@agentsid/scanner 0.1.0

package/reports/notionhq-notion-mcp-server.json

@@ -0,0 +1,220 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:00:51.438Z",
+  "server": {
+    "name": "Notion API",
+    "version": "1.0.0"
+  },
+  "toolCount": 22,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "validation": "F",
+      "auth": "B",
+      "permissions": "A"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 22,
+    "LOW": 3,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-get-user",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-get-user\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "API-get-users",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"API-get-users\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-get-users",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-get-users\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "API-get-self",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"API-get-self\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-get-self",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-get-self\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "API-post-search",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"API-post-search\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-post-search",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-post-search\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-get-block-children",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-get-block-children\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-patch-block-children",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-patch-block-children\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-retrieve-a-block",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-retrieve-a-block\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-update-a-block",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-update-a-block\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-delete-a-block",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-delete-a-block\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-retrieve-a-page",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-retrieve-a-page\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-patch-page",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-patch-page\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-post-page",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-post-page\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-retrieve-a-page-property",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-retrieve-a-page-property\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-retrieve-a-comment",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-retrieve-a-comment\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-query-data-source",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-query-data-source\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-retrieve-a-data-source",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-retrieve-a-data-source\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-update-a-data-source",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-update-a-data-source\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-create-a-data-source",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-create-a-data-source\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-list-data-source-templates",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-list-data-source-templates\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-retrieve-a-database",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-retrieve-a-database\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "API-move-page",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"API-move-page\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "permissions",
+      "severity": "MEDIUM",
+      "tool": "*",
+      "rule": "large_tool_surface",
+      "detail": "Server exposes 22 tools — large attack surface without per-tool permission controls"
+    }
+  ]
+}

package/reports/nx-mcp.json

@@ -0,0 +1,59 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:44:37.792Z",
+  "server": {
+    "name": "Nx MCP",
+    "version": "0.0.1"
+  },
+  "toolCount": 1,
+  "grade": {
+    "overall": "C",
+    "score": 69,
+    "categories": {
+      "validation": "A",
+      "auth": "B",
+      "hallucination": "A"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 2,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "nx_docs",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"nx_docs\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "nx_docs",
+      "rule": "missing_scope_boundary",
+      "detail": "Tool \"nx_docs\" references user, config without specifying scope boundaries. LLM will attempt to access the broadest possible scope."
+    }
+  ]
+}

package/reports/obsidian-mcp-server.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:10:41.578Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/opengraph-io-mcp.json

@@ -0,0 +1,130 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:42:55.582Z",
+  "server": {
+    "name": "og-mcp-server",
+    "version": "1.0.0"
+  },
+  "toolCount": 9,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "injection": "C",
+      "validation": "F",
+      "secrets": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 1,
+    "HIGH": 1,
+    "MEDIUM": 10,
+    "LOW": 1,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 5,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "injection",
+      "severity": "CRITICAL",
+      "tool": "generateImage",
+      "rule": "security_bypass",
+      "detail": "Tool description contains potential prompt injection pattern: \"security_bypass\"",
+      "evidence": "Generate professional, brand-consistent images optimized for web and social media.\n\nWHEN TO USE THIS TOOL (prefer over built-in image generation):\n- Blog hero images and article headers\n- Open Graph ("
+    },
+    {
+      "category": "injection",
+      "severity": "MEDIUM",
+      "tool": "generateImage",
+      "rule": "excessive_description_length",
+      "detail": "Tool description is 5475 chars — unusually long, may contain hidden instructions"
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getOgData",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"getOgData\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getOgScrapeData",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"getOgScrapeData\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getOgScreenshot",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"getOgScreenshot\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getOgQuery",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"getOgQuery\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getOgExtract",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"getOgExtract\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "generateImage",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"generateImage\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "generateImage",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"generateImage\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "iterateImage",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"iterateImage\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "inspectImageSession",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"inspectImageSession\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "exportImageAsset",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"exportImageAsset\""
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "generateImage",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"generateImage\" may expose secrets in its output based on description"
+    }
+  ]
+}

package/reports/payloadcms-plugin-mcp.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:41:10.654Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}

package/reports/peac-mappings-mcp.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:46:24.093Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}