@agentsid/scanner 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (116) hide show
  1. package/README.md +205 -0
  2. package/action/action.yml +42 -0
  3. package/action/index.mjs +179 -0
  4. package/docs/state-of-agent-security-2026.md +377 -0
  5. package/examples/security-scan.yml +57 -0
  6. package/package.json +37 -0
  7. package/reports/aashari-mcp-server-atlassian-confluence.json +110 -0
  8. package/reports/aashari-mcp-server-atlassian-jira.json +138 -0
  9. package/reports/aashari-mcp-server-aws-sso.json +122 -0
  10. package/reports/agentdeskai-browser-tools-mcp.json +361 -0
  11. package/reports/ahmetkca-mcp-server-postgres.json +43 -0
  12. package/reports/aiondadotcom-mcp-ssh.json +166 -0
  13. package/reports/apify-actors-mcp-server.json +43 -0
  14. package/reports/azure-mcp.json +43 -0
  15. package/reports/boilerplate-mcp-tool.json +43 -0
  16. package/reports/browserstack-mcp-server.json +43 -0
  17. package/reports/canvas-mcp-server.json +43 -0
  18. package/reports/canvas-mcp-tool.json +43 -0
  19. package/reports/chrome-devtools-mcp.json +300 -0
  20. package/reports/chrome-local-mcp.json +222 -0
  21. package/reports/claude-flow-mcp.json +43 -0
  22. package/reports/cloudflare-mcp-server.json +43 -0
  23. package/reports/code-canvas-server.json +43 -0
  24. package/reports/cognitionai-metabase-mcp-server.json +43 -0
  25. package/reports/composio-mcp.json +43 -0
  26. package/reports/contentful-mcp-server.json +43 -0
  27. package/reports/dbhub.json +43 -0
  28. package/reports/desktop-commander.json +43 -0
  29. package/reports/dynatrace-oss-dynatrace-mcp-server.json +43 -0
  30. package/reports/e2b-mcp-server.json +67 -0
  31. package/reports/eslint-mcp.json +51 -0
  32. package/reports/european-parliament-mcp-server.json +1467 -0
  33. package/reports/exa-mcp-server.json +74 -0
  34. package/reports/executeautomation-playwright-mcp-server.json +418 -0
  35. package/reports/fast-kit-spec-kit.json +43 -0
  36. package/reports/felores-airtable-mcp-server.json +43 -0
  37. package/reports/figma-mcp.json +103 -0
  38. package/reports/forestadmin-mcp-server.json +43 -0
  39. package/reports/fullrun-mcp.json +43 -0
  40. package/reports/gemini-mcp-tool.json +43 -0
  41. package/reports/gitlab-mcp-agent-server.json +186 -0
  42. package/reports/grackle-ai-mcp.json +43 -0
  43. package/reports/heroku-mcp-server.json +333 -0
  44. package/reports/hisma-server-puppeteer.json +93 -0
  45. package/reports/hubspot-mcp-server.json +43 -0
  46. package/reports/hyper-mcp-shell.json +59 -0
  47. package/reports/iflow-mcp-server-github.json +327 -0
  48. package/reports/jpisnice-shadcn-ui-mcp-server.json +149 -0
  49. package/reports/jsonresume-mcp.json +43 -0
  50. package/reports/mapbox-mcp-server.json +43 -0
  51. package/reports/mcp-framework.json +43 -0
  52. package/reports/mcp-from-openapi.json +43 -0
  53. package/reports/mcp-handler.json +43 -0
  54. package/reports/mcp-proxy.json +43 -0
  55. package/reports/mcp-server-docker.json +59 -0
  56. package/reports/mcp-server-github-gist.json +108 -0
  57. package/reports/mcp-server-google-calendar.json +43 -0
  58. package/reports/mcp-server-jira-cloud.json +43 -0
  59. package/reports/mcp-server-kubernetes.json +43 -0
  60. package/reports/mcp-server-slack.json +411 -0
  61. package/reports/mcp-server-sqlite-npx.json +43 -0
  62. package/reports/mcp-server.json +43 -0
  63. package/reports/mcp-starter.json +59 -0
  64. package/reports/mcp-tool-lint.json +43 -0
  65. package/reports/mcporter.json +43 -0
  66. package/reports/mcptoolshop-mcp-tool-registry.json +43 -0
  67. package/reports/microsoft-devbox-mcp.json +43 -0
  68. package/reports/mobilenext-mobile-mcp.json +214 -0
  69. package/reports/modelcontextprotocol-server-brave-search.json +43 -0
  70. package/reports/modelcontextprotocol-server-everything.json +165 -0
  71. package/reports/modelcontextprotocol-server-fetch.json +43 -0
  72. package/reports/modelcontextprotocol-server-filesystem.json +259 -0
  73. package/reports/modelcontextprotocol-server-github.json +391 -0
  74. package/reports/modelcontextprotocol-server-memory.json +117 -0
  75. package/reports/modelcontextprotocol-server-postgres.json +43 -0
