petroladkin/hookwitness

Review signals: 19 hardcoded secret, 5 known vulnerability. 1 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Gitleaks found a possible hardcoded secret; value withheld. 7 distinct locations. 19 findings.

OSV reports a known vulnerability in this dependency version. golang.org/x/net 5 findings.

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Hookwitness is an MCP server: an agent can list its endpoints through the MCP bridge to the running server: Real input produced the expected result: /stripe/webhooks

  Source: - **[REST API](docs/api.md)** and **[MCP server](docs/agents.md#mcp)**:

  Input: {"tool": "list_endpoints", "arguments": {}}

  Expected: the endpoint list includes /stripe/webhooks

  Command: bin/hookwitness mcp -url http://127.0.0.1:8080 tools/call {"tool": "list_endpoints", "arguments": {}}

  Observed: /stripe/webhooks\",\"requests\":1,\"url\":\"http://127.0.0.1:8080/stripe/webhooks\"}]}"}], "structuredContent": {"endpoints": [{"counter": 1, "created_at": "2026-10-27T20:27:57.396Z", "enabled": true, "id": 1, "last_request_at": "2026-10-27T20:27:57.483Z", "path": "/stripe/webhooks", "requests": 1, "url": "http://127.0.0.1:8080/stripe/webhooks"}], "summary": "1 endpoint(s)"}}

Examples

• The quickstart server answers its health endpoint: command completed successfully

  Source: docs/getting-started.md

  Input: GET /healthz on the running server

  Expected: status ok

  Command: curl -s http://127.0.0.1:8080/healthz

  Observed: {"status":"ok","version":"dev","commit":"none"}

• Requests caught on an endpoint can be read back through the REST API: command completed successfully

  Source: docs/api.md (Requests)

  Input: GET requests of endpoint 1 created by the quickstart POST

  Expected: the POST request is listed

  Command: curl -s http://127.0.0.1:8080/admin/api/v1/endpoints/1/requests

  Observed: { "requests": [ { "id": 1, "endpoint_id": 1, "no": 1, "received_at": "2026-10-27T20:27:57.483Z", "method": "POST", "path": "/stripe/webhooks", "query": "", "status": 200, "verdict": "", "body_size": 36, "body_kept": true, "content_type": "application/json", "replays": 0 } ] }

Local or hosted: local

Build hookwitness from source, run its server, create a catch endpoint, send it a webhook, and read the endpoint back through the MCP server (list_endpoints) and the REST API

