NTWX-AUDIT Master Dashboard

NTWX🛡️ NTWX-AUDIT MASTER — 62 Findings · 5 sources🖥️ CONTROLLED BY M5
Hermes corpus + Cursor pack + Wave-1 MCP + Web estate + Data integrity + Secrets ledger + Google MCP suite addendum · Compiled 2026-08-23
6🔴 Critical
16🟠 High
24🟡 Medium
16🟢 Low/Clean
9🌐 Google MCP
7🩷 Pink/Delete

Filter & Drill Down

① Finding Cards — Sorted by Severity

🔴 RED — URGENT (6)
Act today. Wallet keys / GitHub-exposed credentials / trading secrets.

CODE-M~/.hermes/config.yaml mcp_servers.gdelt.headersGDELT MCP bearer token stored plaintext in Hermes config; re-verified present on 2026-08-23. Ma…MCP-001
SECRETml-ntwx/flowledger/docker-compose.yml (RUNPOD_API_KEY, HF_Live keys at HEAD lines ~35/59/60; pushed to GitHub in 4b5bb37 2026-08-04 <REDACTED>…SEC-001
SECRETkronos-cts/.env tracked in git HEADgit ls-files confirms .env TRACKED; history adds at 59df177(2026-04-20) + bcf8d38(2026-05-13) c…SEC-002
SECRETOnos-M5-MK3-Victor/.env HL_PRIVATE_KEY (wallet 0x204f…d1b1Plaintext agent-wallet private key on disk, mtime 2026-07-16 <REDACTED>…SEC-003
SECRETconway-mk1/.env CON_AGENT_PRIVKEYAgent wallet private key plaintext at conway-mk1/.env mtime 2026-07-30 <REDACTED>…SEC-004
SECRETchrono-wallet/.env WDK_SEED_PHRASEMulti-chain seed phrase (ETH/ARB/TRON/BTC/SOL scope) plaintext, mtime 2026-04-23 <REDACTED>…SEC-005

🟠 ORANGE — FIX THIS WEEK (16)
Auth gaps · protocol drift · dead transports · overstated CTAs.

CODE-M~/Developer/ml-ntwx/ASI-Evolve/.envOPENAI_API_KEY in .env; repo is a git repo; .gitignore lacks .env so one 'git add -A' commits a…MCP-002
CODE-Mhttps://forge-api.ml-nightworx.io/mcpinitialize AND tools/list return 200 with zero auth; full DoD contract-search tool surface publ…MCP-003
CODE-Mhttps://dome.ml-nightworx.io/.well-known/mcp/servers.jsonDiscovery file 200 OK advertises MCP tools/capabilities, but POST /api and /mcp both return 404…MCP-004
CODE-Mpaybridge-api /mcp protocolVersionServer returns 2025-03-26 even when client offers 2024-11-05 — violates spec downgrade rule; ma…MCP-008
CODE-Mforge-api /mcp protocolVersionHard-pinned 2024-11-05 regardless of client offer of 2025-06-18; 2025-era clients expecting new…MCP-009
DATAOnos-M5-MK3-Victor/alpha_telemetry.dbNewest backup Jul 2; newest data Jul 26; today Aug 23 = 55 days of gate-relevant history with n…DATA-001
GOOGLEanalytics-product/combined-mcp/server.jsZero auth enforcement on MCP endpoint — tools/call publicly callable if exposed. CORS open (*).…GMCP-001
GOOGLEanalytics-product/gmail-mcp/server.jsGmail MCP with domain-wide delegation but zero auth check on incoming requests.…GMCP-003
GOOGLEanalytics-product/hawk-mcp/server.jsNIGHTHAWK-specific MCP with zero auth; exposes GA4 property data for NIGHTHAWK property 5507065…GMCP-004
SECRET~/.hermes/config.yaml GDELT bearer token (line 180)mcp_servers.gdelt.headers.Authorization: Bearer <REDACTED> in plaintext config…SEC-006
SECRETOPENROUTER_API_KEY sprawl (6+ files incl. Downloads duplicKey referenced by name in .zshrc, ~/.hermes/.env, kronos-ew-cycle/.env, two scaffold scripts, p…SEC-007
SECRETflowledger/.env ANTHROPIC_API_KEY (standalone).env correctly gitignored but key age ~4.5 months matches compose leak vintage <REDACTED>…SEC-008
WEBhawk.ml-nightworx.ioPay-Bridge card live with QR + 'Open Pay-Bridge' CTA; PAY_BRIDGE_ENABLED=false per brief. Copy …WEB-001
WEBaaas.ml-nightworx.iollms.txt lists 3 dead children: moat (522), oasisproperty (404), legal777 (NXDOMAIN); also 'HAW…WEB-002
WEBagentic-moat-dashboard.web.appRetired Firebase dashboard still serves 200 'Agentic Moat — ML-NIGHTWORX Ops Dashboard'; brief …WEB-009
WEBSKIP studio.ml-nightworx.ioNXDOMAIN confirmed while wiki claims LIVE G18 status — stale wiki claim…WEB-019

🟡 YELLOW — FIX THIS MONTH (24)
Missing metadata · partial coverage · stale backups · governance.

CODE-Mruntime-mcp.ml-nightworx.io (ntwx-mcp-1.1 + runtime-mcp enNXDOMAIN reconfirmed live 2026-08-23 for both inventory entries; inventory already flagged it —…MCP-005
CODE-M~/Developer/infradome/specs/mcp_server_kuzu.pyInventory cites InfraDOME FastMCP stdio command; no infradome dir or mcp_server_kuzu.py anywher…MCP-006
CODE-Mhttps://paybridge-api.ml-nightworx.io/mcpPrior evidence '/mcp 404' was GET-only; POST MCP is fully LIVE (mcp-1.1.1-paybridge 0.2.6). Inv…MCP-007
CODE-M~/Developer/kronos-cts/.env (+ worktrees, services/*/.env).env NOW gitignored (verified) — but 18 secret-history hits remain in git history; F-16 only ha…MCP-013
DATAOnos-M5-MK3-Victor/alpha_telemetry.dbNo rows since 2026-07-26 12:07 (28-day write gap) while -shm sidecar was touched Aug 20 - captu…DATA-002
DATA~/.hermes/state.db, cron/executions.db, verification_evideAll three healthy (quick_check ok) but have zero backups; state.db is 110 MB of irreplaceable s…DATA-005
DATAbackup infrastructureOnly backups are two one-off Jul-2 snapshots sitting in the same directory as the primary…DATA-007
GOOGLEanalytics-product/business-mcp/server.jsAPI key referenced in config but no req.header enforcement found in route handlers.…GMCP-002
GOOGLEanalytics-product/search-mcp/server.jsGSC search data MCP, no auth enforcement. GSC_SERVICE_ACCOUNT_KEY referenced via env.…GMCP-005
GOOGLEanalytics-product/dashboards-mcp/server.jsDashboard data MCP, no auth enforcement found.…GMCP-006
GOOGLEanalytics-product/mcp-server/server.jsGeneric MCP server template; role unclear vs other specialized servers.…GMCP-007
GOOGLEanalytics-product/.env.exampleGA4_SERVICE_ACCOUNT_KEY path points to ~/Downloads/ml-ntwx-il-v1-cba997061bc0.json — Downloads …GMCP-008
SECRETagentic-moat GOOGLE_APPLICATION_CREDENTIALS dangling point.env references SA key path; target file absent on disk <REDACTED>…SEC-009
SECRETagentic-moat/.env FORGE_DATA_GOV_API_KEYActive gov-data key on disk, mtime 2026-08-15, no git exposure found <REDACTED>…SEC-010
WEBlv2.ml-nightworx.io23 unique buy.stripe.com links vs ~205 product-name mentions across 5 sizes x collections; Stri…WEB-003
WEBdome.ml-nightworx.ioAdvertised endpoint https://dome.ml-nightworx.io/api returns HTML SPA fallback (not JSON API); …WEB-004
WEBreflector.ml-nightworx.ioNo meta description, no OG tags, no copyright, no contact email; title 'Reflector Client Manage…WEB-005
WEBinfradome.ml-nightworx.iositemap.xml+robots.txt are HTML SPA fallbacks (soft-404); no meta description, OG, copyright, c…WEB-006
WEBforge.ml-nightworx.ioSource-of-truth workshop site: no sitemap/robots (fallback), no meta description, OG, copyright…WEB-007
WEBanalytics.ml-nightworx.io'CUBBY HOUSE Analytics' ops dashboard publicly reachable, no auth wall observed, no robots/noin…WEB-008
WEBsleep.ml-nightworx.ioPurpose undocumented in brief ('purpose unknown'); Next.js app serving HTML fallbacks for robot…WEB-010
WEBonos-mk2.ml-nightworx.ioTitle is bare 'Streamlit' with Streamlit/Snowflake Apache license text as first content; zero M…WEB-013
WEBestate-wide (12 hosts)SPA soft-404 pattern: /.env and /debug return 200 HTML on reflector/hawk/nighthawk/ntwx/sleep/f…WEB-017
WEBestate-wide (13 hosts)13 of 23 hosts have NO valid sitemap.xml; 14 lack robots.txt; 10 lack meta description — incons…WEB-018

