@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/docs/safety-index/artifacts/promptopia-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "pass",
-  "runId": "run_2026-06-24T020725699Z_7cde9d35",
-  "createdAt": "2026-06-24T02:07:25.699Z",
-  "toolVersion": "0.24.0",
+  "runId": "run_2026-07-06T194948899Z_ab0f7d29",
+  "createdAt": "2026-07-06T19:49:48.899Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "promptopia-server",
     "adapter": "local-process",
@@ -29,8 +29,8 @@
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 5,
+    "total": 8,
+    "pass": 6,
     "fail": 0,
     "partial": 1,
     "unsupported": 1,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 1.030083999999988,
+      "durationMs": 2.4714169999997466,
       "message": "Advertised capability responded with the minimal expected shape (7 items).",
       "evidence": [
         {
@@ -267,7 +267,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "pass",
-      "durationMs": 1.1311249999998836,
+      "durationMs": 1.0759590000006938,
       "message": "Advertised capability responded with the minimal expected shape (1 item).",
       "evidence": [
         {
@@ -290,7 +290,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "unsupported",
-      "durationMs": 0.004041000000142958,
+      "durationMs": 0.0035409999991316,
       "message": "Resources are not advertised by the target.",
       "evidence": [
         {
@@ -306,7 +306,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.02937500000007276,
+      "durationMs": 0.02491699999973207,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -322,7 +322,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 1.6614580000004935,
+      "durationMs": 1.5870000000004438,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -348,7 +348,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "partial",
-      "durationMs": 0.6617910000004485,
+      "durationMs": 0.5944589999999152,
       "message": "Found 1 quality finding(s) across 8 item(s): 0 warnings, 1 info.",
       "evidence": [
         {
@@ -362,6 +362,14 @@
           ],
           "diagnostics": [
             "[info] prompt \"demo_welcome\": Argument 'name' missing description"
+          ],
+          "findings": [
+            {
+              "itemType": "prompt",
+              "itemName": "demo_welcome",
+              "issue": "Argument 'name' missing description",
+              "severity": "info"
+            }
           ]
         }
       ]
@@ -370,7 +378,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.1859999999996944,
+      "durationMs": 0.19179199999962293,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -381,6 +389,23 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "pass",
+      "durationMs": 0.4236670000000231,
+      "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 0,
+          "identifiers": []
+        }
+      ]
     }
   ],
   "healthScore": {
@@ -409,7 +434,8 @@
         "score": 100,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: pass (100/100)"
         ]
       },
       {
@@ -427,16 +453,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 829ms",
-          "p95 latency: 1ms (3 operations)"
+          "Connect: 678ms",
+          "p95 latency: 2ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 829.2160830000003,
-    "toolsListMs": 1.030083999999988,
-    "promptsListMs": 1.1311249999998836,
-    "resourcesListMs": 0.004041000000142958
+    "connectMs": 678.1046249999999,
+    "toolsListMs": 2.4714169999997466,
+    "promptsListMs": 1.0759590000006938,
+    "resourcesListMs": 0.0035409999991316
   }
 }

package/docs/safety-index/artifacts/promptopia-server.md

@@ -1,6 +1,6 @@
 # MCP Observatory Run Report
 
-Generated at 2026-06-24T02:07:25.699Z
+Generated at 2026-07-06T19:49:48.899Z
 
 ## Target and Environment Metadata
 
@@ -25,7 +25,7 @@ Generated at 2026-06-24T02:07:25.699Z
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| pass | 7 | 5 | 0 | 1 | 1 | 0 | 0 |
+| pass | 8 | 6 | 0 | 1 | 1 | 0 | 0 |
 
