{ "disclaimer": "SAMPLE GENERATED FROM CONTROLLED TEST FIXTURE", "note": "Controlled test fixtures illustrating exact JSON and Markdown reports received upon x402 payment.", "samples": { "snapshot_29": { "sku": "GEN-SVC-0200", "name": "MCP Security Risk Snapshot", "price_usdc": 29, "sample_label": "SAMPLE GENERATED FROM CONTROLLED TEST FIXTURE", "report_json": { "product": "GEN-SVC-0200", "product_name": "MCP Security Audit", "audit_id": "b67cb4fd3894ceb8", "timestamp": "2026-09-26T15:40:31.710Z", "target": "sample-fintech-mcp-gateway", "tier": "snapshot", "scope": { "tier": "snapshot", "tools_analyzed": 3, "card": true, "instructions": false, "text": true, "config": true, "release_surface": true, "workflow_steps": 2 }, "risk_level": "HIGH", "risk_score": 48, "verdict": "RISK_DETECTED", "findings": [ { "id": "FIND-001", "check": "capability", "title": "Dangerous capability: Arbitrary code / shell execution", "detail": "Tool \"execute_sql\" exposes arbitrary code / shell execution surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description", "severity": "HIGH" }, { "id": "FIND-002", "check": "config", "title": "Insecure configuration: wildcard permissions", "detail": "Configuration key \"permissions\" is set to a permissive value.", "affected_component": "config.permissions", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"permissions\" to explicit, least-privilege values.", "evidence": "config key \"permissions\" value matched insecure pattern", "severity": "HIGH" }, { "id": "FIND-003", "check": "tool-contract", "title": "missing output schema", "detail": "Tool \"fetch_remote_webhook\" missing output schema", "affected_component": "tools[1]", "reason": "Incomplete or invalid tool contract.", "recommended_action": "Complete the required tool definition fields.", "evidence": "toolContractLint", "severity": "MEDIUM" }, { "id": "FIND-004", "check": "capability", "title": "Dangerous capability: Filesystem mutation", "detail": "Tool \"execute_sql\" exposes filesystem mutation surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-005", "check": "capability", "title": "Dangerous capability: Network / external call", "detail": "Tool \"fetch_remote_webhook\" exposes network / external call surface.", "affected_component": "tools[1]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-006", "check": "config", "title": "Insecure configuration: authentication disabled", "detail": "Configuration key \"auth\" is set to a permissive value.", "affected_component": "config.auth", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"auth\" to explicit, least-privilege values.", "evidence": "config key \"auth\" value matched insecure pattern", "severity": "MEDIUM" } ], "remediation_plan": [ { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-001", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-002", "action": "Restrict \"permissions\" to explicit, least-privilege values.", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "affected_component": "config.permissions" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-003", "action": "Complete the required tool definition fields.", "reason": "Incomplete or invalid tool contract.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-004", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-005", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-006", "action": "Restrict \"auth\" to explicit, least-privilege values.", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "affected_component": "config.auth" } ], "evidence": [ { "kind": "tool-contract-lint", "index": 0, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "tool-contract-lint", "index": 1, "product": "MICRO-0045", "pass": false, "valid": false, "findings": [ "missing output schema" ], "signature": "d3bdb9aee66a7ba40402d9048ae2a4f8d500d0610df7a69437c4557aac973620" }, { "kind": "tool-contract-lint", "index": 2, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" } ], "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ], "pass": false, "signature": "763968d4343ef35d9e2c57c5984586102a688b6e45ca93dd0308341956fb6d92", "report_markdown": "# MCP Security Audit\n\n**Audit ID:** `b67cb4fd3894ceb8` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 48/100)\n\n**Target:** sample-fintech-mcp-gateway\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 6 findings (2 high, 4 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: snapshot\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-004 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-005 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-006 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `763968d4343ef35d9e2c57c5984586102a688b6e45ca93dd0308341956fb6d92`*" }, "report_markdown": "# MCP Security Audit\n\n**Audit ID:** `b67cb4fd3894ceb8` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 48/100)\n\n**Target:** sample-fintech-mcp-gateway\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 6 findings (2 high, 4 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: snapshot\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-004 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-005 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-006 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `763968d4343ef35d9e2c57c5984586102a688b6e45ca93dd0308341956fb6d92`*" }, "full_99": { "sku": "GEN-SVC-0201", "name": "Full MCP Security Audit", "price_usdc": 99, "sample_label": "SAMPLE GENERATED FROM CONTROLLED TEST FIXTURE", "report_json": { "product": "GEN-SVC-0200", "product_name": "MCP Security Audit", "audit_id": "90bfa2e7882f28e5", "timestamp": "2026-09-26T15:40:31.710Z", "target": "sample-fintech-mcp-gateway", "tier": "full", "scope": { "tier": "full", "tools_analyzed": 3, "card": true, "instructions": false, "text": true, "config": true, "release_surface": true, "workflow_steps": 2 }, "risk_level": "HIGH", "risk_score": 60, "verdict": "RISK_DETECTED", "findings": [ { "id": "FIND-001", "check": "capability", "title": "Dangerous capability: Arbitrary code / shell execution", "detail": "Tool \"execute_sql\" exposes arbitrary code / shell execution surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description", "severity": "HIGH" }, { "id": "FIND-002", "check": "config", "title": "Insecure configuration: wildcard permissions", "detail": "Configuration key \"permissions\" is set to a permissive value.", "affected_component": "config.permissions", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"permissions\" to explicit, least-privilege values.", "evidence": "config key \"permissions\" value matched insecure pattern", "severity": "HIGH" }, { "id": "FIND-003", "check": "tool-contract", "title": "missing output schema", "detail": "Tool \"fetch_remote_webhook\" missing output schema", "affected_component": "tools[1]", "reason": "Incomplete or invalid tool contract.", "recommended_action": "Complete the required tool definition fields.", "evidence": "toolContractLint", "severity": "MEDIUM" }, { "id": "FIND-004", "check": "capability", "title": "Dangerous capability: Filesystem mutation", "detail": "Tool \"execute_sql\" exposes filesystem mutation surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-005", "check": "capability", "title": "Dangerous capability: Network / external call", "detail": "Tool \"fetch_remote_webhook\" exposes network / external call surface.", "affected_component": "tools[1]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-006", "check": "config", "title": "Insecure configuration: authentication disabled", "detail": "Configuration key \"auth\" is set to a permissive value.", "affected_component": "config.auth", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"auth\" to explicit, least-privilege values.", "evidence": "config key \"auth\" value matched insecure pattern", "severity": "MEDIUM" }, { "id": "FIND-007", "check": "agent-card", "title": "missing url/endpoint", "detail": "Agent card missing url/endpoint", "affected_component": "card", "reason": "Invalid agent card.", "recommended_action": "Fix the flagged agent-card field.", "evidence": "agentCardValidate", "severity": "MEDIUM" }, { "id": "FIND-008", "check": "agent-card", "title": "missing version", "detail": "Agent card missing version", "affected_component": "card", "reason": "Invalid agent card.", "recommended_action": "Fix the flagged agent-card field.", "evidence": "agentCardValidate", "severity": "MEDIUM" } ], "remediation_plan": [ { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-001", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-002", "action": "Restrict \"permissions\" to explicit, least-privilege values.", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "affected_component": "config.permissions" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-003", "action": "Complete the required tool definition fields.", "reason": "Incomplete or invalid tool contract.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-004", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-005", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-006", "action": "Restrict \"auth\" to explicit, least-privilege values.", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "affected_component": "config.auth" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-007", "action": "Fix the flagged agent-card field.", "reason": "Invalid agent card.", "affected_component": "card" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-008", "action": "Fix the flagged agent-card field.", "reason": "Invalid agent card.", "affected_component": "card" } ], "evidence": [ { "kind": "tool-contract-lint", "index": 0, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "tool-contract-lint", "index": 1, "product": "MICRO-0045", "pass": false, "valid": false, "findings": [ "missing output schema" ], "signature": "d3bdb9aee66a7ba40402d9048ae2a4f8d500d0610df7a69437c4557aac973620" }, { "kind": "tool-contract-lint", "index": 2, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "agent-card-validate", "product": "MICRO-AGENTCARD", "pass": false, "valid": false, "findings": [ "missing url/endpoint", "missing version" ], "signature": "37d58ac96b777cc8586276e7648c26308cfd292a1ca75c82a5a2129b98275b00" }, { "kind": "secret-leak-scan", "product": "MICRO-SECRET", "pass": true, "secret_count": 0, "hits": [], "signature": "7e0956efb11948b8f348194e177eafb382187fe53d6bc31da37dc1075d08f569" }, { "kind": "url-structure-check", "product": "MICRO-URL", "pass": true, "valid": true, "findings": [], "host": "gateway.internal.example.org", "signature": "0ac0d89009902ad7ca36b880e73763854d87311dab84674dfd092ae6425f212d" } ], "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ], "pass": false, "signature": "d5025dfec749b3be3cc8e7239cbf8915ac71abdf8191498cf5fa15ddd9dcbf26", "report_markdown": "# MCP Security Audit\n\n**Audit ID:** `90bfa2e7882f28e5` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 60/100)\n\n**Target:** sample-fintech-mcp-gateway\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 8 findings (2 high, 6 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-004 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-005 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-006 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-007 — [MEDIUM] missing url/endpoint\n\n- **Component:** card\n- **Detail:** Agent card missing url/endpoint\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-008 — [MEDIUM] missing version\n\n- **Component:** card\n- **Detail:** Agent card missing version\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `d5025dfec749b3be3cc8e7239cbf8915ac71abdf8191498cf5fa15ddd9dcbf26`*" }, "report_markdown": "# MCP Security Audit\n\n**Audit ID:** `90bfa2e7882f28e5` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 60/100)\n\n**Target:** sample-fintech-mcp-gateway\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 8 findings (2 high, 6 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-004 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-005 