mcpprobe-scanner 0.3.1__tar.gz → 0.3.3__tar.gz

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/CHANGELOG.md

@@ -6,6 +6,65 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.3.3] - 2026-11-03
+
+Findings in one report no longer share an identity. Nothing about what the checks
+detect has changed.
+
+### Fixed
+
+- A report could contain the same finding identity more than once. A finding was
+  identified by its check ID and location only, but several checks report more than one
+  thing at the same location (TRANS-03 weak and forged session IDs, TRANS-05 plain HTTP
+  and missing security headers, ERR-01 verbose errors and the `Server` header, META-03
+  arbitrary and high-impact capabilities; also AUTH-03, AUTH-04, DOS-01, META-02, META-04
+  and TRANS-04), so their SARIF results shared a `partialFingerprints` value and
+  code-scanning tools could merge them. A server that
+  listed the same tool twice also made META-01 and META-05 report the same finding twice,
+  which counted it twice in `counts`.
+- Each finding now has a `uid` (`<check id>:<location>`, plus `:<variant>` where a check
+  reports more than one thing at one location) that is unique within the report and is
+  used as the SARIF fingerprint. Findings reported twice with identical content are
+  merged into one, keeping the evidence of both, so `counts`, `max_severity`,
+  `findings_max_severity`, attack chains and SARIF results all come from the same
+  de-duplicated list. `id` and SARIF `ruleId` are unchanged (still the check ID).
+- AUTH-03 assesses an authorization server listed twice in the protected resource
+  metadata once.
+
+### Changed
+
+- JSON report: findings have new `uid` and `variant` fields (schema stays 0.3; fields
+  were only added). A finding without a variant keeps the SARIF fingerprint it had in
+  0.3.2; findings that now have a variant get a new one, so code scanning may close the
+  old alert and open a new one for them once.
+
+## [0.3.2] - 2026-11-02
+
+Two counting fixes. Nothing about what the checks detect has changed.
+
+### Fixed
+
+- Attack chains were left out of the summary counts and the pass/fail decision. A scan
+  could list a CRITICAL `CHAIN-01` while the summary line said "critical 0", and
+  `--fail-on critical` passed (exit 0) because no single finding was critical. The
+  terminal now prints a second count line for attack chains under the findings line, for
+  example `Attack chains  critical 1  high 1 ... (2 chains, built from the findings counted
+  above)`. Chains are counted on their own line, not added to the findings counts, because
+  each chain is made of findings that are already counted. The exit code and the
+  `Result:` line now take chains into account, and the `Result:` line says whether
+  findings, attack chains or both reached the threshold.
+- The JSON summary has a new `chain_counts` field and a `findings_max_severity` field;
+  `max_severity` is now the worst of findings and attack chains (the value the exit code
+  uses). SARIF run properties have a new `chainCounts`. `counts` is unchanged: findings
+  only, one per SARIF result.
+- The GitHub Action's annotation and job summary mention attack chains and show them in
+  their own column.
+- Registry survey funnel: a remote URL listed more than once (by a second entry, or as
+  both streamable-http and SSE) was dropped without being counted, so `remote_urls` minus
+  the exclusions did not equal `unique_hosts` (36,687 - 9,976 = 26,711, not 26,617). These
+  are now counted as `duplicate_url`, the summary has `selected_urls`, and the funnel adds
+  up exactly. Re-run `reaggregate` to correct an existing `aggregates.json`.
+
 ## [0.3.1] - 2026-11-01
 
 Fewer false tool-poisoning alarms. META-01 (tool poisoning) was flagging ordinary

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/CHECKS.md

@@ -1,6 +1,6 @@
 # mcpprobe checks catalogue
 
-Generated from the check metadata of mcpprobe 0.3.1 (`mcpprobe checks --format markdown`). Do not edit by hand.
+Generated from the check metadata of mcpprobe 0.3.3 (`mcpprobe checks --format markdown`). Do not edit by hand.
 
 Standards: OWASP MCP Top 10 (IDs `MCP0x:2025`, still a beta list, so shown with `(beta)`), OWASP Top 10 for Agentic Applications (`ASI0x`), OWASP Top 10 for LLM Applications 2026 (`LLM0x:2026`, primary) and 2025 (`LLM0x:2025`, kept for one release cycle). Severities are defaults; a check can raise or lower the severity of an individual finding (for example loopback-only servers are reported one level lower), and heuristic checks never rate a finding Critical on their own.
 

