{
  "info": {
    "name": "CCSM MCP | MONITOREO · estado público",
    "_postman_id": "b886d677-0c5e-4f5d-9417-0257c34c0bb5",
    "description": "Estado público, salud, descargas y pruebas negativas de seguridad. Las pruebas negativas con MCP requieren token de usuario; no utilizar en producción sin supervisión.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "name": "01 · Estado público y descargas",
      "item": [
        {
          "name": "Estado general",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/status",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "status"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\", function () { pm.response.to.have.status(200); });"
                ]
              }
            }
          ]
        },
        {
          "name": "Salud de Laravel",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/up",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "up"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\", function () { pm.response.to.have.status(200); });"
                ]
              }
            }
          ]
        },
        {
          "name": "Portada",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/",
              "host": [
                "{{base_url}}"
              ],
              "path": []
            }
          }
        },
        {
          "name": "Descargar agente Linux ZIP",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/downloads/linux-agent.zip",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "downloads",
                "linux-agent.zip"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\", function () { pm.response.to.have.status(200); });"
                ]
              }
            }
          ]
        },
        {
          "name": "Descargar esta colección Postman",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/downloads/postman-collection.json",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "downloads",
                "postman-collection.json"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\", function () { pm.response.to.have.status(200); });"
                ]
              }
            }
          ]
        }
      ]
    },
    {
      "name": "06 · Seguridad: casos negativos",
      "item": [
        {
          "name": "Admin sin token debe ser rechazado",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/api/v1/admin/agents",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "api",
                "v1",
                "admin",
                "agents"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 401\", function () { pm.response.to.have.status(401); });"
                ]
              }
            }
          ]
        },
        {
          "name": "Agente sin credenciales debe ser rechazado",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/api/v1/agent/heartbeat",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "api",
                "v1",
                "agent",
                "heartbeat"
              ]
            },
            "body": {
              "mode": "raw",
              "raw": "{}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 401\", function () { pm.response.to.have.status(401); });"
                ]
              }
            }
          ]
        },
        {
          "name": "No exponer comando de shell arbitrario",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              },
              {
                "key": "Content-Type",
                "value": "application/json"
              },
              {
                "key": "Authorization",
                "value": "Bearer {{user_token}}"
              },
              {
                "key": "Accept",
                "value": "application/json, text/event-stream"
              },
              {
                "key": "MCP-Protocol-Version",
                "value": "2025-11-25"
              }
            ],
            "url": {
              "raw": "{{base_url}}/mcp",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "mcp"
              ]
            },
            "body": {
              "mode": "raw",
              "raw": "{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 7,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"run_linux_command\",\n    \"arguments\": {\n      \"agent_id\": \"{{agent_id}}\",\n      \"command\": \"sudo bash\"\n    }\n  }\n}",
              "options": {
                "raw": {
                  "language": "json"
                }
              }
            },
            "description": "La respuesta MCP HTTP puede ser 200 con isError=true. Inspeccionar el contenido JSON/SSE."
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\", function () { pm.response.to.have.status(200); });"
                ]
              }
            }
          ]
        },
        {
          "name": "Descargar colección no revela secretos",
          "request": {
            "method": "GET",
            "header": [
              {
                "key": "Accept",
                "value": "application/json"
              }
            ],
            "url": {
              "raw": "{{base_url}}/downloads/postman-collection.json",
              "host": [
                "{{base_url}}"
              ],
              "path": [
                "downloads",
                "postman-collection.json"
              ]
            }
          },
          "event": [
            {
              "listen": "test",
              "script": {
                "type": "text/javascript",
                "exec": [
                  "pm.test(\"HTTP 200\", function () { pm.response.to.have.status(200); });",
                  "pm.test(\"No contiene secretos reales\",()=>pm.expect(pm.response.text()).not.to.include(\"Bearer eyJ\"));"
                ]
              }
            }
          ]
        }
      ]
    }
  ],
  "variable": [
    {
      "key": "base_url",
      "value": "http://127.0.0.1:8011",
      "type": "string"
    },
    {
      "key": "user_token",
      "value": "",
      "type": "string"
    },
    {
      "key": "agent_id",
      "value": "",
      "type": "string"
    }
  ]
}