dorianchn/shanchuanzhi-agent-canary

Review signals: 1 connection review, 4 hardcoded secret, 9 known vulnerability, 4 sensitive read. 1 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; read only test files inside the test workspace or its temporary folders; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 104.16.9.34:443 1 attributed processes.

PID 2428: /usr/local/bin/node · <guest-path>

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 4 findings.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 9 findings.

A repository process attempted to read this sensitive path. 4 distinct locations. 4 findings. 9 attributed processes.

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The stdio MCP server runs via serve --stdio and exposes decoy tools that return fabricated results: Real input produced the expected result: T+0 (internal accounts)

  Source: To run the MCP server over stdio, use agent-canary serve --stdio or run the container with -i and the same arguments.

  Input: {"tool": "canary_transfer_funds", "arguments": {"from_account": "A1", "to_account": "B2", "amount": 5}}

  Expected: status initiated with settlement T+0 (internal accounts)

  Command: node <guest-path> serve --stdio tools/call {"tool": "canary_transfer_funds", "arguments": {"from_account": "A1", "to_account": "B2", "amount": 5}}

  Observed: …T+0 (internal accounts)\"\n}"}]}

• Agent Canary provides decoy tools as a security toolkit: Real input produced the expected result: T+0 (internal accounts)

  Source: It provides decoy tools, canary tokens, a guarded execution gateway, local self-tests, and an optional risk-policy console.

  Input: {"tool": "canary_transfer_funds", "arguments": {"from_account": "A1", "to_account": "B2", "amount": 5}}

  Expected: decoy reply containing settlement T+0 (internal accounts)

  Command: node <guest-path> serve --stdio tools/call {"tool": "canary_transfer_funds", "arguments": {"from_account": "A1", "to_account": "B2", "amount": 5}}

  Observed: …T+0 (internal accounts)\"\n}"}]}

Examples

• Local development verification builds, tests, and smoke-tests the package: command completed successfully

  Source: README.md Local development

  Input: npm run verify

  Expected: package smoke check passes

  Command: npm run verify

  Observed: "} {"scope":"actual manifest bytes, not runtime certification or E4","files":181,"mismatches":[]} {"status":"VERIFIED_BOUNDED_OPERATOR_DEMO","mode":"OPERATOR_TRIGGERED_REAL_TEMPORARY_IO_NOT_MODEL_ATTACK","resultFile":"/tmp/canary-roadshow-home-HpjlLu/roadshow-result.json","fixture":"/tmp/agent-canary-honeypot-ii17zR","caseCount":6,"E4":"NOT_VERIFIED_NO_EXTERNAL_OPERATOR","sha256":"8f2958d4e262dd76fe92a57e247302546aae9d70640090135a0bc84bbab836fa"} > @dorianchn/[email protected] pack:check > node scripts/check-package.mjs package smoke check passed: dorianchn-agent-canary-3.0.0.tgz (72 files)

Local or hosted: local

Run the Agent Canary 3.0 stdio MCP server (serve --stdio) and call a decoy tool (canary_transfer_funds), plus the README Local development verification (npm run verify).

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; python3 --version; test -f README.md && wc -c README.md
cd <guest-path> && cat README.md 2>/dev/null | head -c 7000
node --version; npm --version; cat <guest-path>; echo; cat <guest-path> | head -c 2300; echo; ls <guest-path> /inputs 2>&1
cd <guest-path> && NODE_USE_ENV_PROXY=1 npm ci 2>&1 | tail -n 25; echo "EXIT=${PIPESTATUS[0]}"
cd <guest-path> && npm run verify > <guest-path> 2>&1; echo "EXIT=$?"; tail -n 40 <guest-path>
cd <guest-path> && node dist/competition.js --help 2>&1 | head -n 60; echo "---"; node dist/competition.js serve --help 2>&1 | head -n 30
cd <guest-path> && grep -rn "registerTool\|name: \"" src --include=*.ts | head -n 40
cd <guest-path> && cat src/server.ts | head -c 5000
cd <guest-path> && sed -n 1,100p src/decoys.ts | head -c 6500
cd <guest-path> && grep -rln "setInterval\|cron\|--once\|--now" src scripts docs 2>/dev/null | head; echo "---"; printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"canary_transfer_funds","arguments":{"from_account":"A1","to_account":"B2","amount":5}}}' | timeout 20 node dist/competition.js serve --stdio 2><guest-path> | cut -c1-400; echo "EXIT=${PIPESTATUS[1]}"; cat <guest-path>
cd <guest-path> && grep -n "setInterval\|cron\|--once\|--now" src/ai/console-page.ts | head -5; grep -rn "VERSION" src/config.ts | head -3; cat FREE_BUILD_VERSION.json | head -c 400; echo; cat <guest-path> | head -c 1500
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","<guest-path>","serve","--stdio"],"cwd":"<guest-path>","tool":"canary_transfer_funds","arguments":{"from_account":"A1","to_account":"B2","amount":5},"expected_text":"T+0 (internal accounts)"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The stdio MCP server runs via serve --stdio and exposes decoy tools that return fabricated results","source":"To run the MCP server over stdio, use agent-canary serve --stdio or run the container with -i and the same arguments.","input":"canary_transfer_funds from A1 to B2 amount 5","expected":"status initiated with settlement T+0 (internal accounts)","probe_kind":"mcp","argv":["node","<guest-path>","serve","--stdio"],"tool":"canary_transfer_funds","arguments":{"from_account":"A1","to_account":"B2","amount":5},"expected_text":"T+0 (internal accounts)","cwd":"<guest-path>"},
{"kind":"claim","claim":"Agent Canary provides decoy tools as a security toolkit","source":"It provides decoy tools, canary tokens, a guarded execution gateway, local self-tests, and an optional risk-policy console.","input":"canary_transfer_funds from A1 to B2 amount 5","expected":"decoy reply containing settlement T+0 (internal accounts)","probe_kind":"mcp","argv":["node","<guest-path>","serve","--stdio"],"tool":"canary_transfer_funds","arguments":{"from_account":"A1","to_account":"B2","amount":5},"expected_text":"T+0 (internal accounts)","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Local development verification builds, tests, and smoke-tests the package","source":"README.md Local development","input":"npm run verify","expected":"package smoke check passes","argv":["npm","run","verify"],"cwd":"<guest-path>","env":{},"expected_text":"package smoke check passed"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md and src/ entrypoints (serve --stdio, self-test, ai console, integrate). No cron, scheduler, loop, webhook, or --once/--now trigger found; the only setInterval is browser-side UI polling in src/ai/console-page.ts, which is not a product cycle."}
EOF
python3 -I -c 'import json,sys;[json.load(open(f".coldpass/{f}.json")) for f in ["probe","claims","examples","cycles"]];print("json ok")'
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "EXIT=$?"; tail -c 4000 <guest-path>
cd <guest-path> && grep -o '"valid": *[a-z]*' <guest-path> | sort | uniq -c; grep -o '"status": *"[^"]*"' <guest-path> | sort | uniq -c | head; pgrep -fa "competition.js" | head -3; ls .coldpass
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the Agent Canary 3.0 stdio MCP server (serve --stdio) and call a decoy tool (canary_transfer_funds), plus the README Local development verification (npm run verify).","operation_scope":"Linux guest, Node v22.23.4 and npm 10.9.9 (README requires Node 20+). No GitHub Packages login, no browser, no credentials. Decoy tools are inert and return fabricated results.","steps":["npm ci","npm run verify","node dist/competition.js serve --stdio (MCP tools/call canary_transfer_funds)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay"],"deviations":["README global install (npm config set @dorianchn:registry + npm login + npm install -g @dorianchn/[email protected]) was not run because it needs a GitHub PAT with read:packages; the README Local development path (npm ci, npm run verify) was used instead.","Probes and claims call the package bin directly as node <guest-path> serve --stdio rather than the agent-canary command on PATH.","MCP initialize reports serverInfo.version 1.2.7 (src/config.ts VERSION) while package.json and README say 3.0.0; recorded as an observation, not a test failure.","npm ci reported 6 vulnerabilities (4 moderate, 2 high); not remediated.","npm test in verify reported 97 pass, 0 fail, 3 skipped of 100.","No scheduler/cycle found; cycles.json has detected=false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Optional: align VERSION in src/config.ts with package.json (3.0.0); run npm audit fix for the reported advisories; document that the global install needs GitHub Packages auth."}
EOF
python3 -I -c 'import json;d=json.load(open(".coldpass/report.json"));print(d["outcome"],d["fault_owner"])'; ls -la .coldpass