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcpprobe-scanner
-Version: 0.3.1
+Version: 0.3.3
 Summary: Security scanner for Model Context Protocol (MCP) servers: auth, transport, tool-metadata and poisoning checks with JSON and SARIF output.
 Project-URL: Homepage, https://mcpprobe.tech
 Project-URL: Scanning policy, https://mcpprobe.tech/scanning-policy
@@ -182,8 +182,8 @@ process are in [docs/registry-report.md](docs/registry-report.md).
 
 | Code | Meaning |
 |---|---|
-| `0` | No finding at or above `--fail-on` (default `high`) |
-| `1` | At least one finding at or above `--fail-on` |
+| `0` | No finding or attack chain at or above `--fail-on` (default `high`) |
+| `1` | At least one finding or attack chain at or above `--fail-on` |
 | `2` | Error: target unreachable, bad arguments, ownership verification failed, authorisation refused, or the target opted out |
 | `3` | The target answered but is not an MCP server (for example an ordinary web site); every check is reported not applicable and nothing passes |
 
@@ -202,7 +202,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: mcpprobe-dev/mcpprobe@v0.3.1
+      - uses: mcpprobe-dev/mcpprobe@v0.3.3
         id: scan
         with:
           target: https://staging.your-server.example/mcp

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/README.md

@@ -139,8 +139,8 @@ process are in [docs/registry-report.md](docs/registry-report.md).
 
 | Code | Meaning |
 |---|---|
-| `0` | No finding at or above `--fail-on` (default `high`) |
-| `1` | At least one finding at or above `--fail-on` |
+| `0` | No finding or attack chain at or above `--fail-on` (default `high`) |
+| `1` | At least one finding or attack chain at or above `--fail-on` |
 | `2` | Error: target unreachable, bad arguments, ownership verification failed, authorisation refused, or the target opted out |
 | `3` | The target answered but is not an MCP server (for example an ordinary web site); every check is reported not applicable and nothing passes |
 
@@ -159,7 +159,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: mcpprobe-dev/mcpprobe@v0.3.1
+      - uses: mcpprobe-dev/mcpprobe@v0.3.3
         id: scan
         with:
           target: https://staging.your-server.example/mcp

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/docs/github-action.md

@@ -32,7 +32,7 @@ jobs:
 
       - name: Scan the MCP server
         id: scan
-        uses: mcpprobe-dev/mcpprobe@v0.3.1
+        uses: mcpprobe-dev/mcpprobe@v0.3.3
         with:
           target: https://staging.your-server.example/mcp
           fail-on: high
@@ -61,7 +61,7 @@ A manually triggered version with a URL input lives in
 | Input | Required | Default | Meaning |
 |---|---|---|---|
 | `target` | yes | | MCP endpoint URL (Streamable HTTP), for example `https://staging.example.com/mcp`. |
-| `fail-on` | no | `high` | Fail the step when any finding is at or above this severity: `info`, `low`, `medium`, `high`, `critical`. |
+| `fail-on` | no | `high` | Fail the step when any finding or attack chain is at or above this severity: `info`, `low`, `medium`, `high`, `critical`. |
 | `rate` | no | `5` | Maximum requests per second, 0.1 to 10 (10 is a hard ceiling). |
 | `sarif-output` | no | `mcpprobe.sarif` | Where to write SARIF 2.1.0, relative to the workspace. |
 | `sarif-location` | no | target URL | Repository file to anchor results to. Without it, results point at the endpoint URL, which code scanning shows without a file link. |
@@ -82,8 +82,8 @@ A manually triggered version with a URL input lives in
 
 | Code | `result` | Meaning | What to do |
 |---|---|---|---|
-| `0` | `clean` | No finding at or above `fail-on`. Lower findings are still in the SARIF. | Upload SARIF. |
-| `1` | `findings` | At least one finding at or above `fail-on`. | Upload SARIF; fix or triage the alerts. |
+| `0` | `clean` | No finding or attack chain at or above `fail-on`. Lower findings are still in the SARIF. | Upload SARIF. |
+| `1` | `findings` | At least one finding or attack chain at or above `fail-on`. | Upload SARIF; fix or triage the alerts. |
 | `2` | `error` | Target unreachable, bad input, the target opted out, or authorisation refused. | Read the step log. Do not upload. |
 | `3` | `not-mcp` | The URL answered, but not as an MCP server (for example an HTML page or the wrong path). Nothing was checked and nothing passed. | Fix the URL or the deployment. Do not upload. |
 