🟢 GREEN — GOOD / MINOR (14)
Clean bills + quarterly review items.

CODE-Mcursor-cloud + cursor-subscriptionsCursor-internal servers have no externally probeable endpoint from this Mac; subscriptions entr…MCP-010
CODE-MWalrus/MemWal mock fixtureInventory itself marks simulation-only; no file located on Mac. Plan skip-list excludes Walrus …MCP-011
CODE-Mnighthawk-api.ml-nightworx.io /feeds/* + /api/keysBearer auth correctly enforced on feeds and key endpoints; no unauthenticated surface found. Po…MCP-012
CODE-M~/.claude.json + ~/.cursor/mcp.jsonclaude.json mcpServers empty everywhere; cursor/mcp.json absent. No secret exposure on these su…MCP-014
DATAOnos-M5-MK3-Victor/alpha_telemetry.db-shm/-wal-shm 32KB mtime Aug 20 vs db mtime Jul 29; -wal 0 bytes; journal_mode=delete so sidecars are ve…DATA-003
DATA~/kronos_telemetry.db0 bytes, mtime Jun 28, file(1) says empty, sqlite opens zero-page db with no tables…DATA-004
DATAOnos-M5-MK3-Victor/alpha_telemetry.db147811 of 5397648 rows (2.7%) have valid=0; freelist_count=0 so no wasted space…DATA-006
SECRETCLOUDFLARE_API_TOKEN / TELEGRAM_BOT_TOKEN / Stripe live keNo disk values found; dashboard/Worker-secret held per SOP <REDACTED>…SEC-011
SECRETClaude session keys / cloudflared cert.pemTool-managed creds in default locations <REDACTED>…SEC-012
WEBnighthawk-api.ml-nightworx.ioAPI host 401s all discovery paths incl. robots.txt — acceptable for API but no public docs disc…WEB-011
WEBntwx.ml-nightworx.ioCorporate root has no copyright line, no contact email, no OG tags despite being brand root…WEB-012
WEBagency888.ml-nightworx.ioCopyright says '© 2025 AGENCY888' (stale year) and contact placeholder 'you@company.com' — temp…WEB-014
WEBinfra-aeo.ml-nightworx.ioContact placeholder 'you@company.com' visible on production AEO site…WEB-015
WEBrem.ml-nightworx.ioContact email is personal mark@ml-nightworx.com; llms.txt present; otherwise strongest small-si…WEB-016

ℹ️ INFO — Observations (2)
Non-blocking notes for forward compatibility.

