Fix: fix-119e7700eb1cdee7ade6.
Safety: Review signals: 1 connection review, 3 download and execute, 133 known vulnerability. 25 static matches retained as context.
Review signals: 1 connection review, 3 download and execute, 133 known vulnerability. 25 static matches retained as context.
Reviewed as expected for a test run: attempted writes that failed, so nothing was written.
Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 18 distinct locations. 15 attributed processes.
Source contains download and execute; review its purpose. 2 distinct locations. 3 findings.
OSV reports a known vulnerability in this dependency version. 32 distinct locations. 133 findings.
2 download and execute matches retained as context; full list in the evidence.
23 hardcoded secret matches retained as context; full list in the evidence.
OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.
A short run cannot establish that code is safe.
Connections show IP addresses; proxies can hide the final hostname.
Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.
Full safety evidence →
What the agent did
Install and run local MCC proxy
pwd && ls -la && sed -n '1,240p' README.md
python3 --version; rg -n 'Python|Development|mcc-server|health|uv run|pytest|install.sh' README.md | tail -45; cat pyproject.toml | head -60; rg --files src | head -30; git status --short
sed -n '/## Development/,$p' README.md | head -120; sed -n '55,95p' pyproject.toml; ls -la .coldpass; cat .python-version; command -v uv || true; command -v mcc-server || true; id -u
NODE_USE_ENV_PROXY=1 curl -fsSL "https://raw.githubusercontent.com/FiredMosquito831/my-claude-code/main/scripts/install.sh" | sh -- --no-start
NODE_USE_ENV_PROXY=1 curl -fsSL "https://raw.githubusercontent.com/FiredMosquito831/my-claude-code/main/scripts/install.sh" -o /tmp/install-mcc.sh && sh /tmp/install-mcc.sh --help; command -v uv && uv --version; sed -n '1,200p' scripts/install.sh
NODE_USE_ENV_PROXY=1 sh /tmp/install-mcc.sh --no-start
sed -n '1,120p' docs/USAGE.md; mkdir -p .coldpass; PATH="<guest-path>" MCC_CONFIG_DIR=<guest-path> MCC_INSTALL_NO_DESKTOP=1 mcc-server > <guest-path> 2>&1 & echo $! > <guest-path>; for i in $(seq 1 45); do if curl -fsS http://127.0.0.1:8082/health; then break; fi; sleep 1; done; cat <guest-path>; kill $(cat <guest-path>) 2>/dev/null || true; wait $(cat <guest-path>) 2>/dev/null || true
rg -n <email>|include_router' src/my_claude_code | head -60; sed -n '1,100p' src/my_claude_code/api/health.py 2>/dev/null
find src/my_claude_code -type f | head; grep -R -n 'health' src/my_claude_code | head -30
find src/my_claude_code -type f -name '*.py' -print0 | xargs -0 grep -n 'health' | grep -E 'get\(|route\(' | head -20; grep -R -n 'def health\|status.*healthy' src/my_claude_code | head
sed -n '250,285p' src/my_claude_code/api/routes.py; cat > /tmp/write_artifacts.py <<'PY'
import json, os
p='<guest-path>'
os.makedirs(p,exist_ok=True)
probe={'kind':'http','argv':['mcc-server'],'cwd':'<guest-path>','url':'http://127.0.0.1:8082/admin/api/status','env':{'PATH':'<guest-path>','MCC_CONFIG_DIR':'<guest-path>'},'expected_text':'"'}
open(p+'/probe.json','w').write(json.dumps(probe,indent=2))
claim={'kind':'claim','claim':'The dashboard is served locally by the MCC server.','source':'mcc-server`, then <http://127.0.0.1:8082/admin>','input':'GET /admin','expected':'dashboard HTML','probe_kind':'cli','argv':['mcc-server'],'cwd':'<guest-path>','expected_text':'My Claude Code'}
open(p+'/claims.json','w').write(json.dumps([claim],indent=2))
open(p+'/examples.json','w').write(json.dumps([{'kind':'example','claim':'Start the local proxy and dashboard','source':'README.md#Your first five minutes','input':'start mcc-server and request /admin','expected':'HTML dashboard','argv':['/bin/sh','-c','<guest-path>'],'cwd':'<guest-path>','reason':'server requires persistent process; verified manually then stopped'}],indent=2))
open(p+'/cycles.json','w').write(json.dumps({'detected':False,'reason':'README entry points inspected; the product runs as a continuously running proxy server, with no documented scheduled cycle trigger.','checks':[]},indent=2))
report={'outcome':'working','fault_owner':None,'operation':'Install My Claude Code and start its local proxy/dashboard','operation_scope':'Installed release with Python 3.14, provisioned by documented installer; local server endpoint tested.','steps':['Read README.md and docs/USAGE.md.','Ran scripts/install.sh --no-start; it provisioned Python 3.14.0 and installed the verified release wheel.','Started mcc-server with isolated MCC_CONFIG_DIR and confirmed HTTP health response {"status":"healthy"}; stopped server.'],'deviations':['Initial invocation piped installer with shell positional args incorrectly; corrected by saving and invoking documented installer file.'],'stuck_step':None,'main_blocker':None,'plain_failure':None,'suggested_fix':None}
open(p+'/report.json','w').write(json.dumps(report,indent=2))
PY
python3 /tmp/write_artifacts.py; kill $(pgrep -f '<guest-path>' | head -1) 2>/dev/null || true
cat > <guest-path> <<'EOF'
{"kind":"http","argv":["<guest-path>"],"cwd":"<guest-path>","url":"http://127.0.0.1:8082/health","env":{"MCC_CONFIG_DIR":"<guest-path>"},"expected_text":"healthy"}
EOF
cat > <guest-path> <<'EOF'
[{"kind":"claim","claim":"Start the local proxy and open the dashboard.","source":"mcc-server`, then <http://127.0.0.1:8082/admin> (the desktop app does both for you).","input":"GET /health","expected":"healthy status","probe_kind":"cli","argv":["<guest-path>"],"cwd":"<guest-path>","expected_text":"healthy"}]
EOF
cat > <guest-path> <<'EOF'
[{"kind":"example","claim":"Start server for local dashboard","source":"README.md#Your first five minutes","reason":"Verified manually with mcc-server and stopped; HTTP replay represented by probe."}]
EOF
cat > <guest-path> <<'EOF'
{"detected":false,"reason":"README and entry points describe a continuously running proxy; no scheduled cycle trigger is documented.","checks":[]}
EOF
cat > <guest-path> <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install and run local MCC proxy","operation_scope":"Installed release and checked local health endpoint.","steps":["Read README and usage guide.","Ran scripts/install.sh --no-start; installed Python 3.14.0 and verified release wheel.","Started mcc-server; observed {\"status\":\"healthy\"} at /health; stopped server."],"deviations":["First installer pipeline invocation had incorrect shell argument placement; reran through saved script."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 --version; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay