@agentsid/scanner 0.1.0

package/reports/aashari-mcp-server-atlassian-jira.json

@@ -0,0 +1,138 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:08:00.050Z",
+  "server": {
+    "name": "@aashari/mcp-server-atlassian-jira",
+    "version": "3.3.0"
+  },
+  "toolCount": 5,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "injection": "B",
+      "permissions": "B",
+      "validation": "C",
+      "auth": "B",
+      "secrets": "F"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 7,
+    "MEDIUM": 7,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 1,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "injection",
+      "severity": "MEDIUM",
+      "tool": "jira_get",
+      "rule": "excessive_description_length",
+      "detail": "Tool description is 1814 chars — unusually long, may contain hidden instructions"
+    },
+    {
+      "category": "injection",
+      "severity": "MEDIUM",
+      "tool": "jira_post",
+      "rule": "excessive_description_length",
+      "detail": "Tool description is 1423 chars — unusually long, may contain hidden instructions"
+    },
+    {
+      "category": "permissions",
+      "severity": "HIGH",
+      "tool": "jira_delete",
+      "rule": "dangerous_tool_destructive",
+      "detail": "Tool \"jira_delete\" classified as destructive — requires permission controls"
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "jira_get",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"jira_get\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "jira_post",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"jira_post\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "jira_put",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"jira_put\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "jira_patch",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"jira_patch\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "jira_delete",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"jira_delete\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "jira_get",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"jira_get\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "jira_post",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"jira_post\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "jira_put",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"jira_put\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "jira_patch",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"jira_patch\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "jira_delete",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"jira_delete\" may expose secrets in its output based on description"
+    }
+  ]
+}

package/reports/aashari-mcp-server-aws-sso.json

@@ -0,0 +1,122 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:08:27.250Z",
+  "server": {
+    "name": "@aashari/mcp-server-aws-sso",
+    "version": "4.0.0"
+  },
+  "toolCount": 5,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "injection": "A",
+      "validation": "D",
+      "secrets": "D"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 4,
+    "MEDIUM": 5,
+    "LOW": 3,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "injection",
+      "severity": "MEDIUM",
+      "tool": "aws_sso_login",
+      "rule": "excessive_description_length",
+      "detail": "Tool description is 1024 chars — unusually long, may contain hidden instructions"
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "aws_sso_login",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"aws_sso_login\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "aws_sso_status",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"aws_sso_status\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "aws_sso_status",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"aws_sso_status\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "aws_sso_ls_accounts",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"aws_sso_ls_accounts\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "aws_sso_ls_accounts",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"aws_sso_ls_accounts\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "aws_sso_exec_command",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"aws_sso_exec_command\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "aws_sso_ec2_exec_command",
+      "rule": "unbounded_strings",
+      "detail": "String parameters without length limits or pattern validation in tool \"aws_sso_ec2_exec_command\""
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "aws_sso_login",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"aws_sso_login\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "aws_sso_status",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"aws_sso_status\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "aws_sso_exec_command",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"aws_sso_exec_command\" may expose secrets in its output based on description"
+    },
+    {
+      "category": "secrets",
+      "severity": "HIGH",
+      "tool": "aws_sso_ec2_exec_command",
+      "rule": "potential_secret_exposure",
+      "detail": "Tool \"aws_sso_ec2_exec_command\" may expose secrets in its output based on description"
+    }
+  ]
+}

