Ablation-Tool/kevlar

Review signals: 2 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV reports a known vulnerability in this dependency version. pytest 2 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Tool call results pass through the proxy to the client: Real input produced the expected result: On branch main

  Source: Tool call results cannot be stripped without breaking functionality.

  Input: {"tool": "git_status", "arguments": {"repo_path": "<guest-path>"}}

  Expected: status text returned intact

  Command: <guest-path> <guest-path> --mode strict -- uvx mcp-server-git tools/call {"tool": "git_status", "arguments": {"repo_path": "<guest-path>"}}

  Observed: On branch main\nnothing to commit, working tree clean"}], "isError": false}

Examples

• Calls to tools outside the sanitized set are blocked: command completed successfully

  Source: README.md

  Input: tools/call git_delete_everything sent without tools/list

  Expected: synthetic block message from kevlar

  Command: <guest-path> <guest-path> --mode strict -- uvx mcp-server-git

  Observed: : 3, "result": {"content": [{"type": "text", "text": "kevlar: tool 'git_delete_everything' was not in CDR-sanitized set"}], "isError": true}} {"jsonrpc": "2.0", "id": 1, "result": {"protocolVersion": "2024-11-05", "capabilities": {"prompts": {"listChanged": false}, "resources": {"listChanged": false, "subscribe": false}, "tools": {"listChanged": false}}, "serverInfo": {"name": "mcp-git", "version": "2026.10.19"}}} 2026-10-25 22:52:53,911 INFO kevlar spawned server pid=4167 cmd=uvx mode=strict 2026-10-25 22:52:53,912 WARNING kevlar tools/call blocked for unsanitized tool 'git_delete_everything'

• Repository test suite runs (README Tests section): command completed successfully

  Source: README.md Tests section

  Input: pytest

  Expected: 149 passed

  Command: <guest-path> -q

  Observed: ........................................................................ [ 48%] ........................................................................ [ 96%] ..... [100%] 149 passed in 8.78s

Local or hosted: local

Run Kevlar as a stdio firewall proxy in front of an MCP server and get a real tool result back (README Quickstart / Setup)

cd <guest-path> && pwd && ls -la && id -u && python3 --version && git status 2>&1 | head -3; cat README.md 2>/dev/null | head -150
cd <guest-path> && tail -c 1200 README.md; echo ---; cat pyproject.toml requirements.txt requirements-dev.txt; ls docs tests .coldpass; echo; curl -s -m 10 -o /dev/null -w "%{http_code}\n" $CDP_URL/json/version; echo "cdp_exit=$?"
cd /tmp && (python3 -m venv <guest-path> 2>&1 || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y python3-venv >/tmp/apt.log 2>&1 && python3 -m venv <guest-path>)); <guest-path> --version && <guest-path> --version
cd <guest-path> && <guest-path> install -e ".[dev]" 2>&1 | tail -5; ls <guest-path> | grep -i kevlar
cd <guest-path> && <guest-path> install -e ".[dev]" 2>&1 | head -30; <guest-path> show setuptools 2>/dev/null | head -2
cd <guest-path> && grep -n "__main__\|^def main\|argparse\|add_argument" kevlar.py | head -30; <guest-path> install "pytest>=8.0" 2>&1 | tail -1
cd <guest-path> && timeout 600 <guest-path> -q 2>&1 | tail -8
which node npm npx uvx; node --version 2>&1; npm --version 2>&1; cat <guest-path> | head -5; sed -n 515,560p <guest-path>
cd /tmp && export NODE_USE_ENV_PROXY=1 && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | timeout 180 <guest-path> <guest-path> --mode strict -- npx -y @modelcontextprotocol/server-filesystem /tmp 2>/tmp/kerr.txt | cut -c1-400; echo "rc=${PIPESTATUS[1]}"; tail -5 /tmp/kerr.txt
cd <guest-path> && grep -n -i "nesting\|MAX_DEPTH\|depth" kevlar.py policy.py | head -30
cd /tmp && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | timeout 240 <guest-path> <guest-path> --mode strict -- uvx mcp-server-git 2>/tmp/kerr2.txt | cut -c1-300; echo "rc=${PIPESTATUS[1]}"; tail -4 /tmp/kerr2.txt
cd <guest-path> && sed -n 85,105p kevlar.py
mkdir -p <guest-path> && cd <guest-path> && git init -q -b main . && git -c <email> -c user.name=t commit -q --allow-empty -m init && cd /tmp && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"git_status","arguments":{"repo_path":"<guest-path>"}}}' | timeout 240 <guest-path> <guest-path> --mode strict -- uvx mcp-server-git 2>/dev/null | tail -1 | cut -c1-400
cd /tmp && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"git_status","arguments":{"repo_path":"<guest-path>"}}}' | timeout 240 <guest-path> <guest-path> --mode strict -- uvx mcp-server-git 2>/tmp/kerr3.txt | grep '"id": 3' | cut -c1-400; tail -3 /tmp/kerr3.txt
cd /tmp && ( printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 6; printf '%s\n' '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"git_status","arguments":{"repo_path":"<guest-path>"}}}'; sleep 3 ) | timeout 240 <guest-path> <guest-path> --mode strict -- uvx mcp-server-git 2>/tmp/kerr4.txt | grep '"id": 3' | cut -c1-400
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","<guest-path>","--mode","strict","--","uvx","mcp-server-git"],"cwd":"<guest-path>","tool":"git_status","arguments":{"repo_path":"<guest-path>"},"expected_text":"On branch main"}
EOF
cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"Tool call results pass through the proxy to the client","source":"Tool call results cannot be stripped without breaking functionality.","input":"git_status on <guest-path> via kevlar strict mode","expected":"status text returned intact","probe_kind":"mcp","argv":["<guest-path>","<guest-path>","--mode","strict","--","uvx","mcp-server-git"],"tool":"git_status","arguments":{"repo_path":"<guest-path>"},"expected_text":"On branch main","cwd":"<guest-path>"},
{"kind":"claim","claim":"Calls to tools outside the sanitized set are blocked","source":"Any call to a tool not in the CDR-sanitized set is blocked with a synthetic `isError` response regardless of call content.","input":"git_status call sent without a prior tools/list","expected":"synthetic block message","probe_kind":"mcp","argv":["<guest-path>","<guest-path>","--mode","strict","--","uvx","mcp-server-git"],"tool":"git_status","arguments":{"repo_path":"<guest-path>"},"expected_text":"was not in CDR-sanitized set","cwd":"<guest-path>"}
]
EOF
echo '{"detected":false,"reason":"kevlar is a stdio proxy (policy.py pure engine, kevlar.py async stdio proxy per README Architecture); no cron, scheduler, loop, webhook, --once or --now entry points were found in README or kevlar.py main(). Each proxied session runs once per invocation.","checks":[]}' > cycles.json
echo '[{"kind":"example","claim":"Repository test suite runs (README Tests section)","source":"README.md Tests section","input":"pytest","expected":"149 passed","argv":["<guest-path>","-q"],"cwd":"<guest-path>","expected_text":"149 passed"}]' > examples.json
for f in probe.json claims.json cycles.json examples.json; do <guest-path> -m json.tool $f >/dev/null -I 2>/dev/null || python3 -c "import json,sys;json.load(open('$f'))" && echo "$f ok"; done
ls -la <guest-path> /inputs/ 2>&1 | head; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && python3 - <<'EOF'
import json
p='claims.json'
c=json.load(open(p))
c[1]['tool']='git_delete_everything'
c[1]['arguments']={}
c[1]['input']='call to unlisted tool git_delete_everything'
json.dump(c,open(p,'w'),indent=1)
EOF
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['valid']); print(d['problems']); print([ (c['verdict'],c['outcome'][:120]) for c in d['replay']['details']['claims']]); print(d['replay']['status'], d['replay']['details'].get('evidence_strength'))"
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/chk.json 2>&1; python3 -c "
import json; d=json.load(open('/tmp/chk.json'))
print(d['valid']); print(d['problems'])
for c in d['replay']['details']['claims']: print(json.dumps(c)[:900]); print()
"; grep -n "isError\|was not in\|expected_returncode" <guest-path> | head -30
cd <guest-path> && python3 - <<'EOF'
import json
c=json.load(open('claims.json'))
json.dump([c[0]],open('claims.json','w'),indent=1)
ex=[{"kind":"example","claim":"Calls to tools outside the sanitized set are blocked","source":"README.md","input":"tools/call git_delete_everything sent without tools/list","expected":"synthetic block message from kevlar","argv":["<guest-path>","<guest-path>","--mode","strict","--","uvx","mcp-server-git"],"stdin":"{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"t\",\"version\":\"1\"}}}\n{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}\n{\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"tools/call\",\"params\":{\"name\":\"git_delete_everything\",\"arguments\":{}}}\n","cwd":"<guest-path>","expected_text":"was not in CDR-sanitized set"},
{"kind":"example","claim":"Repository test suite runs (README Tests section)","source":"README.md Tests section","input":"pytest","expected":"149 passed","argv":["<guest-path>","-q"],"cwd":"<guest-path>","expected_text":"149 passed"}]
json.dump(ex,open('examples.json','w'),indent=1)
EOF
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/chk.json 2>&1; python3 -c "
import json; d=json.load(open('/tmp/chk.json'))
print(d.get('valid')); print(d.get('problems'))
r=d.get('replay',{}); print(r.get('status'))
det=r.get('details',{})
for e in det.get('example_checks',[]): print(e['verdict'], e['outcome'][:150])
for c in det.get('claims',[]): print(c['verdict'], c['outcome'][:150])
" ; sed -n 1,5p /tmp/chk.json | cut -c1-300
python3 -c "
import json; d=json.load(open('/tmp/chk.json'))['replay']['details']
print(d.get('evidence_strength'))
for e in d.get('example_checks',[]): print(e.get('verdict'), e.get('returncode'), str(e.get('outcome'))[:120])
for c in d.get('claims',[]): print('claim', c.get('verdict'))
"; pgrep -af "kevlar.py|mcp-server-git|server-filesystem" | grep -v pgrep || echo "no leftover servers"
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"blocked","fault_owner":"repo","operation":"Run Kevlar as a stdio firewall proxy in front of an MCP server and get a real tool result back (README Quickstart / Setup)","operation_scope":"Linux, Python 3.12.3 venv at <guest-path>, Node 22 / npx present. Tested against mcp-server-git via uvx and a local git repo at <guest-path> README's npx filesystem quickstart was also tried.","steps":["python3 -m venv <guest-path> (Python 3.12.3, README requires 3.10+)","cd <guest-path> && <guest-path> install -e \".[dev]\" (README Install / Tests) -> FAILED","<guest-path> install \"pytest>=8.0\"","<guest-path> -q (README Tests) -> 149 passed","python kevlar.py --mode strict -- uvx mcp-server-git (proxy, tools/list and tools/call OK)","python kevlar.py --mode strict -- npx -y @modelcontextprotocol/server-filesystem /tmp (README Quickstart) -> tools/list rejected"],"deviations":["README 'pip install .' / 'pip install -e \".[dev]\"' fails: pyproject.toml sets build-backend 'setuptools.backends.legacy:build', which does not exist (ModuleNotFoundError: setuptools.backends). The 'kevlar' console script was therefore never installed; I ran the same entry point through kevlar.py's own __main__ (main()) with the venv python instead. Source was not edited.","Installed pytest directly (requirements-dev.txt) because the editable install failed.","Filesystem quickstart (kevlar --mode strict -- npx ... server-filesystem /tmp) could not complete: its tools/list response was rejected with 'JSON rejected: nesting depth pre-screen exceeded' (kevlar.py _parse_strict counts all '[' and '{' bytes in the message against 200, not nesting depth), so the proxy returned an internal error.","Strict mode blocks tools/call unless the tool appeared in a prior tools/list response; sending tools/call before tools/list gets 'was not in CDR-sanitized set'. This matches the README, but it means the quickstart requires a handshake order.","Browser/CDP endpoint was checked (GET $CDP_URL/json/version -> HTTP 200) but not used; Kevlar does not need a browser.","No cron/scheduler/webhook entry point exists, so cycles.json has detected:false."],"stuck_step":"pip install -e \".[dev]\" (README Install/Tests): pyproject.toml build-backend 'setuptools.backends.legacy:build' is missing","main_blocker":"The documented install command fails, so the 'kevlar' command is not installed; the README's npx filesystem quickstart also fails because of a 200-bracket pre-screen that rejects valid MCP tools/list responses.","plain_failure":"Installing Kevlar with the README's pip command fails because its packaging config points at a build tool that does not exist. The proxy itself works: its test suite passes (149 tests), and it correctly relays a git server's status and tool list. But the README's filesystem example fails, because the proxy wrongly rejects any server reply with more than about 200 curly or square brackets, even when the nesting is shallow.","suggested_fix":"In pyproject.toml, use a real backend (for example build-backend = \"setuptools.build_meta\"). In kevlar.py _parse_strict, replace the total-bracket count with a real nesting-depth check, or raise the limit so normal tools/list responses pass."}
EOF
python3 -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; ls -la .coldpass; ls <guest-path> | head -30
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import json,sys; d=json.load(sys.stdin); print('valid',d['valid'],'problems',d['problems'],'replay',d['replay']['status'])"