mcpprobe-scanner 0.2.0__tar.gz → 0.3.1__tar.gz

mcpprobe_scanner-0.3.1/CHANGELOG.md

@@ -0,0 +1,273 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project uses
+[Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.3.1] - 2026-11-01
+
+Fewer false tool-poisoning alarms. META-01 (tool poisoning) was flagging ordinary
+documentation in real MCP servers: tool descriptions that say "call this tool first",
+name a sibling tool, link to docs, or mention `~/.ssh` only to say such paths are
+rejected. 0.3.1 retunes those rules. On real tool descriptions from published MCP
+servers that were held out from the tuning, precision at medium or above rose from
+48.0% to 96.0% (false-positive rate 2.7% to 0.1%), and the share of server packages with at
+least one medium-or-above META-01 finding fell from 22.5% to 2.2% on the tuning set
+and from 25.6% to 2.6% on the held-out set. Recall on the project's poisoned texts is
+unchanged (77.4% at medium or above). Known-bad cases such as the demo's `run_command`
+and the 0.2.0 planted-instruction example are still High. Numbers and method:
+[docs/benchmark.md](docs/benchmark.md).
+
+### Changed
+
+- META-01 rules 0.3.1 (`RULES_VERSION`): usage guidance ("always use this tool to", "you
+  must call X first", "call this first when") is no longer an indicator on its own;
+  shadowing needs wording that changes what another tool does; dictionary-word tool names
+  count only when quoted; plain URLs and example.com addresses are not indicators; a
+  credential path is medium only after a read/send verb that is not negated; shadowing in
+  server instructions is low. On 3,762 real descriptions from 128 published MCP server
+  packages (`tests/data/meta01_real_benign.json`) the medium-or-above false-positive rate
+  fell from 2.8% to 0.1% (22.5% to 2.2% of packages); recall on the project's poisoned set
+  is unchanged at medium or above. See docs/benchmark.md.
+- Registry survey disclosure queue: an open server is descriptive. A host qualifies only
+  for META-05 secrets (P1), META-03 high/critical without authentication or AUTH-04 (P2),
+  META-01 high from current rules (P3) or META-07 without authentication (P4).
+
+### Added
+
+- `registry-report recheck` (re-run survey-profile checks on hosts with visible tools, or
+  `--from-queue`, under the same polite rules) and `registry-report reaggregate` (offline;
+  merges scan and recheck passes, re-runs static checks, prints before/after counts).
+- `disclosure-summary.json` (counts only), survey cross-tabs (capability and trifecta by
+  authentication, tool-count distribution, open servers with write/exec-capable tools) in
+  `aggregates.json` and the report; derived labels (`meta01_rules`, `meta01_indicators`,
+  `capabilities`) in `scan.jsonl`.
+
+- `mcpprobe registry-report fetch|scan|calibrate|aggregate|render` (also
+  `python -m mcpprobe.registry`): a resumable pipeline for an anonymised "State of MCP
+  server security" report over the official MCP Registry. It covers:
+  - paging the list API;
+  - remote and package-only selection;
+  - static META-01/06/07 on the tool definitions in registry entries;
+  - a passive survey-profile batch scan (opt-out first, 1 request/s per provider,
+    at most 8 hosts in parallel, public addresses only with pinned connections,
+    same origin only, stop on 429/403, no response bodies stored);
+  - aggregates with 95% Wilson intervals;
+  - a Markdown/SVG report that refuses to name third-party hosts.
+
+  See [docs/registry-report.md](docs/registry-report.md).
+
+## [0.3.0]
+
+Directory readiness, the 2026-07-28 protocol rules, tool annotations and toxic flows.
+Report schema 0.3 (additions only). 24 passive checks, up from 16.
+
+### Added
+
+- **META-06 Tool annotation lint.** Missing `readOnlyHint`, `openWorldHint` and title on
+  every tool, `destructiveHint`/`idempotentHint` on every tool not marked read-only (the
+  spec says they only mean something then), non-boolean hints, and annotations that
+  contradict the tool's apparent capability (read-only or non-destructive on something
+  that executes, writes, deletes, sends or pays; closed-world on a network tool). Medium
+  when a dangerous-class tool is mislabelled, low when annotations are only missing;
+  one finding lists every tool. Fix text cites Anthropic's directory policy (5E) and
+  OpenAI's app review.
+- **META-07 Toxic flow (lethal trifecta).** Warns when one server offers access to
+  private data, intake of untrusted content and a way to send data out, listing the
+  tools in each role. Medium; high when the endpoint needs no authentication. A tool
+  advertising arbitrary command execution counts for all three roles.
+- **2026-07-28 checks**, each verified against the specification text on
+  modelcontextprotocol.io and not applicable (with the negotiated revision as the
+  reason) on servers that speak an earlier revision:
+  - TRANS-06 `server/discover` result: `supportedVersions` including 2026-07-28,
+    `capabilities`, `resultType: "complete"`; missing `serverInfo` is informational.
+  - TRANS-07 a protocol version the server does not list in `supportedVersions` is
+    served instead of rejected with HTTP 400 / `UnsupportedProtocolVersionError`
+    (-32022): downgrade acceptance. One request.
+  - TRANS-08 `Mcp-Method` header that differs from the body, or is missing, is not
+    rejected with HTTP 400 / `HeaderMismatch` (-32020). Two requests. `Mcp-Name` is
+    not tested passively (it exists only for `tools/call`, `resources/read`,
+    `prompts/get`).
+  - TRANS-09 `ttlMs` (number >= 0) and `cacheScope` (`public`/`private`) missing or
+    invalid on `server/discover` and list results. Sends nothing.
+  - AUTH-05 authorization server metadata does not advertise
+    `authorization_response_iss_parameter_supported: true` (RFC 9207). Sends nothing.
