2", "pass": false, "outcome": "blocked", "time_to_working_s": null, "total_s": 209.1063323020935, "steps": [ "cd && ls -la && cat README.md | head -c 6000 && id -u && python3 --version && cat /etc/os-release | head -3", "cd && tail -c 4800 README.md; echo; cat package.json; ls src test .coldpass; git status 2>&1 | head -2", "node --version 2>&1; npm --version 2>&1; which node npm; ls ~/.achromat 2>&1; echo \"ACH_KEY=${ACHROMAT_AGENT_KEY_FILE:-unset}\"; env | grep -i proxy | sed 's/=.*@/=***@/' | head", "cd && npm install 2>&1 | tail -15 && npm run build 2>&1 | tail -10 && ls dist", "cd && npm run typecheck 2>&1 | tail -5; npm test 2>&1 | tail -25", "cd && grep -n \"user_confirmed\\|registration\\|z\\.\\(literal\\|boolean\\)\" src/tools.ts | head -30; grep -n \"ACHROMAT_AGENT_KEY_FILE\\|homedir\" src/config.ts | head", "cd && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"dist/index.js\"],\"cwd\":\"\",\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":false},\"expected_text\":\"ASK THE USER\"}\nEOF\ncat .coldpass/probe.json; ls 2>&1; ls /inputs 2>&1", "cd && = timeout 300 python3 -I --validate --replay 2>&1 | head -c 4000", "cd && grep -rn \"setInterval\\|cron\\|setTimeout\\|--once\\|--now\\|webhook\" src | head; echo \"---\"; grep -n \"stdio\\|StdioServerTransport\" src/index.ts | head -5", "cd && cat > claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"The registration tool requires explicit user confirmation before it creates an identity\",\"source\":\"It requires `user_confirmed: true`, which the agent may set only after you have agreed\",\"input\":\"{\\\"user_confirmed\\\":false}\",\"expected\":\"The server rejects the call and says user_confirmed must be true\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"dist/index.js\"],\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":false},\"expected_text\":\"expected true at user_confirmed\",\"cwd\":\"\"}]\nEOF\ncat > examples.json <<'EOF'\n[{\"kind\":\"example\",\"claim\":\"Offline unit test suite from the Development section\",\"source\":\"README.md Development\",\"input\":\"npm test\",\"expected\":\"All 155 offline tests pass\",\"argv\":[\"npm\",\"test\"],\"cwd\":\"\",\"env\":{},\"expected_text\":\"155 passed\"},\n{\"kind\":\"example\",\"claim\":\"Build compiles the TypeScript source to dist/\",\"source\":\"README.md Run from source / Development\",\"input\":\"npm run build\",\"expected\":\"Build exits 0 and dist/index.js is present\",\"argv\":[\"npm\",\"run\",\"build\"],\"cwd\":\"\",\"env\":{}}]\nEOF\ncat > cycles.json <<'EOF'\n{\"detected\":false,\"reason\":\"Entry points inspected: src/index.ts runs an MCP stdio server that only responds to host requests; no cron, loop, --once/--now, or webhook code in src/. The only setTimeout (src/pow.ts) is a proof-of-work deadline, not a product cycle.\",\"checks\":[]}\nEOF\nfor f in claims.json examples.json cycles.json probe.json; do python3 -I -c \"import json,sys;json.load(open(sys.argv[1]));print('ok',sys.argv[1])\" $f; done", "cd && cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"dist/index.js\"],\"cwd\":\"\",\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":false},\"expected_text\":\"expected true at user_confirmed\"}\nEOF\n= timeout 600 python3 -I --validate --replay 2>&1 | head -c 5000", "cd && cat > probe.json <<'EOF'\n{\"checks\":[{\"check\":\"install\",\"kind\":\"cli\",\"argv\":[\"npm\",\"install\"],\"cwd\":\"\"},{\"check\":\"credentials_error\",\"kind\":\"mcp\",\"argv\":[\"node\",\"dist/index.js\"],\"cwd\":\"\",\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":false},\"expected_text\":\"expected true at user_confirmed\"}]}\nEOF\ncat > claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"The registration tool requires explicit user confirmation before it creates an identity\",\"source\":\"It requires `user_confirmed: true`, which the agent may set only after you have agreed\",\"testable\":false,\"reason\":\"No Achromat identity key exists in this guest and the registration call writes a key and registers with the external MOM service, which needs the user's consent. The only callable path without a key is a refusal (MCP isError), which the checker does not count as a confirmed product result. Observed refusal: 'expected true at user_confirmed'.\"}]\nEOF\ncd .. && = timeout 600 python3 -I --validate --replay 2>&1 | head -c 3000", "cd && = timeout 600 python3 -I --validate --replay > 2>&1; python3 -I -c \"\nimport json\nd=json.load(open(''))\nprint('valid:',d.get('valid'))\nfor p in d.get('problems',[]): print('PROBLEM:',p[:160])\nprint('keys:',list(d.keys()))\nr=d.get('replay',{}).get('details',{})\nprint('examples:',[ (e.get('verdict'),e.get('returncode')) for e in r.get('example_checks',[])])\nprint('cycles:',[c.get('verdict') for c in r.get('cycle_checks',[])])\nprint('claims:',[c.get('verdict') for c in r.get('claims',[])])\n\"", "cd && cat > report.json <<'EOF'\n{\"outcome\":\"needs_credentials\",\"fault_owner\":\"prerequisite\",\"operation\":\"Run the Achromat MCP server from source (README 'Run from source') and call its tools to recall or calibrate tool calls against Achromat MOM\",\"operation_scope\":\"Build, typecheck and offline tests run fully. The live MOM operations (achromat_recall, achromat_calibrate) need an Ed25519 identity registered with mom.achromat.ai; none exists in this guest. Only achromat_register_identity is offered, and it requires user_confirmed=true after the user agrees, because it writes a private key and registers a public key with an external service.\",\"steps\":[\"npm install\",\"npm run build\",\"npm run typecheck\",\"npm test (155 offline tests pass)\",\"node dist/index.js (MCP stdio server, README 'Run from source')\",\"MCP tools/call achromat_register_identity with user_confirmed=false -> refused: 'expected true at user_confirmed'\"],\"deviations\":[\"/inputs/coldpass-preflight.py does not exist in this guest; used as instructed by the checker path that exists.\",\"Did not call achromat_register_identity with user_confirmed=true: it creates an identity on an external service and writes a private key, and the user has not agreed to that.\",\"npm install reported 5 vulnerabilities (3 moderate, 2 high); not fixed, since that would change dependencies.\",\"Used the README's source build instead of npx, so the probe runs the local dist/index.js.\"],\"stuck_step\":\"Calling achromat_recall or achromat_calibrate, which needs a registered identity key\",\"main_blocker\":\"No Achromat identity key exists on this machine. The server offers only achromat_register_identity, and it refuses to run without user_confirmed=true, which needs the user's consent.\",\"plain_failure\":\"The server works and passes its tests, but its real features need a private key registered with the Achromat service. This guest has no key, and creating one needs the user's yes. The checker counts the refusal as a failed check, so validation reports valid=false; that is the expected result without a key.\",\"suggested_fix\":\"Give the agent the user's consent to run achromat_register_identity (or supply an existing unencrypted PKCS#8 Ed25519 key via ACHROMAT_AGENT_KEY_FILE that MOM already knows), then rerun the probe with achromat_recall to check real results.\"}\nEOF\npython3 -I -c \"import json;json.load(open('report.json'));print('report ok')\"; ls -la " ], "stuck_step": "Calling achromat_recall or achromat_calibrate, which needs a registered identity key", "error_excerpt": "No Achromat identity key exists on this machine. The server offers only achromat_register_identity, and it refuses to run without user_confirmed=true, which needs the user's consent.", "what_it_did": "Run the Achromat MCP server from source (README 'Run from source') and call its tools to recall or calibrate tool calls against Achromat MOM", "suggested_fix": "Give the agent the user's consent to run achromat_register_identity (or supply an existing unencrypted PKCS#8 Ed25519 key via ACHROMAT_AGENT_KEY_FILE that MOM already knows), then rerun the probe with achromat_recall to check real results.", "tokens_in": 300741, "tokens_out": 11071, "cost_usd": 0.014374430000000002, "usage_complete": true, "checks": [ { "status": "PASS", "details": { "working": false, "argv": [ "npm", "install" ], "kind": "cli", "returncode": 0, "stdout": "\nup to date, audited 146 packages in 2s\n\n52 packages are looking for funding\n run `npm fund` for details\n\n5 vulnerabilities (3 moderate, 2 high)\n\nTo address issues that do not require attention, run:\n npm audit fix\n\nTo address all issues, run:\n[excerpt truncated]", "stderr": "", "needs_credentials": false, "needs_browser": false, "scope": "partial: install" }, "check": "install", "optional": false }, { "status": "FAIL", "details": { "working": false, "argv": [ "node", "dist/index.js" ], "kind": "mcp", "serverInfo": { "name": "achromat-mcp-server", "version": "0.1.2" }, "tools": [ "achromat_register_identity" ], "tool_schema_bytes": 1329, "tool_result": { "content": [ { "type": "text", "text": "MCP error -32602: Input validation error: Invalid arguments for tool achromat_register_identity: Invalid input: expected true at user_confirmed" } ], "isError": true }, "blocker": "MCP tool result did not confirm the expected product output" }, "check": "credentials_error", "optional": false } ], "safety": { "version": "z2x-1", "rules_version": "z2x-1", "summary": "Review