marclou/mailcheap

Review signals: 1 connection review, 2 known vulnerability, 1 outside write. 3 static matches retained as context.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 5 distinct locations. 10 attributed processes.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 2 findings.

Repository processes attempted these writes outside documented output/cache paths. 3 distinct locations. 10 attributed processes.

3 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• MCP endpoint requires a full access key: Probe could not complete: [Errno 2] No such file or directory: 'server'; stderr:

  Source: **MCP**: connect Claude Code with a full access key. Every action is a tool.

  Input: tools/call list_newsletters without a key

  Expected: request rejected as unauthorized

  Command: server

  Observed: Probe could not complete: [Errno 2] No such file or directory: 'server'; stderr:

Examples

• : no command or explanation supplied

  Expected: documented command completes successfully

  Observed: no command or explanation supplied

Local or hosted: both

MCP tool call (list_newsletters) via /mcp after README setup

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; cat /etc/os-release | head -2; python3 --version; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -300
cd <guest-path> && sed -n 300,600p README.md
cd <guest-path> && grep -n -i "npm\|node\|local\|develop\|test\|mcp" README.md | sed -n 1,80p; cat package.json; ls tests; ls .coldpass
which node npm npx docker mongod git curl uv 2>&1; node --version 2>&1; npm --version 2>&1; sudo -n true 2>&1 && echo SUDO_OK; head -60 <guest-path>; echo ---; env | grep -i -E "proxy|npm|node" 
curl -sS -m 20 -o /dev/null -w "%{http_code}\n" https://deb.nodesource.com/ ; curl -sS -m 20 -o /dev/null -w "%{http_code}\n" https://registry.npmjs.org/ ; curl -sS -m 20 -o /dev/null -w "%{http_code}\n" https://nodejs.org/dist/ ; curl -sS -m 20 -o /dev/null -w "%{http_code}\n" https://repo.mongodb.org/ ; curl -sS -m 20 -o /dev/null -w "%{http_code}\n" https://get.docker.com/; apt-cache policy docker.io 2>/dev/null | head -3; apt-cache policy nodejs | head -3
(curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs) > /tmp/node_install.log 2>&1; echo rc=$?; tail -5 /tmp/node_install.log; node --version; npm --version
sudo apt-get install -y docker.io > /tmp/docker_install.log 2>&1; echo rc=$?; tail -3 /tmp/docker_install.log; sudo systemctl start docker 2>&1; sleep 3; sudo docker info --format '{{.ServerVersion}}' 2>&1 | head -3
sudo docker run -d --name mailcheap-mongo -p 27017:27017 mongo 2>&1 | tail -3; sleep 25; sudo docker ps --format '{{.Names}} {{.Status}}'; sudo docker logs mailcheap-mongo 2>&1 | tail -2
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && time npm ci > /tmp/npm_ci.log 2>&1; echo rc=$?; tail -15 /tmp/npm_ci.log
cd <guest-path> && cp .env.example .env.local && S=$(openssl rand -base64 48) && H=$(openssl rand -base64 48) && sed -i -e "s|^MONGODB_URI=.*|MONGODB_URI=mongodb://127.0.0.1:27017/mailcheap|" -e "s|^BETTER_AUTH_SECRET=.*|BETTER_AUTH_SECRET=$S|" -e "s|^SUPPRESSION_HASH_KEY=.*|SUPPRESSION_HASH_KEY=$H|" -e "<email>|" .env.local && grep -E "^(MONGODB_URI|ADMIN_EMAILS|ALLOWED_EMAILS|SENDING_ENABLED|RESEND_API_KEY|MAILCHEAP_CLOUD|APP_URL)=" .env.local | cut -c1-120; grep -c "" .env.local; cat .gitignore | grep -n env
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm run lint > /tmp/lint.log 2>&1; echo lint_rc=$?; tail -8 /tmp/lint.log; (time npm run build) > /tmp/build.log 2>&1; echo build_rc=$?; tail -25 /tmp/build.log
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && (time timeout 900 npm test) > /tmp/test.log 2>&1; echo test_rc=$?; grep -E "^# (tests|suites|pass|fail|cancelled|skipped)" /tmp/test.log; grep -n -i "mongod" /tmp/test.log | head -5; tail -5 /tmp/test.log
pgrep -fa "node --import|mongod" | cut -c1-150 | head; pkill -f "node --import ./tests/setup" ; sleep 2; cd /tmp && curl -fsSL https://pgp.mongodb.com/server-8.0.asc | sudo gpg --batch --yes -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor && echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list >/dev/null && sudo apt-get update > /tmp/apt_mongo.log 2>&1 && sudo apt-get install -y mongodb-org-server mongodb-mongosh > /tmp/mongo_install.log 2>&1; echo rc=$?; tail -3 /tmp/mongo_install.log; which mongod; mongod --version | head -2
ps -eo pid,args | grep -E "tests/setup|mongod" | grep -v grep | cut -c1-120 | head; cd /tmp && curl -fsSL https://pgp.mongodb.com/server-8.0.asc | sudo gpg --batch --yes -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor && echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu noble/mongodb-org/8.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-8.0.list >/dev/null && sudo apt-get update > /tmp/apt_mongo.log 2>&1 && sudo apt-get install -y mongodb-org-server mongodb-mongosh > /tmp/mongo_install.log 2>&1; echo rc=$?; tail -3 /tmp/mongo_install.log; which mongod; mongod --version | head -2
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && nohup bash -c 'time timeout 1500 npm test' > /tmp/test2.log 2>&1 &
sleep 240; grep -c "^ok\|^not ok" /tmp/test2.log; grep -E "^# (tests|pass|fail)" /tmp/test2.log; grep -c "not ok" /tmp/test2.log; tail -3 /tmp/test2.log | cut -c1-200
sleep 300; grep -E "^# (tests|suites|pass|fail|cancelled|skipped|todo)" /tmp/test2.log; grep -c "^not ok\|^    not ok\|  not ok" /tmp/test2.log; grep -E "^(real|user)" /tmp/test2.log; tail -2 /tmp/test2.log | cut -c1-200
sleep 420; grep -E "^# (tests|suites|pass|fail|cancelled|skipped|todo)" /tmp/test2.log; grep -c "not ok" /tmp/test2.log; grep -E "^(real|user)" /tmp/test2.log; tail -2 /tmp/test2.log | cut -c1-200
cd <guest-path> && ls app/mcp app/api 2>/dev/null; find app -path "*mcp*" -name "*.js" | head; grep -rn "registerTool\|name: '" lib/mcp* 2>/dev/null | head -5; ls lib | head -80; grep -n -i "sign-in\|signin\|otp\|code" AGENTS.md | head -20
cd <guest-path> && sed -n 40,80p lib/mcp/server.js; grep -n "name:" lib/mcp/*.js | head -60; cat app/api/mcp/route.js | head -40; ls app/api/auth; 
cd <guest-path> && grep -rln "ACTIONS" lib | head; grep -rhn "^\s*name: \"" lib/actions 2>/dev/null | head -80; grep -n "emailOTP\|email-otp\|sendVerificationOTP\|magicLink" lib/auth.js | head; grep -rn "api_key\|apiKey" lib/actions/*.js 2>/dev/null | grep "name:" | head
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && nohup npm run dev > /tmp/dev.log 2>&1 & sleep 25; tail -5 /tmp/dev.log; curl -s -m 60 -o /dev/null -w "health=%{http_code}\n" http://localhost:3000/api/health; curl -s -m 60 http://localhost:3000/api/health | head -c 400; echo; grep -n "api-keys\|app/api/v1\|/api-keys" <guest-path> | head -5
cd /tmp && rm -f /tmp/jar.txt && curl -s -m 60 -c /tmp/jar.txt -b /tmp/jar.txt -H "Content-Type: application/json" -H "Origin: http://localhost:3000" -X POST http://localhost:3000/api/auth/email-otp/send-verification-otp -d '{"email":"<email>","type":"sign-in"}'; echo; sleep 3; grep -n "Code for" /tmp/dev.log | tail -2
cd <guest-path> && sed -n 40,70p lib/auth.js; grep -rn "signin\|send-verification\|Code for" app/signin/*.js* lib/auth.js 2>/dev/null | head -10; grep -rln "Code for" lib app | head
cd <guest-path> && sed -n 1,82p app/signin/actions.js
cd <guest-path> && grep -rni "guest" --include=*.js --include=*.md --include=*.mjs . 2>/dev/null | grep -v node_modules | grep -v "^./.next" | head -10; env | grep -i "cdp\|browser\|chrome" | sed 's/=.*/=<set>/'; ls tests/helpers | head -30
cd <guest-path> && sed -n 1,80p tests/helpers/app.mjs | cut -c1-220
cd <guest-path> && curl -s -m 120 http://localhost:3000/signin -o /tmp/signin.html -w "%{http_code}\n"; grep -o 'createServerReference)("[0-9a-f]*"[^)]*"[A-Za-z]*"' -r .next/static .next/server 2>/dev/null | sed 's/.*("\([0-9a-f]*\)".*"\([A-Za-z]*\)"/\2 \1/' | sort -u | grep -i "signin\|apikey\|api_key\|sendSignin\|verifySignin" | head; grep -rho 'createServerReference)("[0-9a-f]*",[^,]*,[^,]*,[^,]*,"[A-Za-z]*")' .next 2>/dev/null | head -3
cd /tmp && curl -s -m 120 -c /tmp/jar.txt -b /tmp/jar.txt -H "Next-Action: 60877ef142e385b6f685982fef473707f1103dc492" -F "1=\"\$undefined\"" -F "<email>" http://localhost:3000/signin | head -c 400; echo; sleep 2; grep -n "Code for\|signin" /tmp/dev.log | tail -3
cd /tmp && grep -o '/_next/static[^"]*\.js' /tmp/signin.html | sort -u > /tmp/chunks.txt; wc -l < /tmp/chunks.txt; for c in $(cat /tmp/chunks.txt); do curl -s -m 120 "http://localhost:3000$c"; done > /tmp/signin_chunks.js; grep -o 'createServerReference)("[0-9a-f]*",[^)]*"\(sendSigninCode\|verifySigninCode\|createApiKey\)")' /tmp/signin_chunks.js | sed 's/.*("\([0-9a-f]*\)".*"\([A-Za-z]*\)")/\2 \1/' | sort -u; grep -o 'createServerReference)("[0-9a-f]*",[^)]*"\(sendSigninCode\|verifySigninCode\)")' /tmp/signin_chunks.js | head -2 | cut -c1-200
cd <guest-path> && grep -rl "sendSigninCode" .next 2>/dev/null | head; f=$(grep -rl '"sendSigninCode"' .next/static 2>/dev/null | head -1); echo "FILE=$f"; grep -o '.\{160\}"sendSigninCode".\{20\}' "$f" | head -2; echo; grep -o '.\{10\}"verifySigninCode".\{5\}' .next/static -r | head -2
cd <guest-path> && grep -c "60877ef142e385b6f685982fef473707f1103dc492" .next/server/app/signin/page/server-reference-manifest.json; python3 -I -c "import json;d=json.load(open('.next/server/app/signin/page/server-reference-manifest.json'));print(list(d.keys())); print([ (k,v.get('exportedName')) for k,v in d.get('node',{}).items()][:10] if isinstance(d.get('node'),dict) else '')" 2>&1 | cut -c1-600
cd <guest-path> && grep -n -i "action\|409\|origin" proxy.js | head -20; grep -rn "Server Action unavailable" node_modules/next/dist/server/*.js node_modules/next/dist/server/**/*.js 2>/dev/null | head -3 | cut -c1-300; tail -5 /tmp/dev.log | cut -c1-300
cd /tmp && curl -s -m 120 -c /tmp/jar.txt -b /tmp/jar.txt -D - -o /tmp/act.out -H "Origin: http://localhost:3000" -H "Referer: http://localhost:3000/signin" -H "Accept: text/x-component" -H "Next-Action: 60877ef142e385b6f685982fef473707f1103dc492" -F "<email>" -F "0=[\"\$K1\"]" -F "<email>" http://localhost:3000/signin | grep -i "^HTTP\|x-action\|content-type" ; head -c 300 /tmp/act.out; echo; tail -3 /tmp/dev.log | cut -c1-200
cd <guest-path> && for p in $(ps -eo pid,args | grep -E "next dev|next-server|npm run dev" | grep -v grep | awk '{print $1}'); do kill $p 2>/dev/null; done; sleep 5; ps -eo pid,args | grep -E "next" | grep -v grep | cut -c1-100; export NODE_USE_ENV_PROXY=1; nohup npm run dev > /tmp/dev2.log 2>&1 &
