hugoguerrap/crypto-claude-desk

Review signals: 1 connection review, 288 known vulnerability.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 1 attributed processes.

PID 2504: <guest-path> · <guest-path>

OSV reports a known vulnerability in this dependency version. 44 distinct locations. 288 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• New paper-trading portfolio starts with $10,000 spot and $10,000 futures: Real input produced the expected result: 10000.0

  Source: You start with $10,000 spot + $10,000 futures.

  Input: {"tool": "get_portfolio_state", "arguments": {}}

  Expected: spot_initial and futures_initial are 10000.0

  Command: <guest-path> run --frozen --project . python mcp-servers/crypto_learning_db.py tools/call {"tool": "get_portfolio_state", "arguments": {}}

  Observed: 10000.0,\"spot_balance\":10000.0,\"futures_initial\":10000.0,\"futures_balance\":10000.0,\"currency\":\"USDT\",\"total_trades\":0,\"wins\":0,\"losses\":0,\"total_pnl\":0.0,\"updated_at\":null},\"open_trades_count\":0,\"open_trades\":[]}"}], "structuredContent": {"status": "success", "portfolio": {"id": 1, "spot_initial": 10000.0, "spot_balance": 10000.0, "futures_initial": 10000.0, "futures_balance": 10000.0, "currency": "USDT", "total_trades": 0, "wins": 0, "losses": 0, "total_pnl": 0.0, "updated_at": null}, "open_trades_count": 0, "open_trades": []}, "isError": false}

Examples

• Install the locked Python dependencies for the MCP servers: command completed successfully

  Source: README.md Troubleshooting: Dependencies not installing

  Input: uv sync --frozen in the repo root

  Expected: dependencies installed, exit 0

  Command: <guest-path> sync --frozen

  Observed: Checked 104 packages in 79ms

• Repository test suite passes: CONTRIBUTING.md says there is no automated test suite and the README documents no test command. Ran instead: uv run --frozen --project . python -m pytest -q (pyproject.toml [tool.pytest.ini_options]); 348 passed in the setup run.

  Source: CONTRIBUTING.md Testing

  Expected: documented command completes successfully

  Observed: CONTRIBUTING.md says there is no automated test suite and the README documents no test command. Ran instead: uv run --frozen --project . python -m pytest -q (pyproject.toml [tool.pytest.ini_options]); 348 passed in the setup run.

• Dashboard ops UI runs on localhost: Optional. Needs Node >=20.9 for Next.js 16.2.6; apt installed Node v18.19.1 and npm 9.2.0, so npm install/npm run dev were not attempted.

  Source: README.md Dashboard (optional)

  Expected: documented command completes successfully

  Observed: Optional. Needs Node >=20.9 for Next.js 16.2.6; apt installed Node v18.19.1 and npm 9.2.0, so npm install/npm run dev were not attempted.

Cycles

• Scheduled autopilot monitor cycle: bin/autopilot.sh runs 'claude -p' headlessly; the Claude Code CLI is not installed in this guest and requires a Claude Pro/Max/Team login, so no cycle could be triggered. Entry points inspected: bin/autopilot.sh, hooks/hooks.json (SessionStart only).

  Source: README.md

  Input: none

  Expected: n/a

  Observed: bin/autopilot.sh runs 'claude -p' headlessly; the Claude Code CLI is not installed in this guest and requires a Claude Pro/Max/Team login, so no cycle could be triggered. Entry points inspected: bin/autopilot.sh, hooks/hooks.json (SessionStart only).