@@ -100,8 +100,9 @@ known false positives, in text and Markdown), a `helpUri`, `security-severity`
 (critical 9.5, high 7.5, medium 5.0, low 2.5, info 0.5), and tags: `security`, `mcp`,
 the mode, and the OWASP MCP Top 10, Agentic (ASI) and LLM Top 10 IDs. Levels are
 `error` for critical and high, `warning` for medium, `note` for low and info. Each
-result carries a stable `partialFingerprints` key (check ID + target), so alerts stay
-the same across runs. Checks that were not applicable or skipped appear as tool
+result carries a stable `partialFingerprints` key (the finding's `uid`: check ID +
+location, plus a variant where one check reports several things at one location), so
+alerts stay the same across runs and no two results in one run share it. Checks that were not applicable or skipped appear as tool
 notifications on the analysis, never as passes.
 
 ## Limits and gotchas
@@ -109,7 +110,7 @@ notifications on the analysis, never as passes.
 - **Reachability.** The container runs on the runner's Docker network, so
   `127.0.0.1` inside it is not the runner. To scan a server started earlier in the
   same job, use the CLI instead of the Action:
-  `pipx run --spec mcpprobe-scanner==0.3.1 mcpprobe http://127.0.0.1:8000/mcp --sarif mcpprobe.sarif`.
+  `pipx run --spec mcpprobe-scanner==0.3.3 mcpprobe http://127.0.0.1:8000/mcp --sarif mcpprobe.sarif`.
   For a remote target, it must be reachable from GitHub-hosted runners.
 - **Private repositories** need GitHub Code Security (Advanced Security) for code
   scanning uploads. Without it, keep the scan step as the gate and save
@@ -121,6 +122,6 @@ notifications on the analysis, never as passes.
   plans to deprecate v3; `upload-sarif@v4` takes the same inputs. Switch when your
   organisation does.
 - **Active mode** (`extra-args: --active ...`) also needs `--authorised-by`,
-  `--scope` and `--verify dns-txt`; see the README. In 0.3.1 the active checks are
+  `--scope` and `--verify dns-txt`; see the README. In 0.3.3 the active checks are
   stubs.
-- **Pin a version.** Use `@v0.3.1` (or a full commit SHA), not `@main`.
+- **Pin a version.** Use `@v0.3.3` (or a full commit SHA), not `@main`.

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/docs/registry-report.md

@@ -47,6 +47,10 @@ These rules are in code, not in this document only. The tests in
   loopback, private, CGNAT, link-local or reserved address. The connection is pinned to
   the vetted address; TLS still verifies the hostname through SNI. IP-literal URLs,
   templated URLs (`{tenant}`) and local names are dropped before scanning.
+- **Funnel arithmetic.** Every listed remote URL is either selected or counted under exactly
+  one reason in `funnel.excluded` (`duplicate_host`: another URL on a host already selected;
+  `duplicate_url` *(0.3.2)*: the same URL listed again by another entry or transport), so
+  `remote_urls - sum(excluded) == selected_urls == unique_hosts` with one URL per host.
 - **Same origin only.** A request to any host other than the target is refused.
 - **Stop on refusal.** The first HTTP 429 or 403 stops all traffic to that rate key for
   the rest of the run and for resumed runs. `Retry-After` is not waited out.