  76. package/reports/modelcontextprotocol-server-puppeteer.json +101 -0
  77. package/reports/modelcontextprotocol-server-sequential-thinking.json +67 -0
  78. package/reports/mongodb-mcp-server.json +43 -0
  79. package/reports/mseep-linear-mcp-server.json +43 -0
  80. package/reports/mseep-mcp-server-sqlite-npx.json +43 -0
  81. package/reports/n8n-mcp.json +123 -0
  82. package/reports/notepost-mcp.json +43 -0
  83. package/reports/notionhq-notion-mcp-server.json +220 -0
  84. package/reports/nx-mcp.json +59 -0
  85. package/reports/obsidian-mcp-server.json +43 -0
  86. package/reports/opengraph-io-mcp.json +130 -0
  87. package/reports/payloadcms-plugin-mcp.json +43 -0
  88. package/reports/peac-mappings-mcp.json +43 -0
  89. package/reports/playwright-mcp.json +236 -0
  90. package/reports/puppeteer-mcp-server.json +43 -0
  91. package/reports/railway-mcp-server.json +194 -0
  92. package/reports/razorpay-blade-mcp.json +182 -0
  93. package/reports/rekog-mcp-nest.json +43 -0
  94. package/reports/remotion-mcp.json +51 -0
  95. package/reports/rollbar-mcp-server.json +43 -0
  96. package/reports/sap-ux-fiori-mcp-server.json +80 -0
  97. package/reports/sentry-mcp-server.json +43 -0
  98. package/reports/server-filesystem.json +43 -0
  99. package/reports/server-memory.json +43 -0
  100. package/reports/shortcut-mcp.json +43 -0
  101. package/reports/supabase-mcp-server-supabase.json +43 -0
  102. package/reports/tavily-mcp.json +79 -0
  103. package/reports/thelord-mcp-server-docker-npx.json +43 -0
  104. package/reports/tyk-technologies-api-to-mcp.json +43 -0
  105. package/reports/tyk-technologies-tyk-dashboard-mcp.json +43 -0
  106. package/reports/ui5-mcp-server.json +157 -0
  107. package/reports/upstash-context7-mcp.json +82 -0
  108. package/reports/vantasdk-vanta-mcp-server.json +43 -0
  109. package/reports/winor30-mcp-server-datadog.json +43 -0
  110. package/reports/wonderwhy-er-desktop-commander.json +43 -0
  111. package/reports/xzxzzx-bilibili-mcp.json +58 -0
  112. package/src/grader.mjs +66 -0
  113. package/src/index.mjs +108 -0
  114. package/src/reporter.mjs +158 -0
  115. package/src/rules.mjs +363 -0
  116. package/src/scanner.mjs +208 -0
package/reports/jsonresume-mcp.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:03:05.164Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mapbox-mcp-server.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:16:51.125Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mcp-framework.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:07:41.453Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mcp-from-openapi.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T19:43:20.630Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mcp-handler.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T19:57:41.611Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mcp-proxy.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T19:58:06.661Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mcp-server-docker.json ADDED
@@ -0,0 +1,59 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:08:55.555Z",
7
+ "server": {
8
+ "name": "mcp-server-docker",
9
+ "version": "1.0.0"
10
+ },
11
+ "toolCount": 1,
12
+ "grade": {
13
+ "overall": "D",
14
+ "score": 52,
15
+ "categories": {
16
+ "permissions": "B",
17
+ "validation": "A",
18
+ "auth": "B"
19
+ }
20
+ },
21
+ "summary": {
22
+ "CRITICAL": 1,
23
+ "HIGH": 1,
24
+ "MEDIUM": 1,
25
+ "LOW": 0,
26
+ "INFO": 0
27
+ },
28
+ "riskProfile": {
29
+ "read_only": 0,
30
+ "mutation": 0,
31
+ "destructive": 0,
32
+ "execution": 1,
33
+ "privilege": 0,
34
+ "financial": 0
35
+ },
36
+ "findings": [
37
+ {
38
+ "category": "permissions",
39
+ "severity": "CRITICAL",
40
+ "tool": "run_command",
41
+ "rule": "dangerous_tool_execution",
42
+ "detail": "Tool \"run_command\" classified as execution — requires permission controls"
43
+ },
44
+ {
45
+ "category": "validation",
46
+ "severity": "MEDIUM",
47
+ "tool": "run_command",
48
+ "rule": "unbounded_strings",
49
+ "detail": "String parameters without length limits or pattern validation in tool \"run_command\""
50
+ },
51
+ {
52
+ "category": "auth",
53
+ "severity": "HIGH",
54
+ "tool": "*",
55