 ## At a Glance
 
@@ -47,16 +47,29 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
-| healthy | conformance | pass | 1.66 | All 7 conformance checks passed. |
-| healthy | prompts | pass | 1.13 | Advertised capability responded with the minimal expected shape (1 item). |
+| healthy | attack-sim | pass | 0.42 | Safe attack simulation found no high-risk MCP attack-readiness findings. |
+| healthy | conformance | pass | 1.59 | All 7 conformance checks passed. |
+| healthy | prompts | pass | 1.08 | Advertised capability responded with the minimal expected shape (1 item). |
 | healthy | security | pass | 0.19 | No security issues detected. |
-| healthy | security-lite | pass | 0.03 | No security issues detected (lightweight scan). |
-| healthy | tools | pass | 1.03 | Advertised capability responded with the minimal expected shape (7 items). |
-| review | schema-quality | partial | 0.66 | Found 1 quality finding(s) across 8 item(s): 0 warnings, 1 info. |
+| healthy | security-lite | pass | 0.02 | No security issues detected (lightweight scan). |
+| healthy | tools | pass | 2.47 | Advertised capability responded with the minimal expected shape (7 items). |
+| review | schema-quality | partial | 0.59 | Found 1 quality finding(s) across 8 item(s): 0 warnings, 1 info. |
 | confirm intent | resources | unsupported | 0.00 | Resources are not advertised by the target. |
 
 ## Evidence Snippets
 
+### attack-sim — pass
+
+Summary: Safe attack simulation found no high-risk MCP attack-readiness findings.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
 ### conformance — pass
 
 Summary: All 7 conformance checks passed.
@@ -152,5 +165,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-06-24T020725699Z_7cde9d35`
+- Run ID: `run_2026-07-06T194948899Z_ab0f7d29`
 - Gate: `pass`

package/docs/safety-index/artifacts/puppeteer-server.json

@@ -1,10 +1,10 @@
 {
   "artifactType": "run",
   "schemaVersion": "1.0.0",
-  "gate": "pass",
-  "runId": "run_2026-06-24T020730285Z_85ad0698",
-  "createdAt": "2026-06-24T02:07:30.285Z",
-  "toolVersion": "0.24.0",
+  "gate": "fail",
+  "runId": "run_2026-07-06T194953996Z_3a6d7344",
+  "createdAt": "2026-07-06T19:49:53.996Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "puppeteer-server",
     "adapter": "local-process",
@@ -29,21 +29,21 @@
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
+    "total": 8,
     "pass": 4,
-    "fail": 0,
+    "fail": 1,
     "partial": 2,
     "unsupported": 1,
     "flaky": 0,
     "skipped": 0,
-    "gate": "pass"
+    "gate": "fail"
   },
   "checks": [
     {
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 0.41391699999985576,
+      "durationMs": 0.4152910000011616,
       "message": "Advertised capability responded with the minimal expected shape (8 items).",
       "evidence": [
         {
@@ -192,7 +192,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "unsupported",
-      "durationMs": 0.0010000000002037268,
+      "durationMs": 0.00045900000077381264,
       "message": "Prompts are not advertised by the target.",
       "evidence": [
         {
@@ -208,7 +208,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "pass",
-      "durationMs": 0.864040999998906,
+      "durationMs": 0.6513340000001335,
       "message": "Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported.",
       "evidence": [
         {
@@ -237,7 +237,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.041500000001178705,
+      "durationMs": 0.036249999999199645,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -253,7 +253,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "partial",
-      "durationMs": 2.417708999999377,
+      "durationMs": 2.328292000000147,
       "message": "6/7 conformance checks passed, 1 failed.",
       "evidence": [
         {
@@ -281,7 +281,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "partial",
-      "durationMs": 0.33158299999922747,
+      "durationMs": 0.26704199999949196,
       "message": "Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info.",
       "evidence": [
         {
@@ -297,6 +297,20 @@
           "diagnostics": [
             "[info] tool \"puppeteer_navigate\": Property 'url' missing description",
             "[warning] resource \"Browser console logs\": Missing description"
+          ],
+          "findings": [
+            {
+              "itemType": "tool",
+              "itemName": "puppeteer_navigate",
+              "issue": "Property 'url' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "resource",
+              "itemName": "Browser console logs",
+              "issue": "Missing description",
+              "severity": "warning"
+            }
           ]
         }
       ]
@@ -305,7 +319,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.18262499999946158,
+      "durationMs": 0.1486669999994774,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -316,10 +330,50 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "fail",
+      "durationMs": 0.35720799999944575,
+      "message": "Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 1,
+          "identifiers": [
+            "puppeteer_evaluate"
+          ],
+          "diagnostics": [
+            "[high] Tool \"puppeteer_evaluate\" combines broad parameters (script) with destructive or non-read-only behavior."
+          ],
+          "findings": [
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "high",
+              "itemType": "tool",
+              "itemName": "puppeteer_evaluate",
+              "message": "Tool \"puppeteer_evaluate\" combines broad parameters (script) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "script"
+                ],
+                "description": "Execute JavaScript in the browser console"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "quarantine"
+            }
+          ]
+        }
+      ]
     }
   ],
   "healthScore": {
-    "overall": 77,
+    "overall": 70,
     "grade": "C",
     "dimensions": [
       {
@@ -341,10 +395,11 @@
       {
         "name": "Security",
         "weight": 0.2,
-        "score": 100,
+        "score": 67,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: fail (0/100)"
         ]
       },
       {
@@ -362,16 +417,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 812ms",
+          "Connect: 685ms",
           "p95 latency: 1ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 812.1966250000005,
-    "toolsListMs": 0.41391699999985576,
-    "promptsListMs": 0.0010000000002037268,
-    "resourcesListMs": 0.864040999998906
+    "connectMs": 685.0922919999994,
+    "toolsListMs": 0.4152910000011616,
+    "promptsListMs": 0.00045900000077381264,
+    "resourcesListMs": 0.6513340000001335
   }
 }

package/docs/safety-index/artifacts/puppeteer-server.md

@@ -1,6 +1,6 @@
 # MCP Observatory Run Report
 
-Generated at 2026-06-24T02:07:30.285Z
+Generated at 2026-07-06T19:49:53.996Z
 
 ## Target and Environment Metadata
 
@@ -13,30 +13,30 @@ Generated at 2026-06-24T02:07:30.285Z
 
 ## Executive Summary
 
-**Health Score: 77/100 (C)**
+**Health Score: 70/100 (C)**
 
 | Dimension | Score | Weight |
 | --- | --- | --- |
 | Protocol Compliance | 60/100 | 30% |
 | Schema Quality | 60/100 | 20% |
-| Security | 100/100 | 20% |
+| Security | 67/100 | 20% |
 | Reliability | 83/100 | 20% |
 | Performance | 100/100 | 10% |
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| pass | 7 | 4 | 0 | 2 | 1 | 0 | 0 |
+| fail | 8 | 4 | 1 | 2 | 1 | 0 | 0 |
 
 ## At a Glance
 
-- Safety verdict: **Needs review** — The server is usable, but caveated checks should be reviewed before agents depend on it.
-- Top risks: conformance: 6/7 conformance checks passed, 1 failed.; schema-quality: Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info.
+- Safety verdict: **Blocked** — One or more checks can break agent dependence and should be fixed before production use.
+- Top risks: conformance: 6/7 conformance checks passed, 1 failed.; schema-quality: Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info.; attack-sim: Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low.
 - Regression/schema drift: Run `mcp-observatory diff <previous-run.json> <current-run.json>` to classify regressions and schema drift.
-- Failing checks: none
+- Failing checks: attack-sim
 - Partial or flaky checks: conformance, schema-quality
 - Skipped checks: none
 - Unsupported checks: prompts
-- Suggested next step: Review the caveated checks next: conformance, schema-quality.
+- Suggested next step: Start with the failing checks: attack-sim.
 - CI next step: `Add CI: npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"`
 