signals: 8 known vulnerability.", "expected": "Reviewed as expected for a test run: attempted writes that failed, so nothing was written.", "findings": [ { "kind": "known-vulnerability", "count": 8, "note": "OSV reports a known vulnerability in this dependency version.", "location_count": 4 } ], "context": [], "limitations": [ "A short run cannot establish that code is safe.", "Connections show IP addresses; proxies can hide the final hostname.", "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing." ], "static": { "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check." }, "evidence_url": "/safety/?run=achromat-ai--achromat-mcp-server-claude-haiku-5-5-1793104599444575845", "evidence_file": "/data/safety/achromat-ai--achromat-mcp-server-claude-haiku-5-5-1793104599444575845.json.gz" }, "agent_execution": "native_agent", "agent_runtime": "claude-code", "agent_runtime_version": "2.1.310 (Claude Code)", "tool_transport": "mcp-assigned-vm", "platform": "linux", "reasoning": "low", "service_tier": null, "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "native_tool_calls": 14, "native_bundle": null, "architecture": null, "backend": "hyperv", "platform_details": { "backend": "hyperv", "os": "linux" }, "platform_conflicts": null, "sandbox_source": null, "source_pin": { "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "url": "https://github.com/achromat-ai/achromat-mcp-server" }, "purpose": "initial", "profile": { "model": "claude-haiku-5-5", "reasoning": "low" }, "fault": { "owner": "prerequisite", "status": "diagnosed", "reason": "No Achromat identity key exists on this machine. The server offers only achromat_register_identity, and it refuses to run without user_confirmed=true, which needs the user's consent." }, "fix_id": "fix-aad8fa0d185d07c48dab", "verifies_run_id": null, "hosting": null, "operation_scope": "partial checks", "tool_calls": 14, "guest_setup": null, "runtime": null, "runtime_version": null, "runtime_revision": null, "source_revision": null, "evidence_version": null, "failure_origin": "task", "evidence_strength": "nothing_checked", "works": "no", "install_s": null, "first_use_s": null, "mcp": "unknown", "needs": [], "needs_which": null, "agent_interface": [], "license": "MIT", "repo_url": "https://github.com/achromat-ai/achromat-mcp-server", "cost_to_try": null, "hardware": null, "what_failed": "No Achromat identity key exists on this machine.", "local_or_hosted": "local", "cycle_checks": [ { "kind": "cycle", "claim": "Scheduled or looping main behavior", "source": "repository entry points", "input": "source inspection", "expected": "identify the product trigger", "verdict": "yes", "outcome": "Entry points inspected: src/index.ts runs an MCP stdio server that only responds to host requests; no cron, loop, --once/--now, or webhook code in src/. The only setTimeout (src/pow.ts) is a proof-of-work deadline, not a product cycle.", "evidence": "Entry points inspected: src/index.ts runs an MCP stdio server that only responds to host requests; no cron, loop, --once/--now, or webhook code in src/. The only setTimeout (src/pow.ts) is a proof-of-work deadline, not a product cycle.", "command": "" } ], "claims": [ { "kind": "claim", "claim": "The registration tool requires explicit user confirmation before it creates an identity", "source": "It requires `user_confirmed: true`, which the agent may set only after you have agreed", "input": "", "expected": "", "command": "", "verdict": "blocked", "outcome": "No Achromat identity key exists in this guest and the registration call writes a key and registers with the external MOM service, which needs the user's consent. The only callable path without a key is a refusal (MCP isError), which the checker does not count as a confirmed product result. Observed refusal: 'expected true at user_confirmed'.", "evidence": "No Achromat identity key exists in this guest and the registration call writes a key and registers with the external MOM service, which needs the user's consent. The only callable path without a key is a refusal (MCP isError), which the checker does not count as a confirmed product result. Observed refusal: 'expected true at user_confirmed'.", "source_checked": true, "source_file": "README.md" } ], "claims_note": null, "example_checks": [ { "kind": "example", "claim": "Offline unit test suite from the Development section", "source": "README.md Development", "input": "npm test", "command": "npm test", "evidence": "ts\u001b[22m\u001b[2m)\u001b[22m\u001b[32m 103\u001b[2mms\u001b[22m\u001b[39m\n \u001b[32m\u2713\u001b[39m test/server.test.ts \u001b[2m(\u001b[22m\u001b[2m16 tests\u001b[22m\u001b[2m)\u001b[22m\u001b[32m 