Nutlope/inspo

Review signals: 66 known vulnerability.

OSV reports a known vulnerability in this dependency version. 18 distinct locations. 64 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• recommend(brief) composes most tools into one call: Real input produced the expected result: Picked Split Studio

  Source: `recommend(brief)` composes most of them into one call.

  Input: {"tool": "recommend", "arguments": {"brief": "calm meditation app"}}

  Expected: a moodboard pick for the brief

  Command: npx -y inspo-mcp tools/call {"tool": "recommend", "arguments": {"brief": "calm meditation app"}}

  Observed: Picked Split Studio - most common macrostructure (4 of the top hits) among the hybrid-search results for the brief. The shortlist carries the runners-up with their exemplar counts; take one of those instead if it fits the brief better.\"\n },\n \"shortlist\": [\n {\n \"slug\": \"split-studio\",\n \"label\": \"Split Studio\",\n \"hits\": 4,\n \"exemplars\": 5\n },\n {\n \"slug\": \"feature-stack\",\n \"label\": \"Feature Stack\",\n \"hits\": 3,\n \"exemplars\": 8\n },\n {\n \"slug\": \"specimen\",\n \"label\": \"Specimen\",\n \"hits\": 2,\n \"exemplars\": 2\n }\n ]

• hybrid lexical and vector search over the archive: Real input produced the expected result: basicagency-com--about

  Source: Hybrid lexical + vector search across the archive

  Input: {"tool": "search_screens", "arguments": {"query": "dark editorial agency", "limit": 3}}

  Expected: matching real sites returned

  Command: npx -y inspo-mcp tools/call {"tool": "search_screens", "arguments": {"query": "dark editorial agency", "limit": 3}}

  Observed: basicagency-com--about\",\n \"title\": \"Basicagency · About\",\n \"northstar\": \"Soft, muted earth tones whisper across a spacious layout, anchored by a relaxed, humanist sans-serif.\",\n \"autopsy\": \"FOLD: Nav top-left: logo \\\"BASIC/DEPT.\\\" plus WORK, ABOUT (active/underlined), NEWS, THINKING, CAREERS, CONTACT; far right \\\"...\\\" menu. Hero split ~50/50: left, stacked headline \\\"WE TURN / CULTURAL / VALUE\\\" in pink; right, pink circle bullet + \\\"INTO / COMPANY / VALUE\\\" plus body copy below. No CTA button. Visual is typographic only - no photo. Balance: heavy left, li

Examples

• Dev loop: run the MCP test suite: command completed successfully

  Source: README.md - Cloning & running step 5

  Input: pnpm --filter @inspo/mcp test

  Expected: 17 checks pass, 0 fail

  Command: pnpm --filter @inspo/mcp test

  Observed: es({}) ✓ count=25 • get_site_pages({"siteSlug":"linear-app"}) ✓ siteSlug,title,sourceUrl,pageCount • search_screens({"query":"dark editorial agency","limit":12,"maxTokens":700}) ✓ count=12 • search_screens({"query":"dark editorial agency","limit":3,"maxTokens":100000}) ✓ count=3 • recommend({"brief":"calm meditation app","maxTokens":900}) ✓ brief,filters,pick,shortlist • get_screen({"slug":"missing-slug"}) ✓ error=No screen with slug 'missing-slug'. • find_examples_for_macrostructure({"name":"not-a-real-thing"}) ✓ error=Unknown macrostructure 'not-a-real-thing'. 17 pass · 0 fail

• One-command installer shows its plan without writing config: command completed successfully

  Source: README.md - Cloning & running step 1 (apps/mcp/README.md install section)

  Input: install --dry-run

  Expected: reports no MCP client on this machine and writes nothing

  Command: npx -y inspo-mcp install --dry-run

  Observed: inspo-mcp v0.1.16 hosted endpoint · https://inspomcp.dev/api/mcp No MCP client detected on this machine. Looked for: Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop and Zed. Add it by hand with either url: https://inspomcp.dev/api/mcp command: npx -y inspo-mcp or force one with --client <id>. Full setup: https://inspomcp.dev/mcp

Local or hosted: local

Run the Inspo MCP server over stdio via the README's zero-config npx route and call its search_screens and recommend tools; also start the README gallery (pnpm dev) and fetch pages.

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; test -f README.md && cat README.md
cd <guest-path> && cat package.json; cat pnpm-workspace.yaml; ls apps packages; cat apps/mcp/README.md | head -150; ls apps/mcp; cat apps/mcp/package.json; node --version 2>&1; npm --version 2>&1; pnpm --version 2>&1; which npx corepack 2>&1
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/Nutlope/inspo.git 2>&1; timeout 120 git fetch --depth 1 origin 0e1e6363f980eb303a75428bcf3de4969c69a7df 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1 2>&1; git status --short | head; env | grep -i proxy; apt-cache policy nodejs 2>&1 | head -4
sudo -n true && echo SUDO_OK; (sudo apt-get update -qq 2>&1 | tail -2); apt-cache policy nodejs npm 2>&1 | head -8; curl -sI https://nodejs.org/dist/index.json 2>&1 | head -1
set -e; mkdir -p <guest-path> && cd <guest-path> && curl -fsSL -o node.tar.xz https://nodejs.org/dist/v22.11.0/node-v22.11.0-linux-x64.tar.xz && tar -xJf node.tar.xz && export PATH=<guest-path> && node --version && npm --version && npm install -g <email> ><guest-path> 2>&1; pnpm --version; echo "PATH add: <guest-path>"
export PATH=<guest-path>; cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 pnpm install --frozen-lockfile > <guest-path> 2>&1; echo rc=$?; tail -15 <guest-path>
export PATH=<guest-path>; cd <guest-path> && timeout 600 pnpm --filter @inspo/mcp test > <guest-path> 2>&1; echo rc=$?; tail -25 <guest-path>; cat apps/mcp/bin/inspo-mcp.js | head -40
export PATH=<guest-path>; cd <guest-path> && ls <guest-path> 2>&1; ls /inputs 2>&1; cat > <guest-path> <<'EOF'
import { Client } from "<guest-path>";
import { StdioClientTransport } from "<guest-path>";
const [tool, args] = [process.argv[2], JSON.parse(process.argv[3] || "{}")];
const t = new StdioClientTransport({ command: "<guest-path>", args: ["<guest-path>"], cwd: "<guest-path>" });
const c = new Client({ name: "probe", version: "0" });
await c.connect(t);
const r = await c.callTool({ name: tool, arguments: args });
console.log(JSON.stringify(r).slice(0, 1500));
await c.close();
EOF
timeout 120 node <guest-path> search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 2000; echo; echo rc=$?
cd <guest-path> && for v in 20.18.0 24.0.0; do d=node-v$v-linux-x64; curl -fsSL -o $d.tar.xz https://nodejs.org/dist/v$v/$d.tar.xz && tar -xJf $d.tar.xz && echo got $v; done; for v in 20.18.0 24.0.0; do N=<guest-path>; echo "== $v"; timeout 120 $N <guest-path> search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 600; echo; done
cd <guest-path> && sed -i 's#command: "<guest-path>"#command: process.execPath#' call.mjs && for v in 20.18.0 22.11.0 24.0.0; do N=<guest-path>; [ $v = 22.11.0 ] && N=<guest-path>; echo "== $v"; timeout 120 $N call.mjs search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 700; echo; done
cd <guest-path> && N=<guest-path>; sed 's#args: \["<guest-path>"\]#args: (process.env.SRV_ARGS ? JSON.parse(process.env.SRV_ARGS) : ["<guest-path>"])#' call.mjs > call2.mjs; echo "== tsx start script"; SRV_ARGS='["<guest-path>","src/server.ts"]' timeout 120 $N call2.mjs search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 800; echo; echo "== --import tsx/esm"; SRV_ARGS='["--import","tsx/esm","<guest-path>"]' timeout 120 $N call2.mjs search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 800
cd <guest-path> && N=<guest-path>; sed -i 's#cwd: "<guest-path>" }#cwd: process.env.SRV_CWD || "<guest-path>" }#' call2.mjs; ls <guest-path> | head; echo "== tsx cli"; SRV_CWD=<guest-path> SRV_ARGS='["<guest-path>","src/server.ts"]' timeout 120 $N call2.mjs search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 900; echo; echo "== --import"; SRV_CWD=<guest-path> SRV_ARGS='["--import","tsx/esm","<guest-path>"]' timeout 120 $N call2.mjs search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 900
export PATH=<guest-path>; mkdir -p <guest-path> && cd <guest-path> && timeout 300 npx -y inspo-mcp --version 2>&1 | tail -5; echo rc=$?; npm view inspo-mcp version 2>&1 | tail -2
export PATH=<guest-path>; cd <guest-path> && sed 's#command: process.execPath#command: process.env.SRV_CMD || process.execPath#' call2.mjs > call3.mjs && cd <guest-path> && SRV_CMD=npx SRV_CWD=<guest-path> SRV_ARGS='["-y","inspo-mcp"]' timeout 300 node <guest-path> search_screens '{"query":"dark editorial agency","limit":3}' 2>&1 | head -c 1200; echo; echo rc=$?
export PATH=<guest-path>; cd <guest-path> && timeout 300 npx -y inspo-mcp install --dry-run 2>&1 | head -30; echo rc=$?; echo ---; cd <guest-path> && grep -rniE "cron|setInterval|schedule|--once|--now|webhook" --include=*.ts --include=*.tsx --include=*.mjs --include=*.json --include=*.md --include=*.yml --exclude-dir=node_modules . | grep -v pnpm-lock | head -30; ls apps/worker apps/cli 2>&1 | head -30
export PATH=<guest-path>; cd <guest-path> && timeout 300 npx -y inspo-mcp install --dry-run > <guest-path> 2>&1; echo rc=$?; wc -c <guest-path>; head -c 1500 <guest-path>; echo; echo ---; cd <guest-path> && grep -rliE "cron|setInterval|--once|--now|webhook" --include=*.ts --include=*.tsx --include=*.mjs --include=*.js --include=*.md --include=*.yml --exclude-dir=node_modules . | head -30; ls apps/worker apps/cli 2>&1 | head -30
cd <guest-path> && grep -niE "cron|setInterval|--once|--now|webhook" apps/worker/src/curate.ts apps/worker/src/seed-urls.ts apps/worker/README.md | head -12; echo ---; head -c 1500 apps/cli/README.md; echo; echo ---; head -c 600 apps/cli/package.json
cd <guest-path> && sed -n 285,315p apps/worker/src/curate.ts; echo ---; grep -n "DATABASE\|TOGETHER\|process.env" apps/worker/src/curate.ts | head; echo ---; grep -n "curate" apps/worker/README.md apps/worker/package.json | head
export PATH=<guest-path>; cd <guest-path> && cat apps/web/package.json | head -20; ls -la apps/web | head -20; grep -n "DATABASE\|NEON\|process.env" -r apps/web/src --include=*.ts --include=*.tsx | head -8; (nohup env NODE_USE_ENV_PROXY=1 pnpm dev > <guest-path> 2>&1 &) ; sleep 60; tail -20 <guest-path>; curl -s -o /dev/null -w "%{http_code}\n" --max-time 30 http://localhost:3000/
pkill -f "turbo run dev" ; pkill -f "next dev"; pkill -f "next-server"; sleep 3; (ss -ltnp 2>/dev/null | grep -E ":3000 " || echo "port 3000 free"); export PATH=<guest-path>; cd <guest-path> && (nohup env NODE_USE_ENV_PROXY=1 NEXT_TELEMETRY_DISABLED=1 pnpm dev > <guest-path> 2>&1 &); sleep 45; curl -s --max-time 60 http://localhost:3000/ | sed -e 's/<[^>]*>/ /g' | tr -s ' \n' | head -c 800; echo; echo; curl -s --max-time 60 http://localhost:3000/screens/basicagency-com--about -o /dev/null -w "screen:%{http_code}\n"; grep -i telemetry <guest-path> | head -3
pkill -f "[t]urbo run dev"; pkill -f "[n]ext dev"; pkill -f "[n]ext-server"; sleep 3; (ss -ltnp 2>/dev/null | grep -E ":3000 " || echo "port 3000 free")
export PATH=<guest-path>; cd <guest-path> && (nohup env NODE_USE_ENV_PROXY=1 NEXT_TELEMETRY_DISABLED=1 pnpm dev > <guest-path> 2>&1 &); sleep 45; curl -s --max-time 60 http://localhost:3000/ | sed -e 's/<[^>]*>/ /g' | tr -s ' \n' | head -c 800; echo; echo; curl -s --max-time 60 http://localhost:3000/screens/basicagency-com--about -o /dev/null -w "screen:%{http_code}\n"; tail -5 <guest-path>
pkill -f "[t]urbo run dev"; pkill -f "[n]ext dev"; pkill -f "[n]ext-server"; sleep 3; (ss -ltnp 2>/dev/null | grep -E ":3000 " || echo "port 3000 free"); export PATH=<guest-path>; cd <guest-path> && SRV_CMD=npx SRV_CWD=<guest-path> SRV_ARGS='["-y","inspo-mcp"]' timeout 300 node <guest-path> recommend '{"brief":"calm meditation app"}' > <guest-path> 2>&1; echo rc=$?; python3 -I -c 'import json,sys; t=open("<guest-path>").read(); d=json.loads(t); s=d["content"][0]["text"]; print(s[:1500])' 2>&1 | head -60
export PATH=<guest-path>; cd <guest-path> && sed -i 's#console.log(JSON.stringify(r).slice(0, 1500));#console.log(r.content.map(x=>x.text).join("\\n"));#' call3.mjs && cd <guest-path> && SRV_CMD=npx SRV_CWD=<guest-path> SRV_ARGS='["-y","inspo-mcp"]' timeout 300 node <guest-path> recommend '{"brief":"calm meditation app"}' > <guest-path> 2>&1; echo rc=$?; head -c 1200 <guest-path>; echo; grep -o '"slug": "[^"]*"' <guest-path> | head -5; grep -o '"brief": "[^"]*"' <guest-path>
cd <guest-path> && mkdir -p .coldpass && NODEPATH=<guest-path> && cat > .coldpass/probe.json <<EOF
{"kind":"mcp","argv":["npx","-y","inspo-mcp"],"cwd":"<guest-path>","env":{"PATH":"$NODEPATH"},"tool":"search_screens","arguments":{"query":"dark editorial agency","limit":3},"expected_text":"basicagency-com--about"}
EOF
cat > .coldpass/claims.json <<EOF
[
{"kind":"claim","claim":"recommend(brief) composes most tools into one call","source":"\`recommend(brief)\` composes most of them into one call.","input":"calm meditation app","expected":"a moodboard pick for the brief","probe_kind":"mcp","argv":["npx","-y","inspo-mcp"],"env":{"PATH":"$NODEPATH"},"tool":"recommend","arguments":{"brief":"calm meditation app"},"expected_text":"Picked Split Studio","cwd":"<guest-path>"},
{"kind":"claim","claim":"hybrid lexical and vector search over the archive","source":"Hybrid lexical + vector search across the archive","input":"dark editorial agency","expected":"matching real sites returned","probe_kind":"mcp","argv":["npx","-y","inspo-mcp"],"env":{"PATH":"$NODEPATH"},"tool":"search_screens","arguments":{"query":"dark editorial agency","limit":3},"expected_text":"basicagency-com--about","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<EOF
[
{"kind":"example","claim":"Dev loop: run the MCP test suite","source":"README.md - Cloning & running step 5","input":"pnpm --filter @inspo/mcp test","expected":"17 checks pass, 0 fail","argv":["pnpm","--filter","@inspo/mcp","test"],"cwd":"<guest-path>","env":{"PATH":"<guest-path>"},"expected_text":"17 pass"},
{"kind":"example","claim":"One-command installer shows its plan without writing config","source":"README.md - Cloning & running step 1 (apps/mcp/README.md install section)","input":"install --dry-run","expected":"reports no MCP client on this machine and writes nothing","argv":["npx","-y","inspo-mcp","install","--dry-run"],"cwd":"<guest-path>","env":{"PATH":"$NODEPATH"},"expected_text":"No MCP client detected"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md, apps/mcp/README.md, apps/mcp/package.json, apps/web/package.json, apps/worker/package.json, apps/cli/package.json. No cron, scheduler, --once/--now, loop or webhook is documented as a product cycle. The only setInterval in source is a browser-side lazy-load helper emitted into a generated page (apps/worker/src/curate.ts:309), not a product schedule. The MCP server runs only when a client launches it (stdio) or on demand (hosted HTTP).","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done; cat .coldpass/probe.json
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo rc=${PIPESTATUS[0]}
cd <guest-path> && python3 -I - <<'EOF'
import json
p="<guest-path>"
c=json.load(open(p))
c[1]["source_file"]="apps/mcp/README.md"
json.dump(c,open(p,"w"),indent=1,ensure_ascii=False)
print("ok")
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo rc=${PIPESTATUS[0]}
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; wc -c <guest-path>; python3 -I -c '
import json,re
t=open("<guest-path>").read()
print(t[:600])
' ; echo ...; grep -o '"valid": *[a-z]*' <guest-path> | head -3; grep -o '"problems": \[[^]]*\]' <guest-path> | head -c 1500
cd <guest-path> && python3 -I -c '
import json
t=open("<guest-path>").read()
d=json.loads(t)
def walk(o,p=""):
    if isinstance(o,dict):
        if "status" in o: print(p, o.get("status"), o.get("kind",""), (o.get("details") or {}).get("working") if isinstance(o.get("details"),dict) else "")
        for k,v in o.items(): walk(v,p+"/"+str(k))
    elif isinstance(o,list):
        for i,v in enumerate(o): walk(v,p+"["+str(i)+"]")
walk(d)
print(list(d.keys()))
print(d["replay"].keys())
'; ss -ltnp | grep -E ":3000 " || echo "no server on 3000"; pgrep -fa "[i]nspo-mcp|[n]ext dev" | head -3 || true
cd <guest-path> && python3 -I -c '
import json
d=json.load(open("<guest-path>"))
r=d["replay"]
print("evidence_strength:", r.get("evidence_strength"))
for k in ["claims","cycle_checks","example_checks"]:
    v=r.get(k)
    print("==",k, type(v).__name__, len(v) if v is not None else None)
    if isinstance(v,list):
        for x in v: print({kk:(str(vv)[:160]) for kk,vv in x.items() if kk in ("status","working","claim","tool","kind","problem","reason","expected_text","ok")} if isinstance(x,dict) else str(x)[:200])
    elif isinstance(v,dict): print(str(v)[:600])
'
cd <guest-path> && python3 -I -c '
import json
d=json.load(open("<guest-path>"))
r=d["replay"]
for k in ["claims","cycle_checks","example_checks"]:
    for x in r[k]:
        print(k, {kk:(str(vv)[:90]) for kk,vv in x.items()})
        print()
'
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the Inspo MCP server over stdio via the README's zero-config npx route and call its search_screens and recommend tools; also start the README gallery (pnpm dev) and fetch pages.","operation_scope":"Ubuntu 24.04 guest, pinned commit 0e1e6363f980eb303a75428bcf3de4969c69a7df. Node 22.11.0 (repo needs >=20) and pnpm 9.15.0 (packageManager pin) installed user-local under <guest-path> Read-only catalogue served from the bundled/CDN seed; no TOGETHER_API_KEY, so search is lexical-only. Gallery run without DATABASE_URL (demo fixtures) with telemetry disabled.","steps":["git init; git remote add origin https://github.com/Nutlope/inspo.git; git fetch --depth 1 origin 0e1e6363f980eb303a75428bcf3de4969c69a7df; git reset --mixed FETCH_HEAD","Installed Node 22.11.0 from nodejs.org tarball (apt only offers Node 18) and <email> via npm -g","pnpm install --frozen-lockfile (README step 3 clone install)","pnpm --filter @inspo/mcp test (README step 5 dev loop): 17 pass, 0 fail","npx -y inspo-mcp --version -> 0.1.16; npx -y inspo-mcp install --dry-run (README install step 1): no client detected, writes nothing","npx -y inspo-mcp with MCP tools/call search_screens {query:'dark editorial agency'} -> returns basicagency-com--about among 3 results (probe)","npx -y inspo-mcp recommend {brief:'calm meditation app'} -> pick Split Studio","pnpm dev (README step 4 gallery) -> http://localhost:3000 returns 200 for / and /screens/basicagency-com--about; server stopped afterwards"],"deviations":["Local clone path from README ('Local (stdio, from a clone)': node apps/mcp/bin/inspo-mcp.js) fails: the shim calls module.register('tsx/esm') and tsx 4.21.0 (lockfile) rejects it with 'tsx must be loaded with --import instead of --loader'. Same failure on Node 20.18, 22.11 and 24.0. Substitute used for clone verification: apps/mcp/node_modules/tsx/dist/cli.mjs src/server.ts (the package's own start script target), which served search_screens correctly. Probe uses the published npx route instead, which works.","Sudo apt nodejs is 18.19 (too old for engines >=20); installed Node 22.11.0 from nodejs.org instead.","First gallery start ran with Next telemetry on; stopped and restarted with NEXT_TELEMETRY_DISABLED=1.","Accidental pkill -f matched my own shell once; no effect on the repo.","Gallery DATABASE_URL not set; admin/curator shows demo fixtures; no DB/Together key used."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Repo: fix apps/mcp/bin/inspo-mcp.js so it works with tsx 4.21 (e.g. spawn node --import tsx/esm, or use tsx's CLI as the package start script does) or pin a tsx version where module.register('tsx/esm') still works; until then the clone-based stdio route in apps/mcp/README.md is broken. Otherwise no fix needed for the npx route."}
EOF
python3 -I -m json.tool .coldpass/report.json > /dev/null && echo report ok; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; head -c 300 <guest-path>; echo; ss -ltnp | grep -E ":3000 " || echo "no port 3000 listener"