package/reports/agentdeskai-browser-tools-mcp.json

@@ -0,0 +1,361 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T19:47:24.655Z",
+  "server": {
+    "name": "Browser Tools MCP",
+    "version": "1.2.0"
+  },
+  "toolCount": 14,
+  "grade": {
+    "overall": "F",
+    "score": 0,
+    "categories": {
+      "permissions": "F",
+      "validation": "F",
+      "auth": "B",
+      "hallucination": "F"
+    }
+  },
+  "summary": {
+    "CRITICAL": 7,
+    "HIGH": 3,
+    "MEDIUM": 22,
+    "LOW": 14,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 5,
+    "mutation": 0,
+    "destructive": 1,
+    "execution": 7,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "permissions",
+      "severity": "HIGH",
+      "tool": "wipeLogs",
+      "rule": "dangerous_tool_destructive",
+      "detail": "Tool \"wipeLogs\" classified as destructive — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "CRITICAL",
+      "tool": "runAccessibilityAudit",
+      "rule": "dangerous_tool_execution",
+      "detail": "Tool \"runAccessibilityAudit\" classified as execution — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "CRITICAL",
+      "tool": "runPerformanceAudit",
+      "rule": "dangerous_tool_execution",
+      "detail": "Tool \"runPerformanceAudit\" classified as execution — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "CRITICAL",
+      "tool": "runSEOAudit",
+      "rule": "dangerous_tool_execution",
+      "detail": "Tool \"runSEOAudit\" classified as execution — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "CRITICAL",
+      "tool": "runNextJSAudit",
+      "rule": "dangerous_tool_execution",
+      "detail": "Tool \"runNextJSAudit\" classified as execution — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "CRITICAL",
+      "tool": "runDebuggerMode",
+      "rule": "dangerous_tool_execution",
+      "detail": "Tool \"runDebuggerMode\" classified as execution — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "CRITICAL",
+      "tool": "runAuditMode",
+      "rule": "dangerous_tool_execution",
+      "detail": "Tool \"runAuditMode\" classified as execution — requires permission controls"
+    },
+    {
+      "category": "permissions",
+      "severity": "CRITICAL",
+      "tool": "runBestPracticesAudit",
+      "rule": "dangerous_tool_execution",
+      "detail": "Tool \"runBestPracticesAudit\" classified as execution — requires permission controls"
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getConsoleLogs",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"getConsoleLogs\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "getConsoleLogs",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"getConsoleLogs\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getConsoleErrors",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"getConsoleErrors\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "getConsoleErrors",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"getConsoleErrors\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getNetworkErrors",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"getNetworkErrors\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "getNetworkErrors",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"getNetworkErrors\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getNetworkLogs",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"getNetworkLogs\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "getNetworkLogs",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"getNetworkLogs\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "takeScreenshot",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"takeScreenshot\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "takeScreenshot",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"takeScreenshot\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "getSelectedElement",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"getSelectedElement\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "getSelectedElement",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"getSelectedElement\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "wipeLogs",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"wipeLogs\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "wipeLogs",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"wipeLogs\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "runAccessibilityAudit",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"runAccessibilityAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "runAccessibilityAudit",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"runAccessibilityAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "runPerformanceAudit",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"runPerformanceAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "runPerformanceAudit",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"runPerformanceAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "runSEOAudit",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"runSEOAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "runSEOAudit",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"runSEOAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "runNextJSAudit",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"runNextJSAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "runNextJSAudit",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"runNextJSAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "runDebuggerMode",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"runDebuggerMode\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "runDebuggerMode",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"runDebuggerMode\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "runAuditMode",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"runAuditMode\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "runAuditMode",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"runAuditMode\""
+    },
+    {
+      "category": "validation",
+      "severity": "MEDIUM",
+      "tool": "runBestPracticesAudit",
+      "rule": "empty_schema",
+      "detail": "Schema defined but no properties specified in tool \"runBestPracticesAudit\""
+    },
+    {
+      "category": "validation",
+      "severity": "LOW",
+      "tool": "runBestPracticesAudit",
+      "rule": "no_required_fields",
+      "detail": "No required fields — all input is optional in tool \"runBestPracticesAudit\""
+    },
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "getNetworkErrors",
+      "rule": "missing_scope_boundary",
+      "detail": "Tool \"getNetworkErrors\" references network without specifying scope boundaries. LLM will attempt to access the broadest possible scope."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "getNetworkLogs",
+      "rule": "missing_scope_boundary",
+      "detail": "Tool \"getNetworkLogs\" references network without specifying scope boundaries. LLM will attempt to access the broadest possible scope."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "runAccessibilityAudit",
+      "rule": "vague_description_over_privilege",
+      "detail": "Tool \"runAccessibilityAudit\" uses vague action words (run, access) without specific operations. LLMs will interpret this as the broadest possible action."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "runPerformanceAudit",
+      "rule": "vague_description_over_privilege",
+      "detail": "Tool \"runPerformanceAudit\" uses vague action words (perform, run) without specific operations. LLMs will interpret this as the broadest possible action."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "runSEOAudit",
+      "rule": "vague_description_over_privilege",
+      "detail": "Tool \"runSEOAudit\" uses vague action words (run) without specific operations. LLMs will interpret this as the broadest possible action."
+    },
+    {
+      "category": "hallucination",
+      "severity": "HIGH",
+      "tool": "runNextJSAudit",
+      "rule": "no_description",
+      "detail": "Tool \"runNextJSAudit\" has no description. LLM will infer behavior entirely from the name — unpredictable tool usage."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "runDebuggerMode",
+      "rule": "vague_description_over_privilege",
+      "detail": "Tool \"runDebuggerMode\" uses vague action words (run) without specific operations. LLMs will interpret this as the broadest possible action."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "runAuditMode",
+      "rule": "vague_description_over_privilege",
+      "detail": "Tool \"runAuditMode\" uses vague action words (perform, run, access) without specific operations. LLMs will interpret this as the broadest possible action."
+    },
+    {
+      "category": "hallucination",
+      "severity": "MEDIUM",
+      "tool": "runBestPracticesAudit",
+      "rule": "vague_description_over_privilege",
+      "detail": "Tool \"runBestPracticesAudit\" uses vague action words (run) without specific operations. LLMs will interpret this as the broadest possible action."
+    }
+  ]
+}

package/reports/ahmetkca-mcp-server-postgres.json

@@ -0,0 +1,43 @@
+{
+  "scanner": {
+    "name": "agentsid-scanner",
+    "version": "0.1.0"
+  },
+  "scannedAt": "2026-03-29T18:08:52.308Z",
+  "server": {
+    "name": "unknown",
+    "version": "?"
+  },
+  "toolCount": 0,
+  "grade": {
+    "overall": "B",
+    "score": 85,
+    "categories": {
+      "auth": "B"
+    }
+  },
+  "summary": {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 0,
+    "LOW": 0,
+    "INFO": 0
+  },
+  "riskProfile": {
+    "read_only": 0,
+    "mutation": 0,
+    "destructive": 0,
+    "execution": 0,
+    "privilege": 0,
+    "financial": 0
+  },
+  "findings": [
+    {
+      "category": "auth",
+      "severity": "HIGH",
+      "tool": "*",
+      "rule": "no_auth_tools",
+      "detail": "Server exposes no authentication-related tools — may accept unauthenticated connections"
+    }
+  ]
+}