@kryptosai/mcp-observatory 0.28.0 → 1.28.1

package/docs/safety-index/artifacts/puppeteer-server.json

@@ -1,10 +1,10 @@
 {
   "artifactType": "run",
   "schemaVersion": "1.0.0",
-  "gate": "pass",
-  "runId": "run_2026-07-06T014701216Z_1c0434b0",
-  "createdAt": "2026-07-06T01:47:01.216Z",
-  "toolVersion": "0.26.1",
+  "gate": "fail",
+  "runId": "run_2026-07-06T194953996Z_3a6d7344",
+  "createdAt": "2026-07-06T19:49:53.996Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "puppeteer-server",
     "adapter": "local-process",
@@ -25,25 +25,25 @@
     "serverVersion": "0.1.0"
   },
   "environment": {
-    "platform": "darwin 24.0.0",
-    "nodeVersion": "v25.8.1"
+    "platform": "darwin 25.5.0",
+    "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 5,
-    "fail": 0,
-    "partial": 1,
+    "total": 8,
+    "pass": 4,
+    "fail": 1,
+    "partial": 2,
     "unsupported": 1,
     "flaky": 0,
     "skipped": 0,
-    "gate": "pass"
+    "gate": "fail"
   },
   "checks": [
     {
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 0.5711250000003929,
+      "durationMs": 0.4152910000011616,
       "message": "Advertised capability responded with the minimal expected shape (8 items).",
       "evidence": [
         {
@@ -192,7 +192,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "unsupported",
-      "durationMs": 0.0006670000002486631,
+      "durationMs": 0.00045900000077381264,
       "message": "Prompts are not advertised by the target.",
       "evidence": [
         {
@@ -208,7 +208,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "pass",
-      "durationMs": 0.5291250000009313,
+      "durationMs": 0.6513340000001335,
       "message": "Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported.",
       "evidence": [
         {
@@ -237,7 +237,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.04550000000017462,
+      "durationMs": 0.036249999999199645,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -252,24 +252,26 @@
     {
       "id": "conformance",
       "capability": "conformance",
-      "status": "pass",
-      "durationMs": 571.27225,
-      "message": "All 7 conformance checks passed.",
+      "status": "partial",
+      "durationMs": 2.328292000000147,
+      "message": "6/7 conformance checks passed, 1 failed.",
       "evidence": [
         {
           "endpoint": "conformance/check",
           "advertised": true,
           "responded": true,
-          "minimalShapePresent": true,
+          "minimalShapePresent": false,
           "itemCount": 7,
-          "identifiers": [],
+          "identifiers": [
+            "tool-response-content"
+          ],
           "diagnostics": [
             "[pass] capabilities-present: Server returned capabilities object.",
             "[pass] server-info: Server provided initialization info.",
             "[pass] tools-capability-match: tools/list returned 8 tool(s).",
             "[pass] prompts-capability-match: Prompts not advertised — endpoint check skipped.",
             "[pass] resources-capability-match: resources/list returned 1 resource(s).",
-            "[pass] tool-response-content: Tool \"puppeteer_connect_active_tab\" response has valid content array.",
+            "[FAIL] tool-response-content: Tool response content check failed: MCP error -32603: Could not find Chrome (ver. 131.0.6778.204). This can occur if either\n 1. you did not perform an installation before running the script (e.g. `npx puppeteer browsers install chrome`) or\n 2. your cache path is incorrectly configured (which is: /Users/williamweishuhn/.cache/puppeteer).\nFor (2), check out our guide on configuring puppeteer at https://pptr.dev/guides/configuration.",
             "[pass] error-handling: Server returned proper error code -32601 for unknown method."
           ]
         }
@@ -279,7 +281,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "partial",
-      "durationMs": 0.4983749999992142,
+      "durationMs": 0.26704199999949196,
       "message": "Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info.",
       "evidence": [
         {
@@ -317,7 +319,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.22308300000076997,
+      "durationMs": 0.1486669999994774,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -328,18 +330,58 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "fail",
+      "durationMs": 0.35720799999944575,
+      "message": "Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 1,
+          "identifiers": [
+            "puppeteer_evaluate"
+          ],
+          "diagnostics": [
+            "[high] Tool \"puppeteer_evaluate\" combines broad parameters (script) with destructive or non-read-only behavior."
+          ],
+          "findings": [
+            {
+              "ruleId": "attack-sim/permission-boundary/broad-destructive-tool",
+              "attackClass": "permission-boundary",
+              "severity": "high",
+              "itemType": "tool",
+              "itemName": "puppeteer_evaluate",
+              "message": "Tool \"puppeteer_evaluate\" combines broad parameters (script) with destructive or non-read-only behavior.",
+              "evidence": {
+                "broadParams": [
+                  "script"
+                ],
+                "description": "Execute JavaScript in the browser console"
+              },
+              "recommendation": "Constrain this tool with typed inputs, allowlists, explicit read-only/destructive annotations, and a harmless CI fixture.",
+              "recommendedAction": "quarantine"
+            }
+          ]
+        }
+      ]
     }
   ],
   "healthScore": {
-    "overall": 89,
-    "grade": "B",
+    "overall": 70,
+    "grade": "C",
     "dimensions": [
       {
         "name": "Protocol Compliance",
         "weight": 0.3,
-        "score": 100,
+        "score": 60,
         "details": [
-          "conformance: pass (100/100)"
+          "conformance: partial (60/100)"
         ]
       },
       {
@@ -353,10 +395,11 @@
       {
         "name": "Security",
         "weight": 0.2,
-        "score": 100,
+        "score": 67,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: fail (0/100)"
         ]
       },
       {
@@ -374,16 +417,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 771ms",
+          "Connect: 685ms",
           "p95 latency: 1ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 770.8425420000003,
-    "toolsListMs": 0.5711250000003929,
-    "promptsListMs": 0.0006670000002486631,
-    "resourcesListMs": 0.5291250000009313
+    "connectMs": 685.0922919999994,
+    "toolsListMs": 0.4152910000011616,
+    "promptsListMs": 0.00045900000077381264,
+    "resourcesListMs": 0.6513340000001335
   }
 }

package/docs/safety-index/artifacts/puppeteer-server.md

@@ -1,6 +1,6 @@
 # MCP Observatory Run Report
 
-Generated at 2026-07-06T01:47:01.216Z
+Generated at 2026-07-06T19:49:53.996Z
 
 ## Target and Environment Metadata
 
@@ -8,35 +8,35 @@ Generated at 2026-07-06T01:47:01.216Z
 - Adapter: `local-process`
 - Command: `npx -y puppeteer-mcp-server`
 - Server: `example-servers/puppeteer 0.1.0`
-- Platform: `darwin 24.0.0`
-- Node: `v25.8.1`
+- Platform: `darwin 25.5.0`
+- Node: `v22.22.1`
 
 ## Executive Summary
 
-**Health Score: 89/100 (B)**
+**Health Score: 70/100 (C)**
 
 | Dimension | Score | Weight |
 | --- | --- | --- |
-| Protocol Compliance | 100/100 | 30% |
+| Protocol Compliance | 60/100 | 30% |
 | Schema Quality | 60/100 | 20% |
-| Security | 100/100 | 20% |
+| Security | 67/100 | 20% |
 | Reliability | 83/100 | 20% |
 | Performance | 100/100 | 10% |
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| pass | 7 | 5 | 0 | 1 | 1 | 0 | 0 |
+| fail | 8 | 4 | 1 | 2 | 1 | 0 | 0 |
 
 ## At a Glance
 
-- Safety verdict: **Needs review** — The server is usable, but caveated checks should be reviewed before agents depend on it.
-- Top risks: schema-quality: Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info.
+- Safety verdict: **Blocked** — One or more checks can break agent dependence and should be fixed before production use.
+- Top risks: conformance: 6/7 conformance checks passed, 1 failed.; schema-quality: Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info.; attack-sim: Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low.
 - Regression/schema drift: Run `mcp-observatory diff <previous-run.json> <current-run.json>` to classify regressions and schema drift.
-- Failing checks: none
-- Partial or flaky checks: schema-quality
+- Failing checks: attack-sim
+- Partial or flaky checks: conformance, schema-quality
 - Skipped checks: none
 - Unsupported checks: prompts
-- Suggested next step: Review the caveated checks next: schema-quality.
+- Suggested next step: Start with the failing checks: attack-sim.
 - CI next step: `Add CI: npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"`
 
 ## Regressions and Recoveries
@@ -47,28 +47,17 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
-| healthy | conformance | pass | 571.27 | All 7 conformance checks passed. |
-| healthy | resources | pass | 0.53 | Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported. |
-| healthy | security | pass | 0.22 | No security issues detected. |
-| healthy | security-lite | pass | 0.05 | No security issues detected (lightweight scan). |
-| healthy | tools | pass | 0.57 | Advertised capability responded with the minimal expected shape (8 items). |
-| review | schema-quality | partial | 0.50 | Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info. |
+| healthy | resources | pass | 0.65 | Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported. |
+| healthy | security | pass | 0.15 | No security issues detected. |
+| healthy | security-lite | pass | 0.04 | No security issues detected (lightweight scan). |
+| healthy | tools | pass | 0.42 | Advertised capability responded with the minimal expected shape (8 items). |
+| review | conformance | partial | 2.33 | 6/7 conformance checks passed, 1 failed. |
+| review | schema-quality | partial | 0.27 | Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info. |
 | confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
+| act now | attack-sim | fail | 0.36 | Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low. |
 
 ## Evidence Snippets
 
-### conformance — pass
-
-Summary: All 7 conformance checks passed.
-
-- Endpoint: `conformance/check`
-  - Advertised: `true`
-  - Responded: `true`
-  - Minimal shape present: `true`
-  - Item count: `7`
-  - Identifiers: none
-  - Diagnostics: [pass] capabilities-present: Server returned capabilities object., [pass] server-info: Server provided initialization info., [pass] tools-capability-match: tools/list returned 8 tool(s). (+4 more)
-
 ### resources — pass
 
 Summary: Advertised capability responded with the minimal expected shape, but one optional resource endpoint appears unsupported.
@@ -124,6 +113,18 @@ Summary: Advertised capability responded with the minimal expected shape (8 item
   - Identifiers: puppeteer_connect_active_tab, puppeteer_navigate, puppeteer_screenshot, puppeteer_click, puppeteer_fill (+3 more)
   - Diagnostics: none
 
+### conformance — partial
+
+Summary: 6/7 conformance checks passed, 1 failed.
+
+- Endpoint: `conformance/check`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `false`
+  - Item count: `7`
+  - Identifiers: tool-response-content
+  - Diagnostics: [pass] capabilities-present: Server returned capabilities object., [pass] server-info: Server provided initialization info., [pass] tools-capability-match: tools/list returned 8 tool(s). (+4 more)
+
 ### schema-quality — partial
 
 Summary: Found 2 quality finding(s) across 9 item(s): 1 warnings, 1 info.
@@ -148,6 +149,18 @@ Summary: Prompts are not advertised by the target.
   - Identifiers: none
   - Diagnostics: none
 
