@kryptosai/mcp-observatory 1.32.0 → 1.33.0

package/docs/safety-index/artifacts/notion-server.md

@@ -0,0 +1,236 @@
+# MCP Observatory Run Report
+
+Generated at 2026-07-15T22:33:40.323Z
+
+## Target and Environment Metadata
+
+- Target: `notion-server`
+- Adapter: `local-process`
+- Command: `npx -y @notionhq/notion-mcp-server`
+- Server: `Notion API 1.0.0`
+- Platform: `darwin 25.5.0`
+- Node: `v22.22.1`
+
+## Executive Summary
+
+**Health Score: 83/100 (B)**
+
+| Dimension | Score | Weight |
+| --- | --- | --- |
+| Protocol Compliance | 100/100 | 30% |
+| Schema Quality | 60/100 | 20% |
+| Security | 87/100 | 20% |
+| Reliability | 67/100 | 20% |
+| Performance | 100/100 | 10% |
+
+| Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| pass | 9 | 5 | 0 | 2 | 2 | 0 | 0 |
+
+## At a Glance
+
+- Safety verdict: **Needs review** — The server is usable, but caveated checks should be reviewed before agents depend on it.
+- Top risks: attack-sim: Safe attack simulation found 1 finding(s): 0 high, 1 medium, 0 low.; schema-quality: Found 31 quality finding(s) across 24 item(s): 0 warnings, 31 info.
+- Regression/schema drift: Run `mcp-observatory diff <previous-run.json> <current-run.json>` to classify regressions and schema drift.
+- Failing checks: none
+- Partial or flaky checks: schema-quality, attack-sim
+- Skipped checks: none
+- Unsupported checks: prompts, resources
+- Suggested next step: Review the caveated checks next: schema-quality, attack-sim.
+- CI next step: `Add CI: npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"`
+
+## What Was Not Tested
+
+- ℹ️ credential_access: Credential scanning was performed (see security findings)
+- ℹ️ destructive_payloads: Destructive payloads were not attempted (safe-mode only)
+
+## Runtime Profile
+
+### Egress Manifest
+
+The following targets were identified as potentially reachable by this server (confidence: **medium**):
+
+| Target | Protocol | Source | Confidence |
+| --- | --- | --- | --- |
+| If supplied, this endpoint will return a page of results starting after the cursor provided. If not supplied, this endpoint will return the first page of results. | unknown | description_analysis | medium |
+| The text that the API compares page and database titles against. | unknown | description_analysis | medium |
+| A `cursor` value returned in a previous response that If supplied, limits the response to results starting after the `cursor`. If not supplied, then the first page of results is returned. Refer to [pagination](https://developers.notion.com/reference/intro#pagination) for more details. | unknown | description_analysis | medium |
+| If supplied, this endpoint will return a page of results starting after the cursor provided. If not supplied, this endpoint will return the first page of results. | unknown | description_analysis | medium |
+| The content to be rendered on the new page, represented as an array of [block objects](https://developers.notion.com/reference/block). | unknown | description_analysis | medium |
+| The icon of the new page. Either an [emoji object](https://developers.notion.com/reference/emoji-object) or an [external file object](https://developers.notion.com/reference/file-object).. | unknown | description_analysis | medium |
+| The cover image of the new page, represented as a [file object](https://developers.notion.com/reference/file-object). | unknown | description_analysis | medium |
+| Identifier for a page [property](https://developers.notion.com/reference/page#all-property-values) | unknown | description_analysis | medium |
+| If supplied, this endpoint will return a page of results starting after the cursor provided. If not supplied, this endpoint will return the first page of results. | unknown | description_analysis | medium |
+| Whether to include meeting note transcripts. When false (default), a placeholder with the meeting note URL is shown instead of the full transcript. | unknown | description_analysis | medium |
+
+### State Mutations
+
+The following state-modifying operations were identified from tool schemas:
+
+| Resource | Operation | Scope | Source |
+| --- | --- | --- | --- |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | delete | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+| filesystem | write | working_directory | description_analysis |
