talirezun/the-curator

Review signals: 6 download and execute, 15 hardcoded secret, 27 known vulnerability, 2 sensitive read.

Reviewed as expected for a test run: tests pointed config folders at /dev/null, where nothing can be written.

Source contains download and execute; review its purpose. 5 distinct locations. 6 findings.

Gitleaks found a possible hardcoded secret; value withheld. 10 distinct locations. 15 findings.

OSV reports a known vulnerability in this dependency version. 8 distinct locations. 23 findings.

A repository process attempted to read this sensitive path. 2 distinct locations. 2 findings. 6 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The MCP bridge is a stdio child process that answers list_domains with the domains in the knowledge folder: Real input produced the expected result: reading-notes

  Source: The MCP bridge is a **stdio child process**

  Input: {"tool": "list_domains", "arguments": {}}

  Expected: list_domains returns reading-notes

  Command: node mcp/server.js --domains-path <guest-path> tools/call {"tool": "list_domains", "arguments": {}}

  Observed: reading-notes\"\n ]\n}"}]}

Examples

• Contributor test suite (npm test) run on Node 22 (CI version); documented in README Contributing row: npm test ran: 277 suites, 271 passed, 6 failed. Failing: test-update-installer, test-next-sync-badge-invalidation, test-update-in-app (need pinned historical commits; the workspace is a depth-1 clone of 4688ade), test-working-state-disclosure (120s timeout), test-build-model and test-mcp-usage (cause not verified). The README documents no nonzero exit, so this is recorded rather than replayed as a pass. Run with Node 18 (system) gave 269 passed, 8 failed.

  Source: README.md Documentation table: CONTRIBUTING.md 'running the tests (`npm test` / `npm run test:live`)'

  Expected: documented command completes successfully

  Observed: npm test ran: 277 suites, 271 passed, 6 failed. Failing: test-update-installer, test-next-sync-badge-invalidation, test-update-in-app (need pinned historical commits; the workspace is a depth-1 clone of 4688ade), test-working-state-disclosure (120s timeout), test-build-model and test-mcp-usage (cause not verified). The README documents no nonzero exit, so this is recorded rather than replayed as a pass. Run with Node 18 (system) gave 269 passed, 8 failed.

Local or hosted: local

Run The Curator's local MCP bridge (node mcp/server.js) and call list_domains against a knowledge folder that contains a domain created through the web API

cd <guest-path> && pwd && ls -la && id -u && cat README.md 2>/dev/null | head -200; python3 --version; git -C . rev-parse HEAD 2>&1 | head -1
cd <guest-path> && grep -n -i -E "^#|install|quick|npm|node|\`\`\`" README.md | head -150
cd <guest-path> && sed -n 453,490p README.md; sed -n 532,548p README.md; node -v; npm -v; cat package.json | head -40
cd <guest-path> && sudo -n true && echo SUDO_OK; (sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm >/tmp/apt.log 2>&1; echo apt_rc=$?); node -v; npm -v
cd <guest-path> && git init -q && git remote add origin https://github.com/talirezun/the-curator && git fetch -q --depth 1 origin 4688ade333c898da7ce88e1c237e4fcb3dd458a7 && git reset -q --mixed FETCH_HEAD && git log --oneline -1; export NODE_USE_ENV_PROXY=1; npm install 2>&1 | tail -15; echo rc=$?
cd <guest-path> && grep -n -i "mcp" README.md | head -40; echo ---; ls mcp; echo ---; grep -n "name: '" mcp/*.js | head -60
cd <guest-path> && sed -n 545,570p README.md; echo ---; ls mcp/tools; sed -n 1,80p mcp/server.js | head -120
cd <guest-path> && ls -la domains | head; echo ---; grep -n "name:" mcp/tools/domains.js mcp/tools/search.js mcp/tools/index.js | head -20; echo ---; grep -n -A3 "name: 'list" mcp/tools/*.js | head -20; ls docs | head -50
cd <guest-path> && mkdir -p <guest-path> && (CURATOR_NO_OPEN=1 DOMAINS_PATH=<guest-path> nohup node src/server.js > <guest-path> 2>&1 &) ; sleep 4; cat <guest-path> | head -30; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:3333/; grep -n -E "^(GET|POST|PUT|DELETE|PATCH) |\| *(GET|POST)" docs/api-reference.md | head -60
cd <guest-path> && grep -n -i "domain" docs/api-reference.md | grep -i -E "post|create|add" | head; grep -rn -i "api/domains" src --include=*.js | head -20
cd <guest-path> && sed -n 98,125p docs/api-reference.md
cd <guest-path> && curl -s -X POST http://localhost:3333/api/domains -H 'Content-Type: application/json' -d '{"displayName":"Reading Notes","description":"Notes on articles I read.","template":"generic"}'; echo; ls <guest-path>; echo; cat <guest-path> 2>/dev/null | head -5
cd <guest-path> && printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_domains","arguments":{}}}' | timeout 20 node mcp/server.js --domains-path <guest-path> 2><guest-path> | tail -2; echo rc=$?; head -5 <guest-path>
cd <guest-path> && ls -la .coldpass; ls /inputs 2>/dev/null; grep -n "stdio JSON-RPC child process" README.md; grep -rn -E "setInterval|node-cron|cron\.|schedule\(" src bin mcp --include=*.js | grep -v public | head -20; ls <guest-path> 2>/dev/null
cd <guest-path> && grep -n -i -E "\-\-once|\-\-now|every (hour|day|minute)|scheduled|webhook|cron" README.md | head; grep -rn -E "\-\-once|\-\-now|setInterval\(" bin src/brain src/routes 2>/dev/null | head; grep -n "command\|case '" bin/curator.js | head -30
cd <guest-path> && export NODE_USE_ENV_PROXY=1; timeout 900 npm test > <guest-path> 2>&1; echo rc=$?; tail -25 <guest-path>
cd <guest-path> && grep -n -B2 -A12 -E "FAIL|✗|Error" <guest-path> | sed 's/\\x1b\[[0-9;]*m//g' | head -150
cd <guest-path> && sed 's/\\x1b\[[0-9;]*m//g' <guest-path> | grep -n -A8 -E "FAIL  test-(build-model|route-write|mcp-usage|frontend-syntax)" | head -80; sed 's/\\x1b\[[0-9;]*m//g' <guest-path> | grep -n -A3 "parses\|✗" | grep -i "error\|✗" | head -20
cd <guest-path> && sed 's/\\x1b\[[0-9;]*m//g' <guest-path> | grep -n -A6 -E "(build-model|route-write-guards|mcp-usage)\.js" | head -60; echo ---; sed -n 1,12p scripts/test-frontend-syntax.js | head -5; grep -n "isWellFormed\|parse" scripts/test-frontend-syntax.js | head -5
cd <guest-path> && grep -n -i -E "node(\.js)? ?(2[0-9]|18|v?[0-9]+\+)|node-version" CONTRIBUTING.md .github/workflows/*.yml | head -15
cd <guest-path> && export NODE_USE_ENV_PROXY=1; (curl -fsSL --max-time 180 https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt -o sums.txt && f=$(grep -o "node-v22[0-9.]*-linux-x64.tar.xz" sums.txt | head -1) && curl -fsSL --max-time 300 https://nodejs.org/dist/latest-v22.x/$f -o node22.tar.xz && mkdir -p node22 && tar -xJf node22.tar.xz -C node22 --strip-components=1 && ./node22/bin/node -v) 2>&1 | tail -5; echo rc=$?
cd <guest-path> && export PATH=<guest-path> NODE_USE_ENV_PROXY=1; node -v; timeout 1200 npm test > <guest-path> 2>&1; echo rc=$?; sed 's/\\x1b\[[0-9;]*m//g' <guest-path> | tail -15
cd <guest-path> && sed 's/\\x1b\[[0-9;]*m//g' <guest-path> | grep -n -A5 -E "FAIL.*(build-model|mcp-usage|working-state-disclosure|update-in-app)" | head -50
cd <guest-path> && sed 's/\\x1b\[[0-9;]*m//g' <guest-path> | sed -n 192,260p | grep -E "✗|Error|assert" | head -12; sed 's/\\x1b\[[0-9;]*m//g' <guest-path> | sed -n 342,360p | grep -E "✗|Error" | head -5
cd <guest-path> && sed -n 1,40p scripts/run-tests.js | grep -v "^$" | head -40; grep -n "argv\|process.argv" scripts/run-tests.js | head
cd <guest-path> && grep -c -F "The MCP bridge is a **stdio child process**" README.md && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","mcp/server.js","--domains-path","<guest-path>"],"cwd":"<guest-path>","tool":"list_domains","arguments":{},"expected_text":"reading-notes"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The MCP bridge is a stdio child process that answers list_domains with the domains in the knowledge folder","source":"The MCP bridge is a **stdio child process**","input":"domains path containing reading-notes","expected":"list_domains returns reading-notes","probe_kind":"mcp","argv":["node","mcp/server.js","--domains-path","<guest-path>"],"tool":"list_domains","arguments":{},"expected_text":"reading-notes","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Contributor test suite (npm test) run on Node 22 (CI version); documented in README Contributing row","source":"README.md Documentation table: CONTRIBUTING.md 'running the tests (`npm test` / `npm run test:live`)'","reason":"npm test ran: 277 suites, 271 passed, 6 failed. Failing: test-update-installer, test-next-sync-badge-invalidation, test-update-in-app (need pinned historical commits; the workspace is a depth-1 clone of 4688ade), test-working-state-disclosure (120s timeout), test-build-model and test-mcp-usage (cause not verified). The README documents no nonzero exit, so this is recorded rather than replayed as a pass. Run with Node 18 (system) gave 269 passed, 8 failed."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md, package.json scripts (start, dev, mcp, test), bin/curator.js (version/help/context/save/doctor/install-hooks subcommands), mcp/server.js (stdio, runs per client request). No cron, scheduler, --once/--now flag, webhook or polling loop for a user-facing cycle was found in README or src/bin/mcp. The README's only periodic mention is roadmap-automatic-sync, a roadmap doc, not a shipped cycle.","checks":[]}
EOF
python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['probe.json','claims.json','examples.json','cycles.json']];print('json ok')"
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay; echo rc=$?
cd <guest-path> && pkill -f "node src/server.js"; sleep 1; (curl -s -o /dev/null -w "%{http_code}" http://localhost:3333/ || echo " port 3333 closed"); cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run The Curator's local MCP bridge (node mcp/server.js) and call list_domains against a knowledge folder that contains a domain created through the web API","operation_scope":"Linux, Node 18.19.1 (system) for the bridge and web server; Node 22.23.4 (user-local, CI version) for npm test. Pinned commit 4688ade. No API key needed for these operations. Knowledge folder <guest-path>, outside the checkout.","steps":["sudo apt-get install -y nodejs npm (Node 18.19.1; README requires 18+)","git init; git remote add origin https://github.com/talirezun/the-curator; git fetch --depth 1 origin 4688ade333c898da7ce88e1c237e4fcb3dd458a7; git reset --mixed FETCH_HEAD","NODE_USE_ENV_PROXY=1 npm install (README Option C)","CURATOR_NO_OPEN=1 DOMAINS_PATH=<guest-path> node src/server.js (web app on :3333; started, then stopped)","curl -X POST http://localhost:3333/api/domains -d '{\"displayName\":\"Reading Notes\"...}' (docs/api-reference.md: POST /api/domains) -> slug reading-notes","node mcp/server.js --domains-path <guest-path>, tools/call list_domains -> count 1, reading-notes","npm test (README Documentation table / CONTRIBUTING) on Node 18 and on Node 22"],"deviations":["Node.js and npm were absent; installed Node 18.19.1 via apt (sudo). README requires 18+.","Workspace was not a git checkout; ran the git init/fetch/reset steps from the task with the pinned commit.","README Option B (curl | sh installer) was not run; Option C (manual npm install) was used, since the guest is Linux and the installer is macOS-specific.","No domain existed, so the domain was created with POST /api/domains (documented in docs/api-reference.md) instead of the UI.","npm test on Node 18: 269 passed, 8 failed. On Node 22 (CI version, downloaded from nodejs.org to <guest-path>): 271 passed, 6 failed. test-update-installer, test-next-sync-badge-invalidation and test-update-in-app need pinned historical commits (ca8e60e, 32cb410) that a depth-1 clone does not have. test-working-state-disclosure timed out at 120s. test-build-model and test-mcp-usage failed; I did not confirm whether the cause is in the repo or the environment.","No product scheduler or cycle was found, so cycles.json records detected:false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None needed for the working operation. For the test suite: run it from a full clone (not depth 1) so the pinned-history tests can resolve their commits, and check test-build-model and test-mcp-usage and the 120s timeout on test-working-state-disclosure against the repo's CI on Node 22."}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c "import json,sys;d=json.load(sys.stdin);print('valid',d['valid'],'problems',d['problems'],'replay',d['replay']['status'])"
cd <guest-path> && ls -la .coldpass; pgrep -af "src/server.js" | grep -v pgrep || echo "no server running"; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:3333/ || echo "port 3333 closed"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run The Curator's local MCP bridge (node mcp/server.js) and call list_domains against a knowledge folder that contains a domain created through the web API","operation_scope":"Linux, Node 18.19.1 (system) for the bridge and web server; Node 22.23.4 (user-local, CI version) for npm test. Pinned commit 4688ade. No API key needed for these operations. Knowledge folder <guest-path>, outside the checkout.","steps":["sudo apt-get install -y nodejs npm (Node 18.19.1; README requires 18+)","git init; git remote add origin https://github.com/talirezun/the-curator; git fetch --depth 1 origin 4688ade333c898da7ce88e1c237e4fcb3dd458a7; git reset --mixed FETCH_HEAD","NODE_USE_ENV_PROXY=1 npm install (README Option C)","CURATOR_NO_OPEN=1 DOMAINS_PATH=<guest-path> node src/server.js (web app on :3333; started, then stopped)","curl -X POST http://localhost:3333/api/domains -d '{\"displayName\":\"Reading Notes\"...}' (docs/api-reference.md: POST /api/domains) -> slug reading-notes","node mcp/server.js --domains-path <guest-path>, tools/call list_domains -> count 1, reading-notes","npm test (README Documentation table / CONTRIBUTING) on Node 18 and on Node 22"],"deviations":["Node.js and npm were absent; installed Node 18.19.1 via apt (sudo). README requires 18+.","Workspace was not a git checkout; ran the git init/fetch/reset steps from the task with the pinned commit.","README Option B (curl | sh installer) was not run; Option C (manual npm install) was used, since the guest is Linux and the installer is macOS-specific.","No domain existed, so the domain was created with POST /api/domains (documented in docs/api-reference.md) instead of the UI.","npm test on Node 18: 269 passed, 8 failed. On Node 22 (CI version, downloaded from nodejs.org to <guest-path>): 271 passed, 6 failed. test-update-installer, test-next-sync-badge-invalidation and test-update-in-app need pinned historical commits (ca8e60e, 32cb410) that a depth-1 clone does not have. test-working-state-disclosure timed out at 120s. test-build-model and test-mcp-usage failed; I did not confirm whether the cause is in the repo or the environment.","No product scheduler or cycle was found, so cycles.json records detected:false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None needed for the working operation. For the test suite: run it from a full clone (not depth 1) so the pinned-history tests can resolve their commits, and check test-build-model, test-mcp-usage and the 120s timeout on test-working-state-disclosure against the repo's CI on Node 22."}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c "import json,sys;d=json.load(sys.stdin);print('valid',d['valid'],'problems',d['problems'],'replay',d['replay']['status'])"