alexeyban/EKOS

Review signals: 1 download and execute, 11 hardcoded secret, 69 known vulnerability. 12 static matches retained as context.

Reviewed as expected for a test run: wrote only to its own open file handles.

Source contains download and execute; review its purpose. install.sh

Gitleaks found a possible hardcoded secret; value withheld. 3 distinct locations. 11 findings.

OSV reports a known vulnerability in this dependency version. 23 distinct locations. 43 findings.

8 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The read-only MCP server exposes the compiled ledger to agents; searching it returns the compiled objects: Real input produced the expected result: billing.Invoice

  Source: `ekos mcp serve --workspace <dir>` exposes the read-only Runtime as a Model Context Protocol

  Input: {"tool": "ekos_search", "arguments": {"query": "Invoice"}}

  Expected: ekos_search returns the compiled object billing.Invoice

  Command: <guest-path> mcp serve --config /tmp/ekos-sample/ekos.toml --workspace /tmp/ekos-sample tools/call {"tool": "ekos_search", "arguments": {"query": "Invoice"}}

  Observed: billing.Invoice\"\n },\n {\n \"id\": \"2eea1b14-c51c-51ab-9481-0f4a34162010\",\n \"name\": \"src/billing.py\"\n },\n {\n \"id\": \"9f491768-37e8-522d-b904-e1899af11a1b\",\n \"name\": \"apply_discount\"\n },\n {\n \"id\": \"3b4feb46-6ab7-5e0b-9d80-ade7b390a713\",\n \"name\": \"src/orders.py\"\n },\n {\n \"id\": \"7cff1a25-a3b9-5686-b26e-66693d36cc66\",\n \"name\": \"place_order\"\n }\n ]\n}", "type": "text"}], "isError": false}

• ekos query find searches compiled object names from the command line: Real input produced the expected result: billing.Invoice

  Source: `ekos query find "<text>" --mode lexical|vector|hybrid`

  Input: find Invoice (lexical) on the committed sample repo

  Expected: lists billing.Invoice among the matches

  Command: <guest-path> query find Invoice --mode lexical --config /tmp/ekos-sample/ekos.toml

  Observed: billing.Invoice 2eea1b14-c51c-51ab-9481-0f4a34162010 src/billing.py 9f491768-37e8-522d-b904-e1899af11a1b apply_discount 3b4feb46-6ab7-5e0b-9d80-ade7b390a713 src/orders.py 7cff1a25-a3b9-5686-b26e-66693d36cc66 place_order

Examples

• EKL query over the ledger returns rows for a matching kind (View; none in this Python-only sample, so zero rows): command completed successfully

  Source: README.md, Views (RFC 0169) section

  Input: FIND Object WHERE kind = 'View'

  Expected: 0 rows.

  Command: <guest-path> ekl 'FIND Object WHERE kind = '"'"'View'"'"'' --config /tmp/ekos-sample/ekos.toml

  Observed: 0 rows.

• Optional documented test suite of the Rust workspace: command completed successfully

  Source: README.md, Verify the install section

  Input: cargo test --workspace from ekos/

  Expected: test result: ok

  Command: <guest-path> test --workspace

  Observed: ql_dialect_clickhouse Doc-tests ekos_plugin_sql_dialect_databricks Doc-tests ekos_plugin_sql_dialect_mssql Doc-tests ekos_plugin_sql_dialect_mysql Doc-tests ekos_plugin_sql_dialect_oracle Doc-tests ekos_plugin_sql_dialect_postgres Doc-tests ekos_plugin_sql_dialect_snowflake Doc-tests ekos_plugin_sql_dialect_trino Doc-tests ekos_plugin_treasury Doc-tests ekos_recovery Doc-tests ekos_runtime Doc-tests ekos_scheduler Doc-tests ekos_segment_backend Doc-tests ekos_semantic Doc-tests ekos_session Doc-tests ekos_simulation Doc-tests ekos_sql_dialect_sdk

Cycles

• Scheduled runs: the console fires pipeline commands on a cron or interval trigger: Scheduling is a feature of the EKOS web console (FastAPI, APScheduler, SQLite, auth tokens, a required notify_url). Its dependencies were not installed and the console was not started in this run, so no cycle was triggered; the Rust CLI has no cron or --once entry point.

  Source: web/api/app/scheduler.py

  Observed: Scheduling is a feature of the EKOS web console (FastAPI, APScheduler, SQLite, auth tokens, a required notify_url). Its dependencies were not installed and the console was not started in this run, so no cycle was triggered; the Rust CLI has no cron or --once entry point.

Local or hosted: local

ekos mcp serve (stdio) and ekos query find on the committed sample repo; ekos ekl and cargo test --workspace as examples

cd <guest-path> && pwd && ls -la && id -u && python3 --version && (git -C . status 2>&1 | head -3); cat /etc/os-release | head -2
cd <guest-path> && ls README* 2>/dev/null; cat README.md 2>/dev/null | head -200
cd <guest-path> && grep -n '^#' README.md | head -120; echo ---; grep -n -i 'cargo \|rustup\|mcp serve\|ekos init\|ekos build\|--out\|python3 -m venv\|pip install' README.md | head -80
cd <guest-path> && sed -n 651,732p README.md; echo ----; sed -n 325,345p README.md; echo ----; sed -n 1589,1600p README.md
cd <guest-path> && sed -n 184,207p README.md; echo ----; sed -n 1,60p install.sh; echo; echo ----; cat rust-toolchain.toml; echo ----; which cargo rustc curl; echo $HTTPS_PROXY $https_proxy
cd /tmp && export NODE_USE_ENV_PROXY=1 && curl -fsSL https://raw.githubusercontent.com/alexeyban/EKOS/main/install.sh -o /tmp/ekos-install.sh; echo "fetch rc=$?"; EKOS_CLI_ONLY=1 sh /tmp/ekos-install.sh 2>&1 | tail -30; echo "rc=${PIPESTATUS[0]}"; ls -la ~/.ekos/bin 2>&1
cd <guest-path> && ls ekos; grep -m3 -n '^version\|^name' ekos/Cargo.toml; ls ekos/crates | head -50; which cc gcc make; echo HOME=$HOME; ls ~/.cargo 2>&1 | head -2; ~/.ekos/bin/ekos --version 2>&1 | head -2; ls <guest-path>; ls -la <guest-path>
id -u; sudo -n true && echo SUDO_OK; (sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential pkg-config curl ca-certificates) 2>&1 | tail -5; echo "apt rc=${PIPESTATUS[0]}"; which cc gcc
cd /tmp && curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o /tmp/rustup-init.sh && sh /tmp/rustup-init.sh -y --profile minimal --default-toolchain stable 2>&1 | tail -4; echo "rc=$?"; . <guest-path> 2>/dev/null || . $HOME/.cargo/env; which cargo && cargo --version && rustc --version
cd <guest-path> && . <guest-path> && nohup cargo build --release -p ekos > <guest-path> 2>&1 &
sleep 60; tail -5 <guest-path>
cd <guest-path> && sed -n 1600,1645p README.md | cut -c1-400; echo ----; sleep 120; tail -3 <guest-path>
sleep 290; tail -3 <guest-path>
E=<guest-path>; $E --version; $E --help | head -60
set -x; E=<guest-path>; rm -rf /tmp/ekos-sample && mkdir -p /tmp/ekos-sample/src && cd /tmp/ekos-sample && cat > src/billing.py <<'EOF'
"""Billing rules for invoices."""

class Invoice:
    """An invoice owed by a customer."""

    def total(self, items):
        """Sum the line item prices."""
        return sum(i.price for i in items)


def apply_discount(invoice, percent):
    """Reduce an invoice total by a percentage."""
    return invoice.total([]) * (100 - percent) / 100
EOF
cat > src/orders.py <<'EOF'
from billing import Invoice, apply_discount

def place_order(items):
    """Create an invoice for the items."""
    return Invoice().total(items)
EOF
$E init --detect 2>&1 | tail -30; echo "init rc=$?"; ls -la; cat ekos.toml | head -40
E=<guest-path>; cd /tmp/ekos-sample && $E build 2>&1 | tail -8; echo "build rc=$?"; $E recover 2>&1 | tail -4; $E resolve 2>&1 | tail -4; $E compile 2>&1 | tail -6; $E commit 2>&1 | tail -6; echo ---; $E coverage 2>&1 | tail -15; $E status 2>&1 | tail -5
E=<guest-path>; cd /tmp/ekos-sample && $E query --help 2>&1 | head -25; echo ---; $E mcp serve --help 2>&1 | head -30; echo ---; $E ekl --help 2>&1 | head -12
E=<guest-path>; cd /tmp/ekos-sample && $E query find Invoice 2>&1 | head -20; echo "rc=$?"; echo ---; $E ekl "SELECT name FROM objects" 2>&1 | head -20; echo ---; $E ekl "SELECT * FROM objects WHERE name = 'Invoice'" 2>&1 | head -20
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, subprocess, sys
argv = sys.argv[1:]
msgs = [
 {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}},
 {"jsonrpc":"2.0","method":"notifications/initialized"},
 {"jsonrpc":"2.0","id":2,"method":"tools/list"},
]
inp = "".join(json.dumps(m)+"\n" for m in msgs)
out = subprocess.run(argv, input=inp, capture_output=True, text=True, timeout=120)
for line in out.stdout.splitlines():
    try:
        m = json.loads(line)
    except Exception:
        continue
    if m.get("id") == 2:
        for t in m["result"]["tools"]:
            print(t["name"], json.dumps(t.get("inputSchema",{}).get("required",[])), list(t.get("inputSchema",{}).get("properties",{}).keys()))
print("stderr:", out.stderr[:300])
EOF
cd <guest-path> && python3 -I mcp_session.py <guest-path> mcp serve --config /tmp/ekos-sample/ekos.toml --workspace /tmp/ekos-sample 2>&1 | head -60
cat > <guest-path> <<'EOF'
import json, subprocess, sys
tool, args = sys.argv[1], json.loads(sys.argv[2])
argv = sys.argv[3:]
msgs = [
 {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}},
 {"jsonrpc":"2.0","method":"notifications/initialized"},
 {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":tool,"arguments":args}},
]
inp = "".join(json.dumps(m)+"\n" for m in msgs)
out = subprocess.run(argv, input=inp, capture_output=True, text=True, timeout=300)
for line in out.stdout.splitlines():
    try: m = json.loads(line)
    except Exception: continue
    if m.get("id") == 2:
        print(json.dumps(m, indent=1)[:2500])
print("stderr:", out.stderr[:300])
EOF
cd <guest-path> && python3 -I mcp_call.py ekos_search '{"query":"Invoice"}' <guest-path> mcp serve --config /tmp/ekos-sample/ekos.toml --workspace /tmp/ekos-sample
cd <guest-path> && grep -n 'ekos query\|ekos ekl\|ekos_search`' README.md | cut -c1-220 | head -20; echo ---; grep -n -i 'cron\|--once\|--now\|webhook\|schedul\|watch mode\|--every\|daemon' README.md | cut -c1-200 | head -30; echo ---; ls ekos/crates/scheduler/src; grep -rn 'fn run\|pub fn\|tick' ekos/crates/scheduler/src/*.rs | head -20
cd <guest-path> && sed -n 2100,2112p README.md; echo ---; wc -l ekos/crates/scheduler/src/lib.rs; grep -n 'pub ' ekos/crates/scheduler/src/lib.rs | head -30; echo ---; grep -rln 'APScheduler\|apscheduler' --include=*.py . | head; grep -rn 'schedule' ekos/crates/cli/src/*.rs | head -10
cd <guest-path> && wc -l app/scheduler.py && sed -n 1,60p app/scheduler.py; ls; cat requirements*.txt 2>/dev/null | head -30; python3 -c "import apscheduler" 2>&1 | tail -1
cd <guest-path> && cat pyproject.toml | head -40; which uv; ls tests | head; grep -rn 'def test.*sched\|fake\|clock' tests/*.py | head -5
cd <guest-path> && . <guest-path> && nohup cargo test --workspace > <guest-path> 2>&1 &
cd /tmp/ekos-sample && E=<guest-path> && $E ekl "FIND Object WHERE kind = 'View'" 2>&1 | head -5; echo "rc=$?"; $E ekl "FIND Object WHERE kind = 'Module'" 2>&1 | head -5; $E query find Invoice --mode lexical 2>&1 | head -4
cd <guest-path> && grep -nF '`ekos mcp serve --workspace <dir>` exposes the read-only Runtime as a Model Context Protocol' README.md; grep -nF '`ekos query find \"<text>\" --mode lexical|vector|hybrid`' README.md; grep -nF 'cargo test --workspace' README.md; grep -nF "ekos ekl \"FIND Object WHERE kind = 'View'\"" README.md; grep -nF 'def build_trigger(kind: str, expr: str):' web/api/app/scheduler.py; sed -n 1295p README.md | cut -c1-200
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, os
W = "<guest-path>"
E = "<guest-path>"
SAMPLE = "/tmp/ekos-sample"
CFG = SAMPLE + "/ekos.toml"
MCP_ARGV = [E, "mcp", "serve", "--config", CFG, "--workspace", SAMPLE]
Q_QUOTE = '`ekos query find "<text>" --mode lexical|vector|hybrid`'
MCP_QUOTE = "`ekos mcp serve --workspace <dir>` exposes the read-only Runtime as a Model Context Protocol"

probe = {
    "kind": "mcp", "argv": MCP_ARGV, "cwd": W,
    "tool": "ekos_search", "arguments": {"query": "Invoice"},
    "expected_text": "billing.Invoice",
}
claims = [
    {"kind": "claim",
     "claim": "The read-only MCP server exposes the compiled ledger to agents; searching it returns the compiled objects",
     "source": MCP_QUOTE, "input": "query=Invoice on the committed sample repo",
     "expected": "ekos_search returns the compiled object billing.Invoice",
     "probe_kind": "mcp", "argv": MCP_ARGV, "tool": "ekos_search",
     "arguments": {"query": "Invoice"}, "expected_text": "billing.Invoice", "cwd": W},
    {"kind": "claim",
     "claim": "ekos query find searches compiled object names from the command line",
     "source": Q_QUOTE, "input": "find Invoice (lexical) on the committed sample repo",
     "expected": "lists billing.Invoice among the matches",
     "probe_kind": "cli", "argv": [E, "query", "find", "Invoice", "--mode", "lexical", "--config", CFG],
     "expected_text": "billing.Invoice", "cwd": SAMPLE},
]
examples = [
    {"kind": "example", "claim": "EKL query over the ledger returns rows for a matching kind (View; none in this Python-only sample, so zero rows)",
     "source": "README.md, Views (RFC 0169) section",
     "input": "FIND Object WHERE kind = 'View'", "expected": "0 rows.",
     "argv": [E, "ekl", "FIND Object WHERE kind = 'View'", "--config", CFG],
     "cwd": SAMPLE, "expected_text": "0 rows."},
    {"kind": "example", "claim": "Optional documented test suite of the Rust workspace",
     "source": "README.md, Verify the install section",
     "input": "cargo test --workspace from ekos/", "expected": "test result: ok",
     "argv": ["<guest-path>", "test", "--workspace"],
     "cwd": W + "/ekos", "expected_text": "test result: ok"},
]
cycles = {
    "detected": True,
    "checks": [
        {"claim": "Scheduled runs: the console fires pipeline commands on a cron or interval trigger",
         "source": "web/api/app/scheduler.py",
         "quote": "def build_trigger(kind: str, expr: str):",
         "reason": "Scheduling is a feature of the EKOS web console (FastAPI, APScheduler, SQLite, auth tokens, a required notify_url). Its dependencies were not installed and the console was not started in this run, so no cycle was triggered; the Rust CLI has no cron or --once entry point."}
    ],
}
def dump(name, obj):
    p = os.path.join(W, ".coldpass", name)
    with open(p, "w", encoding="utf-8") as f:
        json.dump(obj, f, indent=2, ensure_ascii=False); f.write("\n")
    print("wrote", p)
dump("probe.json", probe)
dump("claims.json", claims)
dump("examples.json", examples)
dump("cycles.json", cycles)
EOF
python3 -I <guest-path> && tail -3 <guest-path>
for i in $(seq 1 28); do if grep -q 'test result\|error\[' <guest-path> && ! pgrep -f 'cargo test' >/dev/null; then break; fi; sleep 10; done; pgrep -f 'cargo test' >/dev/null && echo STILL_RUNNING; grep -c 'test result: ok' <guest-path>; grep 'test result' <guest-path> | grep -v ' 0 failed' | head; grep -c 'FAILED\|panicked' <guest-path>; tail -3 <guest-path>
for i in $(seq 1 28); do pgrep -f 'cargo test' >/dev/null || break; sleep 10; done; pgrep -f 'cargo test' >/dev/null && echo STILL_RUNNING; grep 'test result' <guest-path> | awk '{p+=$4; f+=$6} END {print "passed="p" failed="f" suites="NR}'; grep -c 'FAILED\|panicked' <guest-path>; tail -4 <guest-path>
grep -n -B2 -A12 '^error' <guest-path> | grep -v 'Caused by\|failed to parse' | cut -c1-300 | head -60; grep -c 'warning' <guest-path>
df -h / /tmp <guest-path> 2>/dev/null; du -sh <guest-path> 2>/dev/null
rm -rf <guest-path> && df -h / | tail -1 && cd <guest-path> && . <guest-path> && CARGO_PROFILE_TEST_DEBUG=0 CARGO_INCREMENTAL=0 nohup cargo test --workspace > <guest-path> 2>&1 &
sleep 240; df -h / | tail -1; tail -2 <guest-path> | cut -c1-200
for i in $(seq 1 27); do pgrep -f 'cargo test' >/dev/null || break; sleep 10; done; pgrep -f 'cargo test' >/dev/null && echo STILL_RUNNING; df -h / | tail -1; grep 'test result' <guest-path> | awk '{p+=$4; f+=$6} END {print "passed="p" failed="f" suites="NR}'; tail -2 <guest-path> | cut -c1-300
for i in $(seq 1 27); do pgrep -f 'cargo test' >/dev/null || break; sleep 10; done; pgrep -f 'cargo test' >/dev/null && echo STILL_RUNNING; grep 'test result' <guest-path> | awk '{p+=$4; f+=$6} END {print "passed="p" failed="f" suites="NR}'; grep -c 'FAILED\|panicked' <guest-path>; tail -3 <guest-path> | cut -c1-200
for i in $(seq 1 27); do pgrep -f 'cargo test' >/dev/null || break; sleep 10; done; pgrep -f 'cargo test' >/dev/null && echo STILL_RUNNING; grep 'test result' <guest-path> | awk '{p+=$4; f+=$6} END {print "passed="p" failed="f" suites="NR}'; grep -c 'FAILED\|panicked' <guest-path>; tail -2 <guest-path> | cut -c1-200
for i in $(seq 1 28); do pgrep -f 'cargo test' >/dev/null || break; sleep 10; done; pgrep -f 'cargo test' >/dev/null && echo STILL_RUNNING; grep 'test result' <guest-path> | awk '{p+=$4; f+=$6} END {print "passed="p" failed="f" suites="NR}'; grep -c 'FAILED\|panicked' <guest-path>; tail -3 <guest-path> | cut -c1-200; ps aux | grep -c '[r]ustc\|[t]est-'
grep -c '^error' <guest-path>; grep -n 'Doc-tests\|Running' <guest-path> | tail -3 | cut -c1-200; grep 'test result' <guest-path> | tail -2; ps -eo pid,args | grep -E '[c]argo|[r]ustc' | head -3
cd <guest-path> && python3 -I -c "
import json
p='<guest-path>'
ex=json.load(open(p))
ex[1]['env']={'CARGO_PROFILE_TEST_DEBUG':'0','CARGO_INCREMENTAL':'0'}
ex[1]['argv']=['<guest-path>','test','--workspace']
json.dump(ex,open(p,'w'),indent=2,ensure_ascii=False); open(p,'a').write('\n')
print('ok')
" && cd <guest-path> && <env-var>=<guest-path> timeout 3000 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && python3 -I -c "
import json
r={
 'outcome':'working',
 'fault_owner':'none',
 'operation':'ekos mcp serve (stdio) and ekos query find on the committed sample repo; ekos ekl and cargo test --workspace as examples',
 'operation_scope':'EKOS v1.1.0 Rust CLI built from the pinned snapshot at ekos/target/release/ekos; sample repo /tmp/ekos-sample; web console scheduling not exercised',
 'steps':[
  'Read README; installed build-essential via sudo apt-get and Rust via rustup minimal profile (repo pin 1.98.0 fetched automatically).',
  'Ran install.sh with EKOS_CLI_ONLY=1 to avoid the browser wizard; installed release v1.1.0.',
  'Built from source: cargo build --release -p ekos in ekos/ (about 7m44s).',
  'Initialized and ran init --detect, build, recover, resolve, compile, commit on /tmp/ekos-sample; coverage ok.',
  'Probed MCP ekos_search for Invoice over stdio; result contains billing.Invoice.',
  'Ran ekos query find Invoice --mode lexical; result lists billing.Invoice.',
  'Ran ekos ekl FIND Object WHERE kind = View; 0 rows (expected, Python-only sample).',
  'Ran cargo test --workspace: 3102 passed, 0 failed, 181 suites. First run hit disk full in debug build; deleted own target/debug and reran with CARGO_PROFILE_TEST_DEBUG=0 CARGO_INCREMENTAL=0.',
  'Ran checker with --validate --replay: valid, no problems, replay PASS.'
 ],
 'deviations':[
  'Installer fetched release v1.1.0 instead of the pinned commit 8698c2f7; probes and claims used the source-built snapshot binary (also v1.1.0).',
  'Debug test build exhausted the 30G disk; recovered by deleting only own target/debug and running tests with reduced debug info.',
  'Scheduler/cycle feature (web console, FastAPI + APScheduler) was not installed or started; recorded as blocked in cycles.json with no argv.'
 ],
 'stuck_step':None,
 'main_blocker':None,
 'plain_failure':None,
 'suggested_fix':'Install and start the web console (web/api) with a notify_url to exercise scheduled cycles; provision at least 60G disk for debug test builds, or use CARGO_PROFILE_TEST_DEBUG=0.'
}
import os
os.makedirs('<guest-path>',exist_ok=True)
json.dump(r,open('<guest-path>','w'),indent=2)
print('written')
" && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.load(sys.stdin) if False else None; print(sys.stdin.read()[:400])"