GOOGLEanalytics-product (all servers)All 8 servers self-declare as MCP 1.0 pattern: POST /mcp for initialize/tools/list/tools/call +…GMCP-009
WEBSKIP dash.ml-nightworx.ioNXDOMAIN confirmed — consistent with records…WEB-020

🩷 PINK — DELETE / ISOLATED / NOT REQUIRED (7)

kronos_telemetry.db0 bytes since Jun 28 — dead fileDELETE
agentic-moat-dashboard.web.appretired but still serving 200DECOMMISSION
Walrus/MemWal MCP mocksimulation only, do not integratePARKED
VLESS REALITY runbookoff-catalog, jurisdiction flaggedOFF-CATALOG
AMEP-lite protocolpilot-only, never deploy to live surfacesPLANNED-ONLY
dash.ml-nightworx.ioNXDOMAIN, no rebuild unless orderedARCHIVED
mcp-server/server.js (generic template)role unclear vs specialized serversCLARIFY-OR-KILL

② Priority Roadmap — Easy → Difficult × Important → Now

#ActionEffortImpactWhen
1Rotate HL_API_SECRET (kronos-cts .env tracked in HEAD) + git rm --cached30 minTrading accountNOW
2Rotate flowledger RUNPOD/HF/ANTHROPIC keys + force-push clean GitHub history45 minGitHub exposure ×19dNOW
3Move Victor wallet private key (0x204f…d1b1) → macOS Keychain15 minLive walletNOW
4Move chrono-wallet WDK_SEED_PHRASE → encrypted vault15 minMulti-chain seedNOW
5Move conway-mk1 agent privkey → Keychain10 minAgent walletNOW
6Add auth middleware to all 8 Google MCP servers before any deploy30 minData exposureThis week
7Gate hawk /payments Pay-Bridge card behind PAY_BRIDGE_ENABLED flag20 minGTM honestyThis week
8Rotate GDELT bearer token + move to env var injection20 minIntel surfaceThis week
9Clean aaas llms.txt dead SKUs + fix truncated hawk URL15 minAEO accuracyThis week
10Add .env to ASI-Evolve/.gitignore before next commit2 minKey protectionThis week
11Bump forge-api MCP SDK from 2024-11-05 to 2025+ spec1 hrMCP compatThis month
12Create nightly backup job for alpha_telemetry.db (1.9 GB)1 hrData safetyThis month
13Consolidate OPENROUTER_API_KEY sprawl (6+ files → single source)30 minRotation blast radiusThis month
14Move GA4 service-account keys out of ~/Downloads → ~/.config/gcp/10 minKey hygieneThis month
15Add meta/OG/copyright/sitemap to all glass hosts missing them30 min/hostAEO qualityOngoing
16Decommission Firebase legacy dashboard (still 200)15 minCleanupWhen convenient
17Delete kronos_telemetry.db (0-byte dead file)1 minDisk hygieneAnytime
Sources (all ox-alpha sessions):
① MCP Wave-1 audit: @session:default/20260823_111015_d20f53 + @session:default/20260823_112352_f5a35e (14 servers + GDELT addendum)
② Web Estate audit: @session:default/20260823_113759_a60981 (23 hosts, 184 checks)
③ Data Integrity audit: @session:default/20260823_111847_427a13 (8 targets, restore test)
④ Secrets Ledger audit: @session:default/20260823_113116_69adb5 (17 credentials, rotation runbook)
⑤ Google MCP suite addendum: this session (8 servers code-reviewed from ~/projects/analytics-product/)
Unified findings: ~/NTWX-AUDIT-FINDINGS-UNIFIED.json (62 records) · Master file: ~/NTWX-AUDIT-MASTER.md