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-006 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-007 — [MEDIUM] missing url/endpoint\n\n- **Component:** card\n- **Detail:** Agent card missing url/endpoint\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-008 — [MEDIUM] missing version\n\n- **Component:** card\n- **Detail:** Agent card missing version\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `d5025dfec749b3be3cc8e7239cbf8915ac71abdf8191498cf5fa15ddd9dcbf26`*" }, "deep_249": { "sku": "GEN-SVC-0202", "name": "MCP Deep Evidence Audit", "price_usdc": 249, "sample_label": "SAMPLE GENERATED FROM CONTROLLED TEST FIXTURE", "report_json": { "product": "GEN-SVC-0200", "product_name": "MCP Security Audit", "audit_id": "2dbf0ee53fda2c9a", "timestamp": "2026-09-26T15:40:31.710Z", "target": "sample-fintech-mcp-gateway", "tier": "deep", "scope": { "tier": "deep", "tools_analyzed": 3, "card": true, "instructions": false, "text": true, "config": true, "release_surface": true, "workflow_steps": 2 }, "risk_level": "CRITICAL", "risk_score": 72, "verdict": "RISK_DETECTED", "findings": [ { "id": "FIND-001", "check": "capability", "title": "Dangerous capability: Arbitrary code / shell execution", "detail": "Tool \"execute_sql\" exposes arbitrary code / shell execution surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description", "severity": "HIGH" }, { "id": "FIND-002", "check": "config", "title": "Insecure configuration: wildcard permissions", "detail": "Configuration key \"permissions\" is set to a permissive value.", "affected_component": "config.permissions", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"permissions\" to explicit, least-privilege values.", "evidence": "config key \"permissions\" value matched insecure pattern", "severity": "HIGH" }, { "id": "FIND-003", "check": "release-readiness", "title": "Release incompatibility", "detail": "mcp: 1 breaking", "affected_component": "mcp", "reason": "Compatibility regression detected.", "recommended_action": "Resolve the compatibility regression before release.", "evidence": "apiCompatibilitySuite", "severity": "HIGH" }, { "id": "FIND-004", "check": "tool-contract", "title": "missing output schema", "detail": "Tool \"fetch_remote_webhook\" missing output schema", "affected_component": "tools[1]", "reason": "Incomplete or invalid tool contract.", "recommended_action": "Complete the required tool definition fields.", "evidence": "toolContractLint", "severity": "MEDIUM" }, { "id": "FIND-005", "check": "capability", "title": "Dangerous capability: Filesystem mutation", "detail": "Tool \"execute_sql\" exposes filesystem mutation surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-006", "check": "capability", "title": "Dangerous capability: Network / external call", "detail": "Tool \"fetch_remote_webhook\" exposes network / external call surface.", "affected_component": "tools[1]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-007", "check": "config", "title": "Insecure configuration: authentication disabled", "detail": "Configuration key \"auth\" is set to a permissive value.", "affected_component": "config.auth", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"auth\" to explicit, least-privilege values.", "evidence": "config key \"auth\" value matched insecure pattern", "severity": "MEDIUM" }, { "id": "FIND-008", "check": "agent-card", "title": "missing url/endpoint", "detail": "Agent card missing url/endpoint", "affected_component": "card", "reason": "Invalid agent card.", "recommended_action": "Fix the flagged agent-card field.", "evidence": "agentCardValidate", "severity": "MEDIUM" }, { "id": "FIND-009", "check": "agent-card", "title": "missing version", "detail": "Agent card missing version", "affected_component": "card", "reason": "Invalid agent card.", "recommended_action": "Fix the flagged agent-card field.", "evidence": "agentCardValidate", "severity": "MEDIUM" }, { "id": "FIND-010", "check": "workflow", "title": "Broken workflow hash chain", "detail": "Step 2 hash mismatch", "affected_component": "steps.2", "reason": "Workflow step integrity chain is broken.", "recommended_action": "Reconcile the workflow step chain.", "evidence": "workflowIntegrity", "severity": "INFO" } ], "remediation_plan": [ { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-001", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-002", "action": "Restrict \"permissions\" to explicit, least-privilege values.", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "affected_component": "config.permissions" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-003", "action": "Resolve the compatibility regression before release.", "reason": "Compatibility regression detected.", "affected_component": "mcp" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-004", "action": "Complete the required tool definition fields.", "reason": "Incomplete or invalid tool contract.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-005", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-006", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-007", "action": "Restrict \"auth\" to explicit, least-privilege values.", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "affected_component": "config.auth" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-008", "action": "Fix the flagged agent-card field.", "reason": "Invalid agent card.", "affected_component": "card" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-009", "action": "Fix the flagged agent-card field.", "reason": "Invalid agent card.", "affected_component": "card" }, { "priority": "P3", "severity": "INFO", "finding_id": "FIND-010", "action": "Reconcile the workflow step chain.", "reason": "Workflow step integrity chain is broken.", "affected_component": "steps.2" } ], "evidence": [ { "kind": "tool-contract-lint", "index": 0, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "tool-contract-lint", "index": 1, "product": "MICRO-0045", "pass": false, "valid": false, "findings": [ "missing output schema" ], "signature": "d3bdb9aee66a7ba40402d9048ae2a4f8d500d0610df7a69437c4557aac973620" }, { "kind": "tool-contract-lint", "index": 2, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "agent-card-validate", "product": "MICRO-AGENTCARD", "pass": false, "valid": false, "findings": [ "missing url/endpoint", "missing version" ], "signature": "37d58ac96b777cc8586276e7648c26308cfd292a1ca75c82a5a2129b98275b00" }, { "kind": "secret-leak-scan", "product": "MICRO-SECRET", "pass": true, "secret_count": 0, "hits": [], "signature": "7e0956efb11948b8f348194e177eafb382187fe53d6bc31da37dc1075d08f569" }, { "kind": "url-structure-check", "product": "MICRO-URL", "pass": true, "valid": true, "findings": [], "host": "gateway.internal.example.org", "signature": "0ac0d89009902ad7ca36b880e73763854d87311dab84674dfd092ae6425f212d" }, { "kind": "release-readiness", "product": "GEN-SVC-0100", "pass": false, "mcp": { "pass": false, "breaking_changes": [ "removed tool: summarize_memo" ], "changed_fields": [] }, "openapi": { "pass": true, "severity": "NONE", "removed_endpoints": [], "changed_endpoints": [], "parameter_changes": [], "response_schema_changes": [], "required_field_changes": [], "security_changes": [] }, "sdk": { "pass": true, "score": 100, "removed_symbols": [], "semver_impact": "none" }, "blocking_findings": [ { "gate": "mcp", "breaking_count": 1 } ], "signature": "6c8800433e7bc855332b9a92f55ba5b950e8c99aa8542999cfc8a5080db7aa2f" }, { "kind": "workflow-integrity", "product": "MICRO-WORKFLOW", "pass": false, "chain_break_count": 1, "breaks": [ { "step": 2, "expected": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", "got": "fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210" } ], "step_count": 2, "signature": "3e7c50d0955fc4b2eb8ed09fca1da6a3e0df5e66ad55c17f5e482dcdfd168cd8" } ], "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ], "pass": false, "deep": { "attack_surface": { "tools": [ "execute_sql", "fetch_remote_webhook", "summarize_memo" ], "resources": [ "query", "url", "payload", "text" ], "capabilities": [ "execute_sql", "fetch_remote_webhook" ], "permissions": [ "*" ], "auth_boundaries": { "auth_required": false, "wildcard_permissions": true }, "external_urls": [ "https://hooks.partner.org/notify" ], "sensitive_operations": [ { "tool": "execute_sql", "signal": "code-exec" }, { "tool": "fetch_remote_webhook", "signal": "network" } ], "trust_transitions": [ { "from": "https://gateway.internal.example.org/mcp", "to": "tool-calls", "note": "Client connects to the server URL; tools perform the listed sensitive operations." } ] }, "threat_scenarios": [ { "scenario_id": "capability-abuse", "label": "Prompt-based capability abuse", "severity": "HIGH", "evidence_findings": [ "FIND-001", "FIND-005", "FIND-006" ], "fact": "3 finding(s) detected directly matching this scenario surface.", "inference": "An adversary with access to the agent interaction surface could exploit flagged capability-abuse conditions.", "unknowns": [ "Runtime mitigation or filtering outside supplied static definitions.", "Actual caller privileges and host process isolation in the deployment environment." ], "remediation_actions": [ "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary." ] }, { "scenario_id": "auth-failure", "label": "Authorization boundary failure", "severity": "MEDIUM", "evidence_findings": [ "FIND-007" ], "fact": "1 finding(s) detected directly matching this scenario surface.", "inference": "An adversary with access to the agent interaction surface could exploit flagged auth-failure conditions.", "unknowns": [ "Runtime mitigation or filtering outside supplied static definitions.", "Actual caller privileges and host process isolation in the deployment environment." ], "remediation_actions": [ "Restrict \"auth\" to explicit, least-privilege values." ] } ], "finding_correlations": [ { "name": "Unauthenticated command execution exposure", "reason": "Authentication is weak or disabled while a tool exposes code/shell execution, widening the blast radius of a compromise.", "contributing_findings": [ "FIND-001", "FIND-007" ] }, { "name": "Overprivileged tool with external invocation", "reason": "Wildcard permissions combined with network-capable tools increase the impact of any tool misuse.", "contributing_findings": [ "FIND-002", "FIND-006" ] } ], "evidence_graph": { "nodes": [ { "id": "ev-c8c67687", "type": "evidence", "kind": "tool-contract-lint" }, { "id": "ev-7e4d00cc", "type": "evidence", "kind": "tool-contract-lint" }, { "id": "ev-49816f6c", "type": "evidence", "kind": "tool-contract-lint" }, { "id": "ev-78a3ee05", "type": "evidence", "kind": "agent-card-validate" }, { "id": "ev-0f18df60", "type": "evidence", "kind": "secret-leak-scan" }, { "id": "ev-652b0c3d", "type": "evidence", "kind": "url-structure-check" }, { "id": "ev-15ad83f2", "type": "evidence", "kind": "release-readiness" }, { "id": "ev-a899cd0c", "type": "evidence", "kind": "workflow-integrity" }, { "id": "FIND-001", "type": "finding", "severity": "HIGH", "component": "tools[0]" }, { "id": "FIND-002", "type": "finding", "severity": "HIGH", "component": "config.permissions" }, { "id": "FIND-003", "type": "finding", "severity": "HIGH", "component": "mcp" }, { "id": "FIND-004", "type": "finding", "severity": "MEDIUM", "component": "tools[1]" }, { "id": "FIND-005", "type": "finding", "severity": "MEDIUM", "component": "tools[0]" }, { "id": "FIND-006", "type": "finding", "severity": "MEDIUM", "component": "tools[1]" }, { "id": "FIND-007", "type": "finding", "severity": "MEDIUM", "component": "config.auth" }, { "id": "FIND-008", "type": "finding", "severity": "MEDIUM", "component": "card" }, { "id": "FIND-009", "type": "finding", "severity": "MEDIUM", "component": "card" }, { "id": "FIND-010", "type": "finding", "severity": "INFO", "component": "steps.2" } ], "edges": [ { "from": "FIND-001", "to": "tools[0]", "relation": "affects" }, { "from": "FIND-002", "to": "config.permissions", "relation": "affects" }, { "from": "FIND-003", "to": "mcp", "relation": "affects" }, { "from": "FIND-004", "to": "tools[1]", "relation": "affects" }, { "from": "FIND-005", "to": "tools[0]", "relation": "affects" }, { "from": "FIND-006", "to": "tools[1]", "relation": "affects" }, { "from": "FIND-007", "to": "config.auth", "relation": "affects" }, { "from": "FIND-008", "to": "card", "relation": "affects" }, { "from": "FIND-009", "to": "card", "relation": "affects" }, { "from": "FIND-010", "to": "steps.2", "relation": "affects" } ], "semantics": "finding → evidence → component → impact → remediation → verification" }, "uncertainty_ledger": [ { "kind": "NO_CONTRADICTION", "detail": "No conflicting or ambiguous evidence was detected in the supplied inputs." } ], "exploitability_impact_matrix": [ { "finding": "FIND-001", "exposure": "Dangerous capability: Arbitrary code / shell execution", "preconditions": "Attacker has access to the affected tool/input surface.", "potential_impact": "High (capability abuse / privilege escalation)", "detectability": "Observable via the evidence trace in this report.", "priority": "P1" }, { "finding": "FIND-002", "exposure": "Insecure configuration: wildcard permissions", "preconditions": "Attacker has access to the affected tool/input surface.", "potential_impact": "High (capability abuse / privilege escalation)", "detectability": "Observable via the evidence trace in this report.", "priority": "P1" }, { "finding": "FIND-003", "exposure": "Release incompatibility", "preconditions": "Attacker has access to the affected tool/input surface.", "potential_impact": "High (capability abuse / privilege escalation)", "detectability": "Observable via the evidence trace in this report.", "priority": "P1" } ], "remediation_sequence": [ { "priority": "P0", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "finding": "FIND-001", "depends_on": [] }, { "priority": "P0", "action": "Restrict \"permissions\" to explicit, least-privilege values.", "finding": "FIND-002", "depends_on": [] }, { "priority": "P0", "action": "Resolve the compatibility regression before release.", "finding": "FIND-003", "depends_on": [] }, { "priority": "P1", "action": "Complete the required tool definition fields.", "finding": "FIND-004", "depends_on": [ "P0 items resolved first" ] }, { "priority": "P1", "action": "Restrict \"auth\" to explicit, least-privilege values.", "finding": "FIND-007", "depends_on": [ "P0 items resolved first" ] }, { "priority": "P1", "action": "Fix the flagged agent-card field.", "finding": "FIND-008", "depends_on": [ "P0 items resolved first" ] }, { "priority": "P2", "action": "Reconcile the workflow step chain.", "finding": "FIND-010", "depends_on": [ "P0 items resolved first" ] } ], "retest_plan": [ { "finding": "FIND-001", "remediation": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "considered_remediated_when": [ "The affected component (tools[0]) no longer exhibits the flagged condition.", "A re-run of this automated audit on the updated artifacts no longer produces this finding." ], "no_untrusted_code_executed": true }, { "finding": "FIND-002", "remediation": "Restrict \"permissions\" to explicit, least-privilege values.", "considered_remediated_when": [ "The affected component (config.permissions) no longer exhibits the flagged condition.", "A re-run of this automated audit on the updated artifacts no longer produces this finding." ], "no_untrusted_code_executed": true }, { "finding": "FIND-003", "remediation": "Resolve the compatibility regression before release.", "considered_remediated_when": [ "The affected component (mcp) no longer exhibits the flagged condition.", "A re-run of this automated audit on the updated artifacts no longer produces this finding." ], "no_untrusted_code_executed": true } ], "residual_risk": { "qualitative_remaining_risk": "7 lower-severity finding(s) may remain after P0/P1 remediation.", "cannot_establish": [ "Runtime behavior and dynamic exploitation.", "Correctness of remediation without a re-audit of updated artifacts.", "Security of dependencies or configurations not present in the supplied inputs." ], "honest_statement": "This is an automated static assessment; overall risk before remediation was CRITICAL." }, "decision_brief": { "decision": "BLOCK", "top_risks": [ { "finding": "FIND-001", "title": "Dangerous capability: Arbitrary code / shell execution", "severity": "HIGH" }, { "finding": "FIND-002", "title": "Insecure configuration: wildcard permissions", "severity": "HIGH" }, { "finding": "FIND-003", "title": "Release incompatibility", "severity": "HIGH" } ], "why_they_matter": "Critical/high findings can lead to credential compromise, code execution, or privilege escalation.", "fix_first": [ "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "Restrict \"permissions\" to explicit, least-privilege values.", "Resolve the compatibility regression before release." ], "can_wait": [ "missing output schema", "Dangerous capability: Filesystem mutation", "Dangerous capability: Network / external call", "Insecure configuration: authentication disabled", "missing url/endpoint", "missing version" ], "remains_unknown": [ "Runtime exploitation behavior.", "Completeness of remediation without a re-audit." ], "reasoning": "BLOCK based on 0 critical and 3 high finding(s)." }, "evidence_pack": { "audit_id": "2dbf0ee53fda2c9a", "report_version": "genesis-premium-deep/v1", "generated_at": "2026-09-26T15:40:31.710Z", "input_fingerprints": { "tools": "4f3ff654e22f063c", "card": "09071a032079fc26", "text": "7b8dc1661c0f1455", "config": "858bb776dfc0225d", "server_url": "8acfede3e544ac65", "previous": "2ab27300b55282f3", "current": "4a19312db5461b31", "steps": "290ed674a0fa434a" }, "evidence_identifiers": [ "ev-c8c67687", "ev-7e4d00cc", "ev-49816f6c", "ev-78a3ee05", "ev-0f18df60", "ev-652b0c3d", "ev-15ad83f2", "ev-a899cd0c" ], "finding_identifiers": [ "FIND-001", "FIND-002", "FIND-003", "FIND-004", "FIND-005", "FIND-006", "FIND-007", "FIND-008", "FIND-009", "FIND-010" ], "scope": { "analysis_type": "Automated static MCP/agent security assessment (deep evidence)", "source_executed": false }, "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ] } }, "signature": "da6d2176653c139a6efebe6417ec051cc03b0b543525b44e5ec18eddb55b1213", "report_markdown": "# MCP Security Audit\n\n**Audit ID:** `2dbf0ee53fda2c9a` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** CRITICAL (score 72/100)\n\n**Target:** sample-fintech-mcp-gateway\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 10 findings (3 high, 6 medium, 1 info), yielding an overall risk level of CRITICAL. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: deep\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [HIGH] Release incompatibility\n\n- **Component:** mcp\n- **Detail:** mcp: 1 breaking\n- **Reason:** Compatibility regression detected.\n- **Action:** Resolve the compatibility regression before release.\n- **Evidence:** apiCompatibilitySuite\n\n### FIND-004 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-005 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-006 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-007 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-008 — [MEDIUM] missing url/endpoint\n\n- **Component:** card\n- **Detail:** Agent card missing url/endpoint\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-009 — [MEDIUM] missing version\n\n- **Component:** card\n- **Detail:** Agent card missing version\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-010 — [INFO] Broken workflow hash chain\n\n- **Component:** steps.2\n- **Detail:** Step 2 hash mismatch\n- **Reason:** Workflow step integrity chain is broken.\n- **Action:** Reconcile the workflow step chain.\n- **Evidence:** workflowIntegrity\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P1]** Resolve the compatibility regression before release. — Compatibility regression detected.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P3]** Reconcile the workflow step chain. — Workflow step integrity chain is broken.\n\n## Executive decision brief\n\n- **Decision:** `BLOCK`\n- **Reasoning:** BLOCK based on 0 critical and 3 high finding(s).\n- **Impact:** Critical/high findings can lead to credential compromise, code execution, or privilege escalation.\n- **Fix first:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.; Restrict \"permissions\" to explicit, least-privilege values.; Resolve the compatibility regression before release.\n- **Can wait:** missing output schema; Dangerous capability: Filesystem mutation; Dangerous capability: Network / external call; Insecure configuration: authentication disabled; missing url/endpoint; missing version\n- **Remains unknown:** Runtime exploitation behavior.; Completeness of remediation without a re-audit.\n\n## Threat scenarios (Evidence / Inference / Unknown)\n\n### Scenario: Prompt-based capability abuse [HIGH]\n- **Scenario ID:** `capability-abuse`\n- **Fact:** 3 finding(s) detected directly matching this scenario surface.\n- **Inference:** An adversary with access to the agent interaction surface could exploit flagged capability-abuse conditions.\n- **Evidence findings:** FIND-001, FIND-005, FIND-006\n- **Unknowns:** Runtime mitigation or filtering outside supplied static definitions.; Actual caller privileges and host process isolation in the deployment environment.\n- **Remediation actions:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n\n### Scenario: Authorization boundary failure [MEDIUM]\n- **Scenario ID:** `auth-failure`\n- **Fact:** 1 finding(s) detected directly matching this scenario surface.\n- **Inference:** An adversary with access to the agent interaction surface could exploit flagged auth-failure conditions.\n- **Evidence findings:** FIND-007\n- **Unknowns:** Runtime mitigation or filtering outside supplied static definitions.; Actual caller privileges and host process isolation in the deployment environment.\n- **Remediation actions:** Restrict \"auth\" to explicit, least-privilege values.\n\n## Composite finding correlations\n\n- **Unauthenticated command execution exposure**: Authentication is weak or disabled while a tool exposes code/shell execution, widening the blast radius of a compromise. (Findings: FIND-001, FIND-007)\n- **Overprivileged tool with external invocation**: Wildcard permissions combined with network-capable tools increase the impact of any tool misuse. (Findings: FIND-002, FIND-006)\n\n## Exploitability & impact matrix\n\n- **[P1] Dangerous capability: Arbitrary code / shell execution** (`FIND-001`): High (capability abuse / privilege escalation) — Preconditions: Attacker has access to the affected tool/input surface. — Detectability: Observable via the evidence trace in this report.\n- **[P1] Insecure configuration: wildcard permissions** (`FIND-002`): High (capability abuse / privilege escalation) — Preconditions: Attacker has access to the affected tool/input surface. — Detectability: Observable via the evidence trace in this report.\n- **[P1] Release incompatibility** (`FIND-003`): High (capability abuse / privilege escalation) — Preconditions: Attacker has access to the affected tool/input surface. — Detectability: Observable via the evidence trace in this report.\n\n## Attack surface model\n\n- **Tools analyzed:** 3 (execute_sql, fetch_remote_webhook, summarize_memo)\n- **Capabilities:** execute_sql, fetch_remote_webhook\n- **Sensitive operations:** execute_sql (code-exec), fetch_remote_webhook (network)\n- **External URLs:** https://hooks.partner.org/notify\n- **Auth required:** No / Disabled\n\n## Evidence graph\n\n- **Nodes:** 18 · **Edges:** 10\n- **Semantics:** finding → evidence → component → impact → remediation → verification\n\n## Uncertainty & contradiction ledger\n\n- **NO_CONTRADICTION:** No conflicting or ambiguous evidence was detected in the supplied inputs.