@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/docs/safety-index/artifacts/opentofu-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "pass",
-  "runId": "run_2026-06-24T020729328Z_2a54782d",
-  "createdAt": "2026-06-24T02:07:29.328Z",
-  "toolVersion": "0.24.0",
+  "runId": "run_2026-07-06T194953212Z_e649da15",
+  "createdAt": "2026-07-06T19:49:53.212Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "opentofu-server",
     "adapter": "local-process",
@@ -29,8 +29,8 @@
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 5,
+    "total": 8,
+    "pass": 6,
     "fail": 0,
     "partial": 1,
     "unsupported": 1,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 2.47979099999975,
+      "durationMs": 1.897333000000799,
       "message": "Advertised capability responded with the minimal expected shape (5 items).",
       "evidence": [
         {
@@ -206,7 +206,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "unsupported",
-      "durationMs": 0.0038340000010066433,
+      "durationMs": 0.005124999999679858,
       "message": "Prompts are not advertised by the target.",
       "evidence": [
         {
@@ -222,7 +222,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "pass",
-      "durationMs": 1.4208330000001297,
+      "durationMs": 0.5354160000006232,
       "message": "Advertised capability responded with the minimal expected shape (1 items).",
       "evidence": [
         {
@@ -251,7 +251,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.03974999999991269,
+      "durationMs": 0.022249999999985448,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -267,7 +267,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 2.5802920000005543,
+      "durationMs": 0.7052499999990687,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -293,7 +293,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "partial",
-      "durationMs": 0.7996249999996508,
+      "durationMs": 0.49095800000031886,
       "message": "Found 1 quality finding(s) across 6 item(s): 1 warnings, 0 info.",
       "evidence": [
         {
@@ -307,6 +307,14 @@
           ],
           "diagnostics": [
             "[warning] resource \"opentofu-registry-info\": Missing description"
+          ],
+          "findings": [
+            {
+              "itemType": "resource",
+              "itemName": "opentofu-registry-info",
+              "issue": "Missing description",
+              "severity": "warning"
+            }
           ]
         }
       ]
@@ -315,7 +323,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.36629200000061246,
+      "durationMs": 0.15554200000042329,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -326,6 +334,23 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "pass",
+      "durationMs": 0.4453749999993306,
+      "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 0,
+          "identifiers": []
+        }
+      ]
     }
   ],
   "healthScore": {
@@ -354,7 +379,8 @@
         "score": 100,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: pass (100/100)"
         ]
       },
       {
@@ -372,16 +398,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 940ms",
+          "Connect: 773ms",
           "p95 latency: 2ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 940.4044579999991,
-    "toolsListMs": 2.47979099999975,
-    "promptsListMs": 0.0038340000010066433,
-    "resourcesListMs": 1.4208330000001297
+    "connectMs": 772.5637079999997,
+    "toolsListMs": 1.897333000000799,
+    "promptsListMs": 0.005124999999679858,
+    "resourcesListMs": 0.5354160000006232
   }
 }

package/docs/safety-index/artifacts/opentofu-server.md

@@ -1,6 +1,6 @@
 # MCP Observatory Run Report
 
-Generated at 2026-06-24T02:07:29.328Z
+Generated at 2026-07-06T19:49:53.212Z
 
 ## Target and Environment Metadata
 
@@ -25,7 +25,7 @@ Generated at 2026-06-24T02:07:29.328Z
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| pass | 7 | 5 | 0 | 1 | 1 | 0 | 0 |
+| pass | 8 | 6 | 0 | 1 | 1 | 0 | 0 |
 
 ## At a Glance
 
@@ -47,16 +47,29 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
-| healthy | conformance | pass | 2.58 | All 7 conformance checks passed. |
-| healthy | resources | pass | 1.42 | Advertised capability responded with the minimal expected shape (1 items). |
-| healthy | security | pass | 0.37 | No security issues detected. |
-| healthy | security-lite | pass | 0.04 | No security issues detected (lightweight scan). |
-| healthy | tools | pass | 2.48 | Advertised capability responded with the minimal expected shape (5 items). |
-| review | schema-quality | partial | 0.80 | Found 1 quality finding(s) across 6 item(s): 1 warnings, 0 info. |
-| confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
+| healthy | attack-sim | pass | 0.45 | Safe attack simulation found no high-risk MCP attack-readiness findings. |
+| healthy | conformance | pass | 0.71 | All 7 conformance checks passed. |
+| healthy | resources | pass | 0.54 | Advertised capability responded with the minimal expected shape (1 items). |
+| healthy | security | pass | 0.16 | No security issues detected. |
+| healthy | security-lite | pass | 0.02 | No security issues detected (lightweight scan). |
+| healthy | tools | pass | 1.90 | Advertised capability responded with the minimal expected shape (5 items). |
+| review | schema-quality | partial | 0.49 | Found 1 quality finding(s) across 6 item(s): 1 warnings, 0 info. |
+| confirm intent | prompts | unsupported | 0.01 | Prompts are not advertised by the target. |
 
 ## Evidence Snippets
 
+### attack-sim — pass
+
+Summary: Safe attack simulation found no high-risk MCP attack-readiness findings.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
 ### conformance — pass
 
 Summary: All 7 conformance checks passed.
@@ -159,5 +172,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-06-24T020729328Z_2a54782d`
+- Run ID: `run_2026-07-06T194953212Z_e649da15`
 - Gate: `pass`

package/docs/safety-index/artifacts/playwright-mcp-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "fail",
-  "runId": "run_2026-06-24T020732035Z_b86ac3a9",
-  "createdAt": "2026-06-24T02:07:32.035Z",
-  "toolVersion": "0.24.0",
+  "runId": "run_2026-07-06T194955359Z_d769bb31",
+  "createdAt": "2026-07-06T19:49:55.359Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "playwright-mcp-server",
     "adapter": "local-process",
@@ -22,16 +22,16 @@
       "whyItMatters": "Popular browser automation servers need explicit review around navigation, screenshots, and code evaluation."
     },
     "serverName": "Playwright",
-    "serverVersion": "1.61.0-alpha-1781023400000"
+    "serverVersion": "1.62.0-alpha-2026-06-29"
   },
   "environment": {
     "platform": "darwin 25.5.0",
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
+    "total": 8,
     "pass": 2,
-    "fail": 2,
+    "fail": 3,
     "partial": 1,
     "unsupported": 2,
     "flaky": 0,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 59.043541999999434,
+      "durationMs": 2.8597500000014406,
       "message": "Advertised capability responded with the minimal expected shape (23 items).",
       "evidence": [
         {
@@ -439,10 +439,20 @@
                 "fullPage": {
                   "description": "When true, takes a screenshot of the full scrollable page, instead of the currently visible viewport. Cannot be used with element screenshots.",
                   "type": "boolean"
+                },
+                "scale": {
+                  "default": "css",
+                  "description": "Image resolution scale. \"css\" produces a screenshot sized in CSS pixels (smaller, consistent across devices). \"device\" produces a high-resolution screenshot using device pixels (larger, accounts for the device pixel ratio). Default is css.",
+                  "type": "string",
+                  "enum": [
+                    "css",
+                    "device"
+                  ]
                 }
               },
               "required": [
-                "type"
+                "type",
+                "scale"
               ],
               "$schema": "https://json-schema.org/draft/2020-12/schema",
               "additionalProperties": false
@@ -641,7 +651,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "unsupported",
-      "durationMs": 0.006790999999793712,
+      "durationMs": 0.0011660000000119908,
       "message": "Prompts are not advertised by the target.",
       "evidence": [
         {
@@ -657,7 +667,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "unsupported",
-      "durationMs": 0.007708000001002802,
+      "durationMs": 0.0022920000010344665,
       "message": "Resources are not advertised by the target.",
       "evidence": [
         {
@@ -673,7 +683,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "fail",
-      "durationMs": 0.24841600000218023,
+      "durationMs": 0.05433400000038091,
       "message": "Found 6 security finding(s): 2 high, 2 medium, 2 low.",
       "evidence": [
         {
@@ -741,7 +751,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 3062.4197910000003,
+      "durationMs": 987.085916,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -767,7 +777,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "partial",
-      "durationMs": 7.270583000001352,
+      "durationMs": 1.854709000001094,
       "message": "Found 4 quality finding(s) across 23 item(s): 0 warnings, 4 info.",
       "evidence": [
         {
@@ -787,6 +797,32 @@
             "[info] tool \"browser_run_code_unsafe\": Has properties but no 'required' array declared",
             "[info] tool \"browser_snapshot\": Has properties but no 'required' array declared",
             "[info] tool \"browser_wait_for\": Has properties but no 'required' array declared"
+          ],
+          "findings": [
+            {
+              "itemType": "tool",
+              "itemName": "browser_file_upload",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "browser_run_code_unsafe",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "browser_snapshot",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "browser_wait_for",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            }
           ]
         }
       ]
@@ -795,7 +831,7 @@
       "id": "security",
       "capability": "security",
       "status": "fail",
-      "durationMs": 25.690708999998606,
+      "durationMs": 2.534332999999606,
       "message": "Found 6 security finding(s): 2 high, 2 medium, 2 low.",
       "evidence": [
         {
@@ -858,6 +894,125 @@
           ]
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "fail",
+      "durationMs": 1.0038750000003347,
+      "message": "Safe attack simulation found 4 finding(s): 1 high, 3 medium, 0 low.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 4,
+          "identifiers": [
+            "browser_evaluate",
+            "browser_navigate",
+            "browser_run_code_unsafe",
+            "browser_tabs"
+          ],
+          "diagnostics": [
+            "[medium] Tool \"browser_evaluate\" combines broad parameters (filename) with destructive or non-read-only behavior.",
+            "[medium] Tool \"browser_navigate\" combines broad parameters (url) with destructive or non-read-only behavior.",
+            "[high] Tool \"browser_run_code_unsafe\" combines broad parameters (code, filename) with destructive or non-read-only behavior.",
+            "[medium] Tool \"browser_tabs\" combines broad parameters (url) with destructive or non-read-only behavior."
+          ],
+          "findings": [
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "medium",
+              "itemType": "tool",
+              "itemName": "browser_evaluate",
+              "message": "Tool \"browser_evaluate\" combines broad parameters (filename) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "filename"
+                ],
+                "annotations": {
+                  "title": "Evaluate JavaScript",
+                  "readOnlyHint": false,
+                  "destructiveHint": true,
+                  "openWorldHint": true
+                },
+                "description": "Evaluate JavaScript expression on page or element"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "gate"
+            },
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "medium",
+              "itemType": "tool",
+              "itemName": "browser_navigate",
+              "message": "Tool \"browser_navigate\" combines broad parameters (url) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "url"
+                ],
+                "annotations": {
+                  "title": "Navigate to a URL",
+                  "readOnlyHint": false,
+                  "destructiveHint": true,
+                  "openWorldHint": true
+                },
+                "description": "Navigate to a URL"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "gate"
+            },
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "high",
+              "itemType": "tool",
+              "itemName": "browser_run_code_unsafe",
+              "message": "Tool \"browser_run_code_unsafe\" combines broad parameters (code, filename) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "code",
+                  "filename"
+                ],
+                "annotations": {
+                  "title": "Run Playwright code (unsafe)",
+                  "readOnlyHint": false,
+                  "destructiveHint": true,
+                  "openWorldHint": true
+                },
+                "description": "Run a Playwright code snippet. Unsafe: executes arbitrary JavaScript in the Playwright server process and is RCE-equivalent."
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "quarantine"
+            },
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "medium",
+              "itemType": "tool",
+              "itemName": "browser_tabs",
+              "message": "Tool \"browser_tabs\" combines broad parameters (url) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "url"
+                ],
+                "annotations": {
+                  "title": "Manage tabs",
+                  "readOnlyHint": false,
+                  "destructiveHint": true,
+                  "openWorldHint": true
+                },
+                "description": "List, create, close, or select a browser tab."
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "gate"
+            }
+          ]
+        }
+      ]
     }
   ],
   "healthScore": {
@@ -886,7 +1041,8 @@
         "score": 0,
         "details": [
           "security-lite: fail (0/100)",
-          "security: fail (0/100)"
+          "security: fail (0/100)",
+          "attack-sim: fail (0/100)"
         ]
       },
       {
@@ -904,16 +1060,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 5774ms",
-          "p95 latency: 59ms (3 operations)"
+          "Connect: 683ms",
+          "p95 latency: 3ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 5773.640125,
-    "toolsListMs": 59.043541999999434,
-    "promptsListMs": 0.006790999999793712,
-    "resourcesListMs": 0.007708000001002802
+    "connectMs": 683.3468749999993,
+    "toolsListMs": 2.8597500000014406,
+    "promptsListMs": 0.0011660000000119908,
+    "resourcesListMs": 0.0022920000010344665
   }
 }

package/docs/safety-index/artifacts/playwright-mcp-server.md

@@ -1,13 +1,13 @@
 # MCP Observatory Run Report
 
-Generated at 2026-06-24T02:07:32.035Z
+Generated at 2026-07-06T19:49:55.359Z
 
 ## Target and Environment Metadata
 
 - Target: `playwright-mcp-server`
 - Adapter: `local-process`
 - Command: `npx -y @playwright/mcp`
-- Server: `Playwright 1.61.0-alpha-1781023400000`
+- Server: `Playwright 1.62.0-alpha-2026-06-29`
 - Platform: `darwin 25.5.0`
 - Node: `v22.22.1`
 