+  - AUTH-06 deprecated Dynamic Client Registration offered without Client ID Metadata
+    Documents (low), or alongside them (informational). Sends nothing.
+  - "Deprecated HTTP+SSE still reachable" stays TRANS-04 (no new ID).
+- **Directory readiness** (`readiness` in the JSON report): Anthropic 5D/5E/2G/3F,
+  OpenAI annotations, HubSpot no-critical/high, exfiltration/poisoning risk and HTTPS,
+  each `met` / `not_met` / `not_assessable` with source URL, check IDs and a note.
+  Derived only from checks that ran; ownership (3F) is always not assessable from the CLI.
+- **Rate-limit handling.** HTTP 429 is honoured with `Retry-After` (1 s when absent), at
+  most 3 retries per request, within a scan-wide waiting budget (`--rate-limit-wait`,
+  default 30 s). When the budget is used up, the checks that met the throttled
+  responses are reported `not_applicable` (blocked) and their findings withheld,
+  instead of drawing conclusions from throttled responses. DOS-01's burst still
+  observes 429 directly. A target that rate-limits negotiation is reported
+  `unreachable`, not "not an MCP server".
+- **Optional Hugging Face judge for META-01** (`--judge hf:<model-id-or-path>`,
+  `--judge-download`, `--judge-threshold`; extra `mcpprobe-scanner[hf]`). Off by
+  default, safetensors only, no remote code, no download unless asked. Licence notes in
+  docs/judges.md.
+- `scripts/benchmark_judge.py` and docs/benchmark.md: precision, recall and false-positive
+  rate of META-01 on the in-sample corpus and on a new held-out set (65% recall at medium
+  or above, 0 false positives on 40 benign descriptions). The Hugging Face Hub was not
+  reachable when the numbers were produced, so no public dataset or classifier was scored.
+- Report schema 0.3: `checks[].blocked`, `fingerprint.supported_versions`, `readiness`.
+- Fixture `trifecta` (a conformant 2026-07-28 server whose tools form the trifecta); all
+  its check outcomes are pinned in CI.
+
+### Changed
+
+- Annotation contradictions moved from META-03 to META-06 (reported once). META-03 is
+  now titled "Dangerous tool capability exposed". E-mail and payment tools count as
+  writes only when a mutating verb (send, charge, refund, ...) is present, so a
+  read-only `list_emails` marked `readOnlyHint: true` is no longer a contradiction.
+- 2026-07-28 requests now carry the required `io.modelcontextprotocol/clientCapabilities`
+  and the recommended `clientInfo` in `_meta`.
+- The fingerprint reads `supportedVersions` and `_meta["io.modelcontextprotocol/serverInfo"]`
+  from `server/discover` as the 2026-07-28 schema defines them (the pre-release keys are
+  no longer merged into `server_info`).
+- The `hardened` fixture is now dual-era (2026-07-28 and 2025-11-25) with
+  spec-conformant `server/discover`, header validation, caching hints, RFC 9207 and
+  CIMD metadata; it still produces zero findings.
+
+### GitHub Action
+
+- The Action now names its outcome: one annotation per run (`mcpprobe: findings`,
+  `mcpprobe: not an MCP server`, `mcpprobe: scan error`, or a `mcpprobe: passed`
+  notice), a job summary with a severity table, and a new `result` output (`clean`,
+  `findings`, `error`, `not-mcp`). Exit code 3 (not an MCP server) is documented in
+  the `exit-code` output. `sarif-file` is empty when no SARIF was written.
+- `action.yml` description shortened to 115 characters for GitHub Marketplace.
+- README and new `docs/github-action.md` pin `@v0.3.0` and upload SARIF only for exit
+  codes 0 and 1: SARIF from an error or a non-MCP target has no results and would
+  close every open alert. New manual-only example workflow
+  `.github/workflows/example-scan.yml`.
+
+
+## [0.2.0]
+
+Accuracy release, driven by an independent review of a 0.1.0 scan of the project's own
+deliberately weak demo server. 0.1.0 missed the demo's textbook tool poisoning,
+reported four checks as passed that had tested nothing, and rated an unauthenticated
+remote shell low. All of that is fixed and pinned by fixtures in CI.
+
+- Licence changes from MIT to Apache-2.0 for future releases. Version 0.1.0 remains available under MIT.
+
+### Fixed
+
+- **META-01 missed obvious poisoning.** It now detects instructions aimed at the model
+  ("always call this first", "call this tool before any other", "you must", "do not
+  tell the user", "ignore previous instructions"), requests to send the model's context
+  out (conversation, chat history, system prompt, previous messages), requests to
+  harvest the user's secrets, and HTML comments, in tool, argument, prompt and resource
+  descriptions. A directive combined with a context-exfiltration request is high. The
+  demo's `run_command` description is now reported high. Several 0.1 patterns that
+  fired on benign text ("Read the file at the given path", "Forward an email",
+  "Silently ignores unknown fields", "Operating system: Linux", "rather than the user's
+  timezone") were tightened; a corpus of 33 benign real-world descriptions must stay
+  below medium in the test-suite.
+- **Checks no longer report "passed" for things they did not test.** New check status
+  `not_applicable` (with a one-sentence reason and an optional `related_to`), raised
+  through `NotApplicable`. Every early exit was audited: AUTH-03/AUTH-04 are not
+  applicable when the server needs no authentication (related to AUTH-01), TRANS-03
+  when no `Mcp-Session-Id` is issued, META-* when no tool metadata could be read,
+  ERR-01/DOS-01 when every probe was stopped at authentication, META-02 without a
+  previous baseline, TRANS-01/TRANS-02 when a 401/429 hides the behaviour. Transport
+  failures are now `error`, not a pass. Reporters count only `ran` with no findings
+  as passed; SARIF lists not-applicable checks as notifications, never as passes.
+- **AUTH-02 passed when the metadata was missing.** Missing RFC 9728 metadata is now a
+  finding on unauthenticated servers too (medium on public hosts, low on loopback).
+- **AUTH-01 misreported servers scanned with credentials.** When `--header` supplies
+  credentials, one extra request is sent with them removed; a 401/403 marks the server
+  protected. AUTH-04's query-string probe no longer carries the operator's own token.
+- **Not an MCP server.** A target that answers but does not speak MCP (for example an
+  ordinary web site) no longer aborts with a generic error or produces results: the
+  report has `target_kind: "not_mcp"`, every check is not applicable with the
+  observation ("Not an MCP server: initialize -> HTTP 200 text/html"), and the CLI
+  exits with the new code 3. Unreachable targets get `target_kind: "unreachable"`
+  (exit 2, as before).
+
+### Changed
+
+- **META-03 rates by capability.** Tools that advertise arbitrary command execution or
+  arbitrary file read/write (a shell or file capability selected by a free-form string
+  argument) are high on their own and critical on an unauthenticated public endpoint.
+  The fix text says to remove or sandbox the tool with an allow-list; annotations come
+  after. The description states that a passive scan sees the advertised capability, not
+  whether the implementation really executes. Annotation contradictions are one finding
+  listing every affected tool. Check title updated accordingly.
+- **One finding per check per root cause.** META-04 emits one finding listing every
+  affected tool, with each tool's complete `inputSchema` and its specific problems
+  (including arguments missing from `required` and `additionalProperties` not false).
+- **Evidence and proof.** Every finding has `proof` (the complete object judged, built
+  from parsed data), `verify` (one runnable line, a `curl` against the real target for
+  HTTP), `affected`, `evidence_ids`, and `confidence_reason` whenever confidence is not
+  high (enforced). Evidence keeps every request and response header, with credential
+  headers redacted, and bodies up to 64 KiB (was 4 KiB).
+- **Environment-aware fix text.** The edge is detected from response headers
+  (`apigw-requestid`/`x-amz-apigw-id` -> AWS API Gateway, CloudFront, Cloudflare
+  `cf-ray`, Vercel `x-vercel-id`) and public vs local hosts are told apart. TRANS-05 and
+  DOS-01 say where to configure TLS, headers and throttling; AUTH-01 and TRANS-01 drop
+  "bind to 127.0.0.1" on public hosts. AUTH-01 shows the exact `WWW-Authenticate` header
+  with the target's metadata URL and notes that authentication does not make a shell
+  tool safe. TRANS-01 also probes and advises on `Origin: null` and allows requests with
+  no Origin. TRANS-02 mentions version negotiation on `initialize`.
+- **Attack chains.** New top-level `chains`: CHAIN-01 (unauthenticated + arbitrary
+  capability, + poisoned description when META-01 fired on that tool, critical) and
+  CHAIN-02 (the same on a local server that accepts foreign Origins). A chain is only
+  emitted when every constituent finding is present.
+- Report schema 0.2 (`schema_version`, `target_kind`, `environment`, `chains`, the new
+  finding fields, `checks[].related_to`, `summary.checks_passed` /
+  `checks_not_applicable`), documented in `docs/report-schema.md`.
+
+### Tests
+
+- Fixtures pinned in CI: an exact replica of the public demo server (`--preset demo`),
+  the observable passive behaviour of a hardened reference server (`--preset
+  hardened`), and an ordinary HTML site (`--preset html`). The exact outcome of every
+  check against each is asserted; any change fails the suite.
+
+## [0.1.0]
+
+- Published on PyPI as `mcpprobe-scanner` (PyPI blocks `mcpprobe` and `mcpprobe-cli` as too similar to existing projects). The command and the Python package are both `mcpprobe`.
+ - 2026-10-27
+
+First public release of the open-source scanner core.
+
+### Added
+
+- MCP client for Streamable HTTP (JSON-RPC over POST, JSON or SSE responses)
+  and stdio, written to send deliberately non-conformant requests.
+- Protocol fingerprinting: `server/discover` (2026-07-28) first, then
+  `initialize` with 2025-11-25 and 2025-06-18, then the deprecated
+  2024-11-05 HTTP+SSE transport.
+- Evidence log: every request/response with timestamp, method, status, a
+  header subset, bodies truncated to 4 KB, `Authorization` values and known
+  secret patterns redacted.
+- Passive checks: AUTH-01..04, TRANS-01..05, META-01..05, ERR-01, DOS-01.
+- Active checks INJ-01..05, SUPPLY-01/02 and SANDBOX-01 registered as gated
+  stubs (report `not_implemented`; no payloads are sent).
+- Governance items GOV-01..05 listed as attestation-only in every report.
+- Authorisation gate for active mode: `--authorised-by`, `--scope` and
+  ownership verification (`--verify dns-txt` via `_mcpprobe.<host>` TXT, or
+  `--verify local` for stdio); an authorisation record JSON is written next to
+  the report.
+- Opt-out: DNS TXT `mcpprobe-opt-out=all` at `_mcpprobe.<host>` and
+  `/.well-known/mcpprobe-opt-out`, both checked before any MCP request.
+- Rate limiting: 5 requests/second by default, hard ceiling 10.
+- Reports: JSON (with evidence), SARIF 2.1.0 (validated against the official
+  schema in tests) and a rich terminal summary. Exit codes 0 / 1 / 2.
+- META-02 baselines: canonical SHA-256 of tools, prompts, resources and
+  instructions with diffing against a stored baseline (rug-pull detection).
+- Optional LLM-judge hook for META-01 (`ScanOptions.judge`); mcpprobe makes no
+  LLM or third-party network calls itself.
+- Docker container GitHub Action, CI (ruff, strict mypy, pytest on Python
+  3.11 to 3.13) and PyPI Trusted Publishing release workflow.
+
+[0.3.1]: https://github.com/mcpprobe-dev/mcpprobe/releases/tag/v0.3.1
+[0.1.0]: https://github.com/mcpprobe-dev/mcpprobe/releases/tag/v0.1.0

{mcpprobe_scanner-0.2.0 → mcpprobe_scanner-0.3.1}/CHECKS.md

@@ -1,6 +1,6 @@
 # mcpprobe checks catalogue
 
-Generated from the check metadata of mcpprobe 0.2.0 (`mcpprobe checks --format markdown`). Do not edit by hand.
+Generated from the check metadata of mcpprobe 0.3.1 (`mcpprobe checks --format markdown`). Do not edit by hand.
 
 Standards: OWASP MCP Top 10 (IDs `MCP0x:2025`, still a beta list, so shown with `(beta)`), OWASP Top 10 for Agentic Applications (`ASI0x`), OWASP Top 10 for LLM Applications 2026 (`LLM0x:2026`, primary) and 2025 (`LLM0x:2025`, kept for one release cycle). Severities are defaults; a check can raise or lower the severity of an individual finding (for example loopback-only servers are reported one level lower), and heuristic checks never rate a finding Critical on their own.
 
@@ -14,16 +14,24 @@ Passive checks send only what a normal MCP client would send plus a few benign m
 | [AUTH-02](#auth-02---protected-resource-metadata-rfc-9728-missing-or-invalid) | passive | high | Protected resource metadata (RFC 9728) missing or invalid | MCP07:2025 (beta) |
 | [AUTH-03](#auth-03---authorization-server-metadata-weak-or-missing-pkce-s256--https) | passive | high | Authorization server metadata weak or missing (PKCE S256 / HTTPS) | MCP07:2025 (beta), MCP01:2025 (beta) |
 | [AUTH-04](#auth-04---server-accepts-a-self-minted-token-with-the-wrong-audienceissuer) | passive | critical | Server accepts a self-minted token with the wrong audience/issuer | MCP07:2025 (beta), MCP01:2025 (beta), ASI03 |
+| [AUTH-05](#auth-05---authorization-server-does-not-advertise-rfc-9207-iss-support-2026-07-28) | passive | low | Authorization server does not advertise RFC 9207 iss support (2026-07-28) | MCP07:2025 (beta) |
+| [AUTH-06](#auth-06---deprecated-dynamic-client-registration-offered-2026-07-28) | passive | low | Deprecated Dynamic Client Registration offered (2026-07-28) | MCP07:2025 (beta) |
 | [TRANS-01](#trans-01---origin-header-not-validated-dns-rebinding-exposure) | passive | medium | Origin header not validated (DNS-rebinding exposure) | MCP07:2025 (beta) |
 | [TRANS-02](#trans-02---unsupported-mcp-protocol-version-header-not-rejected) | passive | low | Unsupported MCP-Protocol-Version header not rejected | MCP spec conformance / hygiene (no OWASP item) |
 | [TRANS-03](#trans-03---weak-predictable-or-unvalidated-mcp-session-id) | passive | high | Weak, predictable or unvalidated Mcp-Session-Id | MCP07:2025 (beta) |
 | [TRANS-04](#trans-04---deprecated-httpsse-2024-11-05-transport-in-use) | passive | info | Deprecated HTTP+SSE (2024-11-05) transport in use | MCP spec conformance / hygiene (no OWASP item) |
 | [TRANS-05](#trans-05---plain-http-weak-tls-or-missing-security-headers) | passive | high | Plain HTTP, weak TLS or missing security headers | MCP01:2025 (beta) |
+| [TRANS-06](#trans-06---serverdiscover-result-incomplete-2026-07-28) | passive | low | server/discover result incomplete (2026-07-28) | MCP spec conformance / hygiene (no OWASP item) |
+| [TRANS-07](#trans-07---protocol-version-the-server-does-not-advertise-is-accepted-downgrade) | passive | low | Protocol version the server does not advertise is accepted (downgrade) | MCP spec conformance / hygiene (no OWASP item) |
+| [TRANS-08](#trans-08---mcp-method-header-not-validated-against-the-request-body-2026-07-28) | passive | medium | Mcp-Method header not validated against the request body (2026-07-28) | MCP spec conformance / hygiene (no OWASP item) |
+| [TRANS-09](#trans-09---ttlms--cachescope-caching-hints-missing-or-invalid-2026-07-28) | passive | low | ttlMs / cacheScope caching hints missing or invalid (2026-07-28) | MCP spec conformance / hygiene (no OWASP item) |
 | [META-01](#meta-01---possible-tool-description-poisoning) | passive | high | Possible tool-description poisoning | MCP03:2025 (beta), ASI01, ASI04, LLM01:2026, LLM01:2025 |
 | [META-02](#meta-02---tool-surface-changed-since-the-stored-baseline-rug-pull-indicator) | passive | medium | Tool surface changed since the stored baseline (rug-pull indicator) | MCP03:2025 (beta), ASI04 |
-| [META-03](#meta-03---dangerous-tool-capability-exposed-or-annotations-contradict-it) | passive | high | Dangerous tool capability exposed or annotations contradict it | MCP02:2025 (beta), MCP05:2025 (beta), ASI02, ASI05, LLM03:2026, LLM06:2025 |
+| [META-03](#meta-03---dangerous-tool-capability-exposed) | passive | high | Dangerous tool capability exposed | MCP02:2025 (beta), MCP05:2025 (beta), ASI02, ASI05, LLM03:2026, LLM06:2025 |
 | [META-04](#meta-04---tool-schema-hygiene-problems) | passive | low | Tool schema hygiene problems | MCP05:2025 (beta) |
 | [META-05](#meta-05---secret-material-in-server-metadata-or-configuration) | passive | high | Secret material in server metadata or configuration | MCP01:2025 (beta), LLM02:2026, LLM02:2025 |
+| [META-06](#meta-06---tool-annotations-missing-or-inconsistent-with-the-tool) | passive | medium | Tool annotations missing or inconsistent with the tool | MCP spec conformance / hygiene (no OWASP item) |
+| [META-07](#meta-07---toxic-flow-private-data-untrusted-content-and-external-send-on-one-server) | passive | medium | Toxic flow: private data, untrusted content and external send on one server | ASI01, LLM01:2026, LLM01:2025 |
 | [ERR-01](#err-01---verbose-error-responses-leak-stack-traces-paths-or-versions) | passive | medium | Verbose error responses leak stack traces, paths or versions | MCP08:2025 (beta), LLM02:2026, LLM02:2025 |
 | [DOS-01](#dos-01---no-visible-limits-on-request-size-nesting-or-rate) | passive | low | No visible limits on request size, nesting or rate | ASI08, LLM06:2026, LLM10:2025 |
 | [INJ-01](#inj-01---commandcode-injection-safe-canaries) | active | critical | Command/code injection (safe canaries) | MCP05:2025 (beta), ASI05, LLM10:2026 |
@@ -106,6 +114,38 @@ Mints two syntactically valid JWTs the server cannot have issued (HS256 with a r
 
 **Fix.** Validate the token signature against the authorization server's keys, require 'aud' to equal this server's canonical URI (RFC 8707), reject alg=none, and never read tokens from query strings.
 
+### AUTH-05 - Authorization server does not advertise RFC 9207 iss support (2026-07-28)
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | low |
+| Transports | http |
+| Standards | MCP07:2025 (beta) |
+| Evidence | The authorization server metadata document AUTH-03 fetched. |
+
+2026-07-28 says MCP authorization servers SHOULD include the RFC 9207 'iss' parameter in authorization responses and, when they do, MUST advertise authorization_response_iss_parameter_supported: true in their metadata; clients reject a response without iss only when that flag is true. Reads the authorization server metadata AUTH-03 already fetched and reports a flag that is absent or not true. Sends nothing. The revision says this SHOULD is expected to become a MUST.
+
+**False positives.** The spec allows a server to emit iss before it updates its metadata; such a server is reported until the flag is published, because clients key their rejection on the flag.
+
+**Fix.** Include iss in every authorization response, error responses too (RFC 9207 section 2), and publish "authorization_response_iss_parameter_supported": true in the authorization server metadata (https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization#authorization-response-validation). With a hosted identity provider, enable its issuer-identification option.
+
+### AUTH-06 - Deprecated Dynamic Client Registration offered (2026-07-28)
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | low |
+| Transports | http |
+| Standards | MCP07:2025 (beta) |
+| Evidence | The authorization server metadata document AUTH-03 fetched. |
+
+2026-07-28 deprecates OAuth Dynamic Client Registration (RFC 7591) in favour of Client ID Metadata Documents, which authorization servers SHOULD support. Reads the authorization server metadata AUTH-03 already fetched: a registration_endpoint without client_id_metadata_document_supported: true is low (clients have only the deprecated path); a registration_endpoint next to CIMD support is informational (kept for backwards compatibility). No registration request is sent.
+
+**False positives.** Keeping DCR for older clients is allowed; the informational finding is a reminder to plan its removal, not a defect. An authorization server that supports neither DCR nor CIMD (pre-registration only) is not reported here.
+
+**Fix.** Support Client ID Metadata Documents and advertise "client_id_metadata_document_supported": true; keep registration_endpoint only while older clients still need it, and plan its removal (https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration). Open registration endpoints also deserve rate limits and redirect-URI validation.
+
 ### TRANS-01 - Origin header not validated (DNS-rebinding exposure)
 
 | | |
@@ -186,6 +226,70 @@ Flags non-loopback endpoints served over plain HTTP (bearer tokens in clear), TL
 
 **Fix.** Serve the endpoint over HTTPS with TLS 1.2+ only, add Strict-Transport-Security and X-Content-Type-Options: nosniff. Where an edge (API Gateway, CloudFront, Cloudflare, Vercel) is detected the fix text says where to configure it.
 
+### TRANS-06 - server/discover result incomplete (2026-07-28)
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | low |
+| Transports | http, stdio |
+| Standards | MCP spec conformance / hygiene (no OWASP item) |
+| Evidence | The fingerprinting server/discover request and its complete result. |
+
+A 2026-07-28 server MUST implement server/discover. The scanner's first request is server/discover; when it is answered, its result is checked for what the revision requires: supportedVersions (a list of version strings that includes the 2026-07-28 revision the request was served under), a capabilities object and resultType 'complete'. A missing _meta['io.modelcontextprotocol/serverInfo'] (SHOULD) is reported as informational. Caching hints on the same result are checked by TRANS-09. Not applicable to servers that speak an earlier revision through initialize.
+
+**False positives.** A server that answers server/discover under an earlier result shape (for example a 'protocolVersions' key from a pre-release draft) is reported, because 2026-07-28 clients read 'supportedVersions'.
+
+**Fix.** Return the DiscoverResult defined in the 2026-07-28 schema: {"resultType":"complete","supportedVersions":["2026-07-28", ...],"capabilities":{...},"_meta":{"io.modelcontextprotocol/serverInfo":{"name":...,"version":...}},"ttlMs":...,"cacheScope":"public"} (https://modelcontextprotocol.io/specification/2026-07-28/server/discover).
+
+### TRANS-07 - Protocol version the server does not advertise is accepted (downgrade)
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | low |
+| Transports | http |
+| Standards | MCP spec conformance / hygiene (no OWASP item) |
+| Evidence | The server/discover result (supportedVersions) and the downgraded request with its response. |
+
+Takes supportedVersions from the server/discover result and sends one more server/discover declared (in _meta and in the MCP-Protocol-Version header) as the newest earlier revision the server does not list (2025-11-25, 2025-06-18 or 2025-03-26). The spec says a server that does not implement the requested version MUST answer HTTP 400 with UnsupportedProtocolVersionError (-32022). Serving the request anyway means a client or intermediary can push the server onto a revision it claims not to support, without the header validation and other protections of 2026-07-28. One request, no tool is called.
+
+**False positives.** A dual-era server that does serve the older revision but forgot to list it is reported too; listing it in supportedVersions is then the fix. Not applicable when every earlier revision is advertised.
+
+**Fix.** Reject any request whose declared protocol version is not in your supportedVersions with HTTP 400 and {"code":-32022,"message":"Unsupported protocol version","data":{"supported":[...],"requested":"..."}}, before doing any work (https://modelcontextprotocol.io/specification/2026-07-28/basic/versioning). If you do serve the older revision, list it in supportedVersions.
+
+### TRANS-08 - Mcp-Method header not validated against the request body (2026-07-28)
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | medium |
+| Transports | http |
+| Standards | MCP spec conformance / hygiene (no OWASP item) |
+| Evidence | Both probe requests (headers shown) and their responses. |
+
+2026-07-28 requires clients to mirror the JSON-RPC method into an Mcp-Method header, and servers that process the body MUST reject a request whose headers are missing or do not match the body with HTTP 400 and HeaderMismatch (-32020); otherwise a gateway that routes, rate-limits or authorises on the header can be bypassed by a body that says something else. Sends two server/discover requests: one with 'Mcp-Method: tools/list' and one with no Mcp-Method header. Mcp-Name is not tested, because it is only defined for tools/call, resources/read and prompts/get, which a passive scan does not send.
+
+**False positives.** A server that rejects the probes with another 4xx is reported as informational only. When a gateway in front rejects mismatches itself, the finding concerns the server behind it only if the gateway can be bypassed.
+
+**Fix.** Before dispatching, compare Mcp-Method (and, for tools/call, resources/read and prompts/get, the decoded Mcp-Name) with the body; when a required header is missing or differs, answer HTTP 400 with {"code":-32020,"message":"Header mismatch: ..."} (https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http#server-validation).
+
+### TRANS-09 - ttlMs / cacheScope caching hints missing or invalid (2026-07-28)
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | low |
+| Transports | http, stdio |
+| Standards | MCP spec conformance / hygiene (no OWASP item) |
+| Evidence | The server/discover and list results the scan already received. |
+
+2026-07-28 servers MUST include caching hints on complete results of server/discover, tools/list, prompts/list and resources/list (among others): ttlMs, a number of milliseconds that MUST be >= 0, and cacheScope, either 'public' or 'private'. Checks the results the scan already received; sends nothing. A missing cacheScope leaves shared gateways to guess whether a list may be served to other users.
+
+**False positives.** Only the first page of each list is checked. A public cacheScope on an authenticated server is allowed by the spec when the list is the same for every user, so it is not reported.
+
+**Fix.** Add "ttlMs": <milliseconds, >= 0> and "cacheScope": "public" (identical for every user) or "private" (depends on the caller's authorization) to every cacheable result (https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/caching).
+
 ### META-01 - Possible tool-description poisoning
 
 | | |
@@ -196,9 +300,9 @@ Flags non-loopback endpoints served over plain HTTP (bearer tokens in clear), TL
 | Standards | MCP03:2025 (beta), ASI01, ASI04, LLM01:2026, LLM01:2025 |
 | Evidence | The tools/list (or prompts/resources/initialize) response and the matched excerpts. |
 
-Scans every tool, prompt and resource description, every inputSchema parameter description and the server 'instructions' for: prompt-style markup (<IMPORTANT>, <system>, HTML comments), instructions aimed at the model (call this first / before any other tool, you must, conceal from the user, ignore previous instructions, redirect/replace), requests to send the model's context out (conversation, chat history, system prompt, previous messages), requests to harvest secrets (the user's API key, token, password, credentials, .env), credential file paths, references to other tools with behaviour-modifying language (shadowing), URLs and e-mail addresses with send/BCC wording, base64 blobs, zero-width/bidi/tag Unicode, mixed-script homoglyphs and excessive length. Findings carry tiered confidence and are never rated Critical on heuristics alone. A model directive combined with a request to send context out is rated high. Precision is guarded by a corpus of benign real-world descriptions in the test-suite that must stay below medium.
+Scans every tool, prompt and resource description, every inputSchema parameter description and the server 'instructions' for: prompt-style markup (<IMPORTANT>, <system>, HTML comments), instructions aimed at the model (conceal from the user, ignore previous instructions, claim precedence over every other tool or over what the user asks, redirect/replace), requests to send the model's context out (conversation, chat history, system prompt, previous messages), requests to harvest secrets (the user's API key, token, password, credentials, .env), credential file paths next to a read/send verb, wording that changes what another tool does (shadowing), URLs and e-mail addresses with send/BCC wording, base64 blobs, zero-width/bidi/tag Unicode, mixed-script homoglyphs and excessive length. Ordinary usage guidance ("always use this tool to...", "you must call X first") is not an indicator on its own; it raises a finding to high when combined with another instruction category. Findings carry tiered confidence and are never rated Critical on heuristics alone. Precision is guarded in the test-suite by thousands of real descriptions from published MCP servers (docs/benchmark.md).
 
-**False positives.** Legitimate guidance such as 'IMPORTANT: call authenticate before this tool' matches the markup and prerequisite heuristics at medium confidence. URLs to documentation and mentions of sibling tools without behaviour-modifying words are reported at low severity. Review the matched excerpts; a second-opinion judge can be plugged in through the Python API (ScanOptions.judge); mcpprobe itself makes no LLM calls.
+**False positives.** Legitimate text that claims precedence over every other tool ('call this before any other tool whenever...') is reported at medium. Plain URLs, sibling-tool mentions and usage guidance are not reported; a credential path without a read/send verb is low. Review the matched excerpts; a second-opinion judge can be plugged in through the Python API (ScanOptions.judge); mcpprobe itself makes no LLM calls.
 
 **Fix.** Rewrite the description so it only says what the tool does. Remove every instruction addressed to the model (when to call it, what to call first, what to hide from the user) and every request to pass along conversation, prompts, files or credentials. Strip invisible Unicode and HTML comments, and never reference other servers' tools. Pin and hash approved descriptions in clients (see META-02).
 
@@ -218,7 +322,7 @@ Computes SHA-256 over the canonical JSON of each tool, prompt and resource defin
 
 **Fix.** Treat tool definitions as code: version them, review changes, and have clients pin and re-approve definitions when the hash changes.
 
-### META-03 - Dangerous tool capability exposed or annotations contradict it
+### META-03 - Dangerous tool capability exposed
 
 | | |
 |---|---|
@@ -228,11 +332,11 @@ Computes SHA-256 over the canonical JSON of each tool, prompt and resource defin
 | Standards | MCP02:2025 (beta), MCP05:2025 (beta), ASI02, ASI05, LLM03:2026, LLM06:2025 |
 | Evidence | The tools/list response; each affected tool's complete definition is shown as proof. |
 
-Classifies each tool by name, description and parameter names into capability classes. Tools that advertise arbitrary command execution, arbitrary file read or arbitrary file write (a shell/file capability selected by a free-form string argument with no enum, const or pattern) are rated high on their own and critical when the remote endpoint needs no authentication. Declared annotations are cross-checked (a command tool marked readOnlyHint:true is reported), and the remaining high-impact surface (network, e-mail, credentials, payments) is summarised at low severity. Passive scanning sees the advertised capability, not whether the implementation really executes: the rating is based on the name, description and schema, and no tool is called.
+Classifies each tool by name, description and parameter names into capability classes. Tools that advertise arbitrary command execution, arbitrary file read or arbitrary file write (a shell/file capability selected by a free-form string argument with no enum, const or pattern) are rated high on their own and critical when the remote endpoint needs no authentication. The remaining high-impact surface (network, e-mail, credentials, payments) is summarised at low severity. Annotations that contradict the capability are reported by META-06 (until 0.2 they were reported here). Passive scanning sees the advertised capability, not whether the implementation really executes: the rating is based on the name, description and schema, and no tool is called.
 
 **False positives.** Classification is keyword-based: a tool named 'delete_draft' that only removes the user's own draft will be classed 'delete'. A tool that advertises a shell but whose implementation is a stub is still reported, because clients and models act on the advertised capability.
 
-**Fix.** For arbitrary command execution or file access: remove the tool, or sandbox it and replace the free-form argument with an allow-list (enum) of commands or files. Annotations come after that. Make annotations truthful (destructiveHint:true for anything that executes or deletes); they help a careful client warn the user but do nothing about the risk.
+**Fix.** For arbitrary command execution or file access: remove the tool, or sandbox it and replace the free-form argument with an allow-list (enum) of commands or files. Annotations come after that (META-06); they help a careful client warn the user but do nothing about the risk.
 
 ### META-04 - Tool schema hygiene problems
 
@@ -266,6 +370,38 @@ Pattern and entropy scan for AWS/GitHub/Slack/Stripe/Google keys, private key bl
 
 **Fix.** Remove secrets from descriptions and resources, rotate anything that was exposed, and pass credentials through the environment or a secret store, never through metadata.
 
+### META-06 - Tool annotations missing or inconsistent with the tool
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | medium |
+| Transports | http, stdio |
+| Standards | MCP spec conformance / hygiene (no OWASP item) |
+| Evidence | The tools/list response; each affected tool's name, title and annotations are shown as proof. |
+
+Reads each tool's annotations from tools/list. Reported as missing: readOnlyHint, openWorldHint and a title (tool.title or annotations.title) on every tool, and destructiveHint and idempotentHint on every tool not marked readOnlyHint:true (the spec says those two are meaningful only when readOnlyHint is false). Reported as inconsistent: readOnlyHint:true on a tool that looks like it executes, writes, deletes, sends or pays; destructiveHint:false on a tool that looks like it executes, deletes or overwrites; openWorldHint:false on a tool that reaches the network; a hint that is not a boolean; and, as low-severity noise, destructiveHint:true on a tool that only appears to read. Medium when a dangerous-class tool is mislabelled, low when annotations are merely missing. One finding lists every affected tool. Anthropic's directory policy (5E) and OpenAI's app review both require accurate annotations.
+
+**False positives.** The capability behind a contradiction is inferred from keywords in the tool's name, description and parameter names, so a narrowly scoped tool (for example 'delete_draft' that only removes the caller's own draft) may be misread. Missing annotations are a plain observation. Annotations are hints that clients must treat as untrusted; correcting them does not change what a tool can do.
+
+**Fix.** Give every tool a title and set readOnlyHint and openWorldHint explicitly; for tools that are not read-only also set destructiveHint and idempotentHint. Make each value true to the implementation: readOnlyHint:true only when nothing is modified, destructiveHint:true for anything that executes, deletes or overwrites, openWorldHint:true for tools that reach the internet or other external systems. Anthropic's Software Directory Policy (5E, https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy) requires all applicable annotations, and OpenAI's app review (https://developers.openai.com/plugins/deploy/app-review.md) checks readOnlyHint, destructiveHint and openWorldHint for accuracy.
+
+### META-07 - Toxic flow: private data, untrusted content and external send on one server
+
+| | |
+|---|---|
+| Mode | passive (implemented) |
+| Default severity | medium |
+| Transports | http, stdio |
+| Standards | ASI01, LLM01:2026, LLM01:2025 |
+| Evidence | The tools/list response; each role lists its tools and the wording that put them there. |
+
+Classifies every advertised tool into three roles from its capability class and wording: access to private data (files, databases, credentials, the user's mail), intake of untrusted content (fetching URLs, web search, reading mail or messages written by others) and a way to send data out (sending e-mail or messages, HTTP posts, webhooks, uploads). A tool advertising arbitrary command execution counts for all three; arbitrary file read counts as private data. When one server offers all three roles, text planted in the untrusted content can instruct the model to read the private data and send it away: the 'lethal trifecta' of prompt injection. Medium, high when the HTTP endpoint needs no authentication. One finding lists the tools in each role. No tool is called.
+
+**False positives.** Roles are inferred from names, descriptions and capability keywords, not from behaviour. A 'fetch' tool restricted to one internal API, or a 'send' tool that only notifies the signed-in user, is still counted. Conversely a fetch tool with a free-form URL can leak data through the URL itself; that path is not counted as a send role.
+
+**Fix.** Break the trifecta: split the tools across separate servers (or separate client configurations) so no single agent session combines private data, untrusted content and an outbound channel; or gate the send tool behind explicit per-call user confirmation and an allow-list of destinations; or constrain the intake tool to trusted sources. Keep the server authenticated so nobody else can drive the combination.
+
 ### ERR-01 - Verbose error responses leak stack traces, paths or versions
 
 | | |

{mcpprobe_scanner-0.2.0 → mcpprobe_scanner-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpprobe-scanner
-Version: 0.2.0
+Version: 0.3.1
 Summary: Security scanner for Model Context Protocol (MCP) servers: auth, transport, tool-metadata and poisoning checks with JSON and SARIF output.
 Project-URL: Homepage, https://mcpprobe.tech
 Project-URL: Scanning policy, https://mcpprobe.tech/scanning-policy
@@ -35,6 +35,10 @@ Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.4; extra == 'dev'
+Provides-Extra: hf
+Requires-Dist: safetensors>=0.4; extra == 'hf'
+Requires-Dist: torch>=2.2; extra == 'hf'
+Requires-Dist: transformers>=4.40; extra == 'hf'
 Description-Content-Type: text/markdown
 
 # mcpprobe
@@ -84,16 +88,40 @@ which checks ran, which were skipped and why. `mcpprobe checks` lists every chec
 
 | Area | Checks | Examples |
 |---|---|---|
-| Authentication | AUTH-01..04 | endpoint answers without credentials; missing RFC 9728 protected-resource metadata; no PKCE S256; accepts a self-minted JWT with the wrong audience; token accepted in the query string |
-| Transport | TRANS-01..05 | `Origin` not validated (DNS rebinding); bogus `MCP-Protocol-Version` accepted; weak or forgeable `Mcp-Session-Id`; deprecated HTTP+SSE; plain HTTP, weak TLS, missing headers |
-| Tool metadata | META-01..05 | instructions aimed at the model ("always call this first", "do not tell the user"), requests to send conversation, system prompt or secrets out, cross-tool shadowing, credential paths, URLs, base64, HTML comments, zero-width/bidi/homoglyph Unicode; rug-pull diff against a stored SHA-256 baseline; advertised arbitrary command execution or file access (high, critical when unauthenticated) and annotations that contradict capability; schema hygiene; secrets in descriptions or stdio env |
+| Authentication | AUTH-01..06 | endpoint answers without credentials; missing RFC 9728 protected-resource metadata; no PKCE S256; accepts a self-minted JWT with the wrong audience; token accepted in the query string; 2026-07-28: authorization server does not advertise RFC 9207 `iss`, deprecated Dynamic Client Registration without Client ID Metadata Documents |
+| Transport | TRANS-01..09 | `Origin` not validated (DNS rebinding); bogus `MCP-Protocol-Version` accepted; weak or forgeable `Mcp-Session-Id`; deprecated HTTP+SSE still served; plain HTTP, weak TLS, missing headers; 2026-07-28: incomplete `server/discover` result, a version the server does not advertise accepted (downgrade), `Mcp-Method` header/body mismatch not rejected with -32020, missing or invalid `ttlMs`/`cacheScope` |
+| Tool metadata | META-01..07 | instructions aimed at the model ("always call this first", "do not tell the user"), requests to send conversation, system prompt or secrets out, cross-tool shadowing, credential paths, URLs, base64, HTML comments, zero-width/bidi/homoglyph Unicode; rug-pull diff against a stored SHA-256 baseline; advertised arbitrary command execution or file access (high, critical when unauthenticated); schema hygiene; secrets in descriptions or stdio env; tool annotations missing or contradicting the tool (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`, title); the "lethal trifecta" of private data, untrusted content and an outbound channel on one server |
 | Robustness | ERR-01, DOS-01 | stack traces and versions in errors; one oversized argument, one 64-deep nesting probe and 20 paced `tools/list` calls, never more |
 | Active (gated stubs) | INJ-01..05, SUPPLY-01/02, SANDBOX-01 | registered and reported as `not_implemented` in this release |
 | Governance | GOV-01..05 | listed as attestation-only: not assessable by a scan, never marked passed |
 
+24 passive checks (plus 8 gated active stubs and 5 attestation-only governance items);
+`mcpprobe checks` lists them.
+
 Protocol revisions: the scanner tries `server/discover` (2026-07-28) first, then
 `initialize` with 2025-11-25 and 2025-06-18, then the deprecated 2024-11-05 HTTP+SSE
-transport, and records which one answered.
+transport, and records which one answered. Checks for rules that only exist in
+2026-07-28 are reported not applicable, with the negotiated revision as the reason,
+on servers that speak an earlier one.
+
+## Directory readiness
+
+Every JSON report carries a `readiness` list that maps the scan onto the listing
+requirements of the Anthropic, OpenAI and HubSpot MCP directories (OAuth 2.0, complete
+and accurate tool annotations, no hidden instructions, no unresolved critical/high
+findings, low exfiltration and poisoning risk, HTTPS). Each item is `met`, `not_met` or
+`not_assessable`, cites its source and names the checks it rests on; it is derived only
+from checks that actually ran, and anything a scan cannot decide (such as proof of
+endpoint ownership) is `not_assessable` with the reason. See
+[docs/report-schema.md](docs/report-schema.md).
+
+## Rate limits on the target
+
+An HTTP 429 is honoured: the request is repeated after `Retry-After` (1 s if absent),
+within a total waiting budget for the whole scan (`--rate-limit-wait`, 30 s by default).
+When the budget is used up, the checks whose requests were throttled are reported
+not applicable instead of drawing conclusions from throttled responses. DOS-01's burst
+is the exception: a 429 there is the evidence it looks for.
 
 ## Passive vs active
 
@@ -142,6 +170,14 @@ opt-outs (below), but those are courtesy mechanisms, not permission.
   - an HTTP `200` at `/.well-known/mcpprobe-opt-out`.
 - Rate: 5 requests/second by default (`--rate`), hard ceiling 10.
 
+## Registry survey report
+
+`mcpprobe registry-report` builds an anonymised, aggregate-only report on the remote
+servers listed in the official MCP Registry. It uses a reduced passive profile (only what
+an ordinary MCP client sends) and honours opt-outs. It paces traffic at 1 request per
+second per provider and stops at the first 429 or 403. How to run it and the disclosure
+process are in [docs/registry-report.md](docs/registry-report.md).
+
 ## Exit codes
 
 | Code | Meaning |
@@ -166,19 +202,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: mcpprobe-dev/mcpprobe@v0.1.0
+      - uses: mcpprobe-dev/mcpprobe@v0.3.1
+        id: scan
         with:
           target: https://staging.your-server.example/mcp
           fail-on: high
           sarif-output: mcpprobe.sarif
           sarif-location: src/server.py   # optional: anchor alerts to a repo file
+      # Upload only when the scan ran (exit 0 or 1). Exit 2 (error) and 3 (not an MCP
+      # server) produce SARIF with no results, which would close every open alert.
       - uses: github/codeql-action/upload-sarif@v3
-        if: always()
+        if: ${{ !cancelled() && (steps.scan.outputs.exit-code == '0' || steps.scan.outputs.exit-code == '1') }}
         with:
           sarif_file: mcpprobe.sarif
           category: mcpprobe
 ```
 
+Inputs, outputs, exit codes and a manual-dispatch example are in
+[docs/github-action.md](docs/github-action.md).
+
 Or from any CI with the CLI:
 
 ```console
@@ -216,6 +258,20 @@ description after approval is the classic rug pull) and update the file; use
 Server-supplied text is shown with control characters made visible and is never
 interpreted as terminal markup.
 
+## Optional classifier for META-01
+
+```console
+$ pip install 'mcpprobe-scanner[hf]'     # transformers, torch, safetensors
+$ mcpprobe https://your-server.example/mcp --judge hf:/path/to/local/model
+$ mcpprobe https://your-server.example/mcp --judge hf:<hub-model-id> --judge-download
+```
+
+Off by default. A local prompt-injection classifier gives META-01 a second opinion; it
+adds a medium-severity indicator when it flags a description. Only `.safetensors`
+weights are loaded, model code is never executed, and nothing is downloaded unless you
+pass `--judge-download`. Model licences differ; read [docs/judges.md](docs/judges.md)
+first. Detection numbers for the heuristics are in [docs/benchmark.md](docs/benchmark.md).
+
 ## Python API and LLM-judge hook
 
 ```python