+
+_Analyzed at 2026-07-15T22:33:41.108Z_
+
+## Regressions and Recoveries
+
+_Use the `diff` command against another run artifact to classify regressions and recoveries over time._
+
+## Full Capability Status Table
+
+| Focus | Check | Status | Duration (ms) | Message |
+| --- | --- | --- | --- | --- |
+| healthy | conformance | pass | 167.20 | All 7 conformance checks passed. |
+| healthy | runtime-profile | pass | 0.16 | Detected 10 potential egress target(s) and 21 potential state mutation(s) with low confidence. |
+| healthy | security | pass | 1.27 | No security issues detected. |
+| healthy | security-lite | pass | 0.05 | No security issues detected (lightweight scan). |
+| healthy | tools | pass | 1.70 | Advertised capability responded with the minimal expected shape (24 items). |
+| review | attack-sim | partial | 2.51 | Safe attack simulation found 1 finding(s): 0 high, 1 medium, 0 low. |
+| review | schema-quality | partial | 2.06 | Found 31 quality finding(s) across 24 item(s): 0 warnings, 31 info. |
+| confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
+| confirm intent | resources | unsupported | 0.00 | Resources are not advertised by the target. |
+
+## Evidence Snippets
+
+### conformance — pass
+
+Summary: All 7 conformance checks passed.
+
+- Endpoint: `conformance/check`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `7`
+  - Identifiers: none
+  - Diagnostics: [pass] capabilities-present: Server returned capabilities object., [pass] server-info: Server provided initialization info., [pass] tools-capability-match: tools/list returned 24 tool(s). (+4 more)
+
+### runtime-profile — pass
+
+Summary: Detected 10 potential egress target(s) and 21 potential state mutation(s) with low confidence.
+
+- Endpoint: `runtime-profile/analyze`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `31`
+  - Identifiers: none
+  - Diagnostics: Egress entries: 10, State mutations: 21, Confidence: medium
+
+### security — pass
+
+Summary: No security issues detected.
+
+- Endpoint: `security/scan`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
+### security-lite — pass
+
+Summary: No security issues detected (lightweight scan).
+
+- Endpoint: `security/scan-lite`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
+### tools — pass
+
+Summary: Advertised capability responded with the minimal expected shape (24 items).
+
+- Endpoint: `tools/list`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `24`
+  - Identifiers: API-get-user, API-get-users, API-get-self, API-post-search, API-get-block-children (+19 more)
+  - Diagnostics: none
+
+### attack-sim — partial
+
+Summary: Safe attack simulation found 1 finding(s): 0 high, 1 medium, 0 low.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `1`
+  - Identifiers: API-post-search
+  - Diagnostics: [medium] Tool "API-post-search" combines broad parameters (query) with destructive or non-read-only behavior.
+
+### schema-quality — partial
+
+Summary: Found 31 quality finding(s) across 24 item(s): 0 warnings, 31 info.
+
+- Endpoint: `schema-quality/scan`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `31`
+  - Identifiers: API-get-user, API-post-search, API-update-a-block, API-patch-page, API-post-page (+7 more)
+  - Diagnostics: [info] tool "API-get-user": Property 'user_id' missing description, [info] tool "API-post-search": Property 'sort' missing description, [info] tool "API-post-search": Property 'filter' missing description (+28 more)
+
+### prompts — unsupported
+
+Summary: Prompts are not advertised by the target.
+
+- Endpoint: `prompts/list`
+  - Advertised: `false`
+  - Responded: `false`
+  - Minimal shape present: `false`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
+### resources — unsupported
+
+Summary: Resources are not advertised by the target.
+
+- Endpoint: `resources/list | resources/templates/list`
+  - Advertised: `false`
+  - Responded: `false`
+  - Minimal shape present: `false`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
+## Reproduction Commands
+
+```bash
+npm run cli -- run --target <path-to-target-config.json>
+npm run cli -- report --run <path-to-run-artifact.json> --format markdown
+```
+
+## Artifact Provenance
+
+- Artifact type: `run`
+- Schema version: `1.0.0`
+- Run ID: `run_2026-07-15T223340323Z_a54e806c`
+- Gate: `pass`

package/docs/safety-index/artifacts/obsidian-mcp.json

@@ -0,0 +1,66 @@
+{
+  "artifactType": "run",
+  "schemaVersion": "1.0.0",
+  "gate": "fail",
+  "runId": "run_2026-07-15T223501652Z_4a375362",
+  "createdAt": "2026-07-15T22:35:01.652Z",
+  "toolVersion": "1.32.1",
+  "target": {
+    "targetId": "obsidian-mcp",
+    "adapter": "local-process",
+    "command": "npx",
+    "args": [
+      "-y",
+      "obsidian-mcp"
+    ],
+    "cwd": ".",
+    "metadata": {
+      "package": "obsidian-mcp",
+      "purpose": "mcp-safety-index",
+      "riskClass": "Personal knowledge base access",
+      "failureClass": "Note/vault/file boundary",
+      "whyItMatters": "Obsidian MCP servers can read, write, search, and link notes in personal knowledge vaults — agents could access private notes and research."
+    }
+  },
+  "environment": {
+    "platform": "darwin 25.5.0",
+    "nodeVersion": "v22.22.1"
+  },
+  "summary": {
+    "total": 3,
+    "pass": 0,
+    "fail": 0,
+    "partial": 0,
+    "unsupported": 0,
+    "flaky": 0,
+    "skipped": 3,
+    "gate": "fail"
+  },
+  "checks": [
+    {
+      "id": "tools",
+      "capability": "tools",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    },
+    {
+      "id": "prompts",
+      "capability": "prompts",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    },
+    {
+      "id": "resources",
+      "capability": "resources",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    }
+  ],
+  "fatalError": "Could not establish a plain stdio MCP session for target `obsidian-mcp`.\nCommand: npx -y obsidian-mcp\nDiagnosis: The process exited or detached before MCP initialization completed.\nRaw error: MCP error -32000: Connection closed\nLikely causes:\n- The package may expect extra startup arguments or environment variables.\n- The package may not behave like a plain local-process stdio target under this invocation.\n- The server may be crashing immediately and only leaving clues on stderr.\nNext steps:\n- Run the command manually and look for usage output, auth prompts, or crash text.\n- Check whether the package expects a different transport or an app-oriented startup flow.\n- Use the recent stderr lines below before assuming this is a harness bug.\nRecent stderr:\n- obsidian-mcp /tmp/vault                 # ❌ System directory\n- obsidian-mcp ~/.config/vault            # ❌ Hidden directory\n- obsidian-mcp //server/share/vault       # ❌ Network path\n- obsidian-mcp /mnt/network/vault         # ❌ Network mount\n- obsidian-mcp ~/symlink-to-vault         # ❌ External symlink"
+}

package/docs/safety-index/artifacts/obsidian-mcp.md

@@ -0,0 +1,106 @@
+# MCP Observatory Run Report
+
+Generated at 2026-07-15T22:35:01.652Z
+
+## Target and Environment Metadata
+
+- Target: `obsidian-mcp`
+- Adapter: `local-process`
+- Command: `npx -y obsidian-mcp`
+- Server: `unknown `
+- Platform: `darwin 25.5.0`
+- Node: `v22.22.1`
+
+## Executive Summary
+
+| Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| fail | 3 | 0 | 0 | 0 | 0 | 0 | 3 |
+
+## At a Glance
+
+- Safety verdict: **Blocked** — One or more checks can break agent dependence and should be fixed before production use.
+- Top risks: startup: server failed to start
+- Regression/schema drift: Run `mcp-observatory diff <previous-run.json> <current-run.json>` to classify regressions and schema drift.
+- Failing checks: none
+- Partial or flaky checks: none
+- Skipped checks: tools, prompts, resources
+- Unsupported checks: none
+- Suggested next step: Run the target command manually, compare stderr with the diagnosis below, and only raise timeoutMs if startup is genuinely slow.
+- CI next step: `Add CI: npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"`
+
+## What Was Not Tested
+
+- 🔒 network_egress: No outbound network calls were attempted during scan
+- 🔒 filesystem_mutation: Filesystem write operations were not exercised
+- 🔒 credential_access: Credential scanning was not performed
+- ℹ️ destructive_payloads: Destructive payloads were not attempted (safe-mode only)
+
+## Regressions and Recoveries
+
+_Use the `diff` command against another run artifact to classify regressions and recoveries over time._
+
+## Failure Diagnosis
+
+```text
+Could not establish a plain stdio MCP session for target `obsidian-mcp`.
+Command: npx -y obsidian-mcp
+Diagnosis: The process exited or detached before MCP initialization completed.
+Raw error: MCP error -32000: Connection closed
+Likely causes:
+- The package may expect extra startup arguments or environment variables.
+- The package may not behave like a plain local-process stdio target under this invocation.
+- The server may be crashing immediately and only leaving clues on stderr.
+Next steps:
+- Run the command manually and look for usage output, auth prompts, or crash text.
+- Check whether the package expects a different transport or an app-oriented startup flow.
+- Use the recent stderr lines below before assuming this is a harness bug.
+Recent stderr:
+- obsidian-mcp /tmp/vault                 # ❌ System directory
+- obsidian-mcp ~/.config/vault            # ❌ Hidden directory
+- obsidian-mcp //server/share/vault       # ❌ Network path
+- obsidian-mcp /mnt/network/vault         # ❌ Network mount
+- obsidian-mcp ~/symlink-to-vault         # ❌ External symlink
+```
+
+## Full Capability Status Table
+
+| Focus | Check | Status | Duration (ms) | Message |
+| --- | --- | --- | --- | --- |
+| inspect startup | prompts | skipped | 0.00 | Skipped because startup failed before the MCP session initialized. See the failure diagnosis. |
+| inspect startup | resources | skipped | 0.00 | Skipped because startup failed before the MCP session initialized. See the failure diagnosis. |
+| inspect startup | tools | skipped | 0.00 | Skipped because startup failed before the MCP session initialized. See the failure diagnosis. |
+
+## Evidence Snippets
+
+### prompts — skipped
+
+Summary: Skipped because startup failed before the MCP session initialized. See the failure diagnosis.
+
+_No evidence was captured._
+
+### resources — skipped
+
+Summary: Skipped because startup failed before the MCP session initialized. See the failure diagnosis.
+
+_No evidence was captured._
+
+### tools — skipped
+
+Summary: Skipped because startup failed before the MCP session initialized. See the failure diagnosis.
+
+_No evidence was captured._
+
+## Reproduction Commands
+
+```bash
+npm run cli -- run --target <path-to-target-config.json>
+npm run cli -- report --run <path-to-run-artifact.json> --format markdown
+```
+
+## Artifact Provenance
+
+- Artifact type: `run`
+- Schema version: `1.0.0`
+- Run ID: `run_2026-07-15T223501652Z_4a375362`
+- Gate: `fail`

package/docs/safety-index/artifacts/ola-maps-mcp.json

@@ -0,0 +1,66 @@
+{
+  "artifactType": "run",
+  "schemaVersion": "1.0.0",
+  "gate": "fail",
+  "runId": "run_2026-07-15T223509178Z_bd7a7832",
+  "createdAt": "2026-07-15T22:35:09.178Z",
+  "toolVersion": "1.32.1",
+  "target": {
+    "targetId": "ola-maps-mcp",
+    "adapter": "local-process",
+    "command": "npx",
+    "args": [
+      "-y",
+      "ola-maps-mcp"
+    ],
+    "cwd": ".",
+    "metadata": {
+      "package": "ola-maps-mcp",
+      "purpose": "mcp-safety-index",
+      "riskClass": "Indian ride/mapping API access",
+      "failureClass": "Maps/routing/ride boundary",
+      "whyItMatters": "Ola's mapping API serves the Indian market with hyperlocal routing and geocoding. MCP servers accessing Ola Maps handle location data with Indian GPS accuracy characteristics."
+    }
+  },
+  "environment": {
+    "platform": "darwin 25.5.0",
+    "nodeVersion": "v22.22.1"
+  },
+  "summary": {
+    "total": 3,
+    "pass": 0,
+    "fail": 0,
+    "partial": 0,
+    "unsupported": 0,
+    "flaky": 0,
+    "skipped": 3,
+    "gate": "fail"
+  },
+  "checks": [
+    {
+      "id": "tools",
+      "capability": "tools",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    },
+    {
+      "id": "prompts",
+      "capability": "prompts",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    },
+    {
+      "id": "resources",
+      "capability": "resources",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    }
+  ],
+  "fatalError": "Could not establish a plain stdio MCP session for target `ola-maps-mcp`.\nCommand: npx -y ola-maps-mcp\nDiagnosis: The process exited or detached before MCP initialization completed.\nRaw error: MCP error -32000: Connection closed\nLikely causes:\n- The package may expect extra startup arguments or environment variables.\n- The package may not behave like a plain local-process stdio target under this invocation.\n- The server may be crashing immediately and only leaving clues on stderr.\nNext steps:\n- Run the command manually and look for usage output, auth prompts, or crash text.\n- Check whether the package expects a different transport or an app-oriented startup flow.\n- Use the recent stderr lines below before assuming this is a harness bug.\nRecent stderr:\n- npm error 404  'ola-maps-mcp@*' is not in this registry.\n- npm error 404\n- npm error 404 Note that you can also install from a\n- npm error 404 tarball, folder, http url, or git url.\n- npm error A complete log of this run can be found in: /Users/williamweishuhn/.npm/_logs/2026-07-15T22_35_09_248Z-debug-0.log"
+}