\n\n## Remediation sequencing (P0/P1/P2)\n\n- **[P0]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. (Finding: `FIND-001`, Depends on: none)\n- **[P0]** Restrict \"permissions\" to explicit, least-privilege values. (Finding: `FIND-002`, Depends on: none)\n- **[P0]** Resolve the compatibility regression before release. (Finding: `FIND-003`, Depends on: none)\n- **[P1]** Complete the required tool definition fields. (Finding: `FIND-004`, Depends on: P0 items resolved first)\n- **[P1]** Restrict \"auth\" to explicit, least-privilege values. (Finding: `FIND-007`, Depends on: P0 items resolved first)\n- **[P1]** Fix the flagged agent-card field. (Finding: `FIND-008`, Depends on: P0 items resolved first)\n- **[P2]** Reconcile the workflow step chain. (Finding: `FIND-010`, Depends on: P0 items resolved first)\n\n## Retest & acceptance criteria\n\n- **Remediate `FIND-001`:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n - Criteria: The affected component (tools[0]) no longer exhibits the flagged condition.\n - Criteria: A re-run of this automated audit on the updated artifacts no longer produces this finding.\n- **Remediate `FIND-002`:** Restrict \"permissions\" to explicit, least-privilege values.\n - Criteria: The affected component (config.permissions) no longer exhibits the flagged condition.\n - Criteria: A re-run of this automated audit on the updated artifacts no longer produces this finding.\n- **Remediate `FIND-003`:** Resolve the compatibility regression before release.\n - Criteria: The affected component (mcp) no longer exhibits the flagged condition.\n - Criteria: A re-run of this automated audit on the updated artifacts no longer produces this finding.\n\n## Residual risk\n\n- **Remaining:** 7 lower-severity finding(s) may remain after P0/P1 remediation.\n- **Cannot establish:** Runtime behavior and dynamic exploitation.; Correctness of remediation without a re-audit of updated artifacts.; Security of dependencies or configurations not present in the supplied inputs.\n- **Assessment baseline:** This is an automated static assessment; overall risk before remediation was CRITICAL.\n\n## Evidence pack & provenance manifest\n\n- **Audit ID:** `2dbf0ee53fda2c9a`\n- **Version:** genesis-premium-deep/v1\n- **Input fingerprints:** `{\"tools\":\"4f3ff654e22f063c\",\"card\":\"09071a032079fc26\",\"text\":\"7b8dc1661c0f1455\",\"config\":\"858bb776dfc0225d\",\"server_url\":\"8acfede3e544ac65\",\"previous\":\"2ab27300b55282f3\",\"current\":\"4a19312db5461b31\",\"steps\":\"290ed674a0fa434a\"}`\n- **Untrusted source executed:** FALSE (static data analysis only)\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `da6d2176653c139a6efebe6417ec051cc03b0b543525b44e5ec18eddb55b1213`*" }, "report_markdown": "# MCP Security Audit\n\n**Audit ID:** `2dbf0ee53fda2c9a` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** CRITICAL (score 72/100)\n\n**Target:** sample-fintech-mcp-gateway\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 10 findings (3 high, 6 medium, 1 info), yielding an overall risk level of CRITICAL. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: deep\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [HIGH] Release incompatibility\n\n- **Component:** mcp\n- **Detail:** mcp: 1 breaking\n- **Reason:** Compatibility regression detected.\n- **Action:** Resolve the compatibility regression before release.\n- **Evidence:** apiCompatibilitySuite\n\n### FIND-004 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-005 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-006 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-007 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-008 — [MEDIUM] missing url/endpoint\n\n- **Component:** card\n- **Detail:** Agent card missing url/endpoint\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-009 — [MEDIUM] missing version\n\n- **Component:** card\n- **Detail:** Agent card missing version\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-010 — [INFO] Broken workflow hash chain\n\n- **Component:** steps.2\n- **Detail:** Step 2 hash mismatch\n- **Reason:** Workflow step integrity chain is broken.\n- **Action:** Reconcile the workflow step chain.\n- **Evidence:** workflowIntegrity\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P1]** Resolve the compatibility regression before release. — Compatibility regression detected.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P3]** Reconcile the workflow step chain. — Workflow step integrity chain is broken.\n\n## Executive decision brief\n\n- **Decision:** `BLOCK`\n- **Reasoning:** BLOCK based on 0 critical and 3 high finding(s).\n- **Impact:** Critical/high findings can lead to credential compromise, code execution, or privilege escalation.\n- **Fix first:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.; Restrict \"permissions\" to explicit, least-privilege values.; Resolve the compatibility regression before release.\n- **Can wait:** missing output schema; Dangerous capability: Filesystem mutation; Dangerous capability: Network / external call; Insecure configuration: authentication disabled; missing url/endpoint; missing version\n- **Remains unknown:** Runtime exploitation behavior.; Completeness of remediation without a re-audit.\n\n## Threat scenarios (Evidence / Inference / Unknown)\n\n### Scenario: Prompt-based capability abuse [HIGH]\n- **Scenario ID:** `capability-abuse`\n- **Fact:** 3 finding(s) detected directly matching this scenario surface.\n- **Inference:** An adversary with access to the agent interaction surface could exploit flagged capability-abuse conditions.\n- **Evidence findings:** FIND-001, FIND-005, FIND-006\n- **Unknowns:** Runtime mitigation or filtering outside supplied static definitions.; Actual caller privileges and host process isolation in the deployment environment.\n- **Remediation actions:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n\n### Scenario: Authorization boundary failure [MEDIUM]\n- **Scenario ID:** `auth-failure`\n- **Fact:** 1 finding(s) detected directly matching this scenario surface.\n- **Inference:** An adversary with access to the agent interaction surface could exploit flagged auth-failure conditions.\n- **Evidence findings:** FIND-007\n- **Unknowns:** Runtime mitigation or filtering outside supplied static definitions.; Actual caller privileges and host process isolation in the deployment environment.\n- **Remediation actions:** Restrict \"auth\" to explicit, least-privilege values.\n\n## Composite finding correlations\n\n- **Unauthenticated command execution exposure**: Authentication is weak or disabled while a tool exposes code/shell execution, widening the blast radius of a compromise. (Findings: FIND-001, FIND-007)\n- **Overprivileged tool with external invocation**: Wildcard permissions combined with network-capable tools increase the impact of any tool misuse. (Findings: FIND-002, FIND-006)\n\n## Exploitability & impact matrix\n\n- **[P1] Dangerous capability: Arbitrary code / shell execution** (`FIND-001`): High (capability abuse / privilege escalation) — Preconditions: Attacker has access to the affected tool/input surface. — Detectability: Observable via the evidence trace in this report.\n- **[P1] Insecure configuration: wildcard permissions** (`FIND-002`): High (capability abuse / privilege escalation) — Preconditions: Attacker has access to the affected tool/input surface. — Detectability: Observable via the evidence trace in this report.\n- **[P1] Release incompatibility** (`FIND-003`): High (capability abuse / privilege escalation) — Preconditions: Attacker has access to the affected tool/input surface. — Detectability: Observable via the evidence trace in this report.\n\n## Attack surface model\n\n- **Tools analyzed:** 3 (execute_sql, fetch_remote_webhook, summarize_memo)\n- **Capabilities:** execute_sql, fetch_remote_webhook\n- **Sensitive operations:** execute_sql (code-exec), fetch_remote_webhook (network)\n- **External URLs:** https://hooks.partner.org/notify\n- **Auth required:** No / Disabled\n\n## Evidence graph\n\n- **Nodes:** 18 · **Edges:** 10\n- **Semantics:** finding → evidence → component → impact → remediation → verification\n\n## Uncertainty & contradiction ledger\n\n- **NO_CONTRADICTION:** No conflicting or ambiguous evidence was detected in the supplied inputs.\n\n## Remediation sequencing (P0/P1/P2)\n\n- **[P0]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. (Finding: `FIND-001`, Depends on: none)\n- **[P0]** Restrict \"permissions\" to explicit, least-privilege values. (Finding: `FIND-002`, Depends on: none)\n- **[P0]** Resolve the compatibility regression before release. (Finding: `FIND-003`, Depends on: none)\n- **[P1]** Complete the required tool definition fields. (Finding: `FIND-004`, Depends on: P0 items resolved first)\n- **[P1]** Restrict \"auth\" to explicit, least-privilege values. (Finding: `FIND-007`, Depends on: P0 items resolved first)\n- **[P1]** Fix the flagged agent-card field. (Finding: `FIND-008`, Depends on: P0 items resolved first)\n- **[P2]** Reconcile the workflow step chain. (Finding: `FIND-010`, Depends on: P0 items resolved first)\n\n## Retest & acceptance criteria\n\n- **Remediate `FIND-001`:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n - Criteria: The affected component (tools[0]) no longer exhibits the flagged condition.\n - Criteria: A re-run of this automated audit on the updated artifacts no longer produces this finding.\n- **Remediate `FIND-002`:** Restrict \"permissions\" to explicit, least-privilege values.\n - Criteria: The affected component (config.permissions) no longer exhibits the flagged condition.\n - Criteria: A re-run of this automated audit on the updated artifacts no longer produces this finding.\n- **Remediate `FIND-003`:** Resolve the compatibility regression before release.\n - Criteria: The affected component (mcp) no longer exhibits the flagged condition.\n - Criteria: A re-run of this automated audit on the updated artifacts no longer produces this finding.\n\n## Residual risk\n\n- **Remaining:** 7 lower-severity finding(s) may remain after P0/P1 remediation.\n- **Cannot establish:** Runtime behavior and dynamic exploitation.; Correctness of remediation without a re-audit of updated artifacts.; Security of dependencies or configurations not present in the supplied inputs.\n- **Assessment baseline:** This is an automated static assessment; overall risk before remediation was CRITICAL.