+### attack-sim — fail
+
+Summary: Safe attack simulation found 1 finding(s): 1 high, 0 medium, 0 low.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `1`
+  - Identifiers: puppeteer_evaluate
+  - Diagnostics: [high] Tool "puppeteer_evaluate" combines broad parameters (script) with destructive or non-read-only behavior.
+
 ## Reproduction Commands
 
 ```bash
@@ -159,5 +172,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-07-06T014701216Z_1c0434b0`
-- Gate: `pass`
+- Run ID: `run_2026-07-06T194953996Z_3a6d7344`
+- Gate: `fail`

package/docs/safety-index/artifacts/ref-tools-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "pass",
-  "runId": "run_2026-07-06T014658081Z_d215bf43",
-  "createdAt": "2026-07-06T01:46:58.081Z",
-  "toolVersion": "0.26.1",
+  "runId": "run_2026-07-06T194951606Z_e657d5a4",
+  "createdAt": "2026-07-06T19:49:51.606Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "ref-tools-server",
     "adapter": "local-process",
@@ -25,12 +25,12 @@
     "serverVersion": "3.0.3"
   },
   "environment": {
-    "platform": "darwin 24.0.0",
-    "nodeVersion": "v25.8.1"
+    "platform": "darwin 25.5.0",
+    "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 6,
+    "total": 8,
+    "pass": 7,
     "fail": 0,
     "partial": 0,
     "unsupported": 1,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 0.7155000000002474,
+      "durationMs": 0.8886670000001686,
       "message": "Advertised capability responded with the minimal expected shape (2 items).",
       "evidence": [
         {
@@ -92,7 +92,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "pass",
-      "durationMs": 0.22549999999955617,
+      "durationMs": 0.19312499999978172,
       "message": "Advertised capability responded with the minimal expected shape (2 items).",
       "evidence": [
         {
@@ -115,7 +115,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "unsupported",
-      "durationMs": 0.0021660000002157176,
+      "durationMs": 0.0022499999995488906,
       "message": "Resources are not advertised by the target.",
       "evidence": [
         {
@@ -131,7 +131,7 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.01762499999949796,
+      "durationMs": 0.016125000000101863,
       "message": "No security issues detected (lightweight scan).",
       "evidence": [
         {
@@ -147,7 +147,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 0.5051670000002559,
+      "durationMs": 0.5073750000001382,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -173,7 +173,7 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "pass",
-      "durationMs": 0.40233400000033726,
+      "durationMs": 0.4954999999999927,
       "message": "All 4 item(s) have good schema quality.",
       "evidence": [
         {
@@ -190,7 +190,7 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.16862500000024738,
+      "durationMs": 0.19070799999917654,
       "message": "No security issues detected.",
       "evidence": [
         {
@@ -201,6 +201,23 @@
           "itemCount": 0
         }
       ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "pass",
+      "durationMs": 0.24504199999955745,
+      "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 0,
+          "identifiers": []
+        }
+      ]
     }
   ],
   "healthScore": {
@@ -229,7 +246,8 @@
         "score": 100,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: pass (100/100)"
         ]
       },
       {
@@ -247,16 +265,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 652ms",
+          "Connect: 579ms",
           "p95 latency: 1ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 652.1516670000001,
-    "toolsListMs": 0.7155000000002474,
-    "promptsListMs": 0.22549999999955617,
-    "resourcesListMs": 0.0021660000002157176
+    "connectMs": 579.0028749999992,
+    "toolsListMs": 0.8886670000001686,
+    "promptsListMs": 0.19312499999978172,
+    "resourcesListMs": 0.0022499999995488906
   }
 }

package/docs/safety-index/artifacts/ref-tools-server.md

@@ -1,6 +1,6 @@
 # MCP Observatory Run Report
 
-Generated at 2026-07-06T01:46:58.081Z
+Generated at 2026-07-06T19:49:51.606Z
 
 ## Target and Environment Metadata
 
@@ -8,8 +8,8 @@ Generated at 2026-07-06T01:46:58.081Z
 - Adapter: `local-process`
 - Command: `npx -y ref-tools-mcp`
 - Server: `Ref 3.0.3`
-- Platform: `darwin 24.0.0`
-- Node: `v25.8.1`
+- Platform: `darwin 25.5.0`
+- Node: `v22.22.1`
 
 ## Executive Summary
 
@@ -25,7 +25,7 @@ Generated at 2026-07-06T01:46:58.081Z
 
 | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| pass | 7 | 6 | 0 | 0 | 1 | 0 | 0 |
+| pass | 8 | 7 | 0 | 0 | 1 | 0 | 0 |
 
 ## At a Glance
 
@@ -47,16 +47,29 @@ _Use the `diff` command against another run artifact to classify regressions and
 
 | Focus | Check | Status | Duration (ms) | Message |
 | --- | --- | --- | --- | --- |
+| healthy | attack-sim | pass | 0.25 | Safe attack simulation found no high-risk MCP attack-readiness findings. |
 | healthy | conformance | pass | 0.51 | All 7 conformance checks passed. |
-| healthy | prompts | pass | 0.23 | Advertised capability responded with the minimal expected shape (2 items). |
-| healthy | schema-quality | pass | 0.40 | All 4 item(s) have good schema quality. |
-| healthy | security | pass | 0.17 | No security issues detected. |
+| healthy | prompts | pass | 0.19 | Advertised capability responded with the minimal expected shape (2 items). |
+| healthy | schema-quality | pass | 0.50 | All 4 item(s) have good schema quality. |
+| healthy | security | pass | 0.19 | No security issues detected. |
 | healthy | security-lite | pass | 0.02 | No security issues detected (lightweight scan). |
-| healthy | tools | pass | 0.72 | Advertised capability responded with the minimal expected shape (2 items). |
+| healthy | tools | pass | 0.89 | Advertised capability responded with the minimal expected shape (2 items). |
 | confirm intent | resources | unsupported | 0.00 | Resources are not advertised by the target. |
 
 ## Evidence Snippets
 
+### attack-sim — pass
+
+Summary: Safe attack simulation found no high-risk MCP attack-readiness findings.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `0`
+  - Identifiers: none
+  - Diagnostics: none
+
 ### conformance — pass
 
 Summary: All 7 conformance checks passed.
@@ -152,5 +165,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
 
 - Artifact type: `run`
 - Schema version: `1.0.0`
-- Run ID: `run_2026-07-06T014658081Z_d215bf43`
+- Run ID: `run_2026-07-06T194951606Z_e657d5a4`
 - Gate: `pass`