### Start the development server Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/DEVELOPER-CHECKS.md Runs the server in local development mode with no authentication, bound to 127.0.0.1:8787. Keep the terminal open and do not expose it via a tunnel or use for a public server. ```sh npm run dev -- --ip 127.0.0.1 --port 8787 ``` -------------------------------- ### Check Node.js, npm, install dependencies, and run checks Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/README.md Run from the project directory to verify the pinned Node.js 24.14.0 and npm 11.9.0 versions, install dependencies, and run type checking, tests, and a dry-run build. On Windows, use npm.cmd and npx.cmd if PowerShell blocks script wrappers. ```sh node --version npm --version npm ci npm run check ``` -------------------------------- ### Start Node interactive prompt Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/DEVELOPER-CHECKS.md Starts Node's interactive prompt in a second terminal after restarting the server with the command from section 1. ```sh node ``` -------------------------------- ### Send synthetic model request via fetch Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/DEVELOPER-CHECKS.md Paste this JavaScript into the Node prompt to make one real request to NVIDIA through the Worker. The shopping-list example is synthetic. Wait for HTTP status and JSON response; type .exit to leave the prompt. ```js (async () => { const call = { jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'adversarial_review', arguments: { artifact: 'A shopping list removes an item when a receipt contains the same name, without checking quantity or recipient.', review_request: 'Find flaws that could make this automatic removal unreliable.' } } }; const reply = await fetch('http://localhost:8787/mcp', { method: 'POST', headers: { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream' }, body: JSON.stringify(call) }); console.log('HTTP', reply.status); console.log(JSON.stringify(await reply.json(), null, 2)); })(); ``` -------------------------------- ### Personal instruction for MCP host assistant Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/ASSISTANT-INSTRUCTIONS.md Paste this instruction into the assistant's configuration in the MCP host. It directs the assistant to autonomously use OP_Adversarial_Pressure tools for bounded adversarial checks on critical tasks, major pivots, or fragile assumptions, and to report what was integrated or discarded. ```text On critical tasks, major pivots, or fragile assumptions, autonomously use OP_Adversarial_Pressure/Bounded_Tests/Targeted_Challenges for a bounded adversarial check when useful. Read the tool descriptions, select the appropriate tool, follow its rules, triage the result, and report what you integrated or discarded. ``` -------------------------------- ### Run local checks for staging Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md Run these commands to perform preflight checks and build for staging. The untouched template fails preflight due to placeholder URLs, empty allowlists, and an all-zero KV ID. Expect 'Staging preflight passed' after replacing those values. ```sh npm run preflight:staging npm run build:staging ``` -------------------------------- ### Preflight and dry-run deployment for staging Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/LOG-SINK.md Run these commands from an unpublished deployment copy to check the baseline configuration and build the enabled configuration without publishing. The preflight checks the file, not the command-line override; the dry-run checks the build. Neither verifies the collector, token, or delivery. ```sh npm run preflight:staging npx wrangler deploy --dry-run --env staging --var LOG_SINK_ENABLED:true --outdir dist/staging ``` -------------------------------- ### Sign in to ChatGPT account with Wrangler and npm script Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/CHATGPT-SETUP.md Run npx wrangler login and npm run chatgpt:login -- --env staging to sign in. The command opens a temporary preview and browser sign-in page, then stores credentials encrypted. ```sh npx wrangler login npm run chatgpt:login -- --env staging ``` -------------------------------- ### List tools via MCP request Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/DEVELOPER-CHECKS.md Sends a JSON-RPC tools/list request to the local server and prints the tool names. Expect HTTP 200 and the eight tool names listed in the output. ```sh node --input-type=module -e "const r=await fetch('http://localhost:8787/mcp',{method:'POST',headers:{'Content-Type':'application/json',Accept:'application/json, text/event-stream'},body:JSON.stringify({jsonrpc:'2.0',id:1,method:'tools/list',params:{}})}); console.log('HTTP',r.status); const data=await r.json(); console.log(data.result?.tools?.map(t=>t.name)??data);" ``` -------------------------------- ### Create op-redteam-secrets.json with all six secrets Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md Create this JSON file in the parent folder, outside the deployment folder and any shared repository. Fill in your own values for the six required secrets. This is a plaintext file containing credentials; keep access limited and remove it after deployment. ```json { "GITHUB_CLIENT_ID": "replace-with-the-oauth-app-client-id", "GITHUB_CLIENT_SECRET": "replace-with-the-oauth-app-client-secret", "COOKIE_ENCRYPTION_KEY": "replace-with-the-first-generated-key", "IDENTITY_HMAC_KEY": "replace-with-the-second-generated-key", "OPENROUTER_API_KEY": "replace-with-your-openrouter-api-key", "NVIDIA_API_KEY": "replace-with-your-nvidia-api-key" } ``` -------------------------------- ### Create .dev.vars configuration file Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/DEVELOPER-CHECKS.md Create a file named exactly .dev.vars next to package.json with these values. Replace both replace-with-... entries. On Windows, ensure no .txt extension is added. ```dotenv COGNITIVE_RUNTIME_PROFILE=external IDENTITY_HMAC_KEY=replace-with-the-generated-key NVIDIA_API_KEY=replace-with-your-nvidia-api-key LOG_SINK_ENABLED=false ``` -------------------------------- ### Check ChatGPT account status Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/CHATGPT-SETUP.md Run npm run chatgpt:status -- --env staging to check account/session metadata, including credential presence and expiry. Does not print tokens. ```sh npm run chatgpt:status -- --env staging ``` -------------------------------- ### Sign in to Cloudflare with Wrangler Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md Logs in to Cloudflare and verifies the active account. Run these commands in the deployment folder. ```sh npx wrangler login npx wrangler whoami ``` -------------------------------- ### Expected tool names output Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/DEVELOPER-CHECKS.md The expected output from the tools/list request: HTTP 200 and the eight tool names. ```text stress_structure sparring_pressure premortem_trace abuse_path redteam_experiment adversarial_review premortem_scan sparring_scan ``` -------------------------------- ### Configure telemetry log sink with .dev.vars Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/README.md Set these values in the ignored `.dev.vars` file for local development, then restart the server. The sink is off unless LOG_SINK_ENABLED=true; it sends JSON by HTTPS POST to LOG_SINK_URL with an Authorization: Bearer token, and the collector must return a 2xx response. ```dotenv LOG_SINK_ENABLED=true LOG_SINK_URL=https://your-collector.example/ingest LOG_SINK_TOKEN=replace-with-your-collector-token ``` -------------------------------- ### Create KV namespace for OAuth Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md Creates a Cloudflare KV namespace for OAuth registrations and tokens. Run once for this deployment. ```sh npx wrangler kv namespace create OAUTH_KV --env staging --update-config=false ``` -------------------------------- ### Enable ChatGPT primary route in wrangler.jsonc Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/CHATGPT-SETUP.md Set COGNITIVE_GPT_PRIMARY_ENABLED to true in env.staging.vars in wrangler.jsonc to enable the ChatGPT primary route. Keep COGNITIVE_RUNTIME_PROFILE set to external and retain both provider keys for fallback. ```jsonc "COGNITIVE_GPT_PRIMARY_ENABLED": "true" ``` -------------------------------- ### Deploy Worker with secrets to Cloudflare Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md Publishes to Cloudflare and uploads the secrets. Use --secrets-file for this first deployment because the pinned Wrangler version cannot add secrets with secret put before the Worker exists. Confirm the deployed URL matches PUBLIC_ORIGIN exactly. ```sh npx wrangler deploy --env staging --secrets-file "../op-redteam-secrets.json" ``` -------------------------------- ### Set secret and deploy with sink enabled Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/LOG-SINK.md Store the LOG_SINK_TOKEN at the interactive prompt, then deploy with the sink enabled. Never put the token in the command line or in wrangler.jsonc. The Worker already has the six required secrets from the first deployment; these commands do not replace them. ```sh npx wrangler secret put LOG_SINK_TOKEN --env staging npx wrangler deploy --env staging --var LOG_SINK_ENABLED:true ``` -------------------------------- ### Set Cloudflare account ID (macOS/Linux) Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md Sets the CLOUDFLARE_ACCOUNT_ID environment variable in macOS/Linux to select the Cloudflare account explicitly. ```sh export CLOUDFLARE_ACCOUNT_ID="replace-with-your-account-id" ``` -------------------------------- ### Generate identity key with Node.js Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/DEVELOPER-CHECKS.md Generates a random 32-byte base64url-encoded key for IDENTITY_HMAC_KEY. Run this in a terminal after stopping the local server. ```sh node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))" ``` -------------------------------- ### Manual credential renewal command Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/CHATGPT-SETUP.md Run this command to manually renew ChatGPT credentials while saved refresh credentials are still valid. It uses the staging environment. ```sh npm run chatgpt:renew -- --env staging ``` -------------------------------- ### Set Cloudflare account ID (PowerShell) Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md Sets the CLOUDFLARE_ACCOUNT_ID environment variable in PowerShell to select the Cloudflare account explicitly. ```powershell $env:CLOUDFLARE_ACCOUNT_ID = "replace-with-your-account-id" ``` -------------------------------- ### Worker origin URL Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/GETTING-STARTED.md The origin URL for the deployed Worker, used as the OAuth resource indicator. Replace YOUR-SUBDOMAIN with your account's workers.dev subdomain. ```text https://op-redteam-mcp-staging.YOUR-SUBDOMAIN.workers.dev ``` -------------------------------- ### Disable sink on deployed Worker Source: https://github.com/xxyoudeadpunkxx/op-redteam-mcp/blob/main/docs/LOG-SINK.md Deploy without the --var override to reapply the file's LOG_SINK_ENABLED=false value, stopping sink delivery for new invocations. This does not delete events already stored by the collector or disable the separate Cloudflare Analytics Engine metrics. ```sh npx wrangler deploy --env staging ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.