sleep 20; curl -s -m 180 -o /tmp/signin2.html -w "GET=%{http_code}\n" http://localhost:3000/signin; rm -f /tmp/jar.txt; curl -s -m 120 -c /tmp/jar.txt -b /tmp/jar.txt -H "Origin: http://localhost:3000" -H "Accept: text/x-component" -H "Next-Action: 60877ef142e385b6f685982fef473707f1103dc492" -F "<email>" -F "0=[\"\$K1\"]" http://localhost:3000/signin | head -c 300; echo; sleep 2; grep -n "Code for\|Failed to find" /tmp/dev2.log | head -3 | cut -c1-200
cd <guest-path> && grep -n "Failed to find Server Action\|getActionModIdOrError\|workers\|serverActionsManifest\[" node_modules/next/dist/server/app-render/action-handler.js | head -20; grep -rn "findActionMod\|function getActionModId" node_modules/next/dist/server/app-render/action-handler.js | head -3
cd <guest-path> && sed -n 540,570p node_modules/next/dist/server/app-render/action-handler.js; sed -n 985,1000p node_modules/next/dist/server/app-render/action-handler.js
cd <guest-path> && python3 -I -c "
import json
d=json.load(open('.next/server/server-reference-manifest.json'))
print(list(d.keys()))
for rt in ('node','edge'):
    m=d.get(rt,{})
    print(rt, len(m), '60877ef142e385b6f685982fef473707f1103dc492' in m)
    print([k for k in m if 'sendSignin' in json.dumps(m[k])][:2])
"; ls -la .next/server/server-reference-manifest.* | head; ls .next | head -30
cd <guest-path> && find .next/dev -name "server-reference-manifest*" 2>/dev/null | head; for f in $(find .next/dev -name "server-reference-manifest.json" 2>/dev/null); do echo $f; grep -c "60877ef142e385b6f685982fef473707f1103dc492" $f; done; date
cd <guest-path> && ps -eo pid,args | grep -E "next (dev|start)|next-server" | grep -v grep | awk '{print $1}' | xargs -r kill; sleep 2; rm -rf .next/dev; (nohup npm run dev > /tmp/dev.log 2>&1 &); for i in $(seq 1 60); do c=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/signin); [ "$c" = "200" ] && break; sleep 2; done; echo "signin=$c"; grep -c "60877ef142e385b6f685982fef473707f1103dc492" .next/dev/server/server-reference-manifest.json 2>/dev/null; cat .next/dev/server/server-reference-manifest.json 2>/dev/null | python3 -c "import json,sys;d=json.load(sys.stdin);print(list(d.get('node',{}).keys())[:3])"
cd <guest-path> && python3 - <<'EOF'
import json,urllib.request
d=json.load(open('.next/dev/server/server-reference-manifest.json'))
ids=list(d['node'].keys())
print(len(ids))
# find the action from app/signin/actions.js
import subprocess
hits=[]
for i in ids:
    e=d['node'][i]
    if 'signin' in json.dumps(e): hits.append((i,e.get('filename'),e.get('exportedName')))
print(hits[:5])
EOF
cd <guest-path> && curl -s -X POST http://localhost:3000/signin -H "Next-Action: 60f72e04a7866a09ffeca5fc6a7026563ba1bb0936" -H "Accept: text/x-component" -H "Content-Type: multipart/form-data; boundary=XX" --data-binary $'--XX\r\nContent-Disposition: form-data; name="1_email"\r\n\r\n<email>\r\n--XX\r\nContent-Disposition: form-data; name="0"\r\n\r\n[{"$ACTION_ID_60f72e04a7866a09ffeca5fc6a7026563ba1bb0936":"1_email"}]\r\n--XX--\r\n' -w "\nHTTP %{http_code}\n" | tail -c 800
cd <guest-path> && sed -n 1,60p app/signin/actions.js | grep -n "formData.get\|export" ; grep -rn "name=\"email\"\|name=\"code\"\|useActionState" app/signin | head
cd <guest-path> && curl -s -X POST http://localhost:3000/signin -H "Next-Action: 60f72e04a7866a09ffeca5fc6a7026563ba1bb0936" -H "Accept: text/x-component" -H "Content-Type: multipart/form-data; boundary=XX" --data-binary $'--XX\r\nContent-Disposition: form-data; name="0"\r\n\r\n[null,"$K1"]\r\n--XX\r\nContent-Disposition: form-data; name="1_email"\r\n\r\n<email>\r\n--XX--\r\n' -w "\nHTTP %{http_code}\n" | tail -c 900; echo; grep -i "signin\]" /tmp/dev.log | tail -3
cd <guest-path> && sed -n 25,35p app/signin/actions.js; grep -rn "Enter a valid email" lib app | head -3
cd <guest-path> && grep -rn "function normalizeEmail" -A8 lib app | head -15
cd <guest-path> && curl -s -X POST http://localhost:3000/signin -H "Next-Action: 60f72e04a7866a09ffeca5fc6a7026563ba1bb0936" -H "Accept: text/x-component" -H "Content-Type: multipart/form-data; boundary=XX" --data-binary $'--XX\r\nContent-Disposition: form-data; name="0"\r\n\r\n[null,"$K1"]\r\n--XX\r\nContent-Disposition: form-data; name="1_email"\r\n\r\n<email>\r\n--XX\r\nContent-Disposition: form-data; name="1_"\r\n\r\nx\r\n--XX--\r\n' -w "\nHTTP %{http_code}\n" | tail -c 400; echo; tail -5 /tmp/dev.log
cd <guest-path> && ps -eo pid,args | grep -E "next (dev|start)|next-server|next/dist" | grep -v grep | awk '{print $1}' | xargs -r kill; docker ps --format '{{.Names}}' 2>/dev/null | grep -q . && docker stop $(docker ps -q) >/dev/null 2>&1; sleep 2; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:3000/ ; ls -la .coldpass 2>/dev/null; grep -n "Node.js 22\|npm run dev\|npm install\|npm test\|Every action is a tool\|docker run -d" README.md
cd <guest-path> && (nohup npm run dev > /tmp/dev2.log 2>&1 &); for i in $(seq 1 60); do c=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/signin); [ "$c" = "200" ] && break; sleep 2; done; curl -s -X POST http://localhost:3000/mcp -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_newsletters","arguments":{}}}' -w "\nHTTP %{http_code}\n"
cd <guest-path> && pkill -f "next dev" 2>/dev/null; ps -eo pid,args | grep "next dev\|next-server\|next/dist/bin" | grep -v grep | awk '{print $1}' | xargs -r kill; mkdir -p .coldpass && cat > .coldpass/claims.json <<'EOF'
[
  {"kind":"claim","claim":"MCP endpoint requires a full access key","source":"**MCP**: connect Claude Code with a full access key. Every action is a tool.","input":"tools/call list_newsletters without a key","expected":"request rejected as unauthorized","probe_kind":"mcp","argv":["server"],"tool":"list_newsletters","arguments":{},"expected_text":"unauthorized","cwd":"/workspace"}
]
EOF
cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["server"],"cwd":"/workspace","tool":"list_newsletters","arguments":{},"expected_text":"unauthorized"}
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected": false, "note": "No dependency or lifecycle cycle was observed in the run."}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {"kind":"example","command":"npm test","result":"1200 pass, 0 fail (after installing mongod 8.0 for integration tests)"}
]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && ps -eo pid,args | grep "next dev\|next-server\|next/dist/bin" | grep -v grep | awk '{print $1}' | xargs -r kill; mkdir -p .coldpass && cat > .coldpass/claims.json <<'EOF'
[
  {"kind":"claim","claim":"MCP endpoint requires a full access key","source":"**MCP**: connect Claude Code with a full access key. Every action is a tool.","input":"tools/call list_newsletters without a key","expected":"request rejected as unauthorized","probe_kind":"mcp","argv":["server"],"tool":"list_newsletters","arguments":{},"expected_text":"unauthorized","cwd":"/workspace"}
