Dongnesos Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Dongnesos Mcp (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
동네SOS / 이거 어디에 말해? PlayMCP candidate implementation.
This server helps a user prepare a civic inconvenience report without doing the reporting for them. It classifies a Korean neighborhood issue, explains what evidence to prepare, and drafts a neutral copy/paste report. It never submits a report, logs in, reads KakaoTalk, collects precise location, uploads photos, or calls external government APIs.
DongneSOS is not meant to replace search by summarizing web pages. Its service value is that it turns a messy local problem into an action package: official type, likely channel family, evidence checklist, privacy-safe official/public text split, neutral wording, and next action. Search gives pages; DongneSOS gives the next safe action.
classify_civic_issue: classifies the issue into the fixed 28-item taxonomy,routes it to a channel family, and returns the canonical Pro Chat output fields: result_type, priority, routing, source_basis, action_card, draft_policy, and errors.
draft_civic_report: creates a neutral report preparation draft fornon-emergency cases only.
The server intentionally exposes exactly those two tools. Both tools declare MCP inputSchema and outputSchema; the HTTP smoke verifies those schemas are visible in tools/list.
emergency_redirect orblocked_emergency; draft generation is blocked.
channel before submitting.
presentation_mock is a lightweight ChatGPT card shape, not a dependency onKakao Widget APIs.
npm install
npm run check
npm run smoke:http
npm run smoke:dist
npm run dev -- --host 127.0.0.1 --port 3000After npm run build, production start uses:
npm startContainer build:
docker build -t dongnesos-mcp .
docker run --rm -p 3000:3000 dongnesos-mcpPlayMCP in KC image builds require linux/amd64, including on Apple Silicon:
npm run image:build:amd64
npm run image:push:playmcpnpm run image:push:playmcp is a dry-run by default. It only pushes after external image publication is approved and the command is run with DRY_RUN=0 CONFIRM_EXTERNAL_IMAGE_PUSH=1.
Container release smoke:
npm run smoke:docker
npm run preflight:release
npm run package:deploy
npm run verify:bundle
npm run evidence:submissionEndpoints:
GET /healthzPOST /mcpnpm run validate:data
npm run scan:policy
npm test
npm run build
npm run smoke:http
npm run smoke:dist
npm run smoke:docker
npm run preflight:release
npm run package:deploy
npm run verify:bundle
npm run evidence:submissionAfter deployment, verify the public endpoint and write review evidence:
MCP_URL=https://<kakao-cloud-endpoint>/mcp \
EVIDENCE_OUT=deploy/playmcp/evidence/remote-smoke.json \
npm run smoke:endpointThe current acceptance target is 72 passing tests plus the HTTP MCP smoke covering tools/list schemas, classify_civic_issue, and draft_civic_report. Source-card acceptance validates that classify_civic_issue returns official source-card matches plus a compact action card for evidence capture and public-sharing limits.
For the review narrative and sample cases, see DEMO_SCRIPT.md.
For actual-use verification steps and the future 이웃 도움 교류 expansion design, see docs/actual-use-and-neighbor-help-design.md.
For the product differentiation against ordinary search, see docs/search-vs-dongnesos-service-value-20260625.md. The initial official source-card corpus lives in data/source_cards.json and is validated by npm run validate:data; runtime matching lives in src/core/sourceCards.ts.
For owner approval and external deployment stop rules, see deploy/playmcp/owner-approval-packet.md.
For the contest path, deploy through PlayMCP in KC first, copy its Endpoint URL, then temporarily register that endpoint in the PlayMCP developer console. See deploy/playmcp/playmcp-in-kc-registration.md for the exact field mapping.
For a clean source bundle that excludes node_modules, dist, and local evidence files, run npm run package:deploy and use the tarball under deploy/playmcp/package/.
To prove the latest tarball works from a clean extraction, run npm run verify:bundle.
After local or remote smoke runs, npm run evidence:submission writes a review-ready evidence draft to deploy/playmcp/evidence/submission-evidence.generated.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.