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/docs/report-schema.md

@@ -24,7 +24,7 @@ or removed.
 | `readiness` *(0.3)* | array | Directory listing readiness, see below. Always present (for `not_mcp`/`unreachable` every item is `not_assessable`). |
 | `attestations` | array | Governance items a scan cannot assess. |
 | `notes` | array of string | |
-| `summary` | object | `counts` per severity, `max_severity`, `target_kind`, `checks_passed`, `checks_with_findings`, `checks_not_applicable`, `checks_applicable`, `checks_ran`, `checks_skipped`, `checks_not_implemented`, `checks_error`. |
+| `summary` | object | `counts` per severity (findings only), `chain_counts` *(0.3.2, attack chains per severity; each chain is built from findings already in `counts`)*, `max_severity` (from 0.3.2 the worst of findings and chains, the value the exit code uses), `findings_max_severity` *(0.3.2)*, `target_kind`, `checks_passed`, `checks_with_findings`, `checks_not_applicable`, `checks_applicable`, `checks_ran`, `checks_skipped`, `checks_not_implemented`, `checks_error`. |
 | `evidence` | array | Every request/response pair. |
 
 ## `checks[]`
@@ -52,6 +52,8 @@ A check whose requests were rate limited beyond the budget is reported
 | Field | Meaning |
 |---|---|
 | `id`, `title`, `severity`, `confidence`, `standards`, `description`, `fix`, `location`, `details`, `false_positive_notes` | As in 0.1. |
+| `uid` *(0.3.3)* | Identity of the finding, unique within the report and stable across scans: `<id>:<location or ->`, plus `:<variant>` when set. `id` is the check ID, which several findings can share; `uid` tells them apart. It is also the SARIF `partialFingerprints["mcpprobe/v1"]` value. |
+| `variant` *(0.3.3)* | `null` for a check's main finding; a short name (e.g. `forged-session-id`, `plain-http`, `server-header`) for another finding the same check reports at the same location. When two findings would still share a `uid` but say different things (for example two tools listed under the same name with different descriptions), each gets an 8-character variant derived from its content. A finding reported twice with identical content (for example because the server listed the same tool twice) appears once, with the evidence of both. |
 | `confidence_reason` *(0.2)* | One sentence; always present when `confidence` is not `high`. |
 | `verify` *(0.2)* | One runnable line that confirms the fix (a `curl` for HTTP targets, using the real target URL; `$TOKEN` where credentials are needed). |
 | `affected` *(0.2)* | Tools, headers or paths affected. A check emits one finding per root cause, listing every affected item. |

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/__init__.py

@@ -13,7 +13,7 @@ The package is organised as follows:
 
 from __future__ import annotations
 
-__version__ = "0.3.1"
+__version__ = "0.3.3"
 
 POLICY_URL = "https://mcpprobe.tech/scanning-policy"
 USER_AGENT = f"mcpprobe/{__version__} (+{POLICY_URL})"

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/action.py

@@ -6,8 +6,8 @@ always writes SARIF, records outputs in ``$GITHUB_OUTPUT``, writes a job
 summary to ``$GITHUB_STEP_SUMMARY``, emits one workflow annotation that names
 the outcome, and exits with the scanner's exit code:
 
-- 0 clean (no finding at or above ``fail-on``)
-- 1 findings at or above ``fail-on``
+- 0 clean (no finding or attack chain at or above ``fail-on``)
+- 1 a finding or attack chain at or above ``fail-on``
 - 2 error (unreachable target, bad input, opt-out, authorisation refused)
 - 3 the target answered but is not an MCP server (wrong URL or path)
 
@@ -89,19 +89,49 @@ def sarif_counts(path: Path) -> dict[str, int]:
     return counts
 
 
-def describe(code: int, target: str, fail_on: str, counts: Mapping[str, int]) -> tuple[str, str, str]:
+def sarif_chain_counts(path: Path) -> dict[str, int]:
+    """Count attack chains (``runs[].properties.chains``) per severity; empty when unreadable.
+
+    Chains are not SARIF results: each one is built from findings that are already
+    results, so they are counted on their own.
+    """
+    counts = dict.fromkeys(_SEVERITIES, 0)
+    try:
+        data: Any = json.loads(path.read_text(encoding="utf-8"))
+        for run in data.get("runs", []):
+            for chain in run.get("properties", {}).get("chains", []):
+                sev = str(chain.get("severity", "info"))
+                counts[sev if sev in counts else "info"] += 1
+    except (OSError, ValueError, AttributeError):
+        return {}
+    return counts
+
+
+def describe(
+    code: int,
+    target: str,
+    fail_on: str,
+    counts: Mapping[str, int],
+    chain_counts: Mapping[str, int] | None = None,
+) -> tuple[str, str, str]:
     """Return (annotation level, title, message) for an exit code."""
     total = sum(counts.values())
     breakdown = ", ".join(f"{counts[s]} {s}" for s in _SEVERITIES if counts.get(s))
+    chain_counts = chain_counts or {}
+    chains = sum(chain_counts.values())
+    chain_breakdown = ", ".join(f"{chain_counts[s]} {s}" for s in _SEVERITIES if chain_counts.get(s))
+    chain_text = f" and {chains} attack chain(s) built from them ({chain_breakdown})" if chains else ""
     if code == EXIT_CLEAN:
-        found = f" ({breakdown} below the threshold)" if breakdown else ""
-        return "notice", "mcpprobe: passed", f"No finding at or above '{fail_on}' on {target}{found}."
+        below = ", ".join(x for x in (breakdown, f"attack chains: {chain_breakdown}" if chains else "") if x)
+        found = f" ({below} below the threshold)" if below else ""
+        what = "finding or attack chain" if chains else "finding"
+        return "notice", "mcpprobe: passed", f"No {what} at or above '{fail_on}' on {target}{found}."
     if code == EXIT_FINDINGS:
         return (
             "error",
             "mcpprobe: findings",
-            f"{total} finding(s) on {target} ({breakdown}); at least one is at or above '{fail_on}'. "
-            "See the job summary or the code scanning alerts.",
+            f"{total} finding(s) on {target} ({breakdown}){chain_text}; at least one is at or above "
+            f"'{fail_on}'. See the job summary or the code scanning alerts.",
         )
     if code == EXIT_NOT_MCP:
         return (
@@ -119,7 +149,14 @@ def describe(code: int, target: str, fail_on: str, counts: Mapping[str, int]) ->
     )
 
 
-def _summary(code: int, target: str, fail_on: str, counts: Mapping[str, int], message: str) -> str:
+def _summary(
+    code: int,
+    target: str,
+    fail_on: str,
+    counts: Mapping[str, int],
+    message: str,
+    chain_counts: Mapping[str, int] | None = None,
+) -> str:
     lines = [
         "## mcpprobe MCP security scan",
         "",
@@ -130,8 +167,13 @@ def _summary(code: int, target: str, fail_on: str, counts: Mapping[str, int], me
         "",
     ]
     if code in (EXIT_CLEAN, EXIT_FINDINGS) and counts:
-        lines += ["| Severity | Findings |", "|---|---|"]
-        lines += [f"| {s} | {counts[s]} |" for s in _SEVERITIES]
+        if chain_counts and sum(chain_counts.values()):
+            lines += ["| Severity | Findings | Attack chains |", "|---|---|---|"]
+            lines += [f"| {s} | {counts[s]} | {chain_counts.get(s, 0)} |" for s in _SEVERITIES]
+            lines += ["", "Each attack chain is built from findings counted in the Findings column."]
+        else:
+            lines += ["| Severity | Findings |", "|---|---|"]
+            lines += [f"| {s} | {counts[s]} |" for s in _SEVERITIES]
         lines.append("")
     lines.append(
         "Docs: https://mcpprobe.tech · checks: https://github.com/mcpprobe-dev/mcpprobe/blob/main/CHECKS.md"
@@ -157,7 +199,8 @@ def run(env: Mapping[str, str] | None = None) -> int:
     fail_on = argv[argv.index("--fail-on") + 1]
     sarif = argv[argv.index("--sarif") + 1]
     counts = sarif_counts(Path(sarif))
-    level, title, message = describe(code, target, fail_on, counts)
+    chain_counts = sarif_chain_counts(Path(sarif))
+    level, title, message = describe(code, target, fail_on, counts, chain_counts)
     print(f"::{level} title={_escape_property(title)}::{_escape(message)}", file=sys.stderr)
     out = env.get("GITHUB_OUTPUT")
     if out:
@@ -168,7 +211,7 @@ def run(env: Mapping[str, str] | None = None) -> int:
     summary = env.get("GITHUB_STEP_SUMMARY")
     if summary:
         with Path(summary).open("a", encoding="utf-8") as fh:
-            fