@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/docs/public-guidance-crosswalk.md

@@ -0,0 +1,48 @@
+# Public Guidance Crosswalk For MCP Security Audits
+
+MCP Observatory maps MCP server evidence to public security guidance so security teams can review agent tool dependencies with familiar language.
+
+This crosswalk is not a certification, endorsement, authorization to operate, or claim of compliance with any government program. It is a practical mapping from MCP Observatory checks to public guidance themes.
+
+## Sources
+
+Primary public sources used for this crosswalk:
+
+- NSA, **Model Context Protocol (MCP): Security Design Considerations for Organizations Adopting MCP** (May 2026)
+- NSA and partners, **Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems** (April 2024)
+- NSA, NCSC-UK, CISA, and partners, **Guidelines for Secure AI System Development** (November 2023)
+- CISA and partners, **Careful Adoption of Agentic AI Services** (May 2026)
+- NIST, **AI Risk Management Framework 1.0** and **Generative AI Profile NIST AI 600-1**
+- OMB, **M-25-21 Accelerating Federal Use of AI through Innovation, Governance, and Public Trust**
+- OMB, **M-25-22 Driving Efficient Acquisition of Artificial Intelligence in Government**
+
+## Crosswalk
+
+| MCP Observatory control | What Observatory checks | Public guidance theme | Audit evidence |
+|---|---|---|---|
+| `trust_boundaries` | Whether a server exposes risky tools, prompt/resource surfaces, or agent-steering metadata without clear boundaries. | Agentic AI systems need explicit governance, accountability, and threat-model-aware deployment. | Tool inventory, attack simulation findings, profile trust status. |
+| `tool_permissions` | Command, filesystem, browser, network, database, secrets, and broad destructive tool surfaces. | MCP servers create new execution and permission boundaries that should be constrained and reviewed. | Security findings, permission-boundary findings, schema evidence. |
+| `tool_description_integrity` | Hidden instructions, unsafe autonomous behavior, exfiltration language, and tool poisoning patterns in metadata. | AI system components should be secure by design and resistant to manipulation across the lifecycle. | Attack simulator findings with evidence excerpts. |
+| `authentication` | Missing authentication on HTTP targets and target-level auth configuration gaps. | AI services and integrations should enforce identity and access controls appropriate to deployment context. | Target config evidence, normalized finding `mcp-observatory/security/no-auth-http`. |
+| `secrets_exposure` | Secret-like environment variables and credential-like tool output. | Sensitive data used by AI systems needs protection throughout collection, processing, storage, and operation. | Redacted env-var evidence, canary/credential findings, SARIF results. |
+| `schema_validation` | Weak, missing, broad, or permissive schemas and contract drift. | AI system inputs and interfaces should be validated, monitored, and constrained. | Schema quality findings, lock/diff evidence, contract-drift findings. |
+| `input_validation` | Arbitrary command/code/file/path parameters and unconstrained additional properties. | Secure development guidance emphasizes input validation and least privilege. | Security findings and SARIF rule metadata. |
+| `auditability` | Whether audit logging, structured event output, and review artifacts are present. | Government and enterprise adoption needs traceability, monitoring, and evidence for risk management. | Markdown report, JSON report, SARIF, CI artifacts, score JSON. |
+| `runtime_safety` | Startup reliability, conformance, safe tool invocation behavior, and high-risk runtime boundaries. | Secure deployment guidance emphasizes resilient operation, monitoring, incident response, and recovery. | Run artifacts, check statuses, fatal errors, performance evidence. |
+| `supply_chain` | Added destructive tools, broadened schemas, removed required fields, and future dependency indicators. | AI systems inherit software supply-chain risk and need continuous review of updates. | Drift findings, lock files, repeatable CI gates. |
+
+## Why This Matters For MCP
+
+MCP servers are not just libraries. They are agent-facing tool endpoints. A server can expose command execution, filesystem access, browser automation, database operations, cloud APIs, or internal business workflows through tool descriptions and schemas. That makes MCP server review a practical release-gate problem.
+
+MCP Observatory turns that review into:
+
+- one command a maintainer can run locally
+- normalized findings a security reviewer can triage
+- SARIF results GitHub Code Scanning can display
+- trust status JSON a CI gate or badge generator can consume
+- repeatable evidence for remediation tracking
+
+## Review Boundary
+
+MCP Observatory does not prove semantic safety and does not replace human authorization decisions. A passing audit means the tested target produced reproducible evidence for the mapped checks under the tested command and profile.

package/docs/receipt-graph.md

@@ -0,0 +1,54 @@
+# MCP Receipt Graph
+
+Agent trust should be a receipt graph, not a follower graph.
+
+A social graph says who is popular. A receipt graph says what was verified, what could not happen during the run, which artifact can be rerun, and what changed since the last trusted state.
+
+Use this page as the first public map from MCP servers to reproducible evidence. It is intentionally small: a receipt graph should start with high-quality, rerunnable receipts before it tries to become a giant directory.
+
+## Receipt Graph Fields
+
+| Field | Meaning |
+| --- | --- |
+| Server | Public MCP server, package, or repo. |
+| Receipt | JSON/Markdown evidence generated by MCP Observatory. |
+| Attack evidence | Safe `attack-sim` command, report, or SARIF. |
+| CI/SARIF path | Whether the next step is a maintainer CI gate, Code Scanning, or both. |
+| Capability envelope | What the run was allowed to access. |
+| Last verified | Timestamp of the latest public Safety Index refresh. |
+
+## Seed Graph
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Capability envelope | Last verified |
+| --- | --- | --- | --- | --- | --- |
+| [Official everything server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | `attack-sim npx -y @modelcontextprotocol/server-everything` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
+| [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | `attack-sim npx -y @modelcontextprotocol/server-sequential-thinking` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
+| [Official memory server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | `attack-sim npx -y @modelcontextprotocol/server-memory` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
+| [Context7](https://github.com/upstash/context7) | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | `attack-sim npx -y @upstash/context7-mcp` | Maintainer CI conversation candidate. | Public package, no secrets, no production data. | 2026-07-06 |
+| [BrowserMCP](https://github.com/BrowserMCP/mcp) | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | `attack-sim npx -y @browsermcp/mcp` | Browser boundary candidate for CI/SARIF. | Public package, no secrets, no production credentials. | 2026-07-06 |
+| [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | `attack-sim npx -y @playwright/mcp` | High-capability browser boundary; Code Scanning useful. | Public package, no secrets, no production credentials. | 2026-07-06 |
+| [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | `attack-sim npx -y puppeteer-mcp-server` | Browser boundary candidate for review before production. | Public package, no secrets, no production credentials. | 2026-07-06 |
+| [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | `attack-sim npx -y @opentofu/opentofu-mcp-server` | Infrastructure tool surface; CI/SARIF recommended. | Public package, no secrets, no production infrastructure. | 2026-07-06 |
+| [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | [attack-sim](./safety-index/artifacts/kubernetes-server.attack.md) / [SARIF](./safety-index/artifacts/kubernetes-server.attack.sarif) | Kubernetes command and cluster mutation boundary; CI/SARIF recommended before agent dependency. | Public package, no secrets, no kubeconfig, no cluster tool invocation. | 2026-07-06 |
+
+## How To Add A Node
+
+1. Open a [Drop an MCP server, get a receipt request](https://github.com/KryptosAI/mcp-observatory/issues/new?template=tool-call-receipt-request.yml).
+2. Provide a public MCP server and safe startup command.
+3. Run:
+
+```bash
+npx @kryptosai/mcp-observatory test <safe startup command> --json run-artifact.json --markdown run-report.md
+npx @kryptosai/mcp-observatory attack-sim <safe startup command> --json attack-artifact.json --output attack-report.md --sarif attack-results.sarif
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif
+```
+
+4. Attach sanitized artifacts or open a focused PR.
+
+## Agent-Native Ask
+
+```text
+Name one MCP server your agent depends on. I will help turn it into a reproducible receipt: safe startup command, run artifact, attack-sim evidence, SARIF, and a CI gate maintainers can review.
+```
+
+For the public intake loop, see [Drop an MCP server, get a receipt](./drop-server-get-receipt.md) or comment on [the live GitHub thread](https://github.com/KryptosAI/mcp-observatory/issues/146).

package/docs/safety-index/artifacts/antv-chart-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "pass",
-  "runId": "run_2026-06-24T020741323Z_41a77db3",
-  "createdAt": "2026-06-24T02:07:41.323Z",
-  "toolVersion": "0.24.0",
+  "runId": "run_2026-07-06T194957048Z_8266b9f7",
+  "createdAt": "2026-07-06T19:49:57.048Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "antv-chart-server",
     "adapter": "local-process",
@@ -29,8 +29,8 @@
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 5,
+    "total": 8,
+    "pass": 6,
     "fail": 0,
     "partial": 0,
     "unsupported": 2,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 2.671415999997407,
+      "durationMs": 1.708875000000262,
       "message": "Advertised capability responded with the minimal expected shape (27 items).",
       "evidence": [
         {
@@ -82,9 +82,9 @@
             "generate_spreadsheet"
           ],
           "diagnostics": [
-            "[MCP-Server-Chart] 2026-06-24T02:07:44.865Z ℹ️  setting up tool handlers...",
-            "[MCP-Server-Chart] 2026-06-24T02:07:44.867Z ℹ️  tool handlers set up",
-            "[MCP-Server-Chart] 2026-06-24T02:07:44.868Z ✅ Stdio MCP Server started"
+            "[MCP-Server-Chart] 2026-07-06T19:49:57.931Z ℹ️  setting up tool handlers...",
+            "[MCP-Server-Chart] 2026-07-06T19:49:57.932Z ℹ️  tool handlers set up",
+            "[MCP-Server-Chart] 2026-07-06T19:49:57.933Z ✅ Stdio MCP Server started"
           ],
           "schemas": {
             "generate_area_chart": {
@@ -2602,7 +2602,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "unsupported",
-      "durationMs": 0.0014999999984866008,
+      "durationMs": 0.0007079999995767139,
       "message": "Prompts are not advertised by the target.",
       "evidence": [
         {
@@ -2618,7 +2618,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "unsupported",
-      "durationMs": 0.002874999998311978,
+      "durationMs": 0.0027079999999841675,
       "message": "Resources are not advertised by the target.",
       "evidence": [
         {
@@ -2634,7 +2634,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.12066699999923003,
+      "durationMs": 0.07125000000087311,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -2650,7 +2650,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 2.8167500000017753,
+      "durationMs": 1.3637920000001031,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -2676,7 +2676,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "pass",
-      "durationMs": 1.4510000000009313,
+      "durationMs": 2.7793340000007447,
       "message": "All 27 item(s) have good schema quality.",
       "evidence": [
         {
@@ -2693,7 +2693,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 1.5284999999967113,
+      "durationMs": 0.9060420000005251,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -2704,6 +2704,23 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "pass",
+      "durationMs": 1.896708000000217,
+      "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 0,
+          "identifiers": []
+        }
+      ]
     }
   ],
   "healthScore": {
@@ -2732,7 +2749,8 @@
         "score": 100,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: pass (100/100)"
         ]
       },
       {
@@ -2750,16 +2768,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 3548ms",
-          "p95 latency: 3ms (3 operations)"
+          "Connect: 887ms",
+          "p95 latency: 2ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 3548.425417000002,
-    "toolsListMs": 2.671415999997407,
-    "promptsListMs": 0.0014999999984866008,
-    "resourcesListMs": 0.002874999998311978
+    "connectMs": 887.4375419999997,
+    "toolsListMs": 1.708875000000262,
+    "promptsListMs": 0.0007079999995767139,
+    "resourcesListMs": 0.0027079999999841675
   }
 }

package/docs/safety-index/artifacts/antv-chart-server.md

@@ -1,6 +1,6 @@
 # MCP Observatory Run Report
 
-Generated at 2026-06-24T02:07:41.323Z
+Generated at 2026-07-06T19:49:57.048Z
 
 ## Target and Environment Metadata
 
@@ -25,7 +25,7 @@ Generated at 2026-06-24T02:07:41.323Z
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| pass | 7 | 5 | 0 | 0 | 2 | 0 | 0 |
+| pass | 8 | 6 | 0 | 0 | 2 | 0 | 0 |
 
 ## At a Glance
 
@@ -47,16 +47,29 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
-| healthy | conformance | pass | 2.82 | All 7 conformance checks passed. |
-| healthy | schema-quality | pass | 1.45 | All 27 item(s) have good schema quality. |
-| healthy | security | pass | 1.53 | No security issues detected. |
-| healthy | security-lite | pass | 0.12 | No security issues detected (lightweight scan). |
-| healthy | tools | pass | 2.67 | Advertised capability responded with the minimal expected shape (27 items). |
+| healthy | attack-sim | pass | 1.90 | Safe attack simulation found no high-risk MCP attack-readiness findings. |
+| healthy | conformance | pass | 1.36 | All 7 conformance checks passed. |
+| healthy | schema-quality | pass | 2.78 | All 27 item(s) have good schema quality. |
+| healthy | security | pass | 0.91 | No security issues detected. |
+| healthy | security-lite | pass | 0.07 | No security issues detected (lightweight scan). |
+| healthy | tools | pass | 1.71 | Advertised capability responded with the minimal expected shape (27 items). |
 | confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
 | confirm intent | resources | unsupported | 0.00 | Resources are not advertised by the target. |
 
 ## Evidence Snippets
 
+### attack-sim — pass
+
+Summary: Safe attack simulation found no high-risk MCP attack-readiness findings.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
 ### conformance — pass
 
 Summary: All 7 conformance checks passed.
@@ -115,7 +128,7 @@ Summary: Advertised capability responded with the minimal expected shape (27 ite
   - Minimal shape present: `true`
   - Item count: `27`
   - Identifiers: generate_area_chart, generate_bar_chart, generate_boxplot_chart, generate_column_chart, generate_district_map (+22 more)
-  - Diagnostics: [MCP-Server-Chart] 2026-06-24T02:07:44.865Z ℹ️  setting up tool handlers..., [MCP-Server-Chart] 2026-06-24T02:07:44.867Z ℹ️  tool handlers set up, [MCP-Server-Chart] 2026-06-24T02:07:44.868Z ✅ Stdio MCP Server started
+  - Diagnostics: [MCP-Server-Chart] 2026-07-06T19:49:57.931Z ℹ️  setting up tool handlers..., [MCP-Server-Chart] 2026-07-06T19:49:57.932Z ℹ️  tool handlers set up, [MCP-Server-Chart] 2026-07-06T19:49:57.933Z ✅ Stdio MCP Server started
 
 ### prompts — unsupported
 
@@ -152,5 +165,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-06-24T020741323Z_41a77db3`
+- Run ID: `run_2026-07-06T194957048Z_8266b9f7`
 - Gate: `pass`