package/docs/safety-index/artifacts/ola-maps-mcp.md

@@ -0,0 +1,106 @@
+# MCP Observatory Run Report
+
+Generated at 2026-07-15T22:35:09.178Z
+
+## Target and Environment Metadata
+
+- Target: `ola-maps-mcp`
+- Adapter: `local-process`
+- Command: `npx -y ola-maps-mcp`
+- Server: `unknown `
+- Platform: `darwin 25.5.0`
+- Node: `v22.22.1`
+
+## Executive Summary
+
+| Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| fail | 3 | 0 | 0 | 0 | 0 | 0 | 3 |
+
+## At a Glance
+
+- Safety verdict: **Blocked** — One or more checks can break agent dependence and should be fixed before production use.
+- Top risks: startup: server failed to start
+- Regression/schema drift: Run `mcp-observatory diff <previous-run.json> <current-run.json>` to classify regressions and schema drift.
+- Failing checks: none
+- Partial or flaky checks: none
+- Skipped checks: tools, prompts, resources
+- Unsupported checks: none
+- Suggested next step: Run the target command manually, compare stderr with the diagnosis below, and only raise timeoutMs if startup is genuinely slow.
+- CI next step: `Add CI: npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"`
+
+## What Was Not Tested
+
+- 🔒 network_egress: No outbound network calls were attempted during scan
+- 🔒 filesystem_mutation: Filesystem write operations were not exercised
+- 🔒 credential_access: Credential scanning was not performed
+- ℹ️ destructive_payloads: Destructive payloads were not attempted (safe-mode only)
+
+## Regressions and Recoveries
+
+_Use the `diff` command against another run artifact to classify regressions and recoveries over time._
+
+## Failure Diagnosis
+
+```text
+Could not establish a plain stdio MCP session for target `ola-maps-mcp`.
+Command: npx -y ola-maps-mcp
+Diagnosis: The process exited or detached before MCP initialization completed.
+Raw error: MCP error -32000: Connection closed
+Likely causes:
+- The package may expect extra startup arguments or environment variables.
+- The package may not behave like a plain local-process stdio target under this invocation.
+- The server may be crashing immediately and only leaving clues on stderr.
+Next steps:
+- Run the command manually and look for usage output, auth prompts, or crash text.
+- Check whether the package expects a different transport or an app-oriented startup flow.
+- Use the recent stderr lines below before assuming this is a harness bug.
+Recent stderr:
+- npm error 404  'ola-maps-mcp@*' is not in this registry.
+- npm error 404
+- npm error 404 Note that you can also install from a
+- npm error 404 tarball, folder, http url, or git url.
+- npm error A complete log of this run can be found in: /Users/williamweishuhn/.npm/_logs/2026-07-15T22_35_09_248Z-debug-0.log
+```
+
+## Full Capability Status Table
+
+| Focus | Check | Status | Duration (ms) | Message |
+| --- | --- | --- | --- | --- |
+| inspect startup | prompts | skipped | 0.00 | Skipped because startup failed before the MCP session initialized. See the failure diagnosis. |
+| inspect startup | resources | skipped | 0.00 | Skipped because startup failed before the MCP session initialized. See the failure diagnosis. |
+| inspect startup | tools | skipped | 0.00 | Skipped because startup failed before the MCP session initialized. See the failure diagnosis. |
+
+## Evidence Snippets
+
+### prompts — skipped
+
+Summary: Skipped because startup failed before the MCP session initialized. See the failure diagnosis.
+
+_No evidence was captured._
+
+### resources — skipped
+
+Summary: Skipped because startup failed before the MCP session initialized. See the failure diagnosis.
+
+_No evidence was captured._
+
+### tools — skipped
+
+Summary: Skipped because startup failed before the MCP session initialized. See the failure diagnosis.
+
+_No evidence was captured._
+
+## Reproduction Commands
+
+```bash
+npm run cli -- run --target <path-to-target-config.json>
+npm run cli -- report --run <path-to-run-artifact.json> --format markdown
+```
+
+## Artifact Provenance
+
+- Artifact type: `run`
+- Schema version: `1.0.0`
+- Run ID: `run_2026-07-15T223509178Z_bd7a7832`
+- Gate: `fail`

