{
  "checker": {
    "details": {
      "checks": [
        {
          "check": "install",
          "details": {
            "argv": [
              "npm",
              "install"
            ],
            "kind": "cli",
            "needs_browser": false,
            "needs_credentials": false,
            "returncode": 0,
            "scope": "partial: install",
            "stderr": "",
            "stdout": "\nup to date, audited 142 packages in 757ms\n\n40 packages are looking for funding\n  run `npm fund` for details\n\n12 vulnerabilities (3 moderate, 6 high, 3 critical)\n\nTo address issues that do not require attention, run:\n  npm audit fix\n\nTo address all issues (including breaking changes), run:\n[excerpt truncated]",
            "working": false
          },
          "optional": false,
          "status": "PASS"
        },
        {
          "check": "list_tools",
          "details": {
            "argv": [
              "npm",
              "run",
              "mcp:demo"
            ],
            "blocker": "product invocation failed: {\"returncode\": 1, \"stdout\": \"\\n> contacts@26.6.29 mcp:demo\\n> node scripts/mcp-demo.js\\n\\n\\u001b[1m\\nContacts over MCP \\u2014 a full session, no Puter required.\\u001b[0m\\n\\u001b[2m3 contacts seeded in the fake cloud.\\n\\u001b[0m\\n  \\u001b[33m\\u2190\\u001b[0m ready \\u001b[2m(notification)\\u001b[0m\\n\\u001b[2mServer up for \\\"calendar\\\". Tools offered: search_contacts, list_contacts, suggest_recipients, get_contact\\u001b[0m\\n\\u001b[2m(That first \\u2190 is the app-to-app protocol's greeting \\u2014 an MCP client ignores it.)\\u001b[0m\\n\\n\\u001b[1m\\u2500\\u2500 Handshake \\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u001b[0m\\n  \\u001b[36m\\u2192\\u001b[0m initialize\\u001b[2m #1\\u001b[0m\\n      \\u001b[2m{\\\"protocolVersion\\\":\\\"2025-06-18\\\",\\\"clientInfo\\\":{\\\"name\\\":\\\"demo\\\",\\\"version\\\":\\\"1\\\"}}\\u001b[0m\\n  \\u001b[32m\\u2190\\u001b[0m \\u001b[32mok\\u001b[0m\\n      \\u001b[2m{\\\"protocolVersion\\\":\\\"2025-06-18\\\",\\\"capabilities\\\":{\\\"tools\\\":{\\\"listChanged\\\":false},\\\"resources\\\":{\\\"listChanged\\\":true,\\\"subscribe\\\":false}},\\\"serverInfo\\\":{\\\"name\\\":\\\"contacts\\\",\\\"title\\\":\\\"Contacts\\\",\\\"version\\\":\\\"1.0.0\\\"},\\u2026 \\u001b[2m(+531 chars)\\u001b[0m\\u001b[0m\\n  \\u001b[36m\\u2192\\u001b[0m notifications/initialized \\u001b[2m(notification)\\u001b[0m\\n      \\u001b[2m(no reply \\u2014 JSON-RPC forbids replying to a notification)\\u001b[0m\\n\\n\\u001b[1m\\u2500\\u2500 What can it do? \\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u001b[0m\\n  \\u001b[36m\\u2192\\u001b[0m tools/list\\u001b[2m #2\\u001b[0m\\n  \\u001b[32m\\u2190\\u001b[0m \\u001b[32mok\\u001b[0m\\n      \\u001b[2m{\\\"tools\\\":[{\\\"name\\\":\\\"search_contacts\\\",\\\"title\\\":\\\"Search contacts\\\",\\\"description\\\":\\\"Search the user's address book across every field \\u2014 name, email, phone, company, job title, tags, notes and address. Use th\\u2026 \\u001b[2m(+2543 chars)\\u001b[0m\\u001b[0m\\n      search_contacts\\u001b[2m \\u2014 Search contacts\\u001b[0m\\n      list_contacts\\u001b[2m \\u2014 List contacts\\u001b[0m\\n      suggest_recipients\\u001b[2m \\u2014 Suggest recipients\\u001b[0m\\n      get_contact\\u001b[2m \\u2014 Get a contact\\u001b[0m\\n\\n\\u001b[1m\\u2500\\u2500 Find someone \\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u001b[0m\\n  \\u001b[36m\\u2192\\u001b[0m tools/call\\u001b[2m #3\\u001b[0m\\n      \\u001b[2m{\\\"name\\\":\\\"search_contacts\\\",\\\"arguments\\\":{\\\"query\\\":\\\"engines\\\"}}\\u001b[0m\\n  \\u001b[32m\\u2190\\u001b[0m \\u001b[32mok\\u001b[0m\\n      1 contact:\\n      \\u2605 Ada Lovelace \\u00b7 Founder \\u00b7 Analytical Engines \\u00b7 <email> \\u00b7 #pioneers  [4ecec3b1-cd6d-4559-b831-cde64e7df87d]\\n      \\u001b[2m+ structuredContent (373 bytes of exact JSON)\\u001b[0m\\n\\n\\u001b[1m\\u2500\\u2500 Who can I email? \\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u001b[0m\\n  \\u001b[36m\\u2192\\u001b[0m tools/call\\u001b[2m #4\\u001b[0m\\n      \\u001b[2m{\\\"name\\\":\\\"suggest_recipients\\\",\\\"arguments\\\":{\\\"query\\\":\\\"a\\\"}}\\u001b[0m\\n  \\u001b[32m\\u2190\\u001b[0m \\u001b[32mok\\u001b[0m\\n      2 matching addresses:\\n      Ada Lovelace <<email>> (Work, Analytical Engines)  [4ecec3b1-cd6d-4559-b831-cde64e7df87d]\\n      Alan Turing <<email>> (Work, Bletchley Park)  [dce31b71-4dd5-43e0-9434-9fb6bd5a1f24]\\n      \\u001b[2m+ structuredContent (353 bytes of exact JSON)\\u001b[0m\\n\\n\\u001b[1m\\u2500\\u2500 