package/docs/safety-index/artifacts/browsermcp-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "pass",
-  "runId": "run_2026-06-24T020731112Z_2e7853f8",
-  "createdAt": "2026-06-24T02:07:31.112Z",
-  "toolVersion": "0.24.0",
+  "runId": "run_2026-07-06T194954693Z_39638a36",
+  "createdAt": "2026-07-06T19:49:54.694Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "browsermcp-server",
     "adapter": "local-process",
@@ -29,8 +29,8 @@
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 6,
+    "total": 8,
+    "pass": 7,
     "fail": 0,
     "partial": 0,
     "unsupported": 1,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 1.2612079999998969,
+      "durationMs": 0.8151659999984986,
       "message": "Advertised capability responded with the minimal expected shape (12 items).",
       "evidence": [
         {
@@ -242,7 +242,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "unsupported",
-      "durationMs": 0.0015829999993002275,
+      "durationMs": 0.0005419999997684499,
       "message": "Prompts are not advertised by the target.",
       "evidence": [
         {
@@ -258,7 +258,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "pass",
-      "durationMs": 0.675042000000758,
+      "durationMs": 0.4444999999996071,
       "message": "Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported.",
       "evidence": [
         {
@@ -285,7 +285,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.03508300000066811,
+      "durationMs": 0.025958000000173342,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -301,7 +301,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 2.116834000000381,
+      "durationMs": 1.574958000001061,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -327,7 +327,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "pass",
-      "durationMs": 0.5424579999998969,
+      "durationMs": 0.36616700000013225,
       "message": "All 12 item(s) have good schema quality.",
       "evidence": [
         {
@@ -344,7 +344,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.24799999999959255,
+      "durationMs": 0.15450000000055297,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -355,6 +355,23 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "pass",
+      "durationMs": 0.5073330000013812,
+      "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 0,
+          "identifiers": []
+        }
+      ]
     }
   ],
   "healthScore": {
@@ -383,7 +400,8 @@
         "score": 100,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: pass (100/100)"
         ]
       },
       {
@@ -401,16 +419,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 903ms",
+          "Connect: 652ms",
           "p95 latency: 1ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 902.8017089999994,
-    "toolsListMs": 1.2612079999998969,
-    "promptsListMs": 0.0015829999993002275,
-    "resourcesListMs": 0.675042000000758
+    "connectMs": 651.8255829999998,
+    "toolsListMs": 0.8151659999984986,
+    "promptsListMs": 0.0005419999997684499,
+    "resourcesListMs": 0.4444999999996071
   }
 }

package/docs/safety-index/artifacts/browsermcp-server.md

@@ -1,6 +1,6 @@
 # MCP Observatory Run Report
 
-Generated at 2026-06-24T02:07:31.112Z
+Generated at 2026-07-06T19:49:54.694Z
 
 ## Target and Environment Metadata
 
@@ -25,7 +25,7 @@ Generated at 2026-06-24T02:07:31.112Z
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| pass | 7 | 6 | 0 | 0 | 1 | 0 | 0 |
+| pass | 8 | 7 | 0 | 0 | 1 | 0 | 0 |
 
 ## At a Glance
 
@@ -47,16 +47,29 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
-| healthy | conformance | pass | 2.12 | All 7 conformance checks passed. |
-| healthy | resources | pass | 0.68 | Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported. |
-| healthy | schema-quality | pass | 0.54 | All 12 item(s) have good schema quality. |
-| healthy | security | pass | 0.25 | No security issues detected. |
-| healthy | security-lite | pass | 0.04 | No security issues detected (lightweight scan). |
-| healthy | tools | pass | 1.26 | Advertised capability responded with the minimal expected shape (12 items). |
+| healthy | attack-sim | pass | 0.51 | Safe attack simulation found no high-risk MCP attack-readiness findings. |
+| healthy | conformance | pass | 1.57 | All 7 conformance checks passed. |
+| healthy | resources | pass | 0.44 | Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported. |
+| healthy | schema-quality | pass | 0.37 | All 12 item(s) have good schema quality. |
+| healthy | security | pass | 0.15 | No security issues detected. |
+| healthy | security-lite | pass | 0.03 | No security issues detected (lightweight scan). |
+| healthy | tools | pass | 0.82 | Advertised capability responded with the minimal expected shape (12 items). |
 | confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
 
 ## Evidence Snippets
 
+### attack-sim — pass
+
+Summary: Safe attack simulation found no high-risk MCP attack-readiness findings.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
 ### conformance — pass
 
 Summary: All 7 conformance checks passed.
@@ -159,5 +172,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-06-24T020731112Z_2e7853f8`
+- Run ID: `run_2026-07-06T194954693Z_39638a36`
 - Gate: `pass`