{ "run_id": "achromat-ai--achromat-mcp-server-gpt-6-luna-1793104610923093453", "date": "2026-10-27T12:39:31.117337+00:00", "repo": "achromat-ai/achromat-mcp-server", "kind": "mcp", "source": "https://github.com/achromat-ai/achromat-mcp-server", "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "model": "gpt-6-luna", "model_version": "gpt-6-luna", "test_version": "readme-38e6b13f3b13804effb95797e3466b1a1334da7a232d897cbc8965867f802605", "pass": true, "outcome": "pass", "time_to_working_s": 128.8637985420064, "total_s": 160.19419503211975, "steps": [ "pwd && id -u && rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'requirements*.txt' -g 'Dockerfile*' -g 'Makefile' -g '.github/workflows/**' | head -80 && git status --short && git rev-parse --is-inside-work-tree && python3 --version && sed -n '1,240p' README.md", "ls -la && find . -maxdepth 3 -iname 'README*' -o -name 'pyproject.toml' -o -name 'package.json' -o -name 'requirements*.txt' | head -80 && python3 --version", "sed -n '1,240p' README.md && cat package.json && ls src && for f in src/*; do echo \"--- $f\"; sed -n '1,180p' \"$f\"; done", "node --version; npm --version; ls -la .coldpass; git init && git remote add origin https://github.com/achromat-ai/achromat-mcp-server && git fetch --depth 1 origin f1c086e89c388ce920908af9a21abd76c0950f5d && git reset --mixed FETCH_HEAD", "npm install", "npm run build && npm run typecheck && npm test", "sed -n '1,220p' src/index.ts && cat server.json", "mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":false},\"expected_text\":\"User confirmation is required\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"The server offers identity registration when there is no key file.\",\"source\":\"The first time you use the server it has no key, so it offers a single tool, `achromat_register_identity`, and your agent will **ask you** whether to set up an identity.\",\"input\":\"No configured key file exists.\",\"expected\":\"The registration tool is offered and requires explicit confirmation.\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":false},\"expected_text\":\"User confirmation is required\"}]\nEOF\ncat > .coldpass/examples.json <<'EOF'\n[{\"kind\":\"example\",\"claim\":\"Build and run the source server over stdio.\",\"source\":\"README.md / Run from source; README.md / Development\",\"input\":\"npm install; npm run build; npm start\",\"expected\":\"Server waits for an MCP host on stdio.\",\"argv\":[\"npm\",\"run\",\"build\"],\"cwd\":\"\",\"expected_text\":\"mark dist/index.js executable\"}]\nEOF\ncat > .coldpass/cycles.json <<'EOF'\n{\"detected\":false,\"reason\":\"Inspected README tools and package entry points: the server waits for host requests over MCP stdio and has no product scheduler, webhook, or cycle trigger.\"}\nEOF", "python3 -I --validate --replay", "sed -n '1,220p' src/format.ts; sed -n '180,330p' src/tools.ts", "cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":true},\"expected_text\":\"User confirmation is required\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"The registration operation requires user agreement before identity setup.\",\"source\":\"It requires `user_confirmed: true`, which the agent may set only after you have agreed; the tool description tells it to ask first.\",\"input\":\"An agent has not received agreement.\",\"expected\":\"The registration is not performed without explicit user confirmation.\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":true},\"expected_text\":\"Please confirm with the user\"}]\nEOF\ncat > .coldpass/examples.json <<'EOF'\n[{\"kind\":\"example\",\"claim\":\"Build the server from source as documented.\",\"source\":\"README.md / Run from source\",\"input\":\"npm install; npm run build\",\"expected\":\"dist/index.js is compiled and executable.\",\"argv\":[\"npm\",\"run\",\"build\"],\"cwd\":\"\",\"expected_text\":\"tsc && node -e\"}]\nEOF", "= python3 -I --validate --replay", "rm -f .coldpass/no-key.pem && cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{},\"expected_text\":\"only achromat_register_identity is offered\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"The server offers the registration tool when no key file exists.\",\"source\":\"The first time you use the server it has no key, so it offers a single tool, `achromat_register_identity`, and your agent will **ask you** whether to set up an identity.\",\"input\":\"Start the stdio server with a missing key path.\",\"expected\":\"Only the registration tool is listed.\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{},\"expected_text\":\"only achromat_register_identity is offered\"}]\nEOF", "= python3 -I --validate --replay", "cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_recall\",\"arguments\":{\"domain\":\"devsecops\",\"tool_name\":\"deploy_service\",\"task_description\":\"Deploy a service using the approved release workflow\",\"arguments\":{\"environment\":\"staging\"}},\"expected_text\":\"A key file exists\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"A missing key is explained when a signed tool is called.