package/docs/safety-index/artifacts/olx-pakistan-mcp.json

@@ -0,0 +1,66 @@
+{
+  "artifactType": "run",
+  "schemaVersion": "1.0.0",
+  "gate": "fail",
+  "runId": "run_2026-07-15T223602432Z_cfed5c8a",
+  "createdAt": "2026-07-15T22:36:02.432Z",
+  "toolVersion": "1.32.1",
+  "target": {
+    "targetId": "olx-pakistan-mcp",
+    "adapter": "local-process",
+    "command": "npx",
+    "args": [
+      "-y",
+      "olx-pakistan-mcp"
+    ],
+    "cwd": ".",
+    "metadata": {
+      "package": "olx-pakistan-mcp",
+      "purpose": "mcp-safety-index",
+      "riskClass": "Pakistani classifieds platform API access",
+      "failureClass": "Listing/ad/user boundary",
+      "whyItMatters": "OLX Pakistan is the country's largest classifieds platform covering property, vehicles, electronics, jobs, and services. MCP servers exposing classified listings, user profiles, and ad management handle personal commerce data for millions of Pakistanis."
+    }
+  },
+  "environment": {
+    "platform": "darwin 25.5.0",
+    "nodeVersion": "v22.22.1"
+  },
+  "summary": {
+    "total": 3,
+    "pass": 0,
+    "fail": 0,
+    "partial": 0,
+    "unsupported": 0,
+    "flaky": 0,
+    "skipped": 3,
+    "gate": "fail"
+  },
+  "checks": [
+    {
+      "id": "tools",
+      "capability": "tools",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    },
+    {
+      "id": "prompts",
+      "capability": "prompts",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    },
+    {
+      "id": "resources",
+      "capability": "resources",
+      "status": "skipped",
+      "durationMs": 0,
+      "message": "Skipped because startup failed before the MCP session initialized. See the failure diagnosis.",
+      "evidence": []
+    }
+  ],
+  "fatalError": "Could not establish a plain stdio MCP session for target `olx-pakistan-mcp`.\nCommand: npx -y olx-pakistan-mcp\nDiagnosis: The process exited or detached before MCP initialization completed.\nRaw error: MCP error -32000: Connection closed\nLikely causes:\n- The package may expect extra startup arguments or environment variables.\n- The package may not behave like a plain local-process stdio target under this invocation.\n- The server may be crashing immediately and only leaving clues on stderr.\nNext steps:\n- Run the command manually and look for usage output, auth prompts, or crash text.\n- Check whether the package expects a different transport or an app-oriented startup flow.\n- Use the recent stderr lines below before assuming this is a harness bug.\nRecent stderr:\n- npm error 404  'olx-pakistan-mcp@*' is not in this registry.\n- npm error 404\n- npm error 404 Note that you can also install from a\n- npm error 404 tarball, folder, http url, or git url.\n- npm error A complete log of this run can be found in: /Users/williamweishuhn/.npm/_logs/2026-07-15T22_36_02_517Z-debug-0.log"
+}