check_integration

com.gemmein/mcp · Verify this server

Runs the reaffirm boundary checks live against the caller's own app; returns structured pass/fail (structuredContent: checks, notes, failedCount, passed). Useful once the app is wired to Gemmein, when confirming it is done, and before go-live. Tier A (public pk_ key only): the collection name is valid, anonymous reads and writes of a private collection are refused, an optional public collection reads as its rule intends — safe against any environment, live included. Tier B (with the sk_dev secret key): proves one user cannot read another's private records, using two throwaway test sessions in the dev environment. sk_live is refused by design — a live secret is never needed here; dev and live enforce the same rules, so isolation proven in dev holds in live. Tier A writes nothing while the boundaries hold — but if a private collection is open to strangers, its anonymous test write succeeds and the record stays, in whatever environment the key names (live included), and the check fails, naming the collection. Tier B writes only in the caller's dev environment: it signs in two test people (created on first use and kept; any earlier sessions of theirs are signed out), creates one probe record as the first and deletes it at the end of the check. Signing a person in signs them out of their earlier sessions, so testUsers suits throwaway addresses: real development people named there are signed out. A failed check means the app's assumptions drifted from its rules.