{
  "checker": {
    "claims": [
      {
        "claim": "Tool call results pass through the proxy to the client",
        "command": "<guest-path> <guest-path> --mode strict -- uvx mcp-server-git tools/call {\"tool\": \"git_status\", \"arguments\": {\"repo_path\": \"<guest-path>\"}}",
        "evidence": "On branch main\\nnothing to commit, working tree clean\"}], \"isError\": false}",
        "expected": "status text returned intact",
        "input": "{\"tool\": \"git_status\", \"arguments\": {\"repo_path\": \"<guest-path>\"}}",
        "kind": "claim",
        "outcome": "Real input produced the expected result: On branch main",
        "source": "Tool call results cannot be stripped without breaking functionality.",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "kevlar is a stdio proxy (policy.py pure engine, kevlar.py async stdio proxy per README Architecture); no cron, scheduler, loop, webhook, --once or --now entry points were found in README or kevlar.py main(). Each proxied session runs once per invocation.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "kevlar is a stdio proxy (policy.py pure engine, kevlar.py async stdio proxy per README Architecture); no cron, scheduler, loop, webhook, --once or --now entry points were found in README or kevlar.py main(). Each proxied session runs once per invocation.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "<guest-path>",
        "--mode",
        "strict",
        "--",
        "uvx",
        "mcp-server-git"
      ],
      "kind": "mcp",
      "scope": "product operation",
      "serverInfo": {
        "name": "mcp-git",
        "version": "2026.10.19"
      },
      "tool_result": {
        "content": [
          {
            "text": "Repository status:\nOn branch main\nnothing to commit, working tree clean",
            "type": "text"
          }
        ],
        "isError": false
      },
      "tool_result_checked": true,
      "tool_schema_bytes": 2263,
      "tools": [
        "git_status",
        "git_diff_unstaged",
        "git_diff_staged",
        "git_diff",
        "git_commit",
        "git_add",
        "git_reset",
        "git_log",
        "git_create_branch",
        "git_checkout",
        "git_show",
        "git_branch"
      ],
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "Calls to tools outside the sanitized set are blocked",
        "command": "<guest-path> <guest-path> --mode strict -- uvx mcp-server-git",
        "deferred": false,
        "evidence": ": 3, \"result\": {\"content\": [{\"type\": \"text\", \"text\": \"kevlar: tool 'git_delete_everything' was not in CDR-sanitized set\"}], \"isError\": true}}\n{\"jsonrpc\": \"2.0\", \"id\": 1, \"result\": {\"protocolVersion\": \"2024-11-05\", \"capabilities\": {\"prompts\": {\"listChanged\": false}, \"resources\": {\"listChanged\": false, \"subscribe\": false}, \"tools\": {\"listChanged\": false}}, \"serverInfo\": {\"name\": \"mcp-git\", \"version\": \"2026.10.19\"}}}\n2026-10-25 22:52:53,911 INFO kevlar spawned server pid=4167 cmd=uvx mode=strict\n2026-10-25 22:52:53,912 WARNING kevlar tools/call blocked for unsanitized tool 'git_delete_everything'",
        "expected": "synthetic block message from kevlar",
        "input": "tools/call git_delete_everything sent without tools/list",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md",
        "verdict": "yes"
      },
      {
        "claim": "Repository test suite runs (README Tests section)",
        "command": "<guest-path> -q",
        "deferred": false,
        "evidence": "........................................................................ [ 48%]\n........................................................................ [ 96%]\n.....                                                                    [100%]\n149 passed in 8.78s",
        "expected": "149 passed",
        "input": "pytest",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md Tests section",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "deviations": [
    "README 'pip install .' / 'pip install -e \".[dev]\"' fails: pyproject.toml sets build-backend 'setuptools.backends.legacy:build', which does not exist (ModuleNotFoundError: setuptools.backends). The 'kevlar' console script was therefore never installed; I ran the same entry point through kevlar.py's own __main__ (main()) with the venv python instead. Source was not edited.",
    "Installed pytest directly (requirements-dev.txt) because the editable install failed.",
    "Filesystem quickstart (kevlar --mode strict -- npx ... server-filesystem /tmp) could not complete: its tools/list response was rejected with 'JSON rejected: nesting depth pre-screen exceeded' (kevlar.py _parse_strict counts all '[' and '{' bytes in the message against 200, not nesting depth), so the proxy returned an internal error.",
    "Strict mode blocks tools/call unless the tool appeared in a prior tools/list response; sending tools/call before tools/list gets 'was not in CDR-sanitized set'. This matches the README, but it means the quickstart requires a handshake order.",
    "Browser/CDP endpoint was checked (GET $CDP_URL/json/version -> HTTP 200) but not used; Kevlar does not need a browser.",
    "No cron/scheduler/webhook entry point exists, so cycles.json has detected:false."
  ],
  "fault_owner": "repo",
  "main_blocker": null,
  "operation": "Run Kevlar as a stdio firewall proxy in front of an MCP server and get a real tool result back (README Quickstart / Setup)",
  "operation_scope": "Linux, Python 3.12.3 venv at <guest-path>, Node 22 / npx present. Tested against mcp-server-git via uvx and a local git repo at <guest-path> README's npx filesystem quickstart was also tried.",
  "outcome": "working",
  "plain_failure": "Installing Kevlar with the README's pip command fails because its packaging config points at a build tool that does not exist. The proxy itself works: its test suite passes (149 tests), and it correctly relays a git server's status and tool list. But the README's filesystem example fails, because the proxy wrongly rejects any server reply with more than about 200 curly or square brackets, even when the nesting is shallow.",
  "steps": [
    "python3 -m venv <guest-path> (Python 3.12.3, README requires 3.10+)",
    "cd <guest-path> && <guest-path> install -e \".[dev]\" (README Install / Tests) -> FAILED",
    "<guest-path> install \"pytest>=8.0\"",
    "<guest-path> -q (README Tests) -> 149 passed",
    "python kevlar.py --mode strict -- uvx mcp-server-git (proxy, tools/list and tools/call OK)",
    "python kevlar.py --mode strict -- npx -y @modelcontextprotocol/server-filesystem /tmp (README Quickstart) -> tools/list rejected"
  ],
  "stuck_step": "pip install -e \".[dev]\" (README Install/Tests): pyproject.toml build-backend 'setuptools.backends.legacy:build' is missing",
  "suggested_fix": "In pyproject.toml, use a real backend (for example build-backend = \"setuptools.build_meta\"). In kevlar.py _parse_strict, replace the total-bracket count with a real nesting-depth check, or raise the limit so normal tools/list responses pass."
}