{
  "projectId": "vergex",
  "title": "VergeX｜模型、策略与 MCP 接入",
  "summary": "生产客户端包含模型提供商、策略市场及独立 MCP 接入配置，主要操作通过同站业务 API 完成；模型决策与订单执行仍依赖未公开后端。",
  "scope": "实际公开网页发布的选定业务 JavaScript 包；REA 解析 1 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:54:34.648666+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "模型与策略目录通过业务 API 读取",
      "detail": "发布包将生产业务前缀设为 /api/v1，并包含 ai-providers、ai-providers/{id}/models、marketplace/strategies 与 marketplace/code-strategies 的请求函数。代码中可以区分模型选择、模型用量和策略目录。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_213c7703301e84b925ff253362f30b825c13e6717e8fbc595f47b65f9c5f2881"
      ],
      "sourceUrls": [
        "https://vergex.trade/assets/index-96ecfae0-D56M-BHN.js"
      ]
    },
    {
      "title": "MCP 接入有独立服务地址",
      "detail": "同一生产包配置 https://mcp.vergex.trade/mcp，以及 Claude Code / Codex 客户端标识和独立通知服务。由此可推断聊天工具接入与网站交互存在不同通道；这不证明二者共享相同权限或风控。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_213c7703301e84b925ff253362f30b825c13e6717e8fbc595f47b65f9c5f2881"
      ],
      "sourceUrls": [
        "https://vergex.trade/assets/index-96ecfae0-D56M-BHN.js"
      ]
    }
  ],
  "limitations": [
    "没有连接 MCP、添加模型密钥或交易所账户；未检查后端策略调度与订单状态机。",
    "前端配置和界面文案无法证明密钥的服务器端存储、加密或隔离。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "index-96ecfae0-D56M-BHN.js",
      "url": "https://vergex.trade/assets/index-96ecfae0-D56M-BHN.js",
      "sha256": "838e63f409aea8b5d87ac53deefe1b0ef73b26eddbad67aeca7aeb49585085d6"
    }
  ],
  "evidenceIds": [
    "ev_213c7703301e84b925ff253362f30b825c13e6717e8fbc595f47b65f9c5f2881"
  ],
  "reportUrl": "/research/rea/vergex.json",
  "coverage": {
    "parsedFiles": 1,
    "parseFailures": 0,
    "semanticCoverage": "partial",
    "rootArtifactSha256": "a738fd6a0b50f115cea54f3a07167471d839cad191cf85dad85793c57d9a1b95",
    "inputFileCount": 1,
    "inputBytes": 1857409,
    "analysisResult": "completed"
  }
}