Local or hosted: local

Start the crypto-learning-db MCP stdio server from the README's plugin config and read the paper-trading portfolio state (get_portfolio_state)

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,400p README.md; cat .python-version; cat pyproject.toml; ls mcp-servers tests; ls /inputs 2>/dev/null
cd <guest-path> && git init -q && git remote add origin https://github.com/hugoguerrap/crypto-claude-desk && git fetch --depth 1 origin 298cfd58408aa86ef3c7ce863c0c19858636df7a 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; which uv; uv --version 2>&1; cat mcp-servers.plugin.json | head -60; cat bin/*.sh 2>/dev/null | head -5; ls bin hooks
curl -LsSf https://astral.sh/uv/install.sh | sh 2>&1 | tail -5; export PATH="$HOME/.local/bin:$PATH"; uv --version
export PATH="$HOME/.local/bin:$PATH"; cd <guest-path> && uv sync --frozen 2>&1 | tail -8; uv run --frozen --project . python -m pytest -q 2>&1 | tail -8
cd <guest-path> && grep -n -A3 "@mcp.tool" mcp-servers/crypto_learning_db.py | grep "def " | head -30; grep -n "mcp.run\|__main__" mcp-servers/crypto_learning_db.py; grep -n "CRYPTO_DB_DIR\|learning.db" mcp-servers/crypto_learning_db.py | head; ls data data/db; cat .coldpass/* 2>/dev/null | head -5; ls -la .coldpass
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import asyncio, json, sys
from fastmcp import Client
from fastmcp.client.transports import PythonStdioTransport
async def main():
    server, tool, args = sys.argv[1], sys.argv[2], json.loads(sys.argv[3])
    async with Client(PythonStdioTransport(server, cwd="<guest-path>")) as c:
        r = await c.call_tool(tool, args)
        print(r.content[0].text if r.content else r)
asyncio.run(main())
EOF
cd <guest-path> && <guest-path> -I -c "print(1)" >/dev/null && ls .venv/bin/python && .venv/bin/python -I <guest-path> mcp-servers/crypto_learning_db.py get_db_stats '{}' 2>&1 | tail -20
cd <guest-path> && sed -n 1186,1240p mcp-servers/crypto_learning_db.py
cd <guest-path> && .venv/bin/python -I <guest-path> mcp-servers/crypto_learning_db.py get_portfolio_state '{}' 2>/dev/null | tail -1
cd <guest-path> && grep -n -i "pytest\|uv run" CONTRIBUTING.md CLAUDE.md | head; sed -n 1,40p bin/autopilot.sh | grep -v "^#" | head -30; grep -n "claude \|case\|monitor)" bin/autopilot.sh | head -20; which claude || echo "no claude CLI"; cat hooks/hooks.json | head -20
cd <guest-path> && grep -n -i "test" CONTRIBUTING.md | head -20; sed -n 125,150p CONTRIBUTING.md; ls .coldpass; ls data
echo $HOME; ls -l $HOME/.local/bin/uv; node --version 2>&1; npm --version 2>&1; cd <guest-path> && grep -n '"engines"\|"node"' dashboard/package.json | head -3; grep -n -i "node" README.md | head
cd <guest-path> && cat package.json | head -40; id -u; sudo -n true && echo SUDO_OK; (sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm) 2>&1 | tail -5; node --version; npm --version
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","run","--frozen","--project",".","python","mcp-servers/crypto_learning_db.py"],"cwd":"<guest-path>","tool":"get_portfolio_state","arguments":{},"expected_text":"\"spot_initial\":10000.0"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"New paper-trading portfolio starts with $10,000 spot and $10,000 futures","source":"You start with $10,000 spot + $10,000 futures.","input":"get_portfolio_state on a fresh learning.db","expected":"spot_initial and futures_initial are 10000.0","probe_kind":"mcp","argv":["<guest-path>","run","--frozen","--project",".","python","mcp-servers/crypto_learning_db.py"],"tool":"get_portfolio_state","arguments":{},"expected_text":"\"spot_initial\":10000.0","cwd":"<guest-path>"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Scheduled autopilot monitor cycle","source":"README.md","quote":"0 * * * * /path/to/crypto-trading-desk/bin/autopilot.sh monitor","schedule":"hourly cron (documented in README 'Autopilot mode')","method":"not run: prerequisite missing","input":"none","expected":"n/a","reason":"bin/autopilot.sh runs 'claude -p' headlessly; the Claude Code CLI is not installed in this guest and requires a Claude Pro/Max/Team login, so no cycle could be triggered. Entry points inspected: bin/autopilot.sh, hooks/hooks.json (SessionStart only)."}]}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Install the locked Python dependencies for the MCP servers","source":"README.md Troubleshooting: Dependencies not installing","input":"uv sync --frozen in the repo root","expected":"dependencies installed, exit 0","argv":["<guest-path>","sync","--frozen"],"cwd":"<guest-path>","expected_text":"+ fastmcp"},{"kind":"example","claim":"Repository test suite passes","source":"CONTRIBUTING.md Testing","reason":"CONTRIBUTING.md says there is no automated test suite and the README documents no test command. Ran instead: uv run --frozen --project . python -m pytest -q (pyproject.toml [tool.pytest.ini_options]); 348 passed in the setup run."},{"kind":"example","claim":"Dashboard ops UI runs on localhost","source":"README.md Dashboard (optional)","deferred":true,"reason":"Optional. Needs Node >=20.9 for Next.js 16.2.6; apt installed Node v18.19.1 and npm 9.2.0, so npm install/npm run dev were not attempted."}]
EOF
for f in probe claims cycles examples; do python3 -I -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done; ls .coldpass
cd <guest-path> && ls -l <guest-path> /inputs/coldpass-preflight.py 2>&1; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && sed -i 's/"expected_text":"\\"spot_initial\\":10000.0"/"expected_text":"10000.0"/' .coldpass/probe.json && sed -i 's/"expected_text":"\\"spot_initial\\":10000.0"/"expected_text":"10000.0"/' .coldpass/claims.json && grep -o '"expected_text":"[^}]*' .coldpass/probe.json .coldpass/claims.json && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print(d.get('valid'), d.get('problems'))"
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Start the crypto-learning-db MCP stdio server from the README's plugin config and read the paper-trading portfolio state (get_portfolio_state)","operation_scope":"Local SQLite paper-trading DB only (no exchange/API keys). Requires uv (installed) and locked Python 3.12 deps (uv sync --frozen). Claude Code CLI not exercised: the Claude-driven agents, slash commands, and the autopilot cron cycle were not run.","steps":["git init; git remote add origin https://github.com/hugoguerrap/crypto-claude-desk; git fetch --depth 1 origin 298cfd58408aa86ef3c7ce863c0c19858636df7a; git reset --mixed FETCH_HEAD","curl -LsSf https://astral.sh/uv/install.sh | sh (README Requirements/uv install) -> uv 0.13.5","uv sync --frozen (README Troubleshooting 'Dependencies not installing')","uv run --frozen --project . python mcp-servers/crypto_learning_db.py (mcp-servers.plugin.json entry), MCP tool get_portfolio_state -> spot_initial 10000.0, futures_initial 10000.0"],"deviations":["Workspace was not a git repo; ran the pinned git init/fetch/reset steps.","uv was installed with the README's curl|sh installer into <guest-path>; probe uses that absolute path.","CONTRIBUTING.md says there is no automated test suite. Ran uv run --frozen --project . python -m pytest -q (pyproject testpaths): 348 passed. Recorded as a reason-based example, not a documented test.","Autopilot cycle (bin/autopilot.sh monitor, README cron example) not run: needs the Claude Code 'claude' CLI, which is not installed in this guest. Recorded in cycles.json with detected:true and no argv.","Dashboard (optional, README) deferred: Next.js 16.2.6 needs Node >=20.9; apt provided Node v18.19.1 / npm 9.2.0. npm install and npm run dev not attempted.","Checker path /inputs/coldpass-preflight.py does not exist; used <guest-path> with the same flags.","First replay failed because expected_text with embedded JSON quotes did not match the checker's view of the result; changed expected_text to 10000.0 (a value in the returned portfolio) and re-validated with no problems.","MCP client used for exploration was a small script outside the checkout (<guest-path>); not part of the repo."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the MCP server. To fully verify the plugin, install Claude Code and run /crypto-trading-desk:setup, then the autopilot monitor cycle; install Node >=20.9 to run the optional dashboard."}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo report ok; ls -la .coldpass; ls report.json 2>/dev/null || echo "no root report.json (good)"; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print(d.get('valid'), d.get('problems'))"