 ## Regressions and Recoveries
@@ -47,13 +47,14 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
-| healthy | resources | pass | 0.86 | Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported. |
-| healthy | security | pass | 0.18 | No security issues detected. |
+| healthy | resources | pass | 0.65 | Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported. |
+| healthy | security | pass | 0.15 | No security issues detected. |
 | healthy | security-lite | pass | 0.04 | No security issues detected (lightweight scan). |
-| healthy | tools | pass | 0.41 | Advertised capability responded with the minimal expected shape (8 items). |
-| review | conformance | partial | 2.42 | 6/7 conformance checks passed, 1 failed. |
-| review | schema-quality | partial | 0.33 | Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info. |
+| healthy | tools | pass | 0.42 | Advertised capability responded with the minimal expected shape (8 items). |
+| review | conformance | partial | 2.33 | 6/7 conformance checks passed, 1 failed. |
+| review | schema-quality | partial | 0.27 | Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info. |
 | confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
+| act now | attack-sim | fail | 0.36 | Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low. |
 
 ## Evidence Snippets
 
@@ -148,6 +149,18 @@ Summary: Prompts are not advertised by the target.
   - Identifiers: none
   - Diagnostics: none
 
+### attack-sim — fail
+
+Summary: Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `1`
+  - Identifiers: puppeteer_evaluate
+  - Diagnostics: [high] Tool "puppeteer_evaluate" combines broad parameters (script) with destructive or non-read-only behavior.
+
 ## Reproduction Commands
 
 ```bash
@@ -159,5 +172,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-06-24T020730285Z_85ad0698`
-- Gate: `pass`
+- Run ID: `run_2026-07-06T194953996Z_3a6d7344`
+- Gate: `fail`

package/docs/safety-index/artifacts/ref-tools-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "pass",
-  "runId": "run_2026-06-24T020728542Z_cc57c712",
-  "createdAt": "2026-06-24T02:07:28.542Z",
-  "toolVersion": "0.24.0",
+  "runId": "run_2026-07-06T194951606Z_e657d5a4",
+  "createdAt": "2026-07-06T19:49:51.606Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "ref-tools-server",
     "adapter": "local-process",
@@ -29,8 +29,8 @@
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 6,
+    "total": 8,
+    "pass": 7,
     "fail": 0,
     "partial": 0,
     "unsupported": 1,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 0.9550839999992604,
+      "durationMs": 0.8886670000001686,
       "message": "Advertised capability responded with the minimal expected shape (2 items).",
       "evidence": [
         {
@@ -92,7 +92,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "pass",
-      "durationMs": 0.21733400000084657,
+      "durationMs": 0.19312499999978172,
       "message": "Advertised capability responded with the minimal expected shape (2 items).",
       "evidence": [
         {
@@ -115,7 +115,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "unsupported",
-      "durationMs": 0.002375000000029104,
+      "durationMs": 0.0022499999995488906,
       "message": "Resources are not advertised by the target.",
       "evidence": [
         {
@@ -131,7 +131,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.017791999998735264,
+      "durationMs": 0.016125000000101863,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -147,7 +147,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 0.5875410000007832,
+      "durationMs": 0.5073750000001382,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -173,7 +173,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "pass",
-      "durationMs": 0.4417920000014419,
+      "durationMs": 0.4954999999999927,
       "message": "All 4 item(s) have good schema quality.",
       "evidence": [
         {
@@ -190,7 +190,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.44887500000004366,
+      "durationMs": 0.19070799999917654,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -201,6 +201,23 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "pass",
+      "durationMs": 0.24504199999955745,
+      "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 0,
+          "identifiers": []
+        }
+      ]
     }
   ],
   "healthScore": {
@@ -229,7 +246,8 @@
         "score": 100,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: pass (100/100)"
         ]
       },
       {
@@ -247,16 +265,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 775ms",
+          "Connect: 579ms",
           "p95 latency: 1ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 774.5396250000003,
-    "toolsListMs": 0.9550839999992604,
-    "promptsListMs": 0.21733400000084657,
-    "resourcesListMs": 0.002375000000029104
+    "connectMs": 579.0028749999992,
+    "toolsListMs": 0.8886670000001686,
+    "promptsListMs": 0.19312499999978172,
+    "resourcesListMs": 0.0022499999995488906
   }
 }