Ghost Agent (Coreon MCP Execution Engine)

The README describes CLI, HTTP API, Telegram, multi-tool chains, and Solana/on-chain capabilities, but provides no tool permission model, natural-language plan confirmation threshold, or pre-execution approval, so least-privilege and confirmation evidence is thin. It requires an OpenAI API key and mentions external APIs and on-chain interaction without explaining data sent, key storage, or protection. Payment-related behavior is not described enough to establish its actual external effects. No rollback or recovery mechanism is shown. The audit and feature claims are attributable to the README, but package metadata points to a different project and repository identity and maintenance ownership are unclear, so attribution earns only limited credit.

The README’s architecture and run modes conflict with the package name, version, repository URL, LICENSE attribution, and the Ralph project described in CLAUDE.md. This undermines self-consistency and prevents attributing Ralph’s tests or CI to the assessed product. Docker commands and a Python version give partial dependency availability guidance, but dependencies are not pinned and source installation details are absent. The supplied test-script excerpts show error-detection logic and scenarios, but are not complete, attributable failure-handling documentation; failure-message evidence is therefore limited.

The README identifies LLMs/users and lists CLI, API, Telegram, Docker, and Solana scenarios, which supports ordinary audience and scenario assessment. Tool registration and chained execution partially define capabilities, but an actual tool inventory, permission boundaries, and safety constraints are missing. Natural-language planning is described as generating plans dynamically without trigger boundaries, disambiguation, or confirmation policy. Environment guidance names Python 3.11+, Docker, and an API key, but deployment and environment-fit instructions remain incomplete.

The README has a product overview, architecture diagram, installation steps, and Docker launch examples, but mixes project names and branches and conflicts with the supplied CLAUDE.md and package.json, so information architecture is only partially usable. The MIT LICENSE file is explicit, but package.json declares ISC; the conflicting metadata prevents full credit. There is no dependable version/change history, clear maintenance responsibility, or complete FAQ. README update dates and project links do not resolve product identity or ownership.

CLI, API, Telegram, and tool-chain output modes are described, and Docker examples make the entry points partly actionable, but there are no source-aligned usage examples or verifiable results. Natural-language planning into structured tool execution and payment-signal handling could provide value, but payment capability is described as future work or as belonging to another branch, and the materials conflict, limiting evidence of marginal value. The installation requires Docker and an OpenAI key; runtime costs, external service costs, and benefits are not explained, so cost-benefit evidence is thin.

The README provides architecture, launch commands, and an audit-passed claim, while test excerpts show concrete error-detection scenarios; however, the audit report contents and attributable implementation supporting the main features and audit claim are not included. README, CLAUDE.md, package.json, and LICENSE conflict on project name, stack, repository link, and license metadata, preventing cross-source corroboration. The README partly distinguishes current features, roadmap items, and another branch’s content, but test and audit claims lack corroboration in the supplied materials, so fact/inference separation is only partial.