@kryptosai/mcp-observatory 0.28.0 → 1.28.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (108) hide show
  1. package/COMMERCIAL.md +26 -5
  2. package/README.md +65 -12
  3. package/dist/src/action-receipt.d.ts +20 -0
  4. package/dist/src/action-receipt.js +85 -0
  5. package/dist/src/action-receipt.js.map +1 -0
  6. package/dist/src/audit.d.ts +64 -0
  7. package/dist/src/audit.js +359 -0
  8. package/dist/src/audit.js.map +1 -0
  9. package/dist/src/checks/attack-sim.d.ts +2 -0
  10. package/dist/src/checks/attack-sim.js +12 -0
  11. package/dist/src/checks/attack-sim.js.map +1 -1
  12. package/dist/src/cli.js +8 -1
  13. package/dist/src/cli.js.map +1 -1
  14. package/dist/src/commands/attack-sim.js +54 -2
  15. package/dist/src/commands/attack-sim.js.map +1 -1
  16. package/dist/src/commands/audit.d.ts +2 -0
  17. package/dist/src/commands/audit.js +132 -0
  18. package/dist/src/commands/audit.js.map +1 -0
  19. package/dist/src/commands/init-ci.d.ts +2 -0
  20. package/dist/src/commands/init-ci.js +71 -11
  21. package/dist/src/commands/init-ci.js.map +1 -1
  22. package/dist/src/commands/legacy.js +2 -0
  23. package/dist/src/commands/legacy.js.map +1 -1
  24. package/dist/src/commands/receipt.d.ts +2 -0
  25. package/dist/src/commands/receipt.js +113 -0
  26. package/dist/src/commands/receipt.js.map +1 -0
  27. package/dist/src/commands/scan.js +23 -5
  28. package/dist/src/commands/scan.js.map +1 -1
  29. package/dist/src/commands/score.js +63 -0
  30. package/dist/src/commands/score.js.map +1 -1
  31. package/dist/src/commands/setup-ci-conversion.d.ts +2 -1
  32. package/dist/src/commands/setup-ci-conversion.js +22 -8
  33. package/dist/src/commands/setup-ci-conversion.js.map +1 -1
  34. package/dist/src/commands/test.js +18 -1
  35. package/dist/src/commands/test.js.map +1 -1
  36. package/dist/src/findings.d.ts +1 -0
  37. package/dist/src/findings.js +1 -0
  38. package/dist/src/findings.js.map +1 -1
  39. package/dist/src/index.d.ts +2 -0
  40. package/dist/src/index.js +2 -0
  41. package/dist/src/index.js.map +1 -1
  42. package/dist/src/receipt.d.ts +100 -0
  43. package/dist/src/receipt.js +375 -0
  44. package/dist/src/receipt.js.map +1 -0
  45. package/dist/src/reporters/attack-sim.js +6 -1
  46. package/dist/src/reporters/attack-sim.js.map +1 -1
  47. package/dist/src/reporters/sarif.js +11 -1
  48. package/dist/src/reporters/sarif.js.map +1 -1
  49. package/dist/src/security-profiles.d.ts +13 -0
  50. package/dist/src/security-profiles.js +59 -0
  51. package/dist/src/security-profiles.js.map +1 -0
  52. package/dist/src/telemetry.d.ts +7 -0
  53. package/dist/src/telemetry.js.map +1 -1
  54. package/docs/10x-agentic-growth-sprint.md +47 -0
  55. package/docs/agent-ecosystem-promotion-plan.md +1 -1
  56. package/docs/agentic-contributor-outreach.md +52 -0
  57. package/docs/code-scanning-demo.md +2 -2
  58. package/docs/commercial-boundary.md +83 -0
  59. package/docs/contributor-proof-cards/README.md +1 -1
  60. package/docs/examples/nsa-mcp-audit-report.md +372 -0
  61. package/docs/examples/nsa-mcp-results.sarif +930 -0
  62. package/docs/examples/nsa-mcp-score.json +13 -0
  63. package/docs/feishu-lark-mcp.md +1 -1
  64. package/docs/github-code-scanning-for-mcp.md +1 -1
  65. package/docs/government-enterprise-pilot.md +93 -0
  66. package/docs/mcp-receipts.md +109 -0
  67. package/docs/mcp-server-safety-index.md +26 -25
  68. package/docs/nsa-mcp-audit-ci.md +88 -0
  69. package/docs/procurement-one-pager.md +74 -0
  70. package/docs/proof.md +2 -2
  71. package/docs/public-guidance-crosswalk.md +48 -0
  72. package/docs/safety-index/artifacts/antv-chart-server.json +41 -23
  73. package/docs/safety-index/artifacts/antv-chart-server.md +23 -10
  74. package/docs/safety-index/artifacts/browsermcp-server.json +38 -20
  75. package/docs/safety-index/artifacts/browsermcp-server.md +23 -10
  76. package/docs/safety-index/artifacts/context7-server.json +85 -28
  77. package/docs/safety-index/artifacts/context7-server.md +35 -22
  78. package/docs/safety-index/artifacts/cyanheads-git-mcp-server.json +460 -36
  79. package/docs/safety-index/artifacts/cyanheads-git-mcp-server.md +31 -18
  80. package/docs/safety-index/artifacts/everything-server.json +38 -20
  81. package/docs/safety-index/artifacts/everything-server.md +25 -12
  82. package/docs/safety-index/artifacts/executeautomation-playwright-server.json +155 -20
  83. package/docs/safety-index/artifacts/executeautomation-playwright-server.md +26 -13
  84. package/docs/safety-index/artifacts/filesystem-server.json +116 -22
  85. package/docs/safety-index/artifacts/filesystem-server.md +27 -14
  86. package/docs/safety-index/artifacts/kubernetes-server.json +252 -27
  87. package/docs/safety-index/artifacts/kubernetes-server.md +44 -18
  88. package/docs/safety-index/artifacts/memory-server.json +39 -21
  89. package/docs/safety-index/artifacts/memory-server.md +24 -11
  90. package/docs/safety-index/artifacts/opentofu-server.json +38 -20
  91. package/docs/safety-index/artifacts/opentofu-server.md +24 -11
  92. package/docs/safety-index/artifacts/playwright-mcp-server.json +140 -20
  93. package/docs/safety-index/artifacts/playwright-mcp-server.md +26 -13
  94. package/docs/safety-index/artifacts/promptopia-server.json +41 -23
  95. package/docs/safety-index/artifacts/promptopia-server.md +26 -13
  96. package/docs/safety-index/artifacts/puppeteer-server.json +77 -34
  97. package/docs/safety-index/artifacts/puppeteer-server.md +45 -32
  98. package/docs/safety-index/artifacts/ref-tools-server.json +38 -20
  99. package/docs/safety-index/artifacts/ref-tools-server.md +22 -9
  100. package/docs/safety-index/artifacts/sequential-thinking-server.json +39 -21
  101. package/docs/safety-index/artifacts/sequential-thinking-server.md +23 -10
  102. package/docs/security-due-diligence.md +87 -0
  103. package/docs/setup-ci-doctor.md +11 -1
  104. package/docs/tool-call-receipts.md +1 -2
  105. package/examples/insecure-mcp-server/mcp-observatory.target.json +13 -0
  106. package/examples/insecure-mcp-server/server.mjs +62 -0
  107. package/package.json +12 -1
  108. package/scripts/postinstall.mjs +22 -7
@@ -2,9 +2,9 @@
2
2
  "artifactType": "run",
3
3
  "schemaVersion": "1.0.0",
4
4
  "gate": "pass",
5
- "runId": "run_2026-07-06T014652851Z_87fbcb76",
6
- "createdAt": "2026-07-06T01:46:52.851Z",
7
- "toolVersion": "0.26.1",
5
+ "runId": "run_2026-07-06T194946771Z_35b0da26",
6
+ "createdAt": "2026-07-06T19:49:46.771Z",
7
+ "toolVersion": "0.28.0",
8
8
  "target": {
9
9
  "targetId": "memory-server",
10
10
  "adapter": "local-process",
@@ -25,12 +25,12 @@
25
25
  "serverVersion": "0.6.3"
26
26
  },
27
27
  "environment": {
28
- "platform": "darwin 24.0.0",
29
- "nodeVersion": "v25.8.1"
28
+ "platform": "darwin 25.5.0",
29
+ "nodeVersion": "v22.22.1"
30
30
  },
31
31
  "summary": {
32
- "total": 7,
33
- "pass": 5,
32
+ "total": 8,
33
+ "pass": 6,
34
34
  "fail": 0,
35
35
  "partial": 1,
36
36
  "unsupported": 1,
@@ -43,7 +43,7 @@
43
43
  "id": "tools",
44
44
  "capability": "tools",
45
45
  "status": "pass",
