diff --git a/tests/Integration/mcp-smoke.sh b/tests/Integration/mcp-smoke.sh
index 6e3c106..b0cfaca 100644
--- a/tests/Integration/mcp-smoke.sh
+++ b/tests/Integration/mcp-smoke.sh
@@ -20,7 +20,8 @@ ADMIN_LOGIN=""
 cleanup_app_passwords_for() { # $1 = user_login
   local login="$1"
   [ -n "$login" ] || return 0
-  local escaped=${login//\'/\\\'}
+  local escaped=${login//\\/\\\\}
+  escaped=${escaped//\'/\\\'}
   wp eval "
 \$u = get_user_by('login', '${escaped}');
 if (\$u) {
@@ -76,7 +77,7 @@ pass "RFC 9728 protected-resource metadata served"
 
 curl -s --max-time 20 -H "Host: $HOST" -H 'X-Forwarded-Proto: https' \
     'http://localhost/?mcp_oauth_discovery=authorization-server' \
-  | grep -q 'client_id_metadata_document_supported' \
+  | grep -Eq '"client_id_metadata_document_supported":[[:space:]]*true' \
   || fail "authorization-server metadata missing CIMD flag"
 pass "RFC 8414 authorization-server metadata advertises CIMD"
 
@@ -99,7 +100,7 @@ pass "401 + WWW-Authenticate without token"
 ADMIN_LOGIN=$(wp user list --role=administrator --field=user_login | head -1)
 TOKEN=$(wp eval-file "$PLUGIN/tests/Integration/mint-token.php" "$ADMIN_LOGIN")
 INIT=$(mcp "$TOKEN" '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"smoke","version":"0"}}}')
-SESSION=$(echo "$INIT" | grep -i '^mcp-session-id:' | awk '{print $2}' | tr -d '\r')
+SESSION=$(echo "$INIT" | grep -i '^mcp-session-id:' | awk '{print $2}' | tr -d '\r' || true)
 echo "$INIT" | grep -q 'LIT MCP pflegt' || fail "instructions missing in initialize result"
 pass "initialize returns LIT instructions (session: ${SESSION:-none})"
 
@@ -123,11 +124,11 @@ pass "MCP token is rejected on /wp/v2/users/me"
 wp user create lit-smoke-sub lit-smoke-sub@example.invalid --role=subscriber >/dev/null
 SUB_TOKEN=$(wp eval-file "$PLUGIN/tests/Integration/mint-token.php" lit-smoke-sub)
 SUB_INIT=$(mcp "$SUB_TOKEN" '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"smoke","version":"0"}}}')
-SUB_SESSION=$(echo "$SUB_INIT" | grep -i '^mcp-session-id:' | awk '{print $2}' | tr -d '\r')
+SUB_SESSION=$(echo "$SUB_INIT" | grep -i '^mcp-session-id:' | awk '{print $2}' | tr -d '\r' || true)
 SUB_CALL=$(mcp "$SUB_TOKEN" '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"lit-site-status","arguments":{}}}' "$SUB_SESSION")
-echo "$SUB_CALL" | grep -q '"isError":true\|"error"' || fail "subscriber could call lit-site-status: $SUB_CALL"
+echo "$SUB_CALL" | grep -Eq '"isError":[[:space:]]*true|"error":[[:space:]]*\{' || fail "subscriber could call lit-site-status: $SUB_CALL"
 SUB_META=$(mcp "$SUB_TOKEN" '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"mcp-adapter-execute-ability","arguments":{"ability_name":"lit/site-status","parameters":{}}}}' "$SUB_SESSION")
-echo "$SUB_META" | grep -q '"isError":true\|"error"' || fail "subscriber could use execute-ability: $SUB_META"
+echo "$SUB_META" | grep -Eq '"isError":[[:space:]]*true|"error":[[:space:]]*\{' || fail "subscriber could use execute-ability: $SUB_META"
 pass "role gate blocks subscriber (direct tool and meta-tool)"
 
 echo "ALL CHECKS PASSED"