Dongnesos Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Dongnesos Mcp (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
동네SOS / 이거 어디에 말해? PlayMCP candidate implementation.
This server helps a user prepare a civic inconvenience report without doing the reporting for them. It classifies a Korean neighborhood issue, explains what evidence to prepare, and drafts a neutral copy/paste report. It never submits a report, logs in, reads KakaoTalk, collects precise location, uploads photos, or calls external government APIs.
classify_civic_issue: classifies the issue into the fixed 28-item taxonomy,routes it to a channel family, and returns the canonical Pro Chat output fields: result_type, priority, routing, draft_policy, and errors.
draft_civic_report: creates a neutral report preparation draft fornon-emergency cases only.
The server intentionally exposes exactly those two tools. Both tools declare MCP inputSchema and outputSchema; the HTTP smoke verifies those schemas are visible in tools/list.
emergency_redirect orblocked_emergency; draft generation is blocked.
channel before submitting.
presentation_mock is a lightweight ChatGPT card shape, not a dependency onKakao Widget APIs.
npm install
npm run check
npm run smoke:http
npm run smoke:dist
npm run dev -- --host 127.0.0.1 --port 3000After npm run build, production start uses:
npm startContainer build:
docker build -t dongnesos-mcp .
docker run --rm -p 3000:3000 dongnesos-mcpPlayMCP in KC image builds require linux/amd64, including on Apple Silicon:
npm run image:build:amd64
npm run image:push:playmcpnpm run image:push:playmcp is a dry-run by default. It only pushes after external image publication is approved and the command is run with DRY_RUN=0 CONFIRM_EXTERNAL_IMAGE_PUSH=1.
Container release smoke:
npm run smoke:docker
npm run preflight:release
npm run package:deploy
npm run verify:bundle
npm run evidence:submissionEndpoints:
GET /healthzPOST /mcpnpm run validate:data
npm run scan:policy
npm test
npm run build
npm run smoke:http
npm run smoke:dist
npm run smoke:docker
npm run preflight:release
npm run package:deploy
npm run verify:bundle
npm run evidence:submissionAfter deployment, verify the public endpoint and write review evidence:
MCP_URL=https://<kakao-cloud-endpoint>/mcp \
EVIDENCE_OUT=deploy/playmcp/evidence/remote-smoke.json \
npm run smoke:endpointThe current acceptance target is at least 61 passing tests plus the HTTP MCP smoke covering tools/list schemas, classify_civic_issue, and draft_civic_report.
For the review narrative and sample cases, see DEMO_SCRIPT.md.
For actual-use verification steps and the future 이웃 도움 교류 expansion design, see docs/actual-use-and-neighbor-help-design.md.
For owner approval and external deployment stop rules, see deploy/playmcp/owner-approval-packet.md.
For the contest path, deploy through PlayMCP in KC first, copy its Endpoint URL, then temporarily register that endpoint in the PlayMCP developer console. See deploy/playmcp/playmcp-in-kc-registration.md for the exact field mapping.
For a clean source bundle that excludes node_modules, dist, and local evidence files, run npm run package:deploy and use the tarball under deploy/playmcp/package/.
To prove the latest tarball works from a clean extraction, run npm run verify:bundle.
After local or remote smoke runs, npm run evidence:submission writes a review-ready evidence draft to deploy/playmcp/evidence/submission-evidence.generated.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.