46
- "durationMs": 8.82391699999971,
46
+ "durationMs": 7.618457999999919,
47
47
  "message": "Advertised capability responded with the minimal expected shape (9 items).",
48
48
  "evidence": [
49
49
  {
@@ -295,7 +295,7 @@
295
295
  "id": "prompts",
296
296
  "capability": "prompts",
297
297
  "status": "unsupported",
298
- "durationMs": 0.0030410000003939786,
298
+ "durationMs": 0.0020410000001902517,
299
299
  "message": "Prompts are not advertised by the target.",
300
300
  "evidence": [
301
301
  {
@@ -311,7 +311,7 @@
311
311
  "id": "resources",
312
312
  "capability": "resources",
313
313
  "status": "pass",
314
- "durationMs": 0.8521670000000086,
314
+ "durationMs": 1.1717079999998532,
315
315
  "message": "Advertised capability responded with the minimal expected shape (1 items).",
316
316
  "evidence": [
317
317
  {
@@ -344,7 +344,7 @@
344
344
  "id": "security-lite",
345
345
  "capability": "security-lite",
346
346
  "status": "pass",
347
- "durationMs": 0.03016700000034689,
347
+ "durationMs": 0.04383400000006077,
348
348
  "message": "No security issues detected (lightweight scan).",
349
349
  "evidence": [
350
350
  {
@@ -360,7 +360,7 @@
360
360
  "id": "conformance",
361
361
  "capability": "conformance",
362
362
  "status": "pass",
363
- "durationMs": 10.965208000000075,
363
+ "durationMs": 9.354083000000173,
364
364
  "message": "All 7 conformance checks passed.",
365
365
  "evidence": [
366
366
  {
@@ -386,7 +386,7 @@
386
386
  "id": "schema-quality",
387
387
  "capability": "schema-quality",
388
388
  "status": "partial",
389
- "durationMs": 4.120625000000018,
389
+ "durationMs": 4.083458000000064,
390
390
  "message": "Found 4 quality finding(s) across 10 item(s): 0 warnings, 4 info.",
391
391
  "evidence": [
392
392
  {
@@ -440,7 +440,7 @@
440
440
  "id": "security",
441
441
  "capability": "security",
442
442
  "status": "pass",
443
- "durationMs": 3.843583999999737,
443
+ "durationMs": 3.6132500000003347,
444
444
  "message": "No security issues detected.",
445
445
  "evidence": [
446
446
  {
@@ -451,6 +451,23 @@
451
451
  "itemCount": 0
452
452
  }
453
453
  ]
454
+ },
455
+ {
456
+ "id": "attack-sim",
457
+ "capability": "attack-sim",
458
+ "status": "pass",
459
+ "durationMs": 3.8723329999997986,
460
+ "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
461
+ "evidence": [
462
+ {
463
+ "endpoint": "attack-sim/safe",
464
+ "advertised": true,
465
+ "responded": true,
466
+ "minimalShapePresent": true,
467
+ "itemCount": 0,
468
+ "identifiers": []
469
+ }
470
+ ]
454
471
  }
455
472
  ],
456
473
  "healthScore": {
@@ -479,7 +496,8 @@
479
496
  "score": 100,
480
497
  "details": [
481
498
  "security-lite: pass (100/100)",
482
- "security: pass (100/100)"
499
+ "security: pass (100/100)",
500
+ "attack-sim: pass (100/100)"
483
501
  ]
484
502
  },
485
503
  {
@@ -497,16 +515,16 @@
497
515
  "weight": 0.1,
498
516
  "score": 100,
499
517
  "details": [
500
- "Connect: 704ms",
501
- "p95 latency: 9ms (3 operations)"
518
+ "Connect: 628ms",
519
+ "p95 latency: 8ms (3 operations)"
502
520
  ]
503
521
  }
504
522
  ]
505
523
  },
506
524
  "performanceMetrics": {
507
- "connectMs": 704.0154159999997,
508
- "toolsListMs": 8.82391699999971,
509
- "promptsListMs": 0.0030410000003939786,
510
- "resourcesListMs": 0.8521670000000086
525
+ "connectMs": 628.0643749999999,
526
+ "toolsListMs": 7.618457999999919,
527
+ "promptsListMs": 0.0020410000001902517,
528
+ "resourcesListMs": 1.1717079999998532
511
529
  }
512
530
  }
@@ -1,6 +1,6 @@
1
1
  # MCP Observatory Run Report
2
2
 