cd <guest-path> && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
ls -la <guest-path> ; ls /inputs 2>&1; echo "CDP_URL=$CDP_URL <env-var>=$<env-var>"
cd <guest-path> && which docker go make node npm 2>&1; go version 2>&1; docker --version 2>&1; cat Makefile; ls .coldpass; ls docs | head -50; cat <guest-path> | head -5
go version; env | grep -i -E 'proxy|GOPROXY|GOTOOLCHAIN' ; cat /etc/os-release | head -2; timeout 20 curl -sI https://go.dev/dl/go1.27.linux-amd64.tar.gz | head -3; echo "---"; timeout 20 curl -sI https://proxy.golang.org/golang.org/toolchain/@v/v0.0.1-go1.27.linux-amd64.info | head -3
cd /tmp && timeout 30 curl -s 'https://go.dev/dl/?mode=json&include=all' | python3 -c "import json,sys; d=json.load(sys.stdin); print([r['version'] for r in d if r['version'].startswith('go1.27')][:5]); print([f['filename'] for r in d if r['version'].startswith('go1.27') for f in r['files'] if f['os']=='linux' and f['arch']=='amd64' and f['kind']=='archive'][:3])"
mkdir -p /tmp/goroot-dl && cd /tmp/goroot-dl && timeout 600 curl -fsSL -o go1.27.3.linux-amd64.tar.gz https://go.dev/dl/go1.27.3.linux-amd64.tar.gz && ls -la && mkdir -p /tmp/go127 && tar -C /tmp/go127 -xzf go1.27.3.linux-amd64.tar.gz && /tmp/go127/go/bin/go version
cd <guest-path> && export PATH=/tmp/go127/go/bin:$PATH GOTOOLCHAIN=local && make build 2>&1 | tail -20 && ls -la bin/ && ./bin/hookwitness --help 2>&1 | head -60
cd <guest-path> && cat docs/getting-started.md | head -150; echo ====; ./bin/hookwitness serve -h 2>&1 | head -60
cd <guest-path> && grep -n -i -A12 '^## mcp' docs/agents.md | head -120; echo ====; sed -n 1,80p docs/api.md
mkdir -p /tmp/hw-data && cd <guest-path> && (nohup ./bin/hookwitness serve -db /tmp/hw-data/hookwitness.db > /tmp/hw-data/serve.log 2>&1 &) ; sleep 3; curl -s http://127.0.0.1:8080/healthz; echo; curl -s http://127.0.0.1:8080/admin/api/v1/endpoints; echo; tail -5 /tmp/hw-data/serve.log
cd <guest-path> && grep -n -A25 '^### Endpoints\|^## Routes' docs/api.md | head -80; grep -n 'requests' docs/api.md | head -20
API=http://127.0.0.1:8080/admin/api/v1; curl -s -X POST $API/endpoints -H 'Content-Type: application/json' -d '{"path":"/stripe/webhooks"}'; echo; curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1:8080/stripe/webhooks -H 'Content-Type: application/json' -d '{"type":"invoice.paid","id":"evt_1"}'; sleep 1; curl -s "$API/endpoints/1/requests" | head -c 800; echo
cd <guest-path> && ./bin/hookwitness mcp -h 2>&1 | head -30; grep -n -i 'tool' docs/agents.md | head -40
cd <guest-path> && sed -n 120,150p docs/agents.md
cd <guest-path> && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_endpoints","arguments":{}}}' | timeout 30 ./bin/hookwitness mcp -url http://127.0.0.1:8080 2>/tmp/hw-data/mcp.err; echo "rc=$?"; cat /tmp/hw-data/mcp.err | head -5
cd <guest-path> && grep -rn -E 'time\.NewTicker|time\.Tick\(|cron|--once|--now|prune' --include=*.go internal cmd | grep -v _test | head -20; echo ===; node --version; which gcc cc; go env CC 2>/dev/null; PATH=/tmp/go127/go/bin:$PATH go env CC
cd <guest-path> && sed -n 95,140p internal/store/vacuum.go; grep -rn -i 'vacuum' docs/*.md README.md | head -5; grep -rn 'Vacuum\|vacuum' --include=*.go internal cmd | grep -v _test | grep -v 'store/vacuum.go' | head
cd <guest-path> && export PATH=/tmp/go127/go/bin:$PATH GOTOOLCHAIN=local && make js-test 2>&1 | tail -5; echo "js rc=${PIPESTATUS[0]}"; timeout 1500 make test > /tmp/hw-data/test.log 2>&1; echo "test rc=$?"; tail -25 /tmp/hw-data/test.log
cd <guest-path> && grep -rn -i 'go-version\|go_version\|1\.2[67]' .github/workflows/*.yml | head; grep -n -i 'addr\|8080\|port' scripts/docscheck/*.go | head -20
cd <guest-path> && export PATH=/tmp/go127/go/bin:$PATH GOTOOLCHAIN=local && timeout 900 make docs-check > /tmp/hw-data/docs-check.log 2>&1; echo "rc=$?"; tail -40 /tmp/hw-data/docs-check.log
cd <guest-path> && grep -c -F -- '- **[REST API](docs/api.md)** and **[MCP server](docs/agents.md#mcp)**:' README.md && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["bin/hookwitness","mcp","-url","http://127.0.0.1:8080"],"cwd":"<guest-path>","tool":"list_endpoints","arguments":{},"expected_text":"/stripe/webhooks"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Hookwitness is an MCP server: an agent can list its endpoints through the MCP bridge to the running server","source":"- **[REST API](docs/api.md)** and **[MCP server](docs/agents.md#mcp)**:","input":"list_endpoints with no arguments, against the running server that holds /stripe/webhooks","expected":"the endpoint list includes /stripe/webhooks","probe_kind":"mcp","argv":["bin/hookwitness","mcp","-url","http://127.0.0.1:8080"],"tool":"list_endpoints","arguments":{},"expected_text":"/stripe/webhooks","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"The quickstart server answers its health endpoint","source":"docs/getting-started.md","input":"GET /healthz on the running server","expected":"status ok","argv":["curl","-s","http://127.0.0.1:8080/healthz"],"cwd":"<guest-path>","expected_text":"\"status\":\"ok\""},
{"kind":"example","claim":"Requests caught on an endpoint can be read back through the REST API","source":"docs/api.md (Requests)","input":"GET requests of endpoint 1 created by the quickstart POST","expected":"the POST request is listed","argv":["curl","-s","http://127.0.0.1:8080/admin/api/v1/endpoints/1/requests"],"cwd":"<guest-path>","expected_text":"\"method\": \"POST\""}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README, docs/ and cmd/internal entry points: no cron, scheduler, --once/--now or webhook-triggered product cycle is documented. The only background loop is internal/store/vacuum.go Housekeep, an internal ticker that reclaims freed SQLite space only after 8 MiB is freed; it has no documented trigger or observable output at this scale, so no cycle was run.","checks":[]}
EOF
python3 -I -c 'import json;[json.load(open(f"<guest-path>")) for n in ["probe","claims","examples","cycles"]];print("json ok")'
ls <guest-path>; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay; echo "rc=$?"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Build hookwitness from source, run its server, create a catch endpoint, send it a webhook, and read the endpoint back through the MCP server (list_endpoints) and the REST API","operation_scope":"Linux guest (Ubuntu 24.04, non-root uid 1000). Go 1.27.3 installed user-local at /tmp/go127 because the system Go could not fetch the go1.27 toolchain. No Docker. Server listens on 127.0.0.1:8080 with a fresh SQLite database at /tmp/hw-data/hookwitness.db, left running until guest teardown. No login (no users), so no credentials were needed.","steps":["make build (with Go 1.27.3 on PATH, GOTOOLCHAIN=local) -> bin/hookwitness","bin/hookwitness serve -db /tmp/hw-data/hookwitness.db (docs/getting-started.md step 1, source build)","curl http://127.0.0.1:8080/healthz -> status ok","POST /admin/api/v1/endpoints {\"path\":\"/stripe/webhooks\"} -> 201 endpoint 1 (docs/api.md)","curl -X POST http://127.0.0.1:8080/stripe/webhooks -d '{\"type\":\"invoice.paid\",\"id\":\"evt_1\"}' -> 200 (README quick start)","GET /admin/api/v1/endpoints/1/requests -> the POST is recorded","bin/hookwitness mcp -url http://127.0.0.1:8080, tools/call list_endpoints -> /stripe/webhooks listed (docs/agents.md MCP)","make js-test -> 0 failures","make test -> 1 failing test (see deviations)","make docs-check -> 43 blocks run, 24 skipped, 0 failed","checker --validate --replay -> PASS"],"deviations":["System Go could not fetch go1.27 ('toolchain not available'); installed go1.27.3 from https://go.dev/dl/go1.27.3.linux-amd64.tar.gz into /tmp/go127 (user-local, no sudo needed).","Docker is not installed; used the README's 'build from source' path instead of the docker run command.","make test: 1 failing test, internal/picture TestDecodedBytesBoundsTheDecode (budget_test.go:97: 'RGBA64 PNG: estimated 1985536, the decode allocated 1990536'). All other packages pass. The operation under test does not depend on it. Not fixed (no product source edits).","The task's /inputs/coldpass-preflight.py path does not exist in this guest; ran <guest-path> instead.","Git metadata was not needed: the Makefile falls back when git is absent, and the source snapshot was used as supplied (no git init/fetch of the pinned commit was performed)."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Fix the flaky/Go-version-sensitive memory-budget assertion in internal/picture/budget_test.go (estimate vs allocated bytes differ by about 5 KB for RGBA64 PNG) so make test passes on Go 1.27.3."}
EOF
python3 -I -c 'import json;d=json.load(open("<guest-path>"));print(d["outcome"], d["fault_owner"])'; ls -la .coldpass; ls -la report.json 2>&1 | head -1