Add someone \\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u2500\\u001b[0m\\n  \\u001b[36m\\u2192\\u001b[0m tools/call\\u001b[2m #5\\u001b[0m\\n      \\u001b[2m{\\\"name\\\":\\\"create_contact\\\",\\\"arguments\\\":{\\\"firstName\\\":\\\"Radia\\\",\\\"lastName\\\":\\\"Perlman\\\",\\\"company\\\":\\\"Spanning Tree\\\",\\\"emails\\\":[{\\\"label\\\":\\\"Work\\\",\\\"value\\\":\\\"<email>\\\"}],\\\"tags\\\":[\\\"pioneers\\\"]}}\\u001b[0m\\n  \\u001b[33m\\u2190\\u001b[0m \\u001b[33merror -32602\\u001b[0m  Unknown tool \\\"create_contact\\\"\\n\", \"stderr\": \"file:///workspace/src/contacts/scripts/mcp-demo.js:174\\nconst radiaId = created.result.structuredContent.contact.id\\n                               ^\\n\\nTypeError: Cannot read properties of undefined (reading 'structuredContent')\\n    at file:///workspace/src/contacts/scripts/mcp-demo.js:174:32\\n\\nNode.js v22.23.3\\n\", \"needs_credentials\": false, \"needs_browser\": false}",
            "kind": "cli",
            "needs_browser": false,
            "needs_credentials": false,
            "returncode": 1,
            "stderr": "file:///workspace/src/contacts/scripts/mcp-demo.js:174\nconst radiaId = created.result.structuredContent.contact.id\n                               ^\n\nTypeError: Cannot read properties of undefined (reading 'structuredContent')\n    at file:///workspace/src/contacts/scripts/mcp-demo.js:174:32\n\nNode.js v22.23.3",
            "stdout": "\n> contacts@26.6.29 mcp:demo\n> node scripts/mcp-demo.js\n\n[1m\nContacts over MCP \u2014 a full session, no Puter required.[0m\n[2m3 contacts seeded in the fake cloud.\n[0m\n  [33m\u2190[0m ready [2m(notification)[0m\n[2mServer up for \"calendar\". Tools offered: search_contacts, list_contacts, suggest_recipients, get_contact[0m\n[2m(That first \u2190 is the app-to-app protocol's greeting \u2014 an MCP client ignores it.)[0m\n\n[excerpt truncated]",
            "working": false
          },
          "optional": false,
          "status": "FAIL"
        }
      ],
      "scope": "partial checks",
      "working": false
    },
    "status": "FAIL"
  },
  "deviations": [
    "Root README 'Getting started' expects Node.js 22.12+; Node was not installed in the guest, so I installed it via NodeSource setup_22.x and apt.",
    "src/contacts README 'Development > npm run mcp:demo' failed: `Unknown tool \"create_contact\"` (JSON-RPC -32602), then scripts/mcp-demo.js:174 TypeError. Cause: the demo registers its fake server as caller 'calendar', and src/api/protocol.js ALLOWED_CALLERS grants calendar READ_METHODS only, so the refusal is correct and the demo's write step is inconsistent with its own grant. I did not modify product source.",
    "`npm install` rewrote src/contacts/package-lock.json (mtime changed). No git repo is present, so I could not diff it against the pinned commit. Treat it as possibly changed.",
    "Probe uses the checks form: install (npm install) and list_tools (npm run mcp:demo). The list_tools check exits 1 because of the demo bug above, so it is partial evidence, not a clean pass."
  ],
  "main_blocker": "Demo script defect: it calls create_contact on a server granted only calendar read methods.",
  "operation": "Contacts MCP server (src/contacts): initialize handshake, tools/list, and read tool calls search_contacts and suggest_recipients via the documented `npm run mcp:demo`, all against the real server code with an in-memory store.",
  "operation_scope": "Covers the MCP handshake, tool catalogue, and read-only tools only. Not exercised: the Puter cloud (no account or desktop; the demo uses a fake store), the write tools (create/update/delete), and the browser UI. The `npm run mcp:demo` script exits 1 at its 'Add someone' step, so the demo as documented does not complete.",
  "outcome": "blocked",
  "steps": [
    "Installed Node.js 22 via NodeSource setup_22.x + apt nodejs (v22.23.3, npm 10.9.9) because the guest had no node",
    "cd src/contacts && npm install (rc 0; npm audit reports 12 vulnerabilities, not addressed)",
    "npm run mcp:demo (rc 1; handshake, tools/list, search_contacts, suggest_recipients succeeded; failed at create_contact)",
    "Wrote .coldpass/probe.json and .coldpass/observed.json"
  ],
  "stuck_step": "npm run mcp:demo (src/contacts README, Development section): fails at the create_contact step",
  "suggested_fix": "In scripts/mcp-demo.js, either register the fake server with a caller that has the write grant (for example 'ai'), or skip the create/update/delete steps when the grant lacks them. Then rerun `npm run mcp:demo` in src/contacts."
}