3
- Generated at 2026-07-06T01:46:52.851Z
3
+ Generated at 2026-07-06T19:49:46.771Z
4
4
 
5
5
  ## Target and Environment Metadata
6
6
 
@@ -8,8 +8,8 @@ Generated at 2026-07-06T01:46:52.851Z
8
8
  - Adapter: `local-process`
9
9
  - Command: `npx -y @modelcontextprotocol/server-memory`
10
10
  - Server: `memory-server 0.6.3`
11
- - Platform: `darwin 24.0.0`
12
- - Node: `v25.8.1`
11
+ - Platform: `darwin 25.5.0`
12
+ - Node: `v22.22.1`
13
13
 
14
14
  ## Executive Summary
15
15
 
@@ -25,7 +25,7 @@ Generated at 2026-07-06T01:46:52.851Z
25
25
 
26
26
  | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
27
27
  | --- | --- | --- | --- | --- | --- | --- | --- |
28
- | pass | 7 | 5 | 0 | 1 | 1 | 0 | 0 |
28
+ | pass | 8 | 6 | 0 | 1 | 1 | 0 | 0 |
29
29
 
30
30
  ## At a Glance
31
31
 
@@ -47,16 +47,29 @@ _Use the `diff` command against another run artifact to classify regressions and
47
47
 
48
48
  | Focus | Check | Status | Duration (ms) | Message |
49
49
  | --- | --- | --- | --- | --- |
50
- | healthy | conformance | pass | 10.97 | All 7 conformance checks passed. |
51
- | healthy | resources | pass | 0.85 | Advertised capability responded with the minimal expected shape (1 items). |
52
- | healthy | security | pass | 3.84 | No security issues detected. |
53
- | healthy | security-lite | pass | 0.03 | No security issues detected (lightweight scan). |
54
- | healthy | tools | pass | 8.82 | Advertised capability responded with the minimal expected shape (9 items). |
55
- | review | schema-quality | partial | 4.12 | Found 4 quality finding(s) across 10 item(s): 0 warnings, 4 info. |
50
+ | healthy | attack-sim | pass | 3.87 | Safe attack simulation found no high-risk MCP attack-readiness findings. |
51
+ | healthy | conformance | pass | 9.35 | All 7 conformance checks passed. |
52
+ | healthy | resources | pass | 1.17 | Advertised capability responded with the minimal expected shape (1 items). |
53
+ | healthy | security | pass | 3.61 | No security issues detected. |
54
+ | healthy | security-lite | pass | 0.04 | No security issues detected (lightweight scan). |
55
+ | healthy | tools | pass | 7.62 | Advertised capability responded with the minimal expected shape (9 items). |
56
+ | review | schema-quality | partial | 4.08 | Found 4 quality finding(s) across 10 item(s): 0 warnings, 4 info. |
56
57
  | confirm intent | prompts | unsupported | 0.00 | Prompts are not advertised by the target. |
57
58
 
58
59
  ## Evidence Snippets
59
60
 
61
+ ### attack-sim — pass
62
+
63
+ Summary: Safe attack simulation found no high-risk MCP attack-readiness findings.
64
+
65
+ - Endpoint: `attack-sim/safe`
66
+ - Advertised: `true`
67
+ - Responded: `true`
68
+ - Minimal shape present: `true`
69
+ - Item count: `0`
70
+ - Identifiers: none
71
+ - Diagnostics: none
72
+
60
73
  ### conformance — pass
61
74
 
62
75
  Summary: All 7 conformance checks passed.
@@ -159,5 +172,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
159
172
 