\",\"source\":\"The key itself is read on the first tool call, so a wrong key never makes the server disappear from your host: the tool call returns a message saying what to fix.\",\"input\":\"Call recall without a configured key file.\",\"expected\":\"The tool returns an actionable missing key message.\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_recall\",\"arguments\":{\"domain\":\"devsecops\",\"tool_name\":\"deploy_service\",\"task_description\":\"Deploy a service using the approved release workflow\",\"arguments\":{\"environment\":\"staging\"}},\"expected_text\":\"A key file exists\"}]\nEOF\ncat > .coldpass/examples.json <<'EOF'\n[{\"kind\":\"example\",\"claim\":\"Build and run from source using documented commands.\",\"source\":\"README.md / Run from source; README.md / Development\",\"input\":\"npm install; npm run build; npm start\",\"expected\":\"The built server starts and waits on stdio.\",\"argv\":[\"npm\",\"run\",\"build\"],\"cwd\":\"\",\"expected_text\":\"node -e\"}]\nEOF", "= python3 -I --validate --replay", "cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":true},\"expected_text\":\"REGISTERED. A new identity was created\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"Identity registration creates a local Ed25519 key and registers it with MOM.\",\"source\":\"generates an Ed25519 key pair on your machine,\",\"input\":\"Explicitly confirmed identity registration.\",\"expected\":\"Registration response confirms identity creation and saves the key.\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_register_identity\",\"arguments\":{\"user_confirmed\":true},\"expected_text\":\"REGISTERED. A new identity was created\"}]\nEOF", "= python3 -I --validate --replay", "cat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"With a registered key file, the server offers recall and calibrate tools.\",\"source\":\"Then `achromat_recall` and `achromat_calibrate` appear in place of the registration tool.\",\"input\":\"Start the server with the registered key file.\",\"expected\":\"Recall and calibrate tools become available.\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_recall\",\"arguments\":{\"domain\":\"devsecops\",\"tool_name\":\"deploy_service\",\"task_description\":\"Deploy a service using the approved release workflow\",\"arguments\":{\"environment\":\"staging\"}},\"expected_text\":\"Could not reach\"}]\nEOF\ncat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_recall\",\"arguments\":{\"domain\":\"devsecops\",\"tool_name\":\"deploy_service\",\"task_description\":\"Deploy a service using the approved release workflow\",\"arguments\":{\"environment\":\"staging\"}},\"expected_text\":\"Could not reach\"}\nEOF", "= python3 -I --validate --replay", "cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_recall\",\"arguments\":{\"domain\":\"devsecops\",\"tool_name\":\"deploy_service\",\"task_description\":\"Deploy a service using the approved release workflow\",\"arguments\":{\"environment\":\"staging\"}},\"expected_text\":\"NO MATCH: no verified compliant version of this call is known\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"Recall reports when no verified compliant call is known.\",\"source\":\"On a match you get `compliant_arguments`, a `steering_directive` and the rule that applied.\",\"input\":\"Recall a deployment call with no existing lesson.\",\"expected\":\"NO MATCH response advises calibration.\",\"probe_kind\":\"mcp\",\"argv\":[\"node\",\"\"],\"cwd\":\"\",\"env\":{\"ACHROMAT_AGENT_KEY_FILE\":\"\"},\"tool\":\"achromat_recall\",\"arguments\":{\"domain\":\"devsecops\",\"tool_name\":\"deploy_service\",\"task_description\":\"Deploy a service using the approved release workflow\",\"arguments\":{\"environment\":\"staging\"}},\"expected_text\":\"NO MATCH: no verified compliant version of this call is known\"}]\nEOF", "= python3 -I --validate --replay", "cat > .coldpass/report.json <<'EOF'\n{\"outcome\":\"working\",\"fault_owner\":null,\"operation\":\"Built the documented Node MCP server, registered a guest-local identity during manual exercise, then called achromat_recall and replayed the no-match response.\",\"operation_scope\":\"Node.js 22.23.4 (README requires Node.js 20+); npm install; npm run build; npm run typecheck; npm test; real MCP recall with signed registered key.\",\"steps\":[\"Read README and package entry points.\",\"Initialized git metadata and fetched pinned commit f1c086e89c388ce920908af9a21abd76c0950f5d.\",\"npm install succeeded.\",\"npm run build succeeded.\",\"npm run typecheck succeeded.\",\"npm test passed: 8 files and 155 tests.\",\"Called achromat_register_identity with explicit true in the disposable guest; MOM registered the identity and saved the key under .coldpass.\",\"Called achromat_recall for a deployment request; received NO MATCH and calibration guidance.\",\"Checker validation and replay passed.\"],\"deviations\":[\"The initial registry probe performed identity registration and changed the registered tool list; final probe uses achromat_recall with the resulting guest-local key. No user or host secrets were used.\"],\"stuck_step\":null,\"main_blocker\":null,\"plain_failure\":null,\"suggested_fix\":null}\nEOF\nls -la .coldpass && git status --short" ], "stuck_step": null, "error_excerpt": null, "what_it_did": "Built the documented Node MCP server, registered a guest-local identity during manual exercise, then called achromat_recall and replayed the no-match response.", "suggested_fix": null, "tokens_in": 696599, "tokens_out": 4272, "cost_usd": null, "usage_complete": true, "checks": [ { "check": "operation", "status": "PASS", "details": { "working": true, "argv": [ "node", "" ], "kind": "mcp", "serverInfo": { "name": "achromat-mcp-server", "version": "0.1.2" }, "tools": [ "achromat_recall", "achromat_calibrate" ], "tool_schema_bytes": 4392, "tool_result": { "content": [ { "type": "text", "text": "NO MATCH: no verified compliant version of this call is known.\nNext step: call achromat_calibrate with the arguments you intend to use. If it answers BLOCK, follow its steering directive." } ], "isError": false }, "tool_result_checked": true, "scope": "product operation" } } ], "safety": { "version": "z2x-1", "rules_version": "z2x-1", "summary": "Review signals: 1 connection review, 8 known vulnerability.", "expected": "Reviewed as expected for a test run: attempted writes that failed, so nothing was written; resolver address lookups that send no data.", "findings": [ { "kind": "connection-review", "count": 1, "note": "Repository processes attempted these non-loopback connections; proxies can hide the final hostname.", "location_count": 1, "path": "104.21.0.247:443", "process_count": 8 }, { "kind": "known-vulnerability", "count": 8, "note": "OSV reports a known vulnerability in this dependency version.", "location_count": 4 } ], "context": [], "limitations": [ "A short run cannot establish that code is safe.", "Connections show IP addresses; proxies can hide the final hostname.", "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing." ], "static": { "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check." }, "evidence_url": "/safety/?run=achromat-ai--achromat-mcp-server-gpt-6-luna-1793104610923093453", "evidence_file": "/data/safety/achromat-ai--achromat-mcp-server-gpt-6-luna-1793104610923093453.json.gz" }, "agent_execution": "native_agent", "agent_runtime": "codex", "agent_runtime_version": "codex-cli 0.164.0", "tool_transport": "mcp-assigned-vm", "platform": "linux", "reasoning": "low", "service_tier": "standard", "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "native_tool_calls": 23, "native_bundle": null, "architecture": null, "backend": "hyperv", "platform_details": { "backend": "hyperv", "os": "linux" }, "platform_conflicts": null, "sandbox_source": null, "source_pin": { "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "url": "https://github.com/achromat-ai/achromat-mcp-server" }, "purpose": "initial", "profile": { "model": "gpt-6-luna", "reasoning": "low" }, "fault": { "owner": null, "status": "resolved", "reason": null }, "fix_id": null, "verifies_run_id": null, "hosting": null, "operation_scope": "product operation", "tool_calls": 23, "guest_setup": null, "runtime": null, "runtime_version": null, "runtime_revision": null, "source_revision": null, "evidence_version": null, "failure_origin": null, "evidence_strength": "readme_checked", "works": "yes", "install_s": null, "first_use_s": null, "mcp": "local", "needs": [], "needs_which": null, "agent_interface": [ "mcp" ], "license": "MIT", "repo_url": "https://github.com/achromat-ai/achromat-mcp-server", "cost_to_try": "free", "hardware": null, "what_failed": null, "local_or_hosted": "local", "cycle_checks": [ { "kind": "cycle", "claim": "Scheduled or looping main behavior", "source": "repository entry points", "input": "source inspection", "expected": "identify the product trigger", "verdict": "yes", "outcome": "Inspected README tools and package entry points: the server waits for host requests over MCP stdio and has no product scheduler, webhook, or cycle trigger.", "evidence": "Inspected README tools and package entry points: the server waits for host requests over MCP stdio and has no product scheduler, webhook, or cycle trigger.", "command": "" } ], "claims": [ { "kind": "claim", "claim": "Recall reports when no verified compliant call is known.", "source": "On a match you get `compliant_arguments`, a `steering_directive` and the rule that applied.", "input": "{\"tool\": \"achromat_recall\", \"arguments\": {\"domain\": \"devsecops\", \"tool_name\": \"deploy_service\", \"task_description\": \"Deploy a service using the approved release workflow\", \"arguments\": {\"environment\": \"staging\"}}}", "expected": "NO MATCH response advises calibration.", "command": "node tools/call {\"tool\": \"achromat_recall\", \"arguments\": {\"domain\": \"devsecops\", \"tool_name\": \"deploy_service\", \"task_description\": \"Deploy a service using the approved release workflow\", \"arguments\": {\"environment\": \"staging\"}}}", "verdict": "yes", "outcome": "Real input produced the expected result: NO MATCH: no verified compliant version of this call is known", "evidence": "NO MATCH: no verified compliant version of this call is known.\\nNext step: call achromat_calibrate with the arguments you intend to use. If it answers BLOCK, follow its steering directive.\"}], \"isError\": false}", "source_checked": true, "source_file": "README.md" } ], "claims_note": null, "example_checks": [ { "kind": "example", "claim": "Build and run from source using documented commands.", "source": "README.md / Run from source; README.md / Development", "input": "npm install; npm run build; npm start", "command": "npm run build", "evidence": "> @achromat-ai/mcp-server@0.1.2 build\n> tsc && node -e \"require('node:fs').chmodSync('dist/index.js', 0o755)\"", "deferred": false, "expected": "The built server starts and waits on stdio.", "returncode": 0, "verdict": "yes", "outcome": "command completed successfully" } ], "does_what_it_says": "yes", "maintenance": { "archived": false, "commits_90d": 8, "last_commit_at": "2026-10-22T12:27:39Z", "last_release_at": null, "median_reply_hours": null, "merged_prs_90d": 0, "note": "actively maintained: last commit 5 days ago; 8 commits and 0 merged PRs in 90 days; 1 open issues, 0 open PRs; no releases", "open_issues": 1, "open_prs": 0, "reply_share": null, "reply_threads": 0, "verdict": "maintained" }, "maintenance_verdict": "maintained", "maintenance_note": "actively maintained: last commit 5 days ago; 8 commits and 0 merged PRs in 90 days; 1 open issues, 0 open PRs; no releases", "maintained": "active", "maintained_note": "last commit 5 days ago; 1 open issues, 0 answered or closed", "last_commit_at": "2026-10-22T12:27:48Z", "last_release_at": null, "open_issues": 1, "answered_issues": 0, "platforms_claimed": [ "mac", "windows" ], "topic": "mcp-server", "agent_interfaces": [ { "interface": "mcp", "evidence": "independent checker", "observed": true, "operation_checked": true } ], "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.", "mcp_context": { "tool_count": 2, "schema_bytes": 4392, "tokens_approx": 1098, "estimate_method": "ceil(compact UTF-8 tools/list JSON bytes / 4)", "scope": "returned tools/list page only; excludes client framing and tool results" }, "tested_at": "2026-10-27T12:39:31.117337+00:00", "tested_commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "tested_with": { "agent": "codex", "agent_version": "codex-cli 0.164.0", "model": "gpt-6-luna", "model_route": "gpt-6-luna", "reasoning": "low", "os": "linux", "backend": "hyperv", "transport": "mcp-assigned-vm" }, "setup_identity": { "repo": "achromat-ai/achromat-mcp-server", "source": "https://github.com/achromat-ai/achromat-mcp-server", "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "source_revision": null, "os": "linux", "architecture": null, "backend": "hyperv", "model": "gpt-6-luna", "model_version": "gpt-6-luna", "agent_execution": "native_agent", "agent_runtime": "codex", "agent_runtime_version": "codex-cli 0.164.0", "tool_transport": "mcp-assigned-vm", "runtime": null, "runtime_version": null, "runtime_revision": null, "sandbox_source": null, "guest_setup": null, "source_pin": { "commit": "f1c086e89c388ce920908af9a21abd76c0950f5d", "url": "https://github.com/achromat-ai/achromat-mcp-server" }, "platform_details": { "os": "linux", "backend": "hyperv" }, "platform_conflicts": null, "reasoning": "low", "service_tier": "standard", "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "operation": "Built the documented Node MCP server, registered a guest-local identity during manual exercise, then called achromat_recall and replayed the no-match response.", "operation_scope": "product operation", "hosting": null, "kind": "mcp", "test_version": "readme-38e6b13f3b13804effb95797e3466b1a1334da7a232d897cbc8965867f802605", "evidence_version": null }, "other_model": null, "other_run_id": null, "models_agree": null, "furthest_model": null, "transcript_url": "/transcripts/achromat-ai--achromat-mcp-server-gpt-6-luna-1793104610923093453.txt", "report_url": "/reports/achromat-ai--achromat-mcp-server-gpt-6-luna-1793104610923093453.json" }