\n\n## Evidence pack & provenance manifest\n\n- **Audit ID:** `2dbf0ee53fda2c9a`\n- **Version:** genesis-premium-deep/v1\n- **Input fingerprints:** `{\"tools\":\"4f3ff654e22f063c\",\"card\":\"09071a032079fc26\",\"text\":\"7b8dc1661c0f1455\",\"config\":\"858bb776dfc0225d\",\"server_url\":\"8acfede3e544ac65\",\"previous\":\"2ab27300b55282f3\",\"current\":\"4a19312db5461b31\",\"steps\":\"290ed674a0fa434a\"}`\n- **Untrusted source executed:** FALSE (static data analysis only)\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `da6d2176653c139a6efebe6417ec051cc03b0b543525b44e5ec18eddb55b1213`*" }, "team_399": { "sku": "GEN-SVC-0203", "name": "MCP Security Team Pack", "price_usdc": 399, "sample_label": "SAMPLE GENERATED FROM CONTROLLED TEST FIXTURE", "report_json": { "product": "GEN-SVC-0203", "product_name": "MCP Security Team Pack", "audit_id": "3d97bd009310ca4c", "timestamp": "2026-09-26T15:40:31.710Z", "target_count": 3, "summary": { "total": 3, "ready": 0, "risk_detected": 3 }, "results": [ { "product": "GEN-SVC-0203", "product_name": "MCP Security Team Pack", "audit_id": "fcffcf574bc2da97", "timestamp": "2026-09-26T15:40:31.710Z", "target": "agent-payment-coordinator", "tier": "full", "scope": { "tier": "full", "tools_analyzed": 3, "card": true, "instructions": false, "text": true, "config": true, "release_surface": true, "workflow_steps": 2 }, "risk_level": "HIGH", "risk_score": 66, "verdict": "RISK_DETECTED", "findings": [ { "id": "FIND-001", "check": "capability", "title": "Dangerous capability: Arbitrary code / shell execution", "detail": "Tool \"execute_sql\" exposes arbitrary code / shell execution surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description", "severity": "HIGH" }, { "id": "FIND-002", "check": "config", "title": "Insecure configuration: wildcard permissions", "detail": "Configuration key \"permissions\" is set to a permissive value.", "affected_component": "config.permissions", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"permissions\" to explicit, least-privilege values.", "evidence": "config key \"permissions\" value matched insecure pattern", "severity": "HIGH" }, { "id": "FIND-003", "check": "tool-contract", "title": "missing output schema", "detail": "Tool \"fetch_remote_webhook\" missing output schema", "affected_component": "tools[1]", "reason": "Incomplete or invalid tool contract.", "recommended_action": "Complete the required tool definition fields.", "evidence": "toolContractLint", "severity": "MEDIUM" }, { "id": "FIND-004", "check": "capability", "title": "Dangerous capability: Filesystem mutation", "detail": "Tool \"execute_sql\" exposes filesystem mutation surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-005", "check": "capability", "title": "Dangerous capability: Network / external call", "detail": "Tool \"fetch_remote_webhook\" exposes network / external call surface.", "affected_component": "tools[1]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-006", "check": "config", "title": "Insecure configuration: authentication disabled", "detail": "Configuration key \"auth\" is set to a permissive value.", "affected_component": "config.auth", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"auth\" to explicit, least-privilege values.", "evidence": "config key \"auth\" value matched insecure pattern", "severity": "MEDIUM" }, { "id": "FIND-007", "check": "agent-card", "title": "missing url/endpoint", "detail": "Agent card missing url/endpoint", "affected_component": "card", "reason": "Invalid agent card.", "recommended_action": "Fix the flagged agent-card field.", "evidence": "agentCardValidate", "severity": "MEDIUM" }, { "id": "FIND-008", "check": "agent-card", "title": "missing version", "detail": "Agent card missing version", "affected_component": "card", "reason": "Invalid agent card.", "recommended_action": "Fix the flagged agent-card field.", "evidence": "agentCardValidate", "severity": "MEDIUM" }, { "id": "FIND-009", "check": "dependency", "title": "missing license field", "detail": "missing license field", "affected_component": "package", "reason": "Dependency/configuration concern.", "recommended_action": "Declare a valid license and review dependencies.", "evidence": "dependencyLicenseCheck", "severity": "MEDIUM" } ], "remediation_plan": [ { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-001", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-002", "action": "Restrict \"permissions\" to explicit, least-privilege values.", "reason": "wildcard permissions broadens who can invoke tools and what they can do.", "affected_component": "config.permissions" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-003", "action": "Complete the required tool definition fields.", "reason": "Incomplete or invalid tool contract.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-004", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-005", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-006", "action": "Restrict \"auth\" to explicit, least-privilege values.", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "affected_component": "config.auth" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-007", "action": "Fix the flagged agent-card field.", "reason": "Invalid agent card.", "affected_component": "card" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-008", "action": "Fix the flagged agent-card field.", "reason": "Invalid agent card.", "affected_component": "card" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-009", "action": "Declare a valid license and review dependencies.", "reason": "Dependency/configuration concern.", "affected_component": "package" } ], "evidence": [ { "kind": "tool-contract-lint", "index": 0, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "tool-contract-lint", "index": 1, "product": "MICRO-0045", "pass": false, "valid": false, "findings": [ "missing output schema" ], "signature": "d3bdb9aee66a7ba40402d9048ae2a4f8d500d0610df7a69437c4557aac973620" }, { "kind": "tool-contract-lint", "index": 2, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "agent-card-validate", "product": "MICRO-AGENTCARD", "pass": false, "valid": false, "findings": [ "missing url/endpoint", "missing version" ], "signature": "37d58ac96b777cc8586276e7648c26308cfd292a1ca75c82a5a2129b98275b00" }, { "kind": "secret-leak-scan", "product": "MICRO-SECRET", "pass": true, "secret_count": 0, "hits": [], "signature": "7e0956efb11948b8f348194e177eafb382187fe53d6bc31da37dc1075d08f569" }, { "kind": "dependency-license-check", "product": "MICRO-LICENSE", "pass": false, "findings": [ "missing license field" ], "name": "@enterprise/agent-core", "signature": "6f6fe1038304aa3b570296ad335d2a43cd0a6db48cd3f72878868e816e5358b6" }, { "kind": "url-structure-check", "product": "MICRO-URL", "pass": true, "valid": true, "findings": [], "host": "gateway.internal.example.org", "signature": "0ac0d89009902ad7ca36b880e73763854d87311dab84674dfd092ae6425f212d" } ], "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ], "pass": false, "signature": "337340daa774d4acf13538fb1c283b865931c8fab1237cbd8d6dd77213d6cb37", "report_markdown": "# MCP Security Team Pack\n\n**Audit ID:** `fcffcf574bc2da97` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 66/100)\n\n**Target:** agent-payment-coordinator\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 9 findings (2 high, 7 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-004 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-005 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-006 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-007 — [MEDIUM] missing url/endpoint\n\n- **Component:** card\n- **Detail:** Agent card missing url/endpoint\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-008 — [MEDIUM] missing version\n\n- **Component:** card\n- **Detail:** Agent card missing version\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-009 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `337340daa774d4acf13538fb1c283b865931c8fab1237cbd8d6dd77213d6cb37`*" }, { "product": "GEN-SVC-0203", "product_name": "MCP Security Team Pack", "audit_id": "f9c714f7af2f015a", "timestamp": "2026-09-26T15:40:31.710Z", "target": "agent-orders-processor", "tier": "full", "scope": { "tier": "full", "tools_analyzed": 2, "card": false, "instructions": false, "text": false, "config": true, "release_surface": false, "workflow_steps": 0 }, "risk_level": "HIGH", "risk_score": 54, "verdict": "RISK_DETECTED", "findings": [ { "id": "FIND-001", "check": "tool-contract", "title": "missing output schema", "detail": "Tool \"shell_exec_invoice\" missing output schema", "affected_component": "tools[0]", "reason": "Incomplete or invalid tool contract.", "recommended_action": "Complete the required tool definition fields.", "evidence": "toolContractLint", "severity": "HIGH" }, { "id": "FIND-002", "check": "capability", "title": "Dangerous capability: Arbitrary code / shell execution", "detail": "Tool \"shell_exec_invoice\" exposes arbitrary code / shell execution surface.", "affected_component": "tools[0]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description", "severity": "HIGH" }, { "id": "FIND-003", "check": "capability", "title": "Dangerous capability: Arbitrary code / shell execution", "detail": "Tool \"dispatch_sns\" exposes arbitrary code / shell execution surface.", "affected_component": "tools[1]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description", "severity": "HIGH" }, { "id": "FIND-004", "check": "capability", "title": "Dangerous capability: Network / external call", "detail": "Tool \"dispatch_sns\" exposes network / external call surface.", "affected_component": "tools[1]", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "recommended_action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "evidence": "capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description", "severity": "MEDIUM" }, { "id": "FIND-005", "check": "config", "title": "Insecure configuration: authentication disabled", "detail": "Configuration key \"auth\" is set to a permissive value.", "affected_component": "config.auth", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "recommended_action": "Restrict \"auth\" to explicit, least-privilege values.", "evidence": "config key \"auth\" value matched insecure pattern", "severity": "MEDIUM" }, { "id": "FIND-006", "check": "dependency", "title": "missing license field", "detail": "missing license field", "affected_component": "package", "reason": "Dependency/configuration concern.", "recommended_action": "Declare a valid license and review dependencies.", "evidence": "dependencyLicenseCheck", "severity": "MEDIUM" } ], "remediation_plan": [ { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-001", "action": "Complete the required tool definition fields.", "reason": "Incomplete or invalid tool contract.", "affected_component": "tools[0]" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-002", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[0]" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-003", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-004", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "reason": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "affected_component": "tools[1]" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-005", "action": "Restrict \"auth\" to explicit, least-privilege values.", "reason": "authentication disabled broadens who can invoke tools and what they can do.", "affected_component": "config.auth" }, { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-006", "action": "Declare a valid license and review dependencies.", "reason": "Dependency/configuration concern.", "affected_component": "package" } ], "evidence": [ { "kind": "tool-contract-lint", "index": 0, "product": "MICRO-0045", "pass": false, "valid": false, "findings": [ "missing output schema" ], "signature": "d3bdb9aee66a7ba40402d9048ae2a4f8d500d0610df7a69437c4557aac973620" }, { "kind": "tool-contract-lint", "index": 1, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "dependency-license-check", "product": "MICRO-LICENSE", "pass": false, "findings": [ "missing license field" ], "name": "@enterprise/agent-core", "signature": "6f6fe1038304aa3b570296ad335d2a43cd0a6db48cd3f72878868e816e5358b6" }, { "kind": "url-structure-check", "product": "MICRO-URL", "pass": true, "valid": true, "findings": [], "host": "orders.internal.example.org", "signature": "532c7b3f7fe27e7ecc0b6dce98d13d46ae10b35077e134fcb4eb5fbb6ec023e2" } ], "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ], "pass": false, "signature": "ad24ac171b1a860cfe486d27676bbc03278ceaa04d2a62b32cb10a820e2ff240", "report_markdown": "# MCP Security Team Pack\n\n**Audit ID:** `f9c714f7af2f015a` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 54/100)\n\n**Target:** agent-orders-processor\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 6 findings (3 high, 3 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 2\n- card: false\n- instructions: false\n- text: false\n- config: true\n- release_surface: false\n- workflow_steps: 0\n\n## Findings\n\n### FIND-001 — [HIGH] missing output schema\n\n- **Component:** tools[0]\n- **Detail:** Tool \"shell_exec_invoice\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-002 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"shell_exec_invoice\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-003 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[1]\n- **Detail:** Tool \"dispatch_sns\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-004 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"dispatch_sns\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-005 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-006 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P1]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `ad24ac171b1a860cfe486d27676bbc03278ceaa04d2a62b32cb10a820e2ff240`*" }, { "product": "GEN-SVC-0203", "product_name": "MCP Security Team Pack", "audit_id": "85d14e80ce8de2ea", "timestamp": "2026-09-26T15:40:31.710Z", "target": "agent-reporting-service", "tier": "full", "scope": { "tier": "full", "tools_analyzed": 1, "card": false, "instructions": false, "text": false, "config": true, "release_surface": false, "workflow_steps": 0 }, "risk_level": "LOW", "risk_score": 6, "verdict": "RISK_DETECTED", "findings": [ { "id": "FIND-001", "check": "dependency", "title": "missing license field", "detail": "missing license field", "affected_component": "package", "reason": "Dependency/configuration concern.", "recommended_action": "Declare a valid license and review dependencies.", "evidence": "dependencyLicenseCheck", "severity": "MEDIUM" } ], "remediation_plan": [ { "priority": "P2", "severity": "MEDIUM", "finding_id": "FIND-001", "action": "Declare a valid license and review dependencies.", "reason": "Dependency/configuration concern.", "affected_component": "package" } ], "evidence": [ { "kind": "tool-contract-lint", "index": 0, "product": "MICRO-0045", "pass": true, "valid": true, "findings": [], "signature": "2aef360bc62e068e2b9742ce01ab31a3b20430895e157514367e6ccfb069d163" }, { "kind": "dependency-license-check", "product": "MICRO-LICENSE", "pass": false, "findings": [ "missing license field" ], "name": "@enterprise/reporting-tools", "signature": "6cd2ddeea34aba7a722057bf57514c43d7731cdc5683c93346edfa9c7265b6cc" }, { "kind": "url-structure-check", "product": "MICRO-URL", "pass": true, "valid": true, "findings": [], "host": "reporting.internal.example.org", "signature": "669643cfccbe00e9dcb82acfb77b804271ff9dac70df53744696515f79fb81c3" } ], "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ], "pass": false, "signature": "aacd03db399165b525623d03643fa0f88c4fb0ffb5daddad555ced77538a1a3a", "report_markdown": "# MCP Security Team Pack\n\n**Audit ID:** `85d14e80ce8de2ea` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** LOW (score 6/100)\n\n**Target:** agent-reporting-service\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 1 finding (1 medium), yielding an overall risk level of LOW. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 1\n- card: false\n- instructions: false\n- text: false\n- config: true\n- release_surface: false\n- workflow_steps: 0\n\n## Findings\n\n### FIND-001 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `aacd03db399165b525623d03643fa0f88c4fb0ffb5daddad555ced77538a1a3a`*" } ], "portfolio": { "three_independent_audits": 3, "cross_server_correlations": [ { "finding": "Dangerous capability: Arbitrary code / shell execution", "severity": "HIGH", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor", "agent-orders-processor" ], "common_root_cause": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "shared_remediation": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary." }, { "finding": "missing license field", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor", "agent-reporting-service" ], "common_root_cause": "Dependency/configuration concern.", "shared_remediation": "Declare a valid license and review dependencies." }, { "finding": "missing output schema", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "common_root_cause": "Incomplete or invalid tool contract.", "shared_remediation": "Complete the required tool definition fields." }, { "finding": "Dangerous capability: Network / external call", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "common_root_cause": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "shared_remediation": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary." }, { "finding": "Insecure configuration: authentication disabled", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "common_root_cause": "authentication disabled broadens who can invoke tools and what they can do.", "shared_remediation": "Restrict \"auth\" to explicit, least-privilege values." } ], "heatmap": [ { "target": "agent-payment-coordinator", "risk_level": "HIGH", "critical_high_findings": 2, "auth_issues": 1, "capability_exposure": 3, "priority": "P0" }, { "target": "agent-orders-processor", "risk_level": "HIGH", "critical_high_findings": 3, "auth_issues": 1, "capability_exposure": 3, "priority": "P0" }, { "target": "agent-reporting-service", "risk_level": "LOW", "critical_high_findings": 0, "auth_issues": 0, "capability_exposure": 0, "priority": "P2" } ], "deduplicated_findings": [ { "finding": "Dangerous capability: Arbitrary code / shell execution", "severity": "HIGH", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor", "agent-orders-processor" ], "common_root_cause": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "shared_remediation": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary." }, { "finding": "missing license field", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor", "agent-reporting-service" ], "common_root_cause": "Dependency/configuration concern.", "shared_remediation": "Declare a valid license and review dependencies." }, { "finding": "missing output schema", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "common_root_cause": "Incomplete or invalid tool contract.", "shared_remediation": "Complete the required tool definition fields." }, { "finding": "Dangerous capability: Network / external call", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "common_root_cause": "This capability increases blast radius if the tool is misused or its input is attacker-controlled.", "shared_remediation": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary." }, { "finding": "Insecure configuration: authentication disabled", "severity": "MEDIUM", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "common_root_cause": "authentication disabled broadens who can invoke tools and what they can do.", "shared_remediation": "Restrict \"auth\" to explicit, least-privilege values." } ], "blast_radius": { "shared_dependencies": [ { "shared_dependency": "@enterprise/agent-core", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "note": "A shared dependency means a vulnerability or supply-chain issue in it could affect multiple targets." } ], "shared_auth_patterns": [ { "finding": "Insecure configuration: authentication disabled", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ] } ] }, "remediation_roadmap": [ { "priority": "P0", "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "affected_targets": [ "agent-payment-coordinator", "agent-payment-coordinator", "agent-payment-coordinator", "agent-orders-processor", "agent-orders-processor", "agent-orders-processor" ], "finding": "FIND-001" }, { "priority": "P0", "action": "Restrict \"permissions\" to explicit, least-privilege values.", "affected_targets": [ "agent-payment-coordinator" ], "finding": "FIND-002" }, { "priority": "P1", "action": "Complete the required tool definition fields.", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "finding": "FIND-003" }, { "priority": "P1", "action": "Restrict \"auth\" to explicit, least-privilege values.", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor" ], "finding": "FIND-006" }, { "priority": "P1", "action": "Fix the flagged agent-card field.", "affected_targets": [ "agent-payment-coordinator", "agent-payment-coordinator" ], "finding": "FIND-007" }, { "priority": "P1", "action": "Declare a valid license and review dependencies.", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor", "agent-reporting-service" ], "finding": "FIND-009" } ], "common_control_plan": [ { "action": "Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.", "remediates_findings": 6, "across_targets": [ "agent-payment-coordinator", "agent-orders-processor" ] }, { "action": "Complete the required tool definition fields.", "remediates_findings": 2, "across_targets": [ "agent-payment-coordinator", "agent-orders-processor" ] }, { "action": "Restrict \"auth\" to explicit, least-privilege values.", "remediates_findings": 2, "across_targets": [ "agent-payment-coordinator", "agent-orders-processor" ] }, { "action": "Fix the flagged agent-card field.", "remediates_findings": 2, "across_targets": [ "agent-payment-coordinator" ] }, { "action": "Declare a valid license and review dependencies.", "remediates_findings": 3, "across_targets": [ "agent-payment-coordinator", "agent-orders-processor", "agent-reporting-service" ] } ], "executive_brief": { "riskiest_target": { "target": "agent-payment-coordinator", "risk_level": "HIGH", "findings": 9 }, "most_common_weakness": { "finding": "Dangerous capability: Arbitrary code / shell execution", "affected_targets": [ "agent-payment-coordinator", "agent-orders-processor", "agent-orders-processor" ] }, "highest_reduction_control": "Remediate \"Dangerous capability: Arbitrary code / shell execution\" across 3 targets.", "must_fix_before_deploy": [ "agent-payment-coordinator: Dangerous capability: Arbitrary code / shell execution", "agent-payment-coordinator: Insecure configuration: wildcard permissions", "agent-orders-processor: missing output schema", "agent-orders-processor: Dangerous capability: Arbitrary code / shell execution", "agent-orders-processor: Dangerous capability: Arbitrary code / shell execution" ], "remains_unknown": [ "Runtime exploitation behavior.", "Security of dependencies not present in the supplied inputs." ] }, "correlation_note": "Cross-target correlations detected from supplied fixtures." }, "limitations": [ "Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.", "Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.", "Source code, when supplied, is treated as opaque data and is never executed.", "Absence of findings is not proof of safety." ], "pass": false, "signature": "8be4310bff10c68bf4fce96d8c9dbea58f3b3fb9a73f7acfe0e4944e737c9c9a", "report_markdown": "# MCP Security Team Pack\n\n**Audit ID:** `3d97bd009310ca4c` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Targets analyzed:** 3\n**Summary:** 0 READY, 3 RISK_DETECTED · **Overall PASS:** FAIL/RISK\n\n## Portfolio executive brief\n\n- **Riskiest target:** agent-payment-coordinator (HIGH, 9 findings)\n- **Most common weakness:** Dangerous capability: Arbitrary code / shell execution (across agent-payment-coordinator, agent-orders-processor, agent-orders-processor)\n- **Highest reduction control:** Remediate \"Dangerous capability: Arbitrary code / shell execution\" across 3 targets.\n- **Must fix before deploy:**\n - agent-payment-coordinator: Dangerous capability: Arbitrary code / shell execution\n - agent-payment-coordinator: Insecure configuration: wildcard permissions\n - agent-orders-processor: missing output schema\n - agent-orders-processor: Dangerous capability: Arbitrary code / shell execution\n - agent-orders-processor: Dangerous capability: Arbitrary code / shell execution\n\n## Portfolio risk heatmap\n\n| Target | Risk Level | Critical/High | Auth Issues | Capability Exposure | Priority |\n| --- | --- | --- | --- | --- | --- |\n| agent-payment-coordinator | HIGH | 2 | 1 | 3 | P0 |\n| agent-orders-processor | HIGH | 3 | 1 | 3 | P0 |\n| agent-reporting-service | LOW | 0 | 0 | 0 | P2 |\n\n## Cross-server correlations & shared weaknesses\n\n### Dangerous capability: Arbitrary code / shell execution [HIGH]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor, agent-orders-processor\n- **Common root cause:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Shared remediation:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n\n### missing license field [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor, agent-reporting-service\n- **Common root cause:** Dependency/configuration concern.\n- **Shared remediation:** Declare a valid license and review dependencies.\n\n### missing output schema [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor\n- **Common root cause:** Incomplete or invalid tool contract.\n- **Shared remediation:** Complete the required tool definition fields.\n\n### Dangerous capability: Network / external call [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor\n- **Common root cause:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Shared remediation:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n\n### Insecure configuration: authentication disabled [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor\n- **Common root cause:** authentication disabled broadens who can invoke tools and what they can do.\n- **Shared remediation:** Restrict \"auth\" to explicit, least-privilege values.\n\n\n## Blast radius analysis\n\n- **Shared dependency `@enterprise/agent-core`:** Affects agent-payment-coordinator, agent-orders-processor. A shared dependency means a vulnerability or supply-chain issue in it could affect multiple targets.\n- **Shared auth pattern:** Insecure configuration: authentication disabled across agent-payment-coordinator, agent-orders-processor\n\n## Common control plan\n\n- **Control:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. (Remediates 6 finding(s) across: agent-payment-coordinator, agent-orders-processor)\n- **Control:** Complete the required tool definition fields. (Remediates 2 finding(s) across: agent-payment-coordinator, agent-orders-processor)\n- **Control:** Restrict \"auth\" to explicit, least-privilege values. (Remediates 2 finding(s) across: agent-payment-coordinator, agent-orders-processor)\n- **Control:** Fix the flagged agent-card field. (Remediates 2 finding(s) across: agent-payment-coordinator)\n- **Control:** Declare a valid license and review dependencies. (Remediates 3 finding(s) across: agent-payment-coordinator, agent-orders-processor, agent-reporting-service)\n\n## Portfolio remediation roadmap\n\n- **[P0]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. (Targets: agent-payment-coordinator, agent-payment-coordinator, agent-payment-coordinator, agent-orders-processor, agent-orders-processor, agent-orders-processor)\n- **[P0]** Restrict \"permissions\" to explicit, least-privilege values. (Targets: agent-payment-coordinator)\n- **[P1]** Complete the required tool definition fields. (Targets: agent-payment-coordinator, agent-orders-processor)\n- **[P1]** Restrict \"auth\" to explicit, least-privilege values. (Targets: agent-payment-coordinator, agent-orders-processor)\n- **[P1]** Fix the flagged agent-card field. (Targets: agent-payment-coordinator, agent-payment-coordinator)\n- **[P1]** Declare a valid license and review dependencies. (Targets: agent-payment-coordinator, agent-orders-processor, agent-reporting-service)\n\n---\n\n## Individual target audit reports\n\n### Target 1: agent-payment-coordinator\n\n# MCP Security Team Pack\n\n**Audit ID:** `fcffcf574bc2da97` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 66/100)\n\n**Target:** agent-payment-coordinator\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 9 findings (2 high, 7 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-004 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-005 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-006 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-007 — [MEDIUM] missing url/endpoint\n\n- **Component:** card\n- **Detail:** Agent card missing url/endpoint\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-008 — [MEDIUM] missing version\n\n- **Component:** card\n- **Detail:** Agent card missing version\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-009 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `337340daa774d4acf13538fb1c283b865931c8fab1237cbd8d6dd77213d6cb37`*\n\n### Target 2: agent-orders-processor\n\n# MCP Security Team Pack\n\n**Audit ID:** `f9c714f7af2f015a` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 54/100)\n\n**Target:** agent-orders-processor\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 6 findings (3 high, 3 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 2\n- card: false\n- instructions: false\n- text: false\n- config: true\n- release_surface: false\n- workflow_steps: 0\n\n## Findings\n\n### FIND-001 — [HIGH] missing output schema\n\n- **Component:** tools[0]\n- **Detail:** Tool \"shell_exec_invoice\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-002 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"shell_exec_invoice\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-003 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[1]\n- **Detail:** Tool \"dispatch_sns\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-004 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"dispatch_sns\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-005 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-006 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P1]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `ad24ac171b1a860cfe486d27676bbc03278ceaa04d2a62b32cb10a820e2ff240`*\n\n### Target 3: agent-reporting-service\n\n# MCP Security Team Pack\n\n**Audit ID:** `85d14e80ce8de2ea` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** LOW (score 6/100)\n\n**Target:** agent-reporting-service\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 1 finding (1 medium), yielding an overall risk level of LOW. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 1\n- card: false\n- instructions: false\n- text: false\n- config: true\n- release_surface: false\n- workflow_steps: 0\n\n## Findings\n\n### FIND-001 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `aacd03db399165b525623d03643fa0f88c4fb0ffb5daddad555ced77538a1a3a`*\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Team pack signature: `8be4310bff10c68bf4fce96d8c9dbea58f3b3fb9a73f7acfe0e4944e737c9c9a`*" }, "report_markdown": "# MCP Security Team Pack\n\n**Audit ID:** `3d97bd009310ca4c` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Targets analyzed:** 3\n**Summary:** 0 READY, 3 RISK_DETECTED · **Overall PASS:** FAIL/RISK\n\n## Portfolio executive brief\n\n- **Riskiest target:** agent-payment-coordinator (HIGH, 9 findings)\n- **Most common weakness:** Dangerous capability: Arbitrary code / shell execution (across agent-payment-coordinator, agent-orders-processor, agent-orders-processor)\n- **Highest reduction control:** Remediate \"Dangerous capability: Arbitrary code / shell execution\" across 3 targets.\n- **Must fix before deploy:**\n - agent-payment-coordinator: Dangerous capability: Arbitrary code / shell execution\n - agent-payment-coordinator: Insecure configuration: wildcard permissions\n - agent-orders-processor: missing output schema\n - agent-orders-processor: Dangerous capability: Arbitrary code / shell execution\n - agent-orders-processor: Dangerous capability: Arbitrary code / shell execution\n\n## Portfolio risk heatmap\n\n| Target | Risk Level | Critical/High | Auth Issues | Capability Exposure | Priority |\n| --- | --- | --- | --- | --- | --- |\n| agent-payment-coordinator | HIGH | 2 | 1 | 3 | P0 |\n| agent-orders-processor | HIGH | 3 | 1 | 3 | P0 |\n| agent-reporting-service | LOW | 0 | 0 | 0 | P2 |\n\n## Cross-server correlations & shared weaknesses\n\n### Dangerous capability: Arbitrary code / shell execution [HIGH]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor, agent-orders-processor\n- **Common root cause:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Shared remediation:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n\n### missing license field [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor, agent-reporting-service\n- **Common root cause:** Dependency/configuration concern.\n- **Shared remediation:** Declare a valid license and review dependencies.\n\n### missing output schema [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor\n- **Common root cause:** Incomplete or invalid tool contract.\n- **Shared remediation:** Complete the required tool definition fields.\n\n### Dangerous capability: Network / external call [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor\n- **Common root cause:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Shared remediation:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n\n### Insecure configuration: authentication disabled [MEDIUM]\n- **Affected targets:** agent-payment-coordinator, agent-orders-processor\n- **Common root cause:** authentication disabled broadens who can invoke tools and what they can do.\n- **Shared remediation:** Restrict \"auth\" to explicit, least-privilege values.\n\n\n## Blast radius analysis\n\n- **Shared dependency `@enterprise/agent-core`:** Affects agent-payment-coordinator, agent-orders-processor. A shared dependency means a vulnerability or supply-chain issue in it could affect multiple targets.\n- **Shared auth pattern:** Insecure configuration: authentication disabled across agent-payment-coordinator, agent-orders-processor\n\n## Common control plan\n\n- **Control:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. (Remediates 6 finding(s) across: agent-payment-coordinator, agent-orders-processor)\n- **Control:** Complete the required tool definition fields. (Remediates 2 finding(s) across: agent-payment-coordinator, agent-orders-processor)\n- **Control:** Restrict \"auth\" to explicit, least-privilege values. (Remediates 2 finding(s) across: agent-payment-coordinator, agent-orders-processor)\n- **Control:** Fix the flagged agent-card field. (Remediates 2 finding(s) across: agent-payment-coordinator)\n- **Control:** Declare a valid license and review dependencies. (Remediates 3 finding(s) across: agent-payment-coordinator, agent-orders-processor, agent-reporting-service)\n\n## Portfolio remediation roadmap\n\n- **[P0]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. (Targets: agent-payment-coordinator, agent-payment-coordinator, agent-payment-coordinator, agent-orders-processor, agent-orders-processor, agent-orders-processor)\n- **[P0]** Restrict \"permissions\" to explicit, least-privilege values. (Targets: agent-payment-coordinator)\n- **[P1]** Complete the required tool definition fields. (Targets: agent-payment-coordinator, agent-orders-processor)\n- **[P1]** Restrict \"auth\" to explicit, least-privilege values. (Targets: agent-payment-coordinator, agent-orders-processor)\n- **[P1]** Fix the flagged agent-card field. (Targets: agent-payment-coordinator, agent-payment-coordinator)\n- **[P1]** Declare a valid license and review dependencies. (Targets: agent-payment-coordinator, agent-orders-processor, agent-reporting-service)\n\n---\n\n## Individual target audit reports\n\n### Target 1: agent-payment-coordinator\n\n# MCP Security Team Pack\n\n**Audit ID:** `fcffcf574bc2da97` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 66/100)\n\n**Target:** agent-payment-coordinator\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 9 findings (2 high, 7 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 3\n- card: true\n- instructions: false\n- text: true\n- config: true\n- release_surface: true\n- workflow_steps: 2\n\n## Findings\n\n### FIND-001 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-002 — [HIGH] Insecure configuration: wildcard permissions\n\n- **Component:** config.permissions\n- **Detail:** Configuration key \"permissions\" is set to a permissive value.\n- **Reason:** wildcard permissions broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"permissions\" to explicit, least-privilege values.\n- **Evidence:** config key \"permissions\" value matched insecure pattern\n\n### FIND-003 — [MEDIUM] missing output schema\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-004 — [MEDIUM] Dangerous capability: Filesystem mutation\n\n- **Component:** tools[0]\n- **Detail:** Tool \"execute_sql\" exposes filesystem mutation surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"write|create|delete|remove|rename|move|upload\" matched tool description\n\n### FIND-005 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"fetch_remote_webhook\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-006 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-007 — [MEDIUM] missing url/endpoint\n\n- **Component:** card\n- **Detail:** Agent card missing url/endpoint\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-008 — [MEDIUM] missing version\n\n- **Component:** card\n- **Detail:** Agent card missing version\n- **Reason:** Invalid agent card.\n- **Action:** Fix the flagged agent-card field.\n- **Evidence:** agentCardValidate\n\n### FIND-009 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Restrict \"permissions\" to explicit, least-privilege values. — wildcard permissions broadens who can invoke tools and what they can do.\n- **[P2]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Fix the flagged agent-card field. — Invalid agent card.\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `337340daa774d4acf13538fb1c283b865931c8fab1237cbd8d6dd77213d6cb37`*\n\n### Target 2: agent-orders-processor\n\n# MCP Security Team Pack\n\n**Audit ID:** `f9c714f7af2f015a` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 54/100)\n\n**Target:** agent-orders-processor\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 6 findings (3 high, 3 medium), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 2\n- card: false\n- instructions: false\n- text: false\n- config: true\n- release_surface: false\n- workflow_steps: 0\n\n## Findings\n\n### FIND-001 — [HIGH] missing output schema\n\n- **Component:** tools[0]\n- **Detail:** Tool \"shell_exec_invoice\" missing output schema\n- **Reason:** Incomplete or invalid tool contract.\n- **Action:** Complete the required tool definition fields.\n- **Evidence:** toolContractLint\n\n### FIND-002 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[0]\n- **Detail:** Tool \"shell_exec_invoice\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-003 — [HIGH] Dangerous capability: Arbitrary code / shell execution\n\n- **Component:** tools[1]\n- **Detail:** Tool \"dispatch_sns\" exposes arbitrary code / shell execution surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"execute|shell|bash|sh\\b|terminal|command|run[_ -]?code\" matched tool description\n\n### FIND-004 — [MEDIUM] Dangerous capability: Network / external call\n\n- **Component:** tools[1]\n- **Detail:** Tool \"dispatch_sns\" exposes network / external call surface.\n- **Reason:** This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **Action:** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary.\n- **Evidence:** capability signal \"network|http|fetch|request|webhook|outbound|call[_ -]?external\" matched tool description\n\n### FIND-005 — [MEDIUM] Insecure configuration: authentication disabled\n\n- **Component:** config.auth\n- **Detail:** Configuration key \"auth\" is set to a permissive value.\n- **Reason:** authentication disabled broadens who can invoke tools and what they can do.\n- **Action:** Restrict \"auth\" to explicit, least-privilege values.\n- **Evidence:** config key \"auth\" value matched insecure pattern\n\n### FIND-006 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P1]** Complete the required tool definition fields. — Incomplete or invalid tool contract.\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P1]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Confirm the capability is intended, least-privilege, and input-validated; document its trust boundary. — This capability increases blast radius if the tool is misused or its input is attacker-controlled.\n- **[P2]** Restrict \"auth\" to explicit, least-privilege values. — authentication disabled broadens who can invoke tools and what they can do.\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `ad24ac171b1a860cfe486d27676bbc03278ceaa04d2a62b32cb10a820e2ff240`*\n\n### Target 3: agent-reporting-service\n\n# MCP Security Team Pack\n\n**Audit ID:** `85d14e80ce8de2ea` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** LOW (score 6/100)\n\n**Target:** agent-reporting-service\n**Verdict:** RISK_DETECTED\n\n## Executive summary\n\nAutomated assessment found 1 finding (1 medium), yielding an overall risk level of LOW. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Scope\n\n- tier: full\n- tools_analyzed: 1\n- card: false\n- instructions: false\n- text: false\n- config: true\n- release_surface: false\n- workflow_steps: 0\n\n## Findings\n\n### FIND-001 — [MEDIUM] missing license field\n\n- **Component:** package\n- **Detail:** missing license field\n- **Reason:** Dependency/configuration concern.\n- **Action:** Declare a valid license and review dependencies.\n- **Evidence:** dependencyLicenseCheck\n\n## Remediation plan\n\n- **[P2]** Declare a valid license and review dependencies. — Dependency/configuration concern.\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Report signature: `aacd03db399165b525623d03643fa0f88c4fb0ffb5daddad555ced77538a1a3a`*\n\n## Limitations\n\n- Automated static assessment of supplied artifacts only — no runtime access, no dynamic testing, no penetration testing.\n- Findings derive only from the provided tool definitions, schemas, configuration and text; absent inputs are not analyzed.\n- Source code, when supplied, is treated as opaque data and is never executed.\n- Absence of findings is not proof of safety.\n\n*Team pack signature: `8be4310bff10c68bf4fce96d8c9dbea58f3b3fb9a73f7acfe0e4944e737c9c9a`*" }, "critical_gate_49": { "sku": "GEN-SVC-0212", "name": "AI Critical Release Gate", "price_usdc": 49, "sample_label": "SAMPLE GENERATED FROM CONTROLLED TEST FIXTURE", "report_json": { "product": "GEN-SVC-0210", "product_name": "AI Release Risk Gate", "audit_id": "c6524b01474d3cdd", "timestamp": "2026-09-26T15:40:31.710Z", "tier": "critical-gate", "verdict": "BLOCK", "risk_level": "HIGH", "risk_score": 24, "affected_surfaces": [ "openapi" ], "findings": [ { "id": "FIND-001", "check": "compatibility", "title": "Compatibility blocker", "detail": "openapi: CRITICAL", "affected_component": "openapi", "reason": "Backwards-incompatible change detected.", "recommended_action": "Restore compatibility or gate the release behind a major version.", "evidence": "apiCompatibilitySuite", "severity": "HIGH" }, { "id": "FIND-002", "check": "changelog", "title": "Breaking-change signals in changelog", "detail": "breaking, removed, deprecated", "affected_component": "changelog", "reason": "Changelog signals possible breaking changes.", "recommended_action": "Review the flagged changelog entries.", "evidence": "apiChangelogRisk", "severity": "HIGH" } ], "blockers": [ { "id": "FIND-001", "check": "compatibility", "title": "Compatibility blocker", "detail": "openapi: CRITICAL", "affected_component": "openapi", "reason": "Backwards-incompatible change detected.", "recommended_action": "Restore compatibility or gate the release behind a major version.", "evidence": "apiCompatibilitySuite", "severity": "HIGH" }, { "id": "FIND-002", "check": "changelog", "title": "Breaking-change signals in changelog", "detail": "breaking, removed, deprecated", "affected_component": "changelog", "reason": "Changelog signals possible breaking changes.", "recommended_action": "Review the flagged changelog entries.", "evidence": "apiChangelogRisk", "severity": "HIGH" } ], "remediation_plan": [ { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-001", "action": "Restore compatibility or gate the release behind a major version.", "reason": "Backwards-incompatible change detected.", "affected_component": "openapi" }, { "priority": "P1", "severity": "HIGH", "finding_id": "FIND-002", "action": "Review the flagged changelog entries.", "reason": "Changelog signals possible breaking changes.", "affected_component": "changelog" } ], "evidence": [ { "kind": "compatibility-suite", "product": "GEN-SVC-0100", "pass": false, "mcp": { "pass": true, "breaking_changes": [], "changed_fields": [] }, "openapi": { "pass": false, "severity": "CRITICAL", "removed_endpoints": [ "/v1/refunds" ], "changed_endpoints": [], "parameter_changes": [], "response_schema_changes": [], "required_field_changes": [], "security_changes": [] }, "sdk": { "pass": true, "score": 100, "removed_symbols": [], "semver_impact": "none" }, "blocking_findings": [ { "gate": "openapi", "severity": "CRITICAL" } ], "signature": "93d9e59cec81299e55a6681294ad587930d7881044fe27636e8b97e2de16cfce" }, { "kind": "changelog-risk", "product": "MICRO-0046", "pass": false, "risk": "HIGH", "breaking_signals_found": [ "breaking", "removed", "deprecated" ], "signal_count": 3, "signature": "1e3b042c6d4e098f053c0cb7bbba1d975de3bdd0424bc14d8ec66fc5875bd78e" } ], "limitations": [ "Deterministic static analysis of supplied before/after artifacts only.", "Verdict reflects contract/security regressions detected in the provided inputs; it is not a security guarantee.", "Runtime behavior and external dependencies not present in the inputs are not evaluated." ], "pass": false, "signature": "bcb6c75cf0e7eed698fda69a82d242279a247a18006ef40c111966ee531ea1d6", "report_markdown": "# AI Release Risk Gate\n\n**Audit ID:** `c6524b01474d3cdd` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 24/100)\n\n**Target:** unspecified\n**Verdict:** BLOCK\n\n## Executive summary\n\nAutomated assessment found 2 findings (2 high), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Findings\n\n### FIND-001 — [HIGH] Compatibility blocker\n\n- **Component:** openapi\n- **Detail:** openapi: CRITICAL\n- **Reason:** Backwards-incompatible change detected.\n- **Action:** Restore compatibility or gate the release behind a major version.\n- **Evidence:** apiCompatibilitySuite\n\n### FIND-002 — [HIGH] Breaking-change signals in changelog\n\n- **Component:** changelog\n- **Detail:** breaking, removed, deprecated\n- **Reason:** Changelog signals possible breaking changes.\n- **Action:** Review the flagged changelog entries.\n- **Evidence:** apiChangelogRisk\n\n## Remediation plan\n\n- **[P1]** Restore compatibility or gate the release behind a major version. — Backwards-incompatible change detected.\n- **[P1]** Review the flagged changelog entries. — Changelog signals possible breaking changes.\n\n## Limitations\n\n- Deterministic static analysis of supplied before/after artifacts only.\n- Verdict reflects contract/security regressions detected in the provided inputs; it is not a security guarantee.\n- Runtime behavior and external dependencies not present in the inputs are not evaluated.\n\n*Report signature: `bcb6c75cf0e7eed698fda69a82d242279a247a18006ef40c111966ee531ea1d6`*" }, "report_markdown": "# AI Release Risk Gate\n\n**Audit ID:** `c6524b01474d3cdd` · **Timestamp:** 2026-09-26T15:40:31.710Z · **Risk level:** HIGH (score 24/100)\n\n**Target:** unspecified\n**Verdict:** BLOCK\n\n## Executive summary\n\nAutomated assessment found 2 findings (2 high), yielding an overall risk level of HIGH. The highest-severity findings should be remediated before the target is trusted with sensitive data or privileged actions.\n\n## Findings\n\n### FIND-001 — [HIGH] Compatibility blocker\n\n- **Component:** openapi\n- **Detail:** openapi: CRITICAL\n- **Reason:** Backwards-incompatible change detected.\n- **Action:** Restore compatibility or gate the release behind a major version.\n- **Evidence:** apiCompatibilitySuite\n\n### FIND-002 — [HIGH] Breaking-change signals in changelog\n\n- **Component:** changelog\n- **Detail:** breaking, removed, deprecated\n- **Reason:** Changelog signals possible breaking changes.\n- **Action:** Review the flagged changelog entries.\n- **Evidence:** apiChangelogRisk\n\n## Remediation plan\n\n- **[P1]** Restore compatibility or gate the release behind a major version. — Backwards-incompatible change detected.\n- **[P1]** Review the flagged changelog entries. — Changelog signals possible breaking changes.\n\n## Limitations\n\n- Deterministic static analysis of supplied before/after artifacts only.\n- Verdict reflects contract/security regressions detected in the provided inputs; it is not a security guarantee.\n- Runtime behavior and external dependencies not present in the inputs are not evaluated.\n\n*Report signature: `bcb6c75cf0e7eed698fda69a82d242279a247a18006ef40c111966ee531ea1d6`*" } } }