160
173
  - Artifact type: `run`
161
174
  - Schema version: `1.0.0`
162
- - Run ID: `run_2026-07-06T014652851Z_87fbcb76`
175
+ - Run ID: `run_2026-07-06T194946771Z_35b0da26`
163
176
  - Gate: `pass`
@@ -2,9 +2,9 @@
2
2
  "artifactType": "run",
3
3
  "schemaVersion": "1.0.0",
4
4
  "gate": "pass",
5
- "runId": "run_2026-07-06T014700071Z_aaaf7fe5",
6
- "createdAt": "2026-07-06T01:47:00.071Z",
7
- "toolVersion": "0.26.1",
5
+ "runId": "run_2026-07-06T194953212Z_e649da15",
6
+ "createdAt": "2026-07-06T19:49:53.212Z",
7
+ "toolVersion": "0.28.0",
8
8
  "target": {
9
9
  "targetId": "opentofu-server",
10
10
  "adapter": "local-process",
@@ -25,12 +25,12 @@
25
25
  "serverVersion": "0.1.0"
26
26
  },
27
27
  "environment": {
28
- "platform": "darwin 24.0.0",
29
- "nodeVersion": "v25.8.1"
28
+ "platform": "darwin 25.5.0",
29
+ "nodeVersion": "v22.22.1"
30
30
  },
31
31
  "summary": {
32
- "total": 7,
33
- "pass": 5,
32
+ "total": 8,
33
+ "pass": 6,
34
34
  "fail": 0,
35
35
  "partial": 1,
36
36
  "unsupported": 1,
@@ -43,7 +43,7 @@
43
43
  "id": "tools",
44
44
  "capability": "tools",
45
45
  "status": "pass",
46
- "durationMs": 2.2472500000003492,
46
+ "durationMs": 1.897333000000799,
47
47
  "message": "Advertised capability responded with the minimal expected shape (5 items).",
48
48
  "evidence": [
49
49
  {
@@ -206,7 +206,7 @@
206
206
  "id": "prompts",
207
207
  "capability": "prompts",
208
208
  "status": "unsupported",
209
- "durationMs": 0.006666999999652035,
209
+ "durationMs": 0.005124999999679858,
210
210
  "message": "Prompts are not advertised by the target.",
211
211
  "evidence": [
212
212
  {
@@ -222,7 +222,7 @@
222
222
  "id": "resources",
223
223
  "capability": "resources",
224
224
  "status": "pass",
225
- "durationMs": 0.5788329999995767,
225
+ "durationMs": 0.5354160000006232,
226
226
  "message": "Advertised capability responded with the minimal expected shape (1 items).",
227
227
  "evidence": [
228
228
  {
@@ -251,7 +251,7 @@
251
251
  "id": "security-lite",
252
252
  "capability": "security-lite",
253
253
  "status": "pass",
254
- "durationMs": 0.032666999999491964,
254
+ "durationMs": 0.022249999999985448,
255
255
  "message": "No security issues detected (lightweight scan).",
256
256
  "evidence": [
257
257
  {
@@ -267,7 +267,7 @@
267
267
  "id": "conformance",
268
268
  "capability": "conformance",
269
269
  "status": "pass",
270
- "durationMs": 0.7163330000003043,
270
+ "durationMs": 0.7052499999990687,
271
271
  "message": "All 7 conformance checks passed.",
272
272
  "evidence": [
273
273
  {
@@ -293,7 +293,7 @@
293
293
  "id": "schema-quality",
294
294
  "capability": "schema-quality",
295
295
  "status": "partial",
296
- "durationMs": 0.5057919999999285,
296
+ "durationMs": 0.49095800000031886,
297
297
  "message": "Found 1 quality finding(s) across 6 item(s): 1 warnings, 0 info.",
298
298
  "evidence": [
299
299
  {
@@ -323,7 +323,7 @@
323
323
  "id": "security",
324
324
  "capability": "security",
325
325
  "status": "pass",
326
- "durationMs": 0.2513330000001588,
326
+ "durationMs": 0.15554200000042329,
327
327
  "message": "No security issues detected.",
328
328
  "evidence": [
329
329
  {
@@ -334,6 +334,23 @@
334
334
  "itemCount": 0
335
335
  }
336
336
  ]
337
+ },
338
+ {
339
+ "id": "attack-sim",
340
+ "capability": "attack-sim",
341
+ "status": "pass",
342
+ "durationMs": 0.4453749999993306,
343
+ "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
344
+ "evidence": [
345
+ {
346
+ "endpoint": "attack-sim/safe",
347
+ "advertised": true,
348
+ "responded": true,
349
+ "minimalShapePresent": true,
350
+ "itemCount": 0,
351
+ "identifiers": []
352
+ }
353
+ ]
337
354
  }
338
355
  ],
339
356
  "healthScore": {
@@ -362,7 +379,8 @@
362
379
  "score": 100,
363
380
  "details": [
364
381
  "security-lite: pass (100/100)",
365
- "security: pass (100/100)"
382
+ "security: pass (100/100)",
383
+ "attack-sim: pass (100/100)"
366
384
  ]
367
385
  },
368
386
  {
@@ -380,16 +398,16 @@
380
398
  "weight": 0.1,
381
399
  "score": 100,
382
400
  "details": [
383
- "Connect: 1133ms",
401
+ "Connect: 773ms",
384
402
  "p95 latency: 2ms (3 operations)"
385
403
  ]
386
404
  }
387
405
  ]
388
406
  },
389
407
  "performanceMetrics": {
390
- "connectMs": 1133.1395840000005,
391
- "toolsListMs": 2.2472500000003492,
392
- "promptsListMs": 0.006666999999652035,
393
- "resourcesListMs": 0.5788329999995767
408
+ "connectMs": 772.5637079999997,
409
+ "toolsListMs": 1.897333000000799,
410
+ "promptsListMs": 0.005124999999679858,
411
+ "resourcesListMs": 0.5354160000006232
394
412
  }
395
413
  }
@@ -1,6 +1,6 @@
1
1
  # MCP Observatory Run Report
2
2
 
