{ "run_id": "snyk--agent-scan-gpt-6-luna-1792770068966562069", "date": "2026-10-23T15:42:38.720810+00:00", "repo": "snyk/agent-scan", "kind": "repo", "source": "https://github.com/snyk/agent-scan", "commit": "a8c8c5879a008edacb2a50d1a9fe0a40ee91d205", "model": "gpt-6-luna", "model_version": "gpt-6-luna", "test_version": "readme-f72312298d35d84837d4fc5f6f22b138d54d456600b5ed431e36e8f5db931dbf", "pass": true, "outcome": "pass", "time_to_working_s": 62.50217725394759, "total_s": 89.75420618057251, "steps": [ "cd && (vault-search 'agent-scan Snyk repository README setup' || true) && cat 2>/dev/null && cat ~/.agents/skills/i-have-adhd/SKILL.md 2>/dev/null && cat ~/.agents/skills/ponytail/SKILL.md 2>/dev/null && cat ~/.agents/skills/p3-mode/SKILL.md 2>/dev/null && rg --files -g 'AGENTS.md' -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g '.github/workflows/*' -g '*requirements*' | head -100 && git status --short --branch && git log -1 --oneline && sed -n '1,240p' README.md", "cd && for f in ~/.agents/skills/i-have-adhd/SKILL.md ~/.agents/skills/ponytail/SKILL.md ~/.agents/skills/p3-mode/SKILL.md; do if test -r \"$f\"; then printf '\\n--- %s ---\\n' \"$f\"; cat \"$f\"; fi; done; printf '\\n--- files ---\\n'; rg --files -g 'AGENTS.md' -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g '.github/workflows/*' -g '*requirements*' | head -100; printf '\\n--- git ---\\n'; git status --short --branch; git log -1 --oneline; printf '\\n--- readme ---\\n'; sed -n '1,240p' README.md; printf '\\n--- uid/python ---\\n'; id -u; python3 --version", "cd && tail -200 README.md; find .. -name AGENTS.md -print; command -v uv || true; command -v curl; command -v git; git init -q && git remote add origin https://github.com/snyk/agent-scan && git fetch --depth 1 origin a8c8c5879a008edacb2a50d1a9fe0a40ee91d205 && git reset --mixed FETCH_HEAD", "cd && mkdir -p .coldpass && (curl -LsSf https://astral.sh/uv/install.sh | sh) && --version", "cd && --version && snyk-agent-scan@latest --help | head -50", "cd && snyk-agent-scan@latest inspect --help; sed -n '1,160p' docs/scanning.md", "cd && env -u SNYK_TOKEN snyk-agent-scan@latest inspect --json > ; rc=$?; cat ; printf 'returncode=%s\\n' \"$rc\"; mkdir -p .coldpass; python3 - <<'PY'\nimport json\np=''\njson.dump({'kind':'cli','argv':['','snyk-agent-scan@latest','inspect','--json'],'cwd':'','expected_text':'\"scan_path_responses\"'},open(p+'/probe.json','w'),indent=2)\njson.dump([{'kind':'claim','claim':'Inspect components without security analysis.','source':'Inspect and display MCP tools, prompts, and resources without security\\nverification.','input':'empty local agent configuration','expected':'inspect output','probe_kind':'cli','argv':['','snyk-agent-scan@latest','inspect','--json'],'expected_text':'\"scan_path_responses\"','cwd':''}],open(p+'/claims.json','w'),indent=2)\njson.dump([],open(p+'/examples.json','w'),indent=2)\njson.dump({'detected':False,'reason':'README documents one-shot CLI scans and background mode requires Snyk Evo contact; no local scheduler cycle is exposed.','checks':[]},open(p+'/cycles.json','w'),indent=2)\nPY", "cd && cat .coldpass/probe.json; cat > .coldpass/probe.json <<'EOF'\n{\"kind\":\"cli\",\"argv\":[\"\",\"snyk-agent-scan@latest\",\"inspect\",\"--json\"],\"cwd\":\"\",\"expected_text\":\"{}\"}\nEOF\ncat > .coldpass/claims.json <<'EOF'\n[{\"kind\":\"claim\",\"claim\":\"Inspect and display MCP tools, prompts, and resources without security verification.\",\"source\":\"Inspect and display MCP tools, prompts, and resources without security\\nverification.\",\"input\":\"empty local agent configuration\",\"expected\":\"{}\",\"probe_kind\":\"cli\",\"argv\":[\"\",\"snyk-agent-scan@latest\",\"inspect\",\"--json\"],\"expected_text\":\"{}\",\"cwd\":\"\"}]\nEOF\ncat > .coldpass/report.json <<'EOF'\n{\"outcome\":\"working\",\"fault_owner\":null,\"operation\":\"uvx snyk-agent-scan@latest inspect --json\",\"operation_scope\":\"Local discovery and inspection; Snyk API scan requires SNYK_TOKEN.\",\"steps\":[\"Installed uv using the README linked installer.\",\"Ran the README documented inspect operation; it returned {} with exit code 0.\"],\"deviations\":[\"uv installer placed binaries at ; initial assumed path was incorrect, then used installed executable.\"],\"stuck_step\":null,\"main_blocker\":null,\"plain_failure\":null,\"suggested_fix\":null}\nEOF\n= python3 -I --validate --replay", "cd && python3 - <<'PY'\nimport json\np='.coldpass/claims.json'; d=json.load(open(p)); d[0]['source']='Inspect and display tools, prompts, and resources without security verification.'; json.dump(d,open(p,'w'),indent=2)\nPY\n= python3 -I --validate --replay", "cd && python3 - <<'PY'\nimport json\np='.coldpass/claims.json'; d=json.load(open(p)); d[0]['source']='Agent Scan searches through your local agent\\'s configuration files to find agents, skills, and MCP servers.'; json.dump(d,open(p,'w'),indent=2)\nPY\n= python3 -I --validate --replay" ], "stuck_step": null, "error_excerpt": null, "what_it_did": "uvx snyk-agent-scan@latest inspect --json", "suggested_fix": null, "tokens_in": 184774, "tokens_out": 2069, "cost_usd": null, "usage_complete": true, "checks": [ { "check": "operation", "status": "PASS", "details": { "working": true, "argv": [ "", "snyk-agent-scan@latest", "inspect", "--json" ], "kind": "cli", "returncode": 0, "stdout": "{}", "stderr": "", "needs_credentials": false, "needs_browser": false, "scope": "product operation" } } ], "safety": { "version": "z2x-1", "rules_version": "z2x-1", "summary": "Review signals: 91 known vulnerability. 5 static matches retained as context.", "findings": [ { "kind": "known-vulnerability", "count": 91, "note": "OSV reports a known vulnerability in this dependency version.", "location_count": 5 } ], "context": [ { "kind": "hardcoded-secret", "count": 5, "note": "Gitleaks found a possible hardcoded secret; value withheld.", "location_count": 3 } ], "limitations": [ "A short run cannot establish that code is safe.", "Connections show IP addresses; proxies can hide the final hostname.", "Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing." ], "static": { "dependency_note": "OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check." }, "evidence_url": "/safety/?run=snyk--agent-scan-gpt-6-luna-1792770068966562069", "evidence_file": "/data/safety/snyk--agent-scan-gpt-6-luna-1792770068966562069.json.gz" }, "agent_execution": "native_agent", "agent_runtime": "codex", "agent_runtime_version": "codex-cli 0.163.0", "tool_transport": "mcp-assigned-vm", "platform": "linux", "reasoning": "low", "service_tier": "standard", "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "native_tool_calls": 10, "native_bundle": null, "architecture": null, "backend": "hyperv", "platform_details": { "backend": "hyperv", "os": "linux" }, "platform_conflicts": null, "sandbox_source": null, "source_pin": { "commit": "a8c8c5879a008edacb2a50d1a9fe0a40ee91d205", "url": "https://github.com/snyk/agent-scan" }, "purpose": "initial", "profile": { "model": "gpt-6-luna", "reasoning": "low" }, "fault": { "owner": null, "status": "resolved", "reason": null }, "fix_id": null, "verifies_run_id": null, "hosting": null, "operation_scope": "product operation", "tool_calls": 10, "guest_setup": null, "runtime": null, "runtime_version": null, "runtime_revision": null, "source_revision": null, "evidence_version": null, "failure_origin": null, "evidence_strength": "readme_checked", "works": "yes", "install_s": null, "first_use_s": null, "mcp": "none", "needs": [], "needs_which": null, "agent_interface": [ "cli" ], "license": "Apache-2.0", "repo_url": "https://github.com/snyk/agent-scan", "cost_to_try": "free", "hardware": null, "what_failed": null, "local_or_hosted": "both", "cycle_checks": [ { "kind": "cycle", "claim": "Scheduled or looping main behavior", "source": "repository entry points", "input": "source inspection", "expected": "identify the product trigger", "verdict": "yes", "outcome": "README documents one-shot CLI scans and background mode requires Snyk Evo contact; no local scheduler cycle is exposed.", "evidence": "README documents one-shot CLI scans and background mode requires Snyk Evo contact; no local scheduler cycle is exposed.", "command": "" } ], "claims": [ { "kind": "claim", "claim": "Inspect and display MCP tools, prompts, and resources without security verification.", "source": "Agent Scan searches through your local agent's configuration files to find agents, skills, and MCP servers.", "input": "empty local agent configuration", "expected": "{}", "command": " snyk-agent-scan@latest inspect --json", "verdict": "yes", "outcome": "Real input produced the expected result: {}", "evidence": "{}\n", "returncode": 0, "source_checked": true, "source_file": "README.md" } ], "claims_note": null, "example_checks": [], "does_what_it_says": "yes", "maintenance": { "archived": false, "commits_90d": 119, "last_commit_at": "2026-10-22T14:57:22Z", "last_release_at": "2026-10-20T12:04:30Z", "median_reply_hours": 12.4, "merged_prs_90d": 74, "note": "actively maintained: last commit 1 days ago; 119 commits and 74 merged PRs in 90 days; 12 open issues, 13 open PRs; 4 of 34 recent threads got a maintainer reply, median first reply 12.4h; latest release 2026-10-20", "open_issues": 12, "open_prs": 13, "reply_share": 0.12, "reply_threads": 34, "verdict": "maintained" }, "maintenance_verdict": "maintained", "maintenance_note": "actively maintained: last commit 1 days ago; 119 commits and 74 merged PRs in 90 days; 12 open issues, 13 open PRs; 4 of 34 recent threads got a maintainer reply, median first reply 12.4h; latest release 2026-10-20", "maintained": "active", "maintained_note": "last commit 0 days ago; 5 open issues, 1 answered or closed", "last_commit_at": "2026-10-23T12:34:06Z", "last_release_at": "2026-10-20T12:04:30Z", "open_issues": 5, "answered_issues": 1, "platforms_claimed": [ "linux", "mac", "windows" ], "topic": "mcp-server", "agent_interfaces": [ { "interface": "mcp", "evidence": "README metadata", "observed": false, "operation_checked": false }, { "interface": "cli", "evidence": "independent checker", "observed": true, "operation_checked": true } ], "agent_interfaces_note": "README metadata is a discovery hint, not pinned documentation proof. Observed interfaces were exercised in this run. An empty list means unknown.", "mcp_context": null, "tested_at": "2026-10-23T15:42:38.720810+00:00", "tested_commit": "a8c8c5879a008edacb2a50d1a9fe0a40ee91d205", "tested_with": { "agent": "codex", "agent_version": "codex-cli 0.163.0", "model": "gpt-6-luna", "model_route": "gpt-6-luna", "reasoning": "low", "os": "linux", "backend": "hyperv", "transport": "mcp-assigned-vm" }, "setup_identity": { "repo": "snyk/agent-scan", "source": "https://github.com/snyk/agent-scan", "commit": "a8c8c5879a008edacb2a50d1a9fe0a40ee91d205", "source_revision": null, "os": "linux", "architecture": null, "backend": "hyperv", "model": "gpt-6-luna", "model_version": "gpt-6-luna", "agent_execution": "native_agent", "agent_runtime": "codex", "agent_runtime_version": "codex-cli 0.163.0", "tool_transport": "mcp-assigned-vm", "runtime": null, "runtime_version": null, "runtime_revision": null, "sandbox_source": null, "guest_setup": null, "source_pin": { "commit": "a8c8c5879a008edacb2a50d1a9fe0a40ee91d205", "url": "https://github.com/snyk/agent-scan" }, "platform_details": { "os": "linux", "backend": "hyperv" }, "platform_conflicts": null, "reasoning": "low", "service_tier": "standard", "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "operation": "uvx snyk-agent-scan@latest inspect --json", "operation_scope": "product operation", "hosting": null, "kind": "repo", "test_version": "readme-f72312298d35d84837d4fc5f6f22b138d54d456600b5ed431e36e8f5db931dbf", "evidence_version": null }, "other_model": null, "other_run_id": null, "models_agree": null, "furthest_model": null, "transcript_url": null, "report_url": "/reports/snyk--agent-scan-gpt-6-luna-1792770068966562069.json" }