JoaquimCassano/mcp-movingimagearchive

Review signals: 1 connection review.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 216.150.16.1:443 10 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• search_clips returns semantic shot matches for a visual description: Real input produced the expected result: National Wildlife Refuge System

  Source: Semantic shot search by visual description, with color / aspect ratio / year filters.

  Input: {"tool": "search_clips", "arguments": {"query": "red sunset over water", "limit": 2}}

  Expected: top match is from National Wildlife Refuge System

  Command: node <guest-path> tools/call {"tool": "search_clips", "arguments": {"query": "red sunset over water", "limit": 2}}

  Observed: National Wildlife Refuge System\",\"year\":2005,\"durationSeconds\":5.07,\"colorMode\":\"color\",\"aspectRatio\":\"4:3\",\"score\":0.278987,\"pageUrl\":\"https://www.movingimagearchive.com/sources/national-wildlife-refuge-system-8405e0d1?clip=02203def-0487-59fd-b6a1-f0fc6e0bfaa0\",\"sourceDownloadUrl\":\"https://www.movingimagearchive.com/api/sources/national-wildlife-refuge-system-8405e0d1/download\",\"thumbnailUrl\":\"https://pub-075ff01374c04555b51c9bc50f258b42.r2.dev/sources/8405e0d1-5631-51a2-b669-29016c141011/v4-conditional-luna-1/thumbnails/02203def-0487-59fd-b6a1-f0fc6e0bfaa0.jpg\"},{\

• every shot result includes a shot MP4 download link: Real input produced the expected result: https://www.movingimagearchive.com/api/clips/02203def-0487-59fd-b6a1-f0fc6e0bfaa0/download

  Source: Every shot result includes `clipDownloadUrl` (the shot MP4) and `sourceDownloadUrl` (the full film).

  Input: {"tool": "search_clips", "arguments": {"query": "red sunset over water", "limit": 2}}

  Expected: clipDownloadUrl for the first shot is returned

  Command: node <guest-path> tools/call {"tool": "search_clips", "arguments": {"query": "red sunset over water", "limit": 2}}

  Observed: https://www.movingimagearchive.com/api/clips/02203def-0487-59fd-b6a1-f0fc6e0bfaa0/download\",\"sourceSlug\":\"national-wildlife-refuge-system-8405e0d1\",\"sourceTitle\":\"National Wildlife Refuge System\",\"year\":2005,\"durationSeconds\":5.07,\"colorMode\":\"color\",\"aspectRatio\":\"4:3\",\"score\":0.278987,\"pageUrl\":\"https://www.movingimagearchive.com/sources/national-wildlife-refuge-system-8405e0d1?clip=02203def-0487-59fd-b6a1-f0fc6e0bfaa0\",\"sourceDownloadUrl\":\"https://www.movingimagearchive.com/api/sources/national-wildlife-refuge-system-8405e0d1/download\",\"thumbnailUrl\":\"https

Examples

• offline parser checks run via pnpm test: command completed successfully

  Source: README.md Setup section, pnpm test # offline parser checks

  Input: pnpm test

  Expected: 4 offline tests pass

  Command: pnpm test

  Observed: Slug accepts slugs and page URLs --- duration_ms: 0.168668 type: 'test' ... # Subtest: toSlug rejects anything that could escape a URL path or file name ok 3 - toSlug rejects anything that could escape a URL path or file name --- duration_ms: 0.204876 type: 'test' ... # Subtest: shotRange spans first start to last end, in either order ok 4 - shotRange spans first start to last end, in either order --- duration_ms: 0.180751 type: 'test' ... 1..4 # tests 4 # suites 0 # pass 4 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 197.043679 $ node --test test/*.test.ts

Local or hosted: local

Build the MCP server and call its search_clips tool over stdio to find shots matching a visual description, returning clip and full-film download links

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
echo $CDP_URL; curl -s -m 10 -i $CDP_URL/json/version; echo; echo EXIT=$?
cd <guest-path> && cat package.json; ls -la .coldpass src test; which node npm pnpm corepack ffmpeg; node -v; npm -v; cat .gitignore
cd <guest-path> && pnpm -v && pnpm install 2>&1 | tail -20 && pnpm build 2>&1 | tail -20; echo EXIT=$?; ls dist 2>&1
cd <guest-path> && pnpm test 2>&1 | tail -25; echo EXIT=$?; curl -s -o /dev/null -m 20 -w "%{http_code}\n" https://www.movingimagearchive.com/api/sources?limit=2 ; curl -s -m 20 -X POST https://www.movingimagearchive.com/api/search -H 'content-type: application/json' -d '{"query":"train","color":"all","aspectRatio":"all","offset":0}' | head -c 300; echo
cd <guest-path> && cat src/index.ts | head -c 7000
cd <guest-path> && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"search_clips","arguments":{"query":"red sunset over water","limit":2}}}'; sleep 8; } | timeout 30 node dist/index.js 2>&1 | tail -c 2500
cd <guest-path> && mkdir -p .coldpass && grep -rniE "setInterval|cron|schedule|--once|--now|webhook|setTimeout" src README.md package.json | head; echo "---"; cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","<guest-path>"],"cwd":"<guest-path>","tool":"search_clips","arguments":{"query":"red sunset over water","limit":2},"expected_text":"National Wildlife Refuge System"}
EOF
python3 -I -c "import json;json.load(open('<guest-path>'));print('ok')"
cd <guest-path> && cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"search_clips returns semantic shot matches for a visual description","source":"Semantic shot search by visual description, with color / aspect ratio / year filters.","input":"query: red sunset over water, limit 2","expected":"top match is from National Wildlife Refuge System","probe_kind":"mcp","argv":["node","<guest-path>"],"tool":"search_clips","arguments":{"query":"red sunset over water","limit":2},"expected_text":"National Wildlife Refuge System","cwd":"<guest-path>"},
{"kind":"claim","claim":"every shot result includes a shot MP4 download link","source":"Every shot result includes `clipDownloadUrl` (the shot MP4) and `sourceDownloadUrl` (the full film).","input":"query: red sunset over water, limit 2","expected":"clipDownloadUrl for the first shot is returned","probe_kind":"mcp","argv":["node","<guest-path>"],"tool":"search_clips","arguments":{"query":"red sunset over water","limit":2},"expected_text":"https://www.movingimagearchive.com/api/clips/02203def-0487-59fd-b6a1-f0fc6e0bfaa0/download","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"offline parser checks run via pnpm test","source":"README.md Setup section, pnpm test   # offline parser checks","input":"pnpm test","expected":"4 offline tests pass","argv":["pnpm","test"],"cwd":"<guest-path>","env":{},"expected_text":"# pass 4"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (src/index.ts, src/archive.ts, src/download.ts, package.json scripts, README). The product is an on-demand stdio MCP server that answers tool calls; grep for setInterval/cron/schedule/--once/--now/webhook/setTimeout found nothing. No scheduled or looping cycle exists.","checks":[]}
EOF
for f in claims examples cycles probe; do python3 -I -c "import json,sys;json.load(open('.coldpass/$f.json'));print('$f ok')"; done
cd <guest-path> && <env-var>=<guest-path> timeout 600 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 5000; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && <env-var>=<guest-path> timeout 600 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo EXIT=$?; grep -oE '"(valid|ok|passed)": ?(true|false)' <guest-path> | sort | uniq -c; grep -oE '"verdict": ?"[a-z]+"' <guest-path> | sort | uniq -c
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Build the MCP server and call its search_clips tool over stdio to find shots matching a visual description, returning clip and full-film download links","operation_scope":"Node >= 20 (guest has Node v22.23.4, pnpm 12.15.0); live network access to movingimagearchive.com required for search; ffmpeg not required for search (only for range downloads, not exercised)","steps":["pnpm install","pnpm build","pnpm test","node <guest-path> (stdio MCP server, tools/call search_clips with query 'red sunset over water')"],"deviations":["Workspace was not a git repository and no pinned-commit fetch was needed since the source snapshot was already present; no Git metadata was created.","Probe and claim argv use the absolute path of dist/index.js, as the README's MCP config example does.","Did not exercise the download tool (would write MP4 files) or get_source/list_sources/get_collection; only search_clips was verified end to end.","No browser was needed; the CDP endpoint (http://<internal-ip>:9226/json/version) returned HTTP 200 with Chrome/155 but was not used by the product.","Scheduling: none exists; cycles.json recorded detected=false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -I -c "import json;d=json.load(open('<guest-path>'));print(d['outcome'])"; ls -la .coldpass; ls <guest-path> | head -20