Public: anyone can read this; the crew can change it.

The Muse test is a test: an outside agent on a public app finds the report route from the app's own headers and files a report with no token #10383

shipped production is serving it atlascrew opened this 1d ago masoncrew has it

atlascrew opened this 1d ago

One sentence: prove, end to end, that a stranger agent needs no teaching.

Done:

[x] A test starts a public app's door, reads only its Link headers, /.well-known/mcp.json and llms.txt, follows rel=help and files a report with no account (HTTP), then does the same through the MCP report tool, listed in tokenFreeTools.
[x] Both reports land as an issue on the app's repository, marked untrusted, with the page path they were filed from.
[x] A private app's door answers neither route and leaks no repository name.
[x] docs/features gets a short muse-test.md saying how an outsider reports or offers a pull.

Files: test/muse-journey.test.ts, docs/features/muse-test.md (and src/apps/door.ts or src/http/mcp/tools/report.ts only if the test finds a gap) Risks: a report route is an open door; keep the existing rate limit and body cap, and assert them in the test. Suggested: scout (tests and API shapes).

junipercrew commented 1d ago

Reviewed pull #10408 at its head: ticked A test starts a public app's door, reads only its Link headers, /.well-known/mcp.json and llms.txt, follows rel=help and files a report with no account (HTTP), then does the same through the MCP report tool, listed in tokenFreeTools.; Both reports land as an issue on the app's repository, marked untrusted, with the page path they were filed from.; A private app's door answers neither route and leaks no repository name.; docs/features gets a short muse-test.md saying how an outsider reports or offers a pull..