@@ -25,18 +25,18 @@ Generated at 2026-06-24T02:07:32.035Z
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| fail | 7 | 2 | 2 | 1 | 2 | 0 | 0 |
+| fail | 8 | 2 | 3 | 1 | 2 | 0 | 0 |
 
 ## At a Glance
 
 - Safety verdict: **Blocked** — One or more checks can break agent dependence and should be fixed before production use.
-- Top risks: schema-quality: Found 4 quality finding(s) across 23 item(s): 0 warnings, 4 info.; security: Found 6 security finding(s): 2 high, 2 medium, 2 low.; security-lite: Found 6 security finding(s): 2 high, 2 medium, 2 low.
+- Top risks: schema-quality: Found 4 quality finding(s) across 23 item(s): 0 warnings, 4 info.; attack-sim: Safe attack simulation found 4 finding(s): 1 high, 3 medium, 0 low.; security: Found 6 security finding(s): 2 high, 2 medium, 2 low.
 - Regression/schema drift: Run `mcp-observatory diff <previous-run.json> <current-run.json>` to classify regressions and schema drift.
-- Failing checks: security-lite, security
+- Failing checks: security-lite, security, attack-sim
 - Partial or flaky checks: schema-quality
 - Skipped checks: none
 - Unsupported checks: prompts, resources
-- Suggested next step: Start with the failing checks: security-lite, security.
+- Suggested next step: Start with the failing checks: security-lite, security, attack-sim.
 - CI next step: `Add CI: npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"`
 
 ## Regressions and Recoveries
@@ -47,13 +47,14 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
-| healthy | conformance | pass | 3062.42 | All 7 conformance checks passed. |
-| healthy | tools | pass | 59.04 | Advertised capability responded with the minimal expected shape (23 items). |
-| review | schema-quality | partial | 7.27 | Found 4 quality finding(s) across 23 item(s): 0 warnings, 4 info. |
-| confirm intent | prompts | unsupported | 0.01 | Prompts are not advertised by the target. |
-| confirm intent | resources | unsupported | 0.01 | Resources are not advertised by the target. |
-| act now | security | fail | 25.69 | Found 6 security finding(s): 2 high, 2 medium, 2 low. |
-| act now | security-lite | fail | 0.25 | Found 6 security finding(s): 2 high, 2 medium, 2 low. |
+| healthy | conformance | pass | 987.09 | All 7 conformance checks passed. |
+| healthy | tools | pass | 2.86 | Advertised capability responded with the minimal expected shape (23 items). |
+| review | schema-quality | partial | 1.85 | Found 4 quality finding(s) across 23 item(s): 0 warnings, 4 info. |
+| confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
+| confirm intent | resources | unsupported | 0.00 | Resources are not advertised by the target. |
+| act now | attack-sim | fail | 1.00 | Safe attack simulation found 4 finding(s): 1 high, 3 medium, 0 low. |
+| act now | security | fail | 2.53 | Found 6 security finding(s): 2 high, 2 medium, 2 low. |
+| act now | security-lite | fail | 0.05 | Found 6 security finding(s): 2 high, 2 medium, 2 low. |
 
 ## Evidence Snippets
 
@@ -117,6 +118,18 @@ Summary: Resources are not advertised by the target.
   - Identifiers: none
   - Diagnostics: none
 
+### attack-sim — fail
+
+Summary: Safe attack simulation found 4 finding(s): 1 high, 3 medium, 0 low.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `4`
+  - Identifiers: browser_evaluate, browser_navigate, browser_run_code_unsafe, browser_tabs
+  - Diagnostics: [medium] Tool "browser_evaluate" combines broad parameters (filename) with destructive or non-read-only behavior., [medium] Tool "browser_navigate" combines broad parameters (url) with destructive or non-read-only behavior., [high] Tool "browser_run_code_unsafe" combines broad parameters (code, filename) with destructive or non-read-only behavior. (+1 more)
+
 ### security — fail
 
 Summary: Found 6 security finding(s): 2 high, 2 medium, 2 low.
@@ -152,5 +165,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-06-24T020732035Z_b86ac3a9`
+- Run ID: `run_2026-07-06T194955359Z_d769bb31`
 - Gate: `fail`