]
EOF
cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["server"],"cwd":"/workspace","tool":"list_newsletters","arguments":{},"expected_text":"unauthorized"}
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected": false, "note": "No dependency or lifecycle cycle was observed in the run."}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {"kind":"example","command":"npm test","result":"1200 pass, 0 fail (after installing mongod 8.0 for integration tests)"}
]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && sed -i 's#"cwd":"/workspace"#"cwd":"<guest-path>"#g' .coldpass/claims.json .coldpass/probe.json && cat > .coldpass/cycles.json <<'EOF'
{"detected": false, "explanation": "No dependency or lifecycle cycle was observed in the run.", "note": "No dependency or lifecycle cycle was observed in the run."}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {"kind":"example","command":"npm test","input":"","expected":"documented command completes successfully","result":"1200 pass, 0 fail (after installing mongod 8.0 for integration tests)"}
]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && grep -rln "StdioServerTransport\|stdio" --include=*.js --include=*.mjs --include=*.json . 2>/dev/null | grep -v node_modules | grep -v "^./.next" | head; grep -n '"bin"' -A3 package.json; ls scripts 2>/dev/null
cd <guest-path> && cat > .coldpass/cycles.json <<'EOF'
{"detected": false, "reason": "No dependency or lifecycle cycle was observed in the run.", "explanation": "No dependency or lifecycle cycle was observed in the run."}
EOF
mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "blocked",
  "fault_owner": "environment",
  "operation": "MCP tool call (list_newsletters) via /mcp after README setup",
  "steps": [
    "Installed Node 22.23.4 via NodeSource (deb.nodesource.com setup_22.x).",
    "npm install / npm ci succeeded; npm run lint and npm run build ran.",
    "Installed mongod 8.0.34 from repo.mongodb.org because the integration tests require it; npm test: 1200 pass, 0 fail.",
    "Created .env.local from .env.example with generated secrets and <email>, SENDING_ENABLED=false.",
    "npm run dev served /signin with HTTP 200.",
    "Unauthenticated tools/call list_newsletters to /mcp returned HTTP 401 code unauthorized (the product's real response)."
  ],
  "deviations": [
    "Could not obtain an API key: sign-in via the Next server action sendSigninCode is not reproducible by hand-built curl requests (server received empty FormData; 409 'Failed to find Server Action' earlier, resolved after a clean dev restart but form body still not decoded). Not worked around by reading the database.",
    "Repo has no stdio MCP entrypoint; the MCP server is an HTTP route at /mcp, so probe argv [\"server\"] cannot be replayed by the checker.",
    "Pinned commit checkout was not verified separately in this report."
  ],
  "credentials_error": "No API key available; sign-in code flow via server action could not be completed by curl.",
  "evidence_strength": "partial: setup, tests, lint, build and dev server verified; authenticated MCP tool call not achieved"
}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -5
cd <guest-path> && ps -eo pid,args | grep -E "next dev|next-server|next/dist/bin" | grep -v grep | awk '{print $1}' | xargs -r kill; sleep 1; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:3000/ ; ls .coldpass