3
- Generated at 2026-07-06T01:47:00.071Z
3
+ Generated at 2026-07-06T19:49:53.212Z
4
4
 
5
5
  ## Target and Environment Metadata
6
6
 
@@ -8,8 +8,8 @@ Generated at 2026-07-06T01:47:00.071Z
8
8
  - Adapter: `local-process`
9
9
  - Command: `npx -y @opentofu/opentofu-mcp-server`
10
10
  - Server: `opentofu 0.1.0`
11
- - Platform: `darwin 24.0.0`
12
- - Node: `v25.8.1`
11
+ - Platform: `darwin 25.5.0`
12
+ - Node: `v22.22.1`
13
13
 
14
14
  ## Executive Summary
15
15
 
@@ -25,7 +25,7 @@ Generated at 2026-07-06T01:47:00.071Z
25
25
 
26
26
  | Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
27
27
  | --- | --- | --- | --- | --- | --- | --- | --- |
28
- | pass | 7 | 5 | 0 | 1 | 1 | 0 | 0 |
28
+ | pass | 8 | 6 | 0 | 1 | 1 | 0 | 0 |
29
29
 
30
30
  ## At a Glance
31
31
 
@@ -47,16 +47,29 @@ _Use the `diff` command against another run artifact to classify regressions and
47
47
 
48
48
  | Focus | Check | Status | Duration (ms) | Message |
49
49
  | --- | --- | --- | --- | --- |
50
- | healthy | conformance | pass | 0.72 | All 7 conformance checks passed. |
51
- | healthy | resources | pass | 0.58 | Advertised capability responded with the minimal expected shape (1 items). |
52
- | healthy | security | pass | 0.25 | No security issues detected. |
53
- | healthy | security-lite | pass | 0.03 | No security issues detected (lightweight scan). |
54
- | healthy | tools | pass | 2.25 | Advertised capability responded with the minimal expected shape (5 items). |
55
- | review | schema-quality | partial | 0.51 | Found 1 quality finding(s) across 6 item(s): 1 warnings, 0 info. |
50
+ | healthy | attack-sim | pass | 0.45 | Safe attack simulation found no high-risk MCP attack-readiness findings. |
51
+ | healthy | conformance | pass | 0.71 | All 7 conformance checks passed. |
52
+ | healthy | resources | pass | 0.54 | Advertised capability responded with the minimal expected shape (1 items). |
53
+ | healthy | security | pass | 0.16 | No security issues detected. |
54
+ | healthy | security-lite | pass | 0.02 | No security issues detected (lightweight scan). |
55
+ | healthy | tools | pass | 1.90 | Advertised capability responded with the minimal expected shape (5 items). |
56
+ | review | schema-quality | partial | 0.49 | Found 1 quality finding(s) across 6 item(s): 1 warnings, 0 info. |
56
57
  | confirm intent | prompts | unsupported | 0.01 | Prompts are not advertised by the target. |
57
58
 
58
59
  ## Evidence Snippets
59
60
 
61
+ ### attack-sim — pass
62
+
63
+ Summary: Safe attack simulation found no high-risk MCP attack-readiness findings.
64
+
65
+ - Endpoint: `attack-sim/safe`
66
+ - Advertised: `true`
67
+ - Responded: `true`
68
+ - Minimal shape present: `true`
69
+ - Item count: `0`
70
+ - Identifiers: none
71
+ - Diagnostics: none
72
+
60
73
  ### conformance — pass
61
74
 
62
75
  Summary: All 7 conformance checks passed.
@@ -159,5 +172,5 @@ npm run cli -- report --run <path-to-run-artifact.json> --format markdown
159
172
 
160
173
  - Artifact type: `run`
161
174
  - Schema version: `1.0.0`
162
- - Run ID: `run_2026-07-06T014700071Z_aaaf7fe5`
175
+ - Run ID: `run_2026-07-06T194953212Z_e649da15`
163
176
  - Gate: `pass`