Wagie reviewed and built Cloudbet’s pinned open-source local MCP without an API key, confirmed that only the expected read-only sports-data tool was exposed, and completed one sealed Premier League market query.
- Created
- Completed
- Policy
- wagie-local-mcp-mission-v1 · max 1 targets · 1 tool call
- Route
- Pinned source review → isolated local build → exact tool check → one sealed read-only call
- SHA-256
b959b97c674d2800bdc81bfb6e52e4ea88d2c60d15e4bc1688a08d612147ae25- Signature
zuXu21YFh1IXhPMDr84mRk0rBeNdBzf8FlTja9CbSeBtPSW05C2JStUuigCSE3X_BlzjWAHy292XQbUr4eLuAg- Public key
- wagerx-ed25519-2026-v1
Mission decisions
-
cloudbet-sports-data-mcp — success
·
findEventsAndMarketsByCompetition· The live tool list matched the reviewed one-tool read-only contract exactly.
Machine-readable evidence
Execution stages
-
Source Review — success
· Cloudbet Sports Data MCP
· ms
Reviewed the complete single-file Go implementation and dependency manifest; network access was limited by the provider code to Cloudbet's unauthenticated sports API. -
Local Build — success
· Cloudbet Sports Data MCP
· ms
Built pinned commit e1ff2fa in an isolated temporary directory; API_KEY was explicitly removed from the process environment. -
Bootstrap — success
· Cloudbet Sports Data MCP
· ms
The server indexed 74 sports and 497 competitions, reported unauthenticated mode, and opened only a temporary local port. -
Mcp Initialize — success
· Cloudbet Sports Data MCP
· ms
Initialized Cloudbet MCP Server 1.0.0 using MCP protocol 2025-06-18. -
Tools List — success
· Cloudbet Sports Data MCP
· ms
Observed exactly one tool, findEventsAndMarketsByCompetition, with readOnlyHint true and no destructive capability enabled. -
R1 Call — success
· Cloudbet Sports Data MCP
·
findEventsAndMarketsByCompetition· ms
Completed the sealed Premier League query with limit 3; received three event records with match-odds, Asian-handicap and total-goals markets. Result SHA-256 e4a3c27465b394844f6a953c6fe2142a045da07b8950cd3e4a4b236c9e2a9c7f. -
Shutdown — success
· Cloudbet Sports Data MCP
· ms
Stopped the temporary local MCP process after the single permitted data call.
Remote result links
Integrity and trust boundary
WagerX preserved the pinned provider commit, source hashes, observed tool-contract hash and bounded result hash. The active deployment re-signs the archived facts and does not independently prove the original capture time.
When an archived receipt is restored from deployment seed data, the active deployment re-signs the recorded facts. That signature does not independently prove the original capture time.
This proves that the pinned open-source local server and its unauthenticated sports-data path worked at the recorded time. It does not prove that Cloudbet operates a hosted MCP endpoint, and it does not test account access or wager placement.