{
  "run_id": "ianewsfr-a11y--mcp-guard-gpt-6-luna-1792783408269659326",
  "date": "2026-10-23T19:33:22.922364+00:00",
  "repo": "ianewsfr-a11y/mcp-guard",
  "kind": "repo",
  "source": "https://github.com/ianewsfr-a11y/mcp-guard",
  "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
  "model": "gpt-6-luna",
  "model_version": "gpt-6-luna",
  "test_version": "readme-f72312298d35d84837d4fc5f6f22b138d54d456600b5ed431e36e8f5db931dbf",
  "pass": true,
  "outcome": "pass",
  "time_to_working_s": 548.1457754949806,
  "total_s": 594.6526825428009,
  "steps": [
    "cd <guest-path> && vault-search 'mcp-guard README MCP server' && cat <host-path> && cat ~/.agents/skills/i-have-adhd/SKILL.md && cat ~/.agents/skills/ponytail/SKILL.md && cat ~/.agents/skills/p3-mode/SKILL.md && rg --files -g 'AGENTS.md' -g 'README*' -g 'p3-models.md' -g 'pyproject.toml' -g 'requirements*' -g '*.json' -g 'Makefile' -g '*.yml' -g '*.yaml' | head -100 && cat README.md && id -u && python3 --version",
    "unused",
    "cd <guest-path>; cat <host-path>; cat ~/.agents/skills/i-have-adhd/SKILL.md; cat ~/.agents/skills/ponytail/SKILL.md; cat ~/.agents/skills/p3-mode/SKILL.md; rg --files -g 'AGENTS.md' -g 'README*' -g 'p3-models.md' -g 'pyproject.toml' -g 'requirements*' -g '*.json' -g 'Makefile' -g '*.yml' -g '*.yaml' | head -100; cat README.md; id -u; python3 --version",
    "cd <guest-path>; ls -la; find . -maxdepth 2 -name AGENTS.md -o -name config_example.json; python3 -m pip --version; command -v uvx; command -v uv; command -v node; command -v npm; command -v mcp-guard; sed -n '1,30p' examples/config_example.json 2>/dev/null; ls examples",
    "cd <guest-path>; sudo -n apt-get update && sudo -n apt-get install -y python3-pip python3-venv nodejs npm; python3 -m venv <guest-path>",
    "cd <guest-path>; <guest-path> -m pip install mcp-guard-audit; <guest-path> -m pip install -e '.[dev]'",
    "cd <guest-path>; <guest-path> inspect config_example.json",
    "cd <guest-path>; mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"cli\",\"argv\":[\"<guest-path>\",\"inspect\",\"config_example.json\"],\"cwd\":\"<guest-path>\",\"expected_text\":\"execute_bash_command\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"The audit identifies command execution capabilities in server tools.\",\"source\":\"`mcp-guard` reads your Model Context Protocol (MCP) configuration or a server's tools list and tells you, in one table, which tools can execute commands, write data, touch a database, reach the network, or run with elevated privileges, and which ones hide instructions for the model in their descriptions (**tool poisoning**).\",\"input\":\"config_example.json\",\"expected\":\"execute_bash_command classified as CRITICAL command-execution\",\"probe_kind\":\"cli\",\"argv\":[\"<guest-path>\",\"inspect\",\"config_example.json\"],\"cwd\":\"<guest-path>\",\"expected_text\":\"command-execution: bash\"}]\nEOF\ncat > .coldpass/examples.json <<'EOF'\n[{\"kind\":\"example\",\"claim\":\"Audit the supplied example configuration\",\"source\":\"README.md, Example\",\"input\":\"config_example.json\",\"expected\":\"The output identifies critical command execution risk\",\"argv\":[\"<guest-path>\",\"inspect\",\"config_example.json\"],\"cwd\":\"<guest-path>\",\"expected_text\":\"command-execution: bash\"}]\nEOF\ncat > .coldpass/cycles.json <<'EOF'\n{\"detected\":false,\"reason\":\"The README describes one-shot inspect and scan commands and no product scheduler, recurring loop, or webhook trigger; the documented inspect operation was run once.\",\"checks\":[]}\nEOF\n<env-var>=<guest-path> python3 -I <guest-path> --validate --replay",
    "cd <guest-path>; cat > .coldpass/report.json <<'EOF'\n{\"outcome\":\"working\",\"fault_owner\":null,\"operation\":\"Install mcp-guard-audit in a Python 3.12 virtual environment and audit the repository's documented example configuration.\",\"operation_scope\":\"README install and inspect workflow; Python 3.10+ satisfied by Python 3.12.3.\",\"steps\":[\"sudo -n apt-get update && sudo -n apt-get install -y python3-pip python3-venv nodejs npm\",\"python3 -m venv <guest-path>\",\"<guest-path> -m pip install mcp-guard-audit\",\"<guest-path> -m pip install -e '.[dev]'\",\"<guest-path> inspect config_example.json\",\"<env-var>=<guest-path> python3 -I <guest-path> --validate --replay\"],\"deviations\":[\"The environment's initial Python lacked pip; system pip, venv, Node and npm were installed with apt before continuing. The package installs were performed in a supported virtual environment.\",\"The README quick replication live command was not run; the offline documented inspect example exercised a useful real audit operation without downloading or executing an MCP server.\"],\"stuck_step\":null,\"main_blocker\":null,\"plain_failure\":null,\"suggested_fix\":null}\nEOF\n<env-var>=<guest-path> python3 -I <guest-path> --validate --replay"
  ],
  "stuck_step": null,
  "error_excerpt": null,
  "what_it_did": "Install mcp-guard-audit in a Python 3.12 virtual environment and audit the repository's documented example configuration.",
  "suggested_fix": null,
  "tokens_in": 326603,
  "tokens_out": 1951,
  "cost_usd": null,
  "usage_complete": true,
  "checks": [
    {
      "check": "operation",
      "status": "PASS",
      "details": {
        "working": true,
        "argv": [
          "<guest-path>",
          "inspect",
          "config_example.json"
        ],
        "kind": "cli",
        "returncode": 0,
        "stdout": "                      mcp-guard audit: config_example.json                      \n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 Type   \u2503 Name                   \u2503    Risk    \u2503 Findings                      \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 server \u2502 ops-toolbox            \u2502  CRITICAL  \u2502 privileged-access: sudo       \u2502\n\u2502        \u2502                        \u2502            \u2502 hardcoded-secret: env         \u2502\n\u2502        \u2502                        \u2502            \u2502 OPS_API_TOKEN=<redacted, 24   \u2502\n\u2502        \u2502                        \u2502            \u2502 chars>                        \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 tool   \u2502 execute_bash_command   \u2502  CRITICAL  \u2502 command-execution: bash,      \u2502\n\u2502        \u2502                        \u2502            \u2502 execute, shell                \u2502\n\u2502        \u2502                        \u2502            \u2502 privileged-access: root       \u2502\n[excerpt truncated]",
        "stderr": "",
        "needs_credentials": false,
        "needs_browser": false,
        "scope": "product operation"
      }
    }
  ],
  "safety": {
    "version": "z2x-1",
    "rules_version": "z2x-1",
    "summary": "Review signals: 1 hardcoded secret, 2 known vulnerability. 18 static matches retained as context.",
    "findings": [
      {
        "kind": "hardcoded-secret",
        "count": 1,
        "note": "Gitleaks found a possible hardcoded secret; value withheld.",
        "location_count": 1,
        "path": "config_example.json"
      },
      {
        "kind": "known-vulnerability",
        "count": 2,
        "note": "OSV reports a known vulnerability in this dependency version.",
        "location_count": 1,
        "path": "pydantic"
      }
    ],
    "context": [
      {
        "kind": "hardcoded-secret",
        "count": 18,
        "note": "Gitleaks found a possible hardcoded secret; value withheld.",
        "location_count": 9
      }
    ],
    "limitations": [
      "A short run cannot establish that code is safe.",
      "Connections show IP addresses; proxies can hide the final hostname.",
      "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing."
    ],
    "static": {
      "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check."
    },
    "evidence_url": "/safety/?run=ianewsfr-a11y--mcp-guard-gpt-6-luna-1792783408269659326",
    "evidence_file": "/data/safety/ianewsfr-a11y--mcp-guard-gpt-6-luna-1792783408269659326.json.gz"
  },
  "agent_execution": "native_agent",
  "agent_runtime": "codex",
  "agent_runtime_version": "codex-cli 0.163.0",
  "tool_transport": "mcp-assigned-vm",
  "platform": "linux",
  "reasoning": "low",
  "service_tier": "standard",
  "resources": {
    "cpus": 2,
    "memory_mib": 4096,
    "disk_mib": 32768
  },
  "native_tool_calls": 9,
  "native_bundle": null,
  "architecture": null,
  "backend": "hyperv",
  "platform_details": {
    "backend": "hyperv",
    "os": "linux"
  },
  "platform_conflicts": null,
  "sandbox_source": null,
  "source_pin": {
    "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
    "url": "https://github.com/ianewsfr-a11y/mcp-guard"
  },
  "purpose": "initial",
  "profile": {
    "model": "gpt-6-luna",
    "reasoning": "low"
  },
  "fault": {
    "owner": null,
    "status": "resolved",
    "reason": null
  },
  "fix_id": null,
  "verifies_run_id": null,
  "hosting": null,
  "operation_scope": "product operation",
  "tool_calls": 9,
  "guest_setup": null,
  "runtime": null,
  "runtime_version": null,
  "runtime_revision": null,
  "source_revision": null,
  "evidence_version": null,
  "failure_origin": null,
  "evidence_strength": "readme_checked",
  "works": "yes",
  "install_s": null,
  "first_use_s": null,
  "mcp": "none",
  "needs": [],
  "needs_which": null,
  "agent_interface": [
    "cli"
  ],
  "license": "MIT",
  "repo_url": "https://github.com/ianewsfr-a11y/mcp-guard",
  "cost_to_try": "free",
  "hardware": null,
  "what_failed": null,
  "local_or_hosted": "local",
  "cycle_checks": [
    {
      "kind": "cycle",
      "claim": "Scheduled or looping main behavior",
      "source": "repository entry points",
      "input": "source inspection",
      "expected": "identify the product trigger",
      "verdict": "yes",
      "outcome": "The README describes one-shot inspect and scan commands and no product scheduler, recurring loop, or webhook trigger; the documented inspect operation was run once.",
      "evidence": "The README describes one-shot inspect and scan commands and no product scheduler, recurring loop, or webhook trigger; the documented inspect operation was run once.",
      "command": ""
    }
  ],
  "claims": [
    {
      "kind": "claim",
      "claim": "The audit identifies command execution capabilities in server tools.",
      "source": "`mcp-guard` reads your Model Context Protocol (MCP) configuration or a server's tools list and tells you, in one table, which tools can execute commands, write data, touch a database, reach the network, or run with elevated privileges, and which ones hide instructions for the model in their descriptions (**tool poisoning**).",
      "input": "config_example.json",
      "expected": "execute_bash_command classified as CRITICAL command-execution",
      "command": "<guest-path> inspect config_example.json",
      "verdict": "yes",
      "outcome": "Real input produced the expected result: command-execution: bash",
      "evidence": "command-execution: bash,      \u2502\n\u2502        \u2502                        \u2502            \u2502 execute, shell                \u2502\n\u2502        \u2502                        \u2502            \u2502 privileged-access: root       \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 tool   \u2502 update_customer_record \u2502    HIGH    \u2502 write-operation: update       \u2502\n\u2502        \u2502                        \u2502            \u2502 database-write: update        \u2502\n\u2502        \u2502                        \u2502            \u2502 database: database, query,    \u2502\n\u2502        \u2502                        \u2502            \u2502 sql, table                    \u2502\n\u251c",
      "returncode": 0,
      "source_checked": true,
      "source_file": "README.md"
    }
  ],
  "claims_note": null,
  "example_checks": [
    {
      "kind": "example",
      "claim": "Audit the supplied example configuration",
      "source": "README.md, Example",
      "input": "config_example.json",
      "command": "<guest-path> inspect config_example.json",
      "evidence": "    \u2502            \u2502 http, url                     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 server \u2502 filesystem             \u2502     LOW    \u2502 no risky capability detected  \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 tool   \u2502 read_user_file         \u2502     LOW    \u2502 no risky capability detected  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\nformat: mcpServers (Claude Desktop / Cursor / Windsurf / Continue) + tools list \n\n6 item(s) audited   CRITICAL  2   HIGH  1   MEDIUM  1   LOW  2",
      "deferred": false,
      "expected": "The output identifies critical command execution risk",
      "returncode": 0,
      "verdict": "yes",
      "outcome": "command completed successfully"
    }
  ],
  "does_what_it_says": "yes",
  "maintenance": {
    "archived": false,
    "commits_90d": 38,
    "last_commit_at": "2026-10-23T15:56:50Z",
    "last_release_at": "2026-10-23T15:57:06Z",
    "median_reply_hours": null,
    "merged_prs_90d": 28,
    "note": "actively maintained: last commit 0 days ago; 38 commits and 28 merged PRs in 90 days; 1 open issues, 0 open PRs; latest release 2026-10-23",
    "open_issues": 1,
    "open_prs": 0,
    "reply_share": null,
    "reply_threads": 0,
    "verdict": "maintained"
  },
  "maintenance_verdict": "maintained",
  "maintenance_note": "actively maintained: last commit 0 days ago; 38 commits and 28 merged PRs in 90 days; 1 open issues, 0 open PRs; latest release 2026-10-23",
  "maintained": "active",
  "maintained_note": "last commit 0 days ago; 1 open issues, 7 answered or closed",
  "last_commit_at": "2026-10-23T15:57:06Z",
  "last_release_at": "2026-10-23T15:57:06Z",
  "open_issues": 1,
  "answered_issues": 7,
  "platforms_claimed": [
    "windows"
  ],
  "topic": "mcp-server",
  "agent_interfaces": [
    {
      "interface": "mcp",
      "evidence": "README metadata",
      "observed": false,
      "operation_checked": false
    },
    {
      "interface": "cli",
      "evidence": "independent checker",
      "observed": true,
      "operation_checked": true
    }
  ],
  "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.",
  "mcp_context": null,
  "tested_at": "2026-10-23T19:33:22.922364+00:00",
  "tested_commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
  "tested_with": {
    "agent": "codex",
    "agent_version": "codex-cli 0.163.0",
    "model": "gpt-6-luna",
    "model_route": "gpt-6-luna",
    "reasoning": "low",
    "os": "linux",
    "backend": "hyperv",
    "transport": "mcp-assigned-vm"
  },
  "setup_identity": {
    "repo": "ianewsfr-a11y/mcp-guard",
    "source": "https://github.com/ianewsfr-a11y/mcp-guard",
    "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
    "source_revision": null,
    "os": "linux",
    "architecture": null,
    "backend": "hyperv",
    "model": "gpt-6-luna",
    "model_version": "gpt-6-luna",
    "agent_execution": "native_agent",
    "agent_runtime": "codex",
    "agent_runtime_version": "codex-cli 0.163.0",
    "tool_transport": "mcp-assigned-vm",
    "runtime": null,
    "runtime_version": null,
    "runtime_revision": null,
    "sandbox_source": null,
    "guest_setup": null,
    "source_pin": {
      "commit": "0fdcc013437964be271fc57fe95e46394b1ccbb7",
      "url": "https://github.com/ianewsfr-a11y/mcp-guard"
    },
    "platform_details": {
      "os": "linux",
      "backend": "hyperv"
    },
    "platform_conflicts": null,
    "reasoning": "low",
    "service_tier": "standard",
    "resources": {
      "cpus": 2,
      "memory_mib": 4096,
      "disk_mib": 32768
    },
    "operation": "Install mcp-guard-audit in a Python 3.12 virtual environment and audit the repository's documented example configuration.",
    "operation_scope": "product operation",
    "hosting": null,
    "kind": "repo",
    "test_version": "readme-f72312298d35d84837d4fc5f6f22b138d54d456600b5ed431e36e8f5db931dbf",
    "evidence_version": null
  },
  "other_model": null,
  "other_run_id": null,
  "models_agree": null,
  "furthest_model": null,
  "transcript_url": null,
  "report_url": "/reports/ianewsfr-a11y--mcp-guard-gpt-6-luna-1792783408269659326.json"
}