verify-live-mcp

name	verify-live-mcp
description	Use when inspecting, verifying, smoke-testing, or describing a deployed mcp-researchpowerpack endpoint or checking whether a commit is active. Defaults to an isolated read-only mcpc surface probe; run tool behavior, provider/LLM calls, live acceptance, deployment, restart, or environment sync only with explicit authorization.

Verify a deployed research MCP

Query the selected endpoint before describing it. Source and package.json.version do not prove the live surface.

• Production: https://research-mcp.yigitkonur.com/mcp
• Manufact server: 188771a3-172e-41d0-926d-bb15bb609802
• Full contract: acceptance contract

The expected v9 surface is exactly plan-research, web-search, extract-evidence, and parameterless review-research. During an authorized transition, report an observed v8 surface as observed; do not correct it from source or memory.

Default: read-only surface smoke

This probe may initialize a session, inspect the target, list tools/resources, and read health://status or research://method. It must not call a public tool, provider, or LLM. Use repository-pinned pnpm exec mcpc, an isolated MCPC_HOME_DIR, a unique session, and an immediate target assertion because mcpc reuses live sessions by name.

set -euo pipefail
MCPC_HOME_DIR="$(mktemp -d)"
export MCPC_HOME_DIR
SESSION="@rp-readonly-$$-$RANDOM"
cleanup() {
  pnpm exec mcpc close "$SESSION" >/dev/null 2>&1 || true
  rm -rf "$MCPC_HOME_DIR"
}
trap cleanup EXIT

TARGET=https://research-mcp.yigitkonur.com/mcp
MCPC_PIN="$(node -p "require('./package.json').devDependencies['@apify/mcpc']")"
test "$(pnpm exec mcpc --version)" = "$MCPC_PIN"
pnpm exec mcpc connect "$TARGET" "$SESSION" --no-profile
pnpm exec mcpc --json "$SESSION" | jq -e --arg target "$TARGET" '._mcpc.server.url == $target'
pnpm exec mcpc --json "$SESSION" tools-list --full
pnpm exec mcpc --json "$SESSION" resources-list
pnpm exec mcpc --json "$SESSION" resources-read health://status | jq -r '.contents[0].text' | jq .
pnpm exec mcpc --json "$SESSION" resources-read research://method

Record the endpoint, UTC probe time, observed tool names/schemas, initialize capabilities, and relevant health fields. Inspect JSON, not colored success banners.

Explicit authorization: behavioral acceptance

Only explicit live-test authorization permits public tool calls or provider/LLM consumption. Prefer the executable matrix:

E2E_MCP_URL=https://research-mcp.yigitkonur.com/mcp pnpm test:live:acceptance

The runner creates an isolated mcpc home and unique sessions, asserts the target, and checks the live-addressable rows in the acceptance contract. Provider-gated rows can report SKIP without failing the process, so a green exit proves only the non-skipped rows. Report pass, skip, and fail counts and never claim skipped coverage.

Deterministic HTTP, contract, and unit suites remain authoritative for injected disconnect cancellation and resume-scope identity; do not claim those from a live endpoint.

Deployment, restart, environment sync, live.yml, and production E2E require their own explicit authorization. This skill does not grant it.

Prove the deployed commit

Inspect the active deployment and status; do not use the version string as proof.

EXPECTED_SHA=$(git rev-parse HEAD)
npx mcp-use servers get 188771a3-172e-41d0-926d-bb15bb609802
printf 'expected commit: %s\n' "$EXPECTED_SHA"

• If a running active deployment already reports EXPECTED_SHA or a Git-verified descendant, record commit/status proof and do not force a redeploy.
• If a new redeploy was required, require the requested commit and a successful health check from that deployment before claiming it live.

For a surface mismatch, report the observed endpoint, active commit/status, and failed contract row. Do not hide transition state or infer successful deployment from branch CI.

mcpc rules

1. Use pnpm exec mcpc from this repository; never rely on a global version.
2. Isolate MCPC_HOME_DIR, generate a unique session, assert its URL, and close it.
3. Use --no-profile for anonymous probes unless OAuth behavior is the subject.
4. Inspect isError, structuredContent, and content JSON for authorized calls.
5. Keep one session for ledger continuity and a separate fresh session for isolation.