+ "rule": "no_auth_tools",
56
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
57
+ }
58
+ ]
59
+ }
package/reports/mcp-server-github-gist.json ADDED
@@ -0,0 +1,108 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:08:57.939Z",
7
+ "server": {
8
+ "name": "mcp-server-github-gist",
9
+ "version": "0.1.0"
10
+ },
11
+ "toolCount": 8,
12
+ "grade": {
13
+ "overall": "F",
14
+ "score": 16,
15
+ "categories": {
16
+ "permissions": "B",
17
+ "validation": "D",
18
+ "auth": "B"
19
+ }
20
+ },
21
+ "summary": {
22
+ "CRITICAL": 0,
23
+ "HIGH": 2,
24
+ "MEDIUM": 6,
25
+ "LOW": 2,
26
+ "INFO": 0
27
+ },
28
+ "riskProfile": {
29
+ "read_only": 0,
30
+ "mutation": 0,
31
+ "destructive": 1,
32
+ "execution": 0,
33
+ "privilege": 0,
34
+ "financial": 0
35
+ },
36
+ "findings": [
37
+ {
38
+ "category": "permissions",
39
+ "severity": "HIGH",
40
+ "tool": "gist_delete",
41
+ "rule": "dangerous_tool_destructive",
42
+ "detail": "Tool \"gist_delete\" classified as destructive — requires permission controls"
43
+ },
44
+ {
45
+ "category": "validation",
46
+ "severity": "LOW",
47
+ "tool": "gist_list",
48
+ "rule": "no_required_fields",
49
+ "detail": "No required fields — all input is optional in tool \"gist_list\""
50
+ },
51
+ {
52
+ "category": "validation",
53
+ "severity": "MEDIUM",
54
+ "tool": "gist_get",
55
+ "rule": "unbounded_strings",
56
+ "detail": "String parameters without length limits or pattern validation in tool \"gist_get\""
57
+ },
58
+ {
59
+ "category": "validation",
60
+ "severity": "MEDIUM",
61
+ "tool": "gist_create",
62
+ "rule": "unbounded_strings",
63
+ "detail": "String parameters without length limits or pattern validation in tool \"gist_create\""
64
+ },
65
+ {
66
+ "category": "validation",
67
+ "severity": "MEDIUM",
68
+ "tool": "gist_update",
69
+ "rule": "unbounded_strings",
70
+ "detail": "String parameters without length limits or pattern validation in tool \"gist_update\""
71
+ },
72
+ {
73
+ "category": "validation",
74
+ "severity": "MEDIUM",
75
+ "tool": "gist_delete",
76
+ "rule": "unbounded_strings",
77
+ "detail": "String parameters without length limits or pattern validation in tool \"gist_delete\""
78
+ },
79
+ {
80
+ "category": "validation",
81
+ "severity": "LOW",
82
+ "tool": "gist_starred",
83
+ "rule": "no_required_fields",
84
+ "detail": "No required fields — all input is optional in tool \"gist_starred\""
85
+ },
86
+ {
87
+ "category": "validation",
88
+ "severity": "MEDIUM",
89
+ "tool": "gist_star",
90
+ "rule": "unbounded_strings",
91
+ "detail": "String parameters without length limits or pattern validation in tool \"gist_star\""
92
+ },
93
+ {
94
+ "category": "validation",
95
+ "severity": "MEDIUM",
96
+ "tool": "gist_unstar",
97
+ "rule": "unbounded_strings",
98
+ "detail": "String parameters without length limits or pattern validation in tool \"gist_unstar\""
99
+ },
100
+ {
101
+ "category": "auth",
102
+ "severity": "HIGH",
103
+ "tool": "*",
104
+ "rule": "no_auth_tools",
105
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
106
+ }
107
+ ]
108
+ }
package/reports/mcp-server-google-calendar.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:09:22.985Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mcp-server-jira-cloud.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:21:22.381Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }
package/reports/mcp-server-kubernetes.json ADDED
@@ -0,0 +1,43 @@
1
+ {
2
+ "scanner": {
3
+ "name": "agentsid-scanner",
4
+ "version": "0.1.0"
5
+ },
6
+ "scannedAt": "2026-03-29T18:18:38.656Z",
7
+ "server": {
8
+ "name": "unknown",
9
+ "version": "?"
10
+ },
11
+ "toolCount": 0,
12
+ "grade": {
13
+ "overall": "B",
14
+ "score": 85,
15
+ "categories": {
16
+ "auth": "B"
17
+ }
18
+ },
19
+ "summary": {
20
+ "CRITICAL": 0,
21
+ "HIGH": 1,
22
+ "MEDIUM": 0,
23
+ "LOW": 0,
24
+ "INFO": 0
25
+ },
26
+ "riskProfile": {
27
+ "read_only": 0,
28
+ "mutation": 0,
29
+ "destructive": 0,
30
+ "execution": 0,
31
+ "privilege": 0,
32
+ "financial": 0
33
+ },
34
+ "findings": [
35
+ {
36
+ "category": "auth",
37
+ "severity": "HIGH",
38
+ "tool": "*",
39
+ "rule": "no_auth_tools",
40
+ "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
41
+ }
42
+ ]
43
+ }