70\u001b[2mms\u001b[22m\u001b[39m\n \u001b[32m\u2713\u001b[39m test/format.test.ts \u001b[2m(\u001b[22m\u001b[2m26 tests\u001b[22m\u001b[2m)\u001b[22m\u001b[32m 10\u001b[2mms\u001b[22m\u001b[39m\n \u001b[32m\u2713\u001b[39m test/config.test.ts \u001b[2m(\u001b[22m\u001b[2m9 tests\u001b[22m\u001b[2m)\u001b[22m\u001b[32m 5\u001b[2mms\u001b[22m\u001b[39m\n\n\u001b[2m Test Files \u001b[22m \u001b[1m\u001b[32m8 passed\u001b[39m\u001b[22m\u001b[90m (8)\u001b[39m\n\u001b[2m Tests \u001b[22m \u001b[1m\u001b[32m155 passed\u001b[39m\u001b[22m\u001b[90m (155)\u001b[39m\n\u001b[2m Start at \u001b[22m 12:39:50\n\u001b[2m Duration \u001b[22m 10.38s\u001b[2m (transform 409ms, setup 0ms, import 1.67s, tests 5.82s, environment 0ms)\u001b[22m", "deferred": false, "expected": "All 155 offline tests pass", "returncode": 0, "verdict": "yes", "outcome": "command completed successfully" }, { "kind": "example", "claim": "Build compiles the TypeScript source to dist/", "source": "README.md Run from source / Development", "input": "npm run build", "command": "npm run build", "evidence": "> @achromat-ai/mcp-server@0.1.2 build\n> tsc && node -e \"require('node:fs').chmodSync('dist/index.js', 0o755)\"", "deferred": false, "expected": "Build exits 0 and dist/index.js is present", "returncode": 0, "verdict": "yes", "outcome": "command completed successfully" } ], "does_what_it_says": null, "maintenance": { "last_commit_at": "2026-10-22T12:27:39Z", "commits_90d": 8, "merged_prs_90d": 0, "open_issues": 1, "open_prs": 0, "reply_share": null, "reply_threads": 0, "median_reply_hours": null, "last_release_at": null, "archived": false, "verdict": "maintained", "note": "actively maintained: last commit 5 days ago; 8 commits and 0 merged PRs in 90 days; 1 open issues, 0 open PRs; no releases" }, "maintenance_verdict": "maintained", "maintenance_note": "actively maintained: last commit 5 days ago; 8 commits and 0 merged PRs in 90 days; 1 open issues, 0 open PRs; no releases", "maintained": "active", "maintained_note": "last commit 5 days ago; 1 open issues, 0 answered or closed", "last_commit_at": "2026-10-22T12:27:48Z", "last_release_at": null, "open_issues": 1, "answered_issues": 0, "platforms_claimed": [ "mac", "windows" ], "topic": "mcp-server", "agent_interfaces": [ { "interface": "mcp", "evidence": "independent checker", "observed": true, "operation_checked": false }, { "interface": "cli", "evidence": "independent checker", "observed": true, "operation_checked": false } ], "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.", "mcp_context": { "tool_count": 1, "schema_bytes": 1329, "tokens_approx": 333, "estimate_method": "ceil(compact UTF-8 tools/list JSON bytes / 4)", "scope": "returned tools/list page only; excludes client framing and tool results" }, "tested_at": "2026-10-27T12:40:08.551025+00:00", "tested_commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "tested_with": { "agent": "claude-code", "agent_version": "2.1.310 (Claude Code)", "model": "claude-haiku-5-5", "model_route": "claude-haiku-5-5", "reasoning": "low", "os": "linux", "backend": "hyperv", "transport": "mcp-assigned-vm" }, "setup_identity": { "repo": "achromat-ai/achromat-mcp-server", "source": "https://github.com/achromat-ai/achromat-mcp-server", "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "source_revision": null, "os": "linux", "architecture": null, "backend": "hyperv", "model": "claude-haiku-5-5", "model_version": "claude-haiku-5-5", "agent_execution": "native_agent", "agent_runtime": "claude-code", "agent_runtime_version": "2.1.310 (Claude Code)", "tool_transport": "mcp-assigned-vm", "runtime": null, "runtime_version": null, "runtime_revision": null, "sandbox_source": null, "guest_setup": null, "source_pin": { "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "url": "https://github.com/achromat-ai/achromat-mcp-server" }, "platform_details": { "os": "linux", "backend": "hyperv" }, "platform_conflicts": null, "reasoning": "low", "service_tier": null, "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "operation": "Run the Achromat MCP server from source (README 'Run from source') and call its tools to recall or calibrate tool calls against Achromat MOM", "operation_scope": "partial checks", "hosting": null, "kind": "mcp", "test_version": "readme-d5b140d3c0f8b95c2dd6fe6fc381a303cacb92679582c22317d8e78b572f0cf2", "evidence_version": null }, "other_model": null, "other_run_id": null, "models_agree": null, "furthest_model": null, "transcript_url": "/transcripts/achromat-ai--achromat-mcp-server-claude-haiku-5-5-1793104599444575845.txt", "report_url": "/reports/achromat-ai--achromat-mcp-server-claude-haiku-5-5-1793104599444575845.json" }