stevenzhao07/medxpert-reg-hub

Review signals: 1 known vulnerability.

OSV reports a known vulnerability in this dependency version. mcp

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Keyword lookup searches hubs and reports matching lines.: Real input produced the expected result: 共命中 33 行

  Source: medxpert quick 关节镜 # 关键词速查 / keyword lookup

  Input: 关节镜

  Expected: matching hub excerpts and hit count

  Command: node bin/medxpert.js quick '关节镜'

  Observed: 共命中 33 行（33 个枢纽文件）。

Examples

• Run the documented keyword lookup for arthroscopy.: command completed successfully

  Source: README.md / 安装 / Install

  Input: 关节镜

  Expected: 33 matching lines across hubs

  Command: node bin/medxpert.js quick '关节镜'

  Observed: 、再处理程序不当等，须在 IFU 写清经确认的再处理程序。 📄 骨科手术器械_全球注册路径汇编.md (命中 17 行) L8: > 编制日期：2026-08-13 ｜ 适用产品：运动医学 / 关节镜无源手术器械 L28: 三类产品均为**无源、可重复使用（或一次性）、配套关节镜/内窥镜使用**的手动手术器械，材质多为外科不锈钢（YY/T 0294.1 / ASTM F899），部分含镍钛合金（Ni-Ti，GB/T 24627 / ASTM F2063）。 L30: - **骨科手术器械（蓝钳 / 取物骨科手术器械）**：关节镜/内窥镜下抓取、取出游离体、软骨碎片或结石。对应中国目录 `02-15-18 内窥镜用取石器械`、`02-04 内窥镜用组织钳/异物钳`。 L31: - **骨科手术器械（断线钳 / 关节镜剪）**：剪断、修整缝线或软组织。对应 `02-03-03 内窥镜用剪`、`02-04 剪钳`。 L34: **关键判定**：配套内窥镜/关节镜使用的版本，各市场普遍归为中低风险（中国 II 类 / 美欧多按 II 类或 I 类可重复使用器械 / 东盟 B 类）；开放手术普通手动钳剪风险更低（中国 I 类 / 美 510(k) 豁免）。本汇编以**关节镜用版本**为基准。 … 其余 12 行 共命中 33 行（33 个枢纽文件）。

Local or hosted: local

README documented medxpert CLI keyword lookup

pwd && git status --short --branch && rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'requirements*.txt' -g 'Dockerfile*' -g '.github/**' | head -80 && python3 --version && python3 -m pip --version
ls -la && rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'requirements*.txt' -g '.github/**' | head -80 && python3 --version && python3 -m pip --version
cat README.md && cat package.json && find . -maxdepth 2 -type f -not -path './.coldpass/*' | sort
node --version; npm --version; sed -n '1,240p' bin/medxpert.js; cat mcp/README.md; cat mcp/requirements.txt
node bin/medxpert.js quick 关节镜; node bin/medxpert.js info; python3 -m pip install -r mcp/requirements.txt
mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["node","bin/medxpert.js","quick","关节镜"],"cwd":"<guest-path>","expected_text":"共命中 33 行"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Keyword lookup searches hubs and reports matching lines.","source":"medxpert quick 关节镜                   # 关键词速查 / keyword lookup","input":"关节镜","expected":"matching hub excerpts and hit count","probe_kind":"cli","argv":["node","bin/medxpert.js","quick","关节镜"],"expected_text":"共命中 33 行","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Run the documented keyword lookup for arthroscopy.","source":"README.md / 安装 / Install","input":"关节镜","expected":"33 matching lines across hubs","argv":["node","bin/medxpert.js","quick","关节镜"],"cwd":"<guest-path>","expected_text":"共命中 33 行"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README install commands and bin/medxpert.js entry point; the CLI performs one lookup or link scan per invocation and defines no scheduler, loop, webhook, or cycle trigger.","checks":[]}
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"README documented medxpert CLI keyword lookup","operation_scope":"Node.js 22.23.4 satisfies package requirement >=18; no product dependencies required for CLI","steps":["Read README.md and package.json","Confirmed Node v22.23.4 and npm 10.9.9","Ran node bin/medxpert.js info","Ran node bin/medxpert.js quick 关节镜; returned excerpts and 33 matching lines","Replayed probe, README claim, example, and cycle inspection with checker; validation passed"],"deviations":["Attempted python3 -m pip install -r mcp/requirements.txt; system pip rejected it with externally-managed-environment (PEP 668). Python MCP server was not required for the documented CLI operation."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF