twayst0/fsv

Review signals: 1 connection review, 1 hardcoded secret, 123 known vulnerability. 3 static matches retained as context.

Reviewed as expected for a test run: a Python interpreter or package manager probed its own interpreter file under a system program folder; attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 72 distinct locations. 15 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. .github/workflows/ci.yml

OSV reports a known vulnerability in this dependency version. 8 distinct locations. 123 findings.

3 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Scanning the local demo site from the README quickstart reports its known findings: Real input produced the expected result: Site Not Using HTTPS

  Source: fsv scan http://127.0.0.1:8961 --authorize

  Input: http://127.0.0.1:8961 (examples/demo_site.py running)

  Expected: CLI scan output lists the Site Not Using HTTPS finding

  Command: <guest-path> scan http://127.0.0.1:8961 --authorize --no-external

  Observed: Site Not Using HTTPS http://127.0.0.1:8961 · CWE-311 · A02 · firm 2. INFO No security.txt / Disclosure Policy http://127.0.0.1:8961/.well-known/security.txt · certain ⚠ No HTTP response was received from the target. Results only reflect checks that don't need HTTP (e.g. DNS). Check the URL, network/proxy, or try --timeout. scan_id: 94d3f3d7-cb24-4809-8344-5d3ad0299de6

• fsv_quick_check is a passive posture check of a URL: Real input produced the expected result: Site Not Using HTTPS

  Source: | `fsv_quick_check` / `fsv_waf_check` | Passive posture check / WAF-CDN detection |

  Input: {"tool": "fsv_quick_check", "arguments": {"target": "http://127.0.0.1:8961", "authorized": true}}

  Expected: MCP tool result contains the Site Not Using HTTPS finding

  Command: <guest-path> mcp tools/call {"tool": "fsv_quick_check", "arguments": {"target": "http://127.0.0.1:8961", "authorized": true}}

  Observed: Site Not Using HTTPS\",\n \"severity\": \"critical\",\n \"confidence\": \"firm\",\n \"status\": \"open\",\n \"url\": \"http://127.0.0.1:8961\",\n \"affected_urls\": [\n \"http://127.0.0.1:8961\"\n ],\n \"module\": \"ssl\",\n \"parameter\": null,\n \"cwe\": \"CWE-311\",\n \"owasp\": \"A02\",\n \"cvss_score\": 7.4,\n \"description\": \"The target is served over HTTP, not HTTPS. All data transferred between the browser and server is unencrypted and can be intercepted by a man-in-the-middle attacker.\",\n \"evidence\": \"\",\n

Examples

• Offline test suite from CONTRIBUTING runs: command completed successfully

  Source: CONTRIBUTING.md (Contributing quick start: pytest -q)

  Input: pytest -q in the workspace venv

  Expected: all tests pass, no network needed

  Command: <guest-path> -q

  Observed: ........................................................................ [ 19%] ..............s......................................................... [ 38%] ........................................................................ [ 58%] ........................................................................ [ 77%] ........................................................................ [ 97%] ........... [100%] 370 passed, 1 skipped in 50.28s

• Demo-site quickstart scan from README See it work: command completed successfully

  Source: README.md (See it work)

  Input: http://127.0.0.1:8961 with --no-external (documented flag)

  Expected: scan completes and lists findings

  Command: <guest-path> scan http://127.0.0.1:8961 --authorize --no-external --profile passive

  Observed: CRITICAL HIGH MEDIUM LOW INFO ─────────────────────────────────────── 1 0 0 0 1 Findings 1. CRITICAL Site Not Using HTTPS http://127.0.0.1:8961 · CWE-311 · A02 · firm 2. INFO No security.txt / Disclosure Policy http://127.0.0.1:8961/.well-known/security.txt · certain ⚠ No HTTP response was received from the target. Results only reflect checks that don't need HTTP (e.g. DNS). Check the URL, network/proxy, or try --timeout. scan_id: b2ff2328-8757-440f-99fc-87fe171693f9

Local or hosted: both

Install FSV from the README and run a real passive scan of the bundled demo site, then call the fsv_quick_check MCP tool against it

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; python3 --version; id -u; cat README.md 2>/dev/null | head -150
cd <guest-path> && sed -n 150,400p README.md | cut -c1-400
cd <guest-path> && cat pyproject.toml | head -40; cat requirements.txt; ls examples scripts tests | head -60; cat install.sh
cd <guest-path> && ls -la .coldpass; bash install.sh 2>&1 | tail -40
cd <guest-path> && source .venv/bin/activate && fsv --help 2>&1 | head -40; fsv modules 2>&1 | head -50; timeout 120 fsv doctor 2>&1 | tail -30
cd <guest-path> && source .venv/bin/activate && (nohup python examples/demo_site.py > <guest-path> 2>&1 & echo $! > <guest-path>); sleep 3; cat <guest-path>; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8961/; tail -5 <guest-path>
cd <guest-path> && source .venv/bin/activate && timeout 600 fsv scan http://127.0.0.1:8961 --authorize --no-external --profile passive 2>&1 | tail -60
cd <guest-path> && grep -n "def fsv_\<email>\<email>\|\.tool(" -r fsv | head -40; grep -rln "cron\|schedule\|--once\|webhook" fsv README.md docs | head; grep -n "pytest\|make test\|CONTRIBUTING" CONTRIBUTING.md | head
cd <guest-path> && grep -n "fsv_quick_check\|fsv_scan\b" -r fsv | head -20; ls fsv; grep -n "Requires \*\*Python\|pip install fsv  \|fsv scan http://127.0.0.1:8961 --authorize\|fsv_quick_check\` / \|Passive posture check" README.md | cut -c1-200
cd <guest-path> && sed -n 160,200p fsv/mcp/server.py; grep -n -i "cron\|schedule\|--once\|webhook" fsv/core/secrets.py fsv/core/eol.py | head -5
ls -la <guest-path> /inputs/ 2>&1 | head; mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import asyncio, sys
from mcp import ClientSession, StdioServerParameters
from mcp.client.stdio import stdio_client
async def main():
    params = StdioServerParameters(command="<guest-path>", args=["mcp"], cwd="/tmp")
    async with stdio_client(params) as (r, w):
        async with ClientSession(r, w) as s:
            await s.initialize()
            res = await s.call_tool("fsv_quick_check", {"target": "http://127.0.0.1:8961", "authorized": True})
            print(res.content[0].text[:1500])
asyncio.run(main())
EOF
cd /tmp && timeout 300 <guest-path> -I <guest-path> 2>&1 | tail -40
cd <guest-path> && sed -n 1,20p CONTRIBUTING.md; cat requirements-dev.txt; cat pytest.ini
cd <guest-path> && .venv/bin/pip install -q -r requirements-dev.txt 2>&1 | tail -3; timeout 900 .venv/bin/pytest -q 2>&1 | tail -15
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
[
  {
    "kind": "claim",
    "claim": "Scanning the local demo site from the README quickstart reports its known findings",
    "source": "fsv scan http://127.0.0.1:8961 --authorize",
    "input": "http://127.0.0.1:8961 (examples/demo_site.py running)",
    "expected": "CLI scan output lists the Site Not Using HTTPS finding",
    "probe_kind": "cli",
    "argv": ["<guest-path>", "scan", "http://127.0.0.1:8961", "--authorize", "--no-external"],
    "cwd": "<guest-path>",
    "expected_text": "Site Not Using HTTPS"
  },
  {
    "kind": "claim",
    "claim": "fsv_quick_check is a passive posture check of a URL",
    "source": "| `fsv_quick_check` / `fsv_waf_check` | Passive posture check / WAF-CDN detection |",
    "input": "http://127.0.0.1:8961 with authorized=true",
    "expected": "MCP tool result contains the Site Not Using HTTPS finding",
    "probe_kind": "mcp",
    "argv": ["<guest-path>", "mcp"],
    "tool": "fsv_quick_check",
    "arguments": {"target": "http://127.0.0.1:8961", "authorized": true},
    "expected_text": "Site Not Using HTTPS",
    "cwd": "<guest-path>"
  }
]
EOF
python3 -m json.tool <guest-path> >/dev/null && echo OK
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","mcp"],"cwd":"<guest-path>","tool":"fsv_quick_check","arguments":{"target":"http://127.0.0.1:8961","authorized":true},"expected_text":"Site Not Using HTTPS"}
EOF
cat > examples.json <<'EOF'
[
  {"kind":"example","claim":"Offline test suite from CONTRIBUTING runs","source":"CONTRIBUTING.md (Contributing quick start: pytest -q)","input":"pytest -q in the workspace venv","expected":"all tests pass, no network needed","argv":["<guest-path>","-q"],"cwd":"<guest-path>","expected_text":"passed"},
  {"kind":"example","claim":"Demo-site quickstart scan from README See it work","source":"README.md (See it work)","input":"http://127.0.0.1:8961 with --no-external (documented flag)","expected":"scan completes and lists findings","argv":["<guest-path>","scan","http://127.0.0.1:8961","--authorize","--no-external","--profile","passive"],"cwd":"<guest-path>","expected_text":"Site Not Using HTTPS"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README, pyproject, fsv/ entry points (cli.py, mcp/server.py) and grep for cron/schedule/--once/--now/webhook: FSV has no built-in scheduler or loop. Each scan runs only when invoked (fsv scan, fsv web, fsv mcp tool calls). The only matches were a Slack webhook regex in secrets.py and the vendor-schedule docstring in eol.py.","checks":[]}
EOF
python3 -m json.tool probe.json >/dev/null && python3 -m json.tool examples.json >/dev/null && python3 -m json.tool cycles.json >/dev/null && echo OK
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; wc -c <guest-path>; grep -n -i "fail\|error\|problem\|ok\|pass" <guest-path> | cut -c1-300 | head -40
cd <guest-path> && python3 -I -c "
import json
d=json.load(open('<guest-path>'))
print('valid',d.get('valid'),'problems',d.get('problems'))
r=d.get('replay',{})
print('replay status',r.get('status'))
for k,v in r.items():
    if k in('details','status'): continue
    print(k, str(v)[:300])
det=r.get('details',{})
print('detail keys', list(det.keys()))
" 2>&1 | cut -c1-400
cd <guest-path> && python3 -I -c "
import json
d=json.load(open('<guest-path>'))
r=d['replay']
for k in ('claims','example_checks','cycle_checks'):
    for x in r.get(k,[]):
        print(k, {kk:(str(vv)[:60]) for kk,vv in x.items() if kk in ('status','verdict','passed','ok','result','working','evidence_strength','claim')})
print('tool_result_checked', r['details'].get('tool_result_checked'))
print('scope', str(r['details'].get('scope'))[:200])
" 2>&1 | cut -c1-500
kill $(cat <guest-path>) 2>/dev/null; sleep 2; pkill -f "examples/demo_site.py" 2>/dev/null; sleep 1; pgrep -af "demo_site|fsv mcp|fsv web" || echo "no test servers running"; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8961/ || echo "port 8961 closed"
ps -eo pid,args | grep -E "demo_site|fsv (mcp|web)" | grep -v grep || echo "no test servers running"; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8961/ ; echo "curl rc=$?"
cd <guest-path> && cat > report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Install FSV from the README and run a real passive scan of the bundled demo site, then call the fsv_quick_check MCP tool against it",
  "operation_scope": "Linux guest, Python 3.12.3 (README requires 3.11+), loopback demo site at http://127.0.0.1:8961 from examples/demo_site.py. Scans were run with --authorize; the demo scan used --no-external so no third-party requests were made. No browser, no credentials, no FSV_TOKEN needed on loopback.",
  "steps": [
    "bash install.sh   (README 'Install': the repo's own installer; created .venv and ran pip install -e .)",
    "fsv doctor   (setup check: all imports, database, DNS OK; 32 modules loaded)",
    "python examples/demo_site.py &   (README 'See it work'; returned HTTP 200 on 127.0.0.1:8961)",
    "fsv scan http://127.0.0.1:8961 --authorize --no-external --profile passive   (real scan: 21 findings incl. Site Not Using HTTPS, Stripe key, actuator exposure)",
    "fsv mcp  (stdio MCP server) -> tool fsv_quick_check {target: http://127.0.0.1:8961, authorized: true} returned JSON findings",
    "pip install -r requirements-dev.txt; pytest -q   (CONTRIBUTING.md; 370 passed, 1 skipped)"
  ],
  "deviations": [
    "Used --no-external on the demo scan (README documents it as the way to skip third-party contacts). The README's default example also queries AWS S3 for the demo bucket.",
    "Ran requirements-dev.txt into the venv for pytest (documented in CONTRIBUTING.md).",
    "The workspace is not a git checkout and no pinned commit was fetched; the source snapshot was already present and the documented install worked without git metadata, so I did not verify it matches commit c71a89438d68c44204fa78f0268d25f77dd24d81.",
    "Replay needs the demo site running on 127.0.0.1:8961 for the claim and example checks. It was up for the validate run, and I stopped it afterwards. Re-running validation with the demo stopped will fail those checks.",
    "No product scheduler or cycle exists, so cycles.json has detected:false with no checks."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": null
}
EOF
python3 -m json.tool report.json >/dev/null && echo REPORT_OK; ls -la <guest-path>