LearningCircuit/local-deep-research

Review signals: 1 connection review, 3 hardcoded secret, 53 known vulnerability. 175 static matches retained as context.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 4 distinct locations. 1 attributed processes.

PID 3426: <guest-path> · ldr-mcp

Gitleaks found a possible hardcoded secret; value withheld. 3 distinct locations. 3 findings.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 53 findings.

172 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• list_strategies returns the research strategies including langgraph-agent: Real input produced the expected result: langgraph-agent

  Source: | `list_strategies` | List research strategies | instant | None |

  Input: {"tool": "list_strategies", "arguments": {}}

  Expected: strategy list includes langgraph-agent

  Command: <guest-path> tools/call {"tool": "list_strategies", "arguments": {}}

  Observed: langgraph-agent\",\n \"label\": \"LangGraph Agent (Autonomous agentic research)\",\n \"description\": \"Agentic research where the LLM autonomously decides what to search, which engines to use, and when to synthesize. Supports all search engines as tools.\"\n }\n ]\n}"}], "structuredContent": {"result": {"status": "success", "strategies": [{"name": "source-based", "label": "Source-Based (Best for small <16,000 context window)", "description": "Comprehensive research with inline citations. Focuses on finding and extracting information from authoritative sources."}, {"name": "focus

• list_search_engines lists available search engines including arxiv: Real input produced the expected result: "name": "arxiv"

  Source: | `list_search_engines` | List available search engines | instant | None |

  Input: {"tool": "list_search_engines", "arguments": {}}

  Expected: engine list includes arxiv

  Command: <guest-path> tools/call {"tool": "list_search_engines", "arguments": {}}

  Observed: "name": "arxiv", "description": "Search papers uploaded to ArXiv.", "strengths": ["scientific papers", "academic research", "physics", "computer science", "mathematics", "statistics", "machine learning", "preprints"], "weaknesses": ["non-academic topics", "consumer products", "news", "general information"], "requires_api_key": false, "is_local": false}, {"name": "brave", "description": "Search the web using the Brave search engine.", "strengths": ["privacy-focused web search", "product information", "reviews", "recent content", "news", "broad coverage"], "weaknesses": ["requires API key with u

Examples

• Benchmark CLI runs a SimpleQA benchmark: Needs a configured LLM provider and search network access; not available in this guest. Installed package and confirmed entry points only (ldr-mcp and ldr-web). Ran the MCP discovery tools instead.

  Source: README.md Benchmarking section

  Expected: documented command completes successfully

  Observed: Needs a configured LLM provider and search network access; not available in this guest. Installed package and confirmed entry points only (ldr-mcp and ldr-web). Ran the MCP discovery tools instead.

• Python API quick_query / LDRClient research: Needs an LLM provider and a logged-in LDR user; not configured in this guest.

  Source: README.md Python API section

  Expected: documented command completes successfully

  Observed: Needs an LLM provider and a logged-in LDR user; not configured in this guest.

Cycles

• Subscriptions refresh on a daily/weekly/custom schedule: Scheduling is an APScheduler background job per logged-in user with an encrypted per-user database; triggering one cycle by hand needs a running web app with a user session, which was not set up in this guest. No cycle was run.

  Source: src/local_deep_research/scheduler/background.py

  Observed: Scheduling is an APScheduler background job per logged-in user with an encrypted per-user database; triggering one cycle by hand needs a running web app with a user session, which was not set up in this guest. No cycle was run.

Local or hosted: both

Install local-deep-research from the pinned source and call its MCP stdio server (ldr-mcp) tools list_strategies and list_search_engines, reading back real results

