{
  "run_id": "ianewsfr-a11y--mcp-guard-claude-haiku-5-5-1792781545288324088",
  "date": "2026-10-23T19:04:33.780018+00:00",
  "repo": "ianewsfr-a11y/mcp-guard",
  "kind": "repo",
  "source": "https://github.com/ianewsfr-a11y/mcp-guard",
  "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
  "model": "claude-haiku-5-5",
  "model_version": "claude-haiku-5-5",
  "test_version": "readme-bdc1b9b3c0d2673aef87e076d14084a8123ddcf09d520c1ee2e364a37c3f4bb9",
  "pass": true,
  "outcome": "pass",
  "time_to_working_s": 687.6421536100097,
  "total_s": 728.4916732311249,
  "steps": [
    "cd <guest-path> && ls -la && git status 2>&1 | head -3; id -u; cat /etc/os-release | head -2; python3 --version; cat README.md 2>/dev/null | head -200",
    "cd <guest-path> && sed -n 200,400p README.md; ls .coldpass; cat CLAUDE.md | head -50; cat requirements.txt requirements-dev.txt; grep -n requires-python pyproject.toml",
    "cd <guest-path> && grep -n '^#' README.md; grep -n -i 'cron\\|schedul\\|--once\\|webhook\\|loop' README.md | head; sed -n 400,520p README.md | cut -c1-300",
    "cd <guest-path> && sed -n 520,570p README.md | cut -c1-400; sed -n 1,60p pyproject.toml; ls .github/workflows examples docs tests; cat .gitignore",
    "cd /tmp && (python3 -m venv <guest-path> 2>&1 || (sudo -n apt-get update -qq && sudo -n apt-get install -y -qq python3-venv >/dev/null 2>&1 && python3 -m venv <guest-path>)) ; <guest-path> --version && cd <guest-path> && <guest-path> install -q -e \".[dev]\" 2>&1 | tail -5; echo rc=$?; <guest-path> --version",
    "cd <guest-path> && <guest-path> show mcp-guard-audit | head -2; <guest-path> -m pytest -q --cov=mcp_guard --cov-report=term 2>&1 | tail -15; ls -la <guest-path> | grep -i -E 'egg|coverage|pytest'",
    "cd <guest-path> && <guest-path> -m pytest -q tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory 2>&1 | grep -E 'Error|assert|E   ' | head -20",
    "cd <guest-path> && M=<guest-path>; $M inspect --help | head -40; which node npx; node --version 2>&1; cat config_example.json | head -30; ls .coldpass",
    "cd <guest-path> && (sudo -n apt-get install -y -qq nodejs npm ><guest-path> 2>&1; echo apt_rc=$?); node --version; npm --version; M=<guest-path>; $M inspect config_example.json; echo rc=$?",
    "cd /tmp && export NODE_USE_ENV_PROXY=1 && timeout 240 <guest-path> inspect --live --yes --server \"npx -y @modelcontextprotocol/server-memory\" --format json 2><guest-path> | head -c 3000; echo; echo rc=${PIPESTATUS[0]}; tail -5 <guest-path>",
    "cd <guest-path> && M=<guest-path>; $M inspect examples/poisoned_tools.json | tail -8; echo rc=$?; $M inspect --rules examples/rules.yaml config_example.json --format json | head -c 400; echo; echo ---; grep -rn -i 'schedul\\|cron\\|interval\\|while True\\|--once\\|--now\\|webhook' mcp_guard | head -20; ls <guest-path> /inputs 2>&1",
    "cd <guest-path> && M=<guest-path> && cat > .coldpass/probe.json <<EOF\n{\"kind\":\"cli\",\"argv\":[\"$M\",\"inspect\",\"config_example.json\",\"--format\",\"json\"],\"cwd\":\"<guest-path>\",\"expected_text\":\"execute_bash_command\"}\nEOF\ncat > .coldpass/claims.json <<EOF\n[\n{\"kind\":\"claim\",\"claim\":\"Offline by default: audits a config without starting servers\",\"source\":\"By default it runs entirely offline and never executes the servers it audits.\",\"input\":\"config_example.json\",\"expected\":\"JSON audit listing execute_bash_command\",\"probe_kind\":\"cli\",\"argv\":[\"$M\",\"inspect\",\"config_example.json\",\"--format\",\"json\"],\"expected_text\":\"execute_bash_command\",\"cwd\":\"<guest-path>\"},\n{\"kind\":\"claim\",\"claim\":\"--live starts the server and audits its real tools (memory server quick start)\",\"source\":\"mcp-guard starts the server once, performs the MCP handshake, reads the tools it really exposes and audits each one:\",\"input\":\"npx -y @modelcontextprotocol/server-memory\",\"expected\":\"JSON audit listing the real delete_entities tool\",\"probe_kind\":\"cli\",\"argv\":[\"$M\",\"inspect\",\"--live\",\"--yes\",\"--server\",\"npx -y @modelcontextprotocol/server-memory\",\"--format\",\"json\"],\"expected_text\":\"delete_entities\",\"cwd\":\"/tmp\"},\n{\"kind\":\"claim\",\"claim\":\"inspect flags hidden instructions as tool poisoning\",\"source\":\"prints a **TOOL POISONING DETECTED** alert under the table\",\"input\":\"examples/poisoned_tools.json\",\"expected\":\"TOOL POISONING DETECTED alert\",\"probe_kind\":\"cli\",\"argv\":[\"$M\",\"inspect\",\"examples/poisoned_tools.json\"],\"expected_text\":\"TOOL POISONING DETECTED\",\"cwd\":\"<guest-path>\"}\n]\nEOF\ncat > .coldpass/examples.json <<EOF\n[\n{\"kind\":\"example\",\"claim\":\"Tool poisoning detection on the shipped sample\",\"source\":\"README.md Tool poisoning section (examples/poisoned_tools.json)\",\"input\":\"examples/poisoned_tools.json\",\"expected\":\"TOOL POISONING DETECTED alert\",\"argv\":[\"$M\",\"inspect\",\"examples/poisoned_tools.json\"],\"cwd\":\"<guest-path>\",\"env\":{},\"expected_text\":\"TOOL POISONING DETECTED\"},\n{\"kind\":\"example\",\"claim\":\"Custom rules file (--rules) applied to a config\",\"source\":\"README.md --rules: custom rules (examples/rules.yaml)\",\"input\":\"examples/rules.yaml with config_example.json\",\"expected\":\"JSON audit with privileged-access finding\",\"argv\":[\"$M\",\"inspect\",\"--rules\",\"examples/rules.yaml\",\"config_example.json\",\"--format\",\"json\"],\"cwd\":\"<guest-path>\",\"env\":{},\"expected_text\":\"privileged-access\"},\n{\"kind\":\"example\",\"claim\":\"Documented test suite\",\"source\":\"README.md Development section (pytest --cov=mcp_guard)\",\"reason\":\"Ran the documented command with the venv pytest: 945 passed, 1 failed (tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory). The failure is environmental: the test expects the venv python under the home directory, but the venv is at <guest-path> and resolves to /usr/bin/python3.12. Not a product defect as far as observed.\"}\n]\nEOF\ncat > .coldpass/cycles.json <<'EOF'\n{\"detected\":false,\"reason\":\"Inspected README (no cron, schedule, --once or --now, webhook or loop features) and mcp_guard source. The only loops are stdio/proxy message pumps (mcp_guard/live/*, runtime/proxy.py, runtime/journal.py, runtime/recorder.py, runtime/inspector.py), which serve one request stream and are not product cycles. mcp-guard runs one audit per invocation.\",\"checks\":[]}\nEOF\nfor f in probe claims examples cycles; do <guest-path> -I -m json.tool .coldpass/$f.json >/dev/null && echo \"$f ok\"; done; cat .coldpass/probe.json",
    "cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}",
    "cd <guest-path> && rm -rf .coverage .pytest_cache && cat > .coldpass/report.json <<'EOF'\n{\"outcome\":\"working\",\"fault_owner\":null,\"operation\":\"Audit MCP server configs and live servers with mcp-guard (static audit of config_example.json, live tools/list of the official memory server, tool-poisoning detection on examples/poisoned_tools.json)\",\"operation_scope\":\"Linux x86_64 Ubuntu 24.04, Python 3.12.3 venv at <guest-path>, Node v18.19.1 / npm 9.2.0 (apt). Offline audit needs no network; the --live memory-server check needs npm registry access. No credentials or browser needed.\",\"steps\":[\"sudo apt-get install -y python3-venv (after python3 -m venv failed on missing ensurepip)\",\"python3 -m venv <guest-path>\",\"<guest-path> install -e \\\".[dev]\\\" (README Development section)\",\"<guest-path> --version -> mcp-guard, version 0.12.0\",\"sudo apt-get install -y nodejs npm (Node needed for npx in README Quick Replication)\",\"<guest-path> inspect config_example.json\",\"NODE_USE_ENV_PROXY=1 <guest-path> inspect --live --yes --server \\\"npx -y @modelcontextprotocol/server-memory\\\" --format json (run from /tmp)\",\"<guest-path> inspect examples/poisoned_tools.json\",\"<guest-path> inspect --rules examples/rules.yaml config_example.json --format json\",\"<guest-path> -m pytest --cov=mcp_guard --cov-report=term-missing (README Development)\"],\"deviations\":[\"python3 -m venv failed: ensurepip not available (Ubuntu python3-venv package missing). Installed python3-venv with sudo apt-get and recreated the venv.\",\"Node/npm were not installed in the guest; installed nodejs and npm from apt (v18.19.1) with sudo so the README's npx quick start could run.\",\"README Development pytest run: 945 passed, 1 failed. tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory expects the venv python path to start with ~, but the venv is at <guest-path> and Python resolves to /usr/bin/python3.12. Environmental, recorded as a reasoned example rather than a pass.\",\"The README's pipx/uvx install path was not used; the Development-section editable install (pip install -e .[dev]) was used instead, as the README documents it.\",\"The task's /inputs/coldpass-preflight.py path does not exist in this VM; the checker at <guest-path> was run with --validate --replay instead.\",\"MCP probe not used: mcp-guard is a CLI and does not serve MCP; the probe and claims are kind cli.\",\"Cycle: none detected (no scheduler, cron, --once or webhook). The while-loops in the source are stdio/proxy pumps.\"],\"stuck_step\":null,\"main_blocker\":null,\"plain_failure\":null,\"suggested_fix\":\"None required for the product. Optional: make the test_proxy home-directory assertion independent of where the venv lives (or run the suite from a venv under $HOME).\"}\nEOF\n<guest-path> -I -m json.tool .coldpass/report.json >/dev/null && echo report ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300; echo; ls -la .coldpass"
  ],
  "stuck_step": null,
  "error_excerpt": null,
  "what_it_did": "Audit MCP server configs and live servers with mcp-guard (static audit of config_example.json, live tools/list of the official memory server, tool-poisoning detection on examples/poisoned_tools.json)",
  "suggested_fix": null,
  "tokens_in": 559351,
  "tokens_out": 13094,
  "cost_usd": 0.02351053,
  "usage_complete": true,
  "checks": [
    {
      "check": "operation",
      "status": "PASS",
      "details": {
        "working": true,
        "argv": [
          "<guest-path>",
          "inspect",
          "config_example.json",
          "--format",
          "json"
        ],
        "kind": "cli",
        "returncode": 0,
        "stdout": "[\n  {\n    \"kind\": \"server\",\n    \"name\": \"ops-toolbox\",\n    \"server\": null,\n    \"risk\": \"CRITICAL\",\n    \"findings\": [\n      {\n        \"id\": \"99d47e387fac685c88458e9c10c13132\",\n        \"category\": \"privileged-access\",\n        \"risk\": \"CRITICAL\",\n        \"evidence\": \"sudo\"\n[excerpt truncated]",
        "stderr": "",
        "needs_credentials": false,
        "needs_browser": false,
        "scope": "product operation"
      }
    }
  ],
  "safety": {
    "version": "z2x-1",
    "rules_version": "z2x-1",
    "summary": "Review signals: 1 hardcoded secret, 2 known vulnerability. 18 static matches retained as context.",
    "findings": [
      {
        "kind": "hardcoded-secret",
        "count": 1,
        "note": "Gitleaks found a possible hardcoded secret; value withheld.",
        "location_count": 1,
        "path": "config_example.json"
      },
      {
        "kind": "known-vulnerability",
        "count": 2,
        "note": "OSV reports a known vulnerability in this dependency version.",
        "location_count": 1,
        "path": "pydantic"
      }
    ],
    "context": [
      {
        "kind": "hardcoded-secret",
        "count": 18,
        "note": "Gitleaks found a possible hardcoded secret; value withheld.",
        "location_count": 9
      }
    ],
    "limitations": [
      "A short run cannot establish that code is safe.",
      "Connections show IP addresses; proxies can hide the final hostname.",
      "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing."
    ],
    "static": {
      "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check."
    },
    "evidence_url": "/safety/?run=ianewsfr-a11y--mcp-guard-claude-haiku-5-5-1792781545288324088",
    "evidence_file": "/data/safety/ianewsfr-a11y--mcp-guard-claude-haiku-5-5-1792781545288324088.json.gz"
  },
  "agent_execution": "native_agent",
  "agent_runtime": "claude-code",
  "agent_runtime_version": "2.1.300 (Claude Code)",
  "tool_transport": "mcp-assigned-vm",
  "platform": "linux",
  "reasoning": "low",
  "service_tier": null,
  "resources": {
    "cpus": 2,
    "memory_mib": 4096,
    "disk_mib": 32768
  },
  "native_tool_calls": 14,
  "native_bundle": null,
  "architecture": null,
  "backend": "hyperv",
  "platform_details": {
    "backend": "hyperv",
    "os": "linux"
  },
  "platform_conflicts": null,
  "sandbox_source": null,
  "source_pin": {
    "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
    "url": "https://github.com/ianewsfr-a11y/mcp-guard"
  },
  "purpose": "initial",
  "profile": {
    "model": "claude-haiku-5-5",
    "reasoning": "low"
  },
  "fault": {
    "owner": null,
    "status": "resolved",
    "reason": null
  },
  "fix_id": null,
  "verifies_run_id": null,
  "hosting": null,
  "operation_scope": "product operation",
  "tool_calls": 14,
  "guest_setup": null,
  "runtime": null,
  "runtime_version": null,
  "runtime_revision": null,
  "source_revision": null,
  "evidence_version": null,
  "failure_origin": null,
  "evidence_strength": "readme_checked",
  "works": "yes",
  "install_s": null,
  "first_use_s": null,
  "mcp": "none",
  "needs": [],
  "needs_which": null,
  "agent_interface": [
    "cli"
  ],
  "license": "MIT",
  "repo_url": "https://github.com/ianewsfr-a11y/mcp-guard",
  "cost_to_try": "free",
  "hardware": null,
  "what_failed": null,
  "local_or_hosted": "local",
  "cycle_checks": [
    {
      "kind": "cycle",
      "claim": "Scheduled or looping main behavior",
      "source": "repository entry points",
      "input": "source inspection",
      "expected": "identify the product trigger",
      "verdict": "yes",
      "outcome": "Inspected README (no cron, schedule, --once or --now, webhook or loop features) and mcp_guard source. The only loops are stdio/proxy message pumps (mcp_guard/live/*, runtime/proxy.py, runtime/journal.py, runtime/recorder.py, runtime/inspector.py), which serve one request stream and are not product cycles. mcp-guard runs one audit per invocation.",
      "evidence": "Inspected README (no cron, schedule, --once or --now, webhook or loop features) and mcp_guard source. The only loops are stdio/proxy message pumps (mcp_guard/live/*, runtime/proxy.py, runtime/journal.py, runtime/recorder.py, runtime/inspector.py), which serve one request stream and are not product cycles. mcp-guard runs one audit per invocation.",
      "command": ""
    }
  ],
  "claims": [
    {
      "kind": "claim",
      "claim": "Offline by default: audits a config without starting servers",
      "source": "By default it runs entirely offline and never executes the servers it audits.",
      "input": "config_example.json",
      "expected": "JSON audit listing execute_bash_command",
      "command": "<guest-path> inspect config_example.json --format json",
      "verdict": "yes",
      "outcome": "Real input produced the expected result: execute_bash_command",
      "evidence": "execute_bash_command\",\n    \"server\": null,\n    \"risk\": \"CRITICAL\",\n    \"findings\": [\n      {\n        \"id\": \"fad9054d64b5abca4b3d8419ac2ec834\",\n        \"category\": \"command-execution\",\n        \"risk\": \"CRITICAL\",\n        \"evidence\": \"bash, execute, shell\"\n      },\n      {\n        \"id\": \"6994492e89d4c3a5716087bc51558440\",\n        \"category\": \"privileged-access\",\n        \"risk\": \"CRITICAL\",\n        \"evidence\": \"root\"\n      }\n    ]\n  },\n  {\n    \"kind\": \"tool\",\n    \"name\": \"update_customer_record\",\n    \"server\": null,\n    \"risk\": \"HIGH\",\n    \"findings\": [\n      {\n        \"id\": \"0773e4a328e89cfd104d",
      "returncode": 0,
      "source_checked": true,
      "source_file": "README.md"
    },
    {
      "kind": "claim",
      "claim": "--live starts the server and audits its real tools (memory server quick start)",
      "source": "mcp-guard starts the server once, performs the MCP handshake, reads the tools it really exposes and audits each one:",
      "input": "npx -y @modelcontextprotocol/server-memory",
      "expected": "JSON audit listing the real delete_entities tool",
      "command": "<guest-path> inspect --live --yes --server 'npx -y @modelcontextprotocol/server-memory' --format json",
      "verdict": "yes",
      "outcome": "Real input produced the expected result: delete_entities",
      "evidence": "delete_entities\",\n    \"server\": \"server-memory\",\n    \"risk\": \"HIGH\",\n    \"findings\": [\n      {\n        \"id\": \"15bbe97fbbcc2c91b67f5876a704eec9\",\n        \"category\": \"write-operation\",\n        \"risk\": \"HIGH\",\n        \"evidence\": \"delete\"\n      }\n    ]\n  },\n  {\n    \"kind\": \"tool\",\n    \"name\": \"delete_observations\",\n    \"server\": \"server-memory\",\n    \"risk\": \"HIGH\",\n    \"findings\": [\n      {\n        \"id\": \"2ab73595feb0ebea35c99155b8995d06\",\n        \"category\": \"write-operation\",\n        \"risk\": \"HIGH\",\n        \"evidence\": \"delete\"\n      }\n    ]\n  },\n  {\n    \"kind\": \"tool\",\n    \"name\": \"delete_rel",
      "returncode": 0,
      "source_checked": true,
      "source_file": "README.md"
    },
    {
      "kind": "claim",
      "claim": "inspect flags hidden instructions as tool poisoning",
      "source": "prints a **TOOL POISONING DETECTED** alert under the table",
      "input": "examples/poisoned_tools.json",
      "expected": "TOOL POISONING DETECTED alert",
      "command": "<guest-path> inspect examples/poisoned_tools.json",
      "verdict": "yes",
      "outcome": "Real input produced the expected result: TOOL POISONING DETECTED",
      "evidence": "TOOL POISONING DETECTED \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 4 tool(s) carry hidden instructions for the model: get_weather, add_numbers, \u2502\n\u2502 translate_text, format_date.                                                 \u2502\n\u2502 Any agent connected to this server reads them as if they came from you. Do   \u2502\n\u2502 not enable these tools until their descriptions and parameter descriptions   \u2502\n\u2502 have been reviewed.                                                          \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f\n",
      "returncode": 0,
      "source_checked": true,
      "source_file": "README.md"
    }
  ],
  "claims_note": null,
  "example_checks": [
    {
      "kind": "example",
      "claim": "Tool poisoning detection on the shipped sample",
      "source": "README.md Tool poisoning section (examples/poisoned_tools.json)",
      "input": "examples/poisoned_tools.json",
      "command": "<guest-path> inspect examples/poisoned_tools.json",
      "evidence": " 0   HIGH  4   MEDIUM  0   LOW  1\n\u256d\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 TOOL POISONING DETECTED \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256e\n\u2502 4 tool(s) carry hidden instructions for the model: get_weather, add_numbers, \u2502\n\u2502 translate_text, format_date.                                                 \u2502\n\u2502 Any agent connected to this server reads them as if they came from you. Do   \u2502\n\u2502 not enable these tools until their descriptions and parameter descriptions   \u2502\n\u2502 have been reviewed.                                                          \u2502\n\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256f",
      "deferred": false,
      "expected": "TOOL POISONING DETECTED alert",
      "returncode": 0,
      "verdict": "yes",
      "outcome": "command completed successfully"
    },
    {
      "kind": "example",
      "claim": "Custom rules file (--rules) applied to a config",
      "source": "README.md --rules: custom rules (examples/rules.yaml)",
      "input": "examples/rules.yaml with config_example.json",
      "command": "<guest-path> inspect --rules examples/rules.yaml config_example.json --format json",
      "evidence": "\"update\"\n      },\n      {\n        \"id\": \"1b25a8ab4e22246c65c777ebbfa39be8\",\n        \"category\": \"database\",\n        \"risk\": \"MEDIUM\",\n        \"evidence\": \"database, query, sql, table\"\n      },\n      {\n        \"id\": \"e5efd8045e9a7c12789b1a68b6cdf766\",\n        \"category\": \"customer-data\",\n        \"risk\": \"HIGH\",\n        \"evidence\": \"customer, customers\"\n      }\n    ]\n  },\n  {\n    \"kind\": \"server\",\n    \"name\": \"filesystem\",\n    \"server\": null,\n    \"risk\": \"LOW\",\n    \"findings\": []\n  },\n  {\n    \"kind\": \"tool\",\n    \"name\": \"fetch_url\",\n    \"server\": null,\n    \"risk\": \"LOW\",\n    \"findings\": []\n  }\n]",
      "deferred": false,
      "expected": "JSON audit with privileged-access finding",
      "returncode": 0,
      "verdict": "yes",
      "outcome": "command completed successfully"
    },
    {
      "kind": "example",
      "claim": "Documented test suite",
      "source": "README.md Development section (pytest --cov=mcp_guard)",
      "input": "",
      "command": "",
      "evidence": "Ran the documented command with the venv pytest: 945 passed, 1 failed (tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory). The failure is environmental: the test expects the venv python under the home directory, but the venv is at <guest-path> and resolves to /usr/bin/python3.12. Not a product defect as far as observed.",
      "deferred": false,
      "expected": "documented command completes successfully",
      "verdict": "blocked",
      "outcome": "Ran the documented command with the venv pytest: 945 passed, 1 failed (tests/test_proxy.py::test_pins_never_store_secrets_or_the_home_directory). The failure is environmental: the test expects the venv python under the home directory, but the venv is at <guest-path> and resolves to /usr/bin/python3.12. Not a product defect as far as observed."
    }
  ],
  "does_what_it_says": "yes",
  "maintenance": {
    "last_commit_at": "2026-10-23T15:56:50Z",
    "commits_90d": 38,
    "merged_prs_90d": 28,
    "open_issues": 1,
    "open_prs": 0,
    "reply_share": null,
    "reply_threads": 0,
    "median_reply_hours": null,
    "last_release_at": "2026-10-23T15:57:06Z",
    "archived": false,
    "verdict": "maintained",
    "note": "actively maintained: last commit 0 days ago; 38 commits and 28 merged PRs in 90 days; 1 open issues, 0 open PRs; latest release 2026-10-23"
  },
  "maintenance_verdict": "maintained",
  "maintenance_note": "actively maintained: last commit 0 days ago; 38 commits and 28 merged PRs in 90 days; 1 open issues, 0 open PRs; latest release 2026-10-23",
  "maintained": "active",
  "maintained_note": "last commit 0 days ago; 1 open issues, 7 answered or closed",
  "last_commit_at": "2026-10-23T15:57:06Z",
  "last_release_at": "2026-10-23T15:57:06Z",
  "open_issues": 1,
  "answered_issues": 7,
  "platforms_claimed": [
    "windows"
  ],
  "topic": "mcp-server",
  "agent_interfaces": [
    {
      "interface": "mcp",
      "evidence": "README metadata",
      "observed": false,
      "operation_checked": false
    },
    {
      "interface": "cli",
      "evidence": "independent checker",
      "observed": true,
      "operation_checked": true
    }
  ],
  "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.",
  "mcp_context": null,
  "tested_at": "2026-10-23T19:04:33.780018+00:00",
  "tested_commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
  "tested_with": {
    "agent": "claude-code",
    "agent_version": "2.1.300 (Claude Code)",
    "model": "claude-haiku-5-5",
    "model_route": "claude-haiku-5-5",
    "reasoning": "low",
    "os": "linux",
    "backend": "hyperv",
    "transport": "mcp-assigned-vm"
  },
  "setup_identity": {
    "repo": "ianewsfr-a11y/mcp-guard",
    "source": "https://github.com/ianewsfr-a11y/mcp-guard",
    "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
    "source_revision": null,
    "os": "linux",
    "architecture": null,
    "backend": "hyperv",
    "model": "claude-haiku-5-5",
    "model_version": "claude-haiku-5-5",
    "agent_execution": "native_agent",
    "agent_runtime": "claude-code",
    "agent_runtime_version": "2.1.300 (Claude Code)",
    "tool_transport": "mcp-assigned-vm",
    "runtime": null,
    "runtime_version": null,
    "runtime_revision": null,
    "sandbox_source": null,
    "guest_setup": null,
    "source_pin": {
      "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
      "url": "https://github.com/ianewsfr-a11y/mcp-guard"
    },
    "platform_details": {
      "os": "linux",
      "backend": "hyperv"
    },
    "platform_conflicts": null,
    "reasoning": "low",
    "service_tier": null,
    "resources": {
      "cpus": 2,
      "memory_mib": 4096,
      "disk_mib": 32768
    },
    "operation": "Audit MCP server configs and live servers with mcp-guard (static audit of config_example.json, live tools/list of the official memory server, tool-poisoning detection on examples/poisoned_tools.json)",
    "operation_scope": "product operation",
    "hosting": null,
    "kind": "repo",
    "test_version": "readme-bdc1b9b3c0d2673aef87e076d14084a8123ddcf09d520c1ee2e364a37c3f4bb9",
    "evidence_version": null
  },
  "other_model": null,
  "other_run_id": null,
  "models_agree": null,
  "furthest_model": null,
  "transcript_url": null,
  "report_url": "/reports/ianewsfr-a11y--mcp-guard-claude-haiku-5-5-1792781545288324088.json"
}