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat /etc/os-release | head -3 && (git -C . rev-parse HEAD 2>&1 | head -1)
cd <guest-path> && ls -la; test -f README.md && wc -l README.md && sed -n 1,200p README.md
cd <guest-path> && sed -n 200,640p README.md | grep -n -i -E 'install|pip|python|run|\$ |```|cli|--|pytest|test' | head -120; echo ---; grep -n -E 'requires-python|^version' pyproject.toml; cat .nvmrc
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/LearningCircuit/local-deep-research 2>&1; timeout 300 git fetch --depth 1 origin 7c274b6f72355aeef9ef1a51396363414307534f 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git rev-parse HEAD
cd <guest-path> && sed -n 350,400p README.md
cd <guest-path> && sed -n 400,430p README.md; echo ----; ls -la .coldpass; ls <guest-path>; ls /inputs 2>&1
mkdir -p <guest-path> && cd <guest-path> && python3 -m venv <guest-path> 2>&1 | tail -3; <guest-path> -V && cd <guest-path> && timeout 900 <guest-path> install -q ".[mcp]" 2>&1 | tail -15; echo "rc=$?"; ls <guest-path> | grep -i ldr
rm -rf <guest-path>; sudo -n apt-get update -qq 2>&1 | tail -2; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3.12-venv 2>&1 | tail -3; cd <guest-path> && python3 -m venv <guest-path> && <guest-path> -V
cd <guest-path> && timeout 1500 <guest-path> install ".[mcp]" > <guest-path> 2>&1; echo "rc=$?"; tail -5 <guest-path>; ls <guest-path> | grep -i ldr
ls -la <guest-path>; cd <guest-path> && ls docs | head -50; sed -n 1,80p docs/mcp-server.md 2>/dev/null | head -120
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import asyncio, sys, json
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client
async def main():
    tool = sys.argv[1]; args = json.loads(sys.argv[2]) if len(sys.argv) > 2 else {}
    params = StdioServerParameters(command="<guest-path>", args=[], cwd="<guest-path>")
    async with stdio_client(params) as (r, w):
        async with ClientSession(r, w) as s:
            await s.initialize()
            if tool == "--list":
                print([t.name for t in (await s.list_tools()).tools]); return
            res = await s.call_tool(tool, args)
            for c in res.content:
                print(getattr(c, "text", c))
asyncio.run(main())
EOF
cd <guest-path> && timeout 300 <guest-path> -I <guest-path> --list 2>&1 | tail -5; timeout 300 <guest-path> -I <guest-path> list_strategies '{}' 2>&1 | tail -20
cd <guest-path> && timeout 300 <guest-path> -I <guest-path> search '{"query":"quantum error correction","engine":"wikipedia"}' 2>&1 | grep -v -E 'INFO|loader' | head -40; echo ---; timeout 200 <guest-path> -I <guest-path> list_search_engines '{}' 2>&1 | grep -v -E 'INFO|loader' | head -20
cd <guest-path> && grep -rn -i -E 'cron|--once|--now|schedul' README.md | head; echo ---; grep -rln -E 'APScheduler|BackgroundScheduler|add_job' src | head; echo ---; grep -n 'list_strategies' README.md; grep -n 'pip install "local-deep-research\[mcp\]"' README.md
cd <guest-path> && wc -l src/local_deep_research/scheduler/background.py && grep -n -E 'def |add_job|interval|cron|IntervalTrigger|CronTrigger' src/local_deep_research/scheduler/background.py | head -60
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>"],"cwd":"<guest-path>","tool":"list_strategies","arguments":{},"expected_text":"langgraph-agent"}
EOF
cat > claims.json <<'EOF'
[
 {"kind":"claim","claim":"list_strategies returns the research strategies including langgraph-agent","source":"| `list_strategies` | List research strategies | instant | None |","input":"list_strategies with no arguments","expected":"strategy list includes langgraph-agent","probe_kind":"mcp","argv":["<guest-path>"],"tool":"list_strategies","arguments":{},"expected_text":"langgraph-agent","cwd":"<guest-path>"},
 {"kind":"claim","claim":"list_search_engines lists available search engines including arxiv","source":"| `list_search_engines` | List available search engines | instant | None |","input":"list_search_engines with no arguments","expected":"engine list includes arxiv","probe_kind":"mcp","argv":["<guest-path>"],"tool":"list_search_engines","arguments":{},"expected_text":"\"name\": \"arxiv\"","cwd":"<guest-path>"}
]
EOF
cat > examples.json <<'EOF'
[
 {"kind":"example","claim":"Benchmark CLI runs a SimpleQA benchmark","source":"README.md Benchmarking section","reason":"Needs a configured LLM provider and search network access; not available in this guest. Installed package and confirmed entry points only (ldr-mcp and ldr-web). Ran the MCP discovery tools instead."},
 {"kind":"example","claim":"Python API quick_query / LDRClient research","source":"README.md Python API section","reason":"Needs an LLM provider and a logged-in LDR user; not configured in this guest."}
]
EOF
cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Subscriptions refresh on a daily/weekly/custom schedule","source":"src/local_deep_research/scheduler/background.py","quote":"self.scheduler.add_job(","reason":"Scheduling is an APScheduler background job per logged-in user with an encrypted per-user database; triggering one cycle by hand needs a running web app with a user session, which was not set up in this guest. No cycle was run."}]}
EOF
for f in probe.json claims.json examples.json cycles.json; do <guest-path> -I -c "import json,sys;json.load(open(sys.argv[1]));print('ok',sys.argv[1])" $f; done; cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
pgrep -fa 'ldr-mcp|ldr-web|local_deep_research' || echo "no leftover servers"; cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install local-deep-research from the pinned source and call its MCP stdio server (ldr-mcp) tools list_strategies and list_search_engines, reading back real results","operation_scope":"Linux Ubuntu 24.04, Python 3.12.3, venv at <guest-path> Covers install and the MCP discovery tools only. Not covered: LLM-backed research (quick_research etc.), live search engine results (Wikipedia was rate-limited, returned 0 results), the web UI, and the subscription scheduler, which need an LLM provider and a logged-in user.","steps":["git init; git remote add origin https://github.com/LearningCircuit/local-deep-research; git fetch --depth 1 origin 7c274b6f72355aeef9ef1a51396363414307534f; git reset --mixed FETCH_HEAD","sudo apt-get install -y python3.12-venv (needed for python3 -m venv)","python3 -m venv <guest-path>","<guest-path> install \".[mcp]\" (run in the checkout; README documents: pip install \"local-deep-research[mcp]\")","<guest-path> (stdio MCP server); tools/call list_strategies and list_search_engines via an MCP stdio client"],"deviations":["README installs from PyPI; this run installed the pinned source checkout with pip install \".[mcp]\" so the tested code matches the pinned commit.","python3 -m venv failed at first (ensurepip missing); fixed by installing python3.12-venv with sudo apt-get.","The checker path in the task was /inputs/coldpass-preflight.py, which does not exist in this guest; ran <guest-path> instead.","Examples (benchmark CLI, Python API) and the cycle check were not run: they need an LLM provider and a logged-in user. Recorded as blocked with reasons.","Used absolute venv path <guest-path> instead of bare ldr-mcp because the venv was not activated."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None for the tested path. To test research end-to-end, configure an LLM provider (for example Ollama) and a search engine, then rerun the research tools."}
EOF
<guest-path> -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read().strip().splitlines()[-1]); print('valid=',d['valid'],'problems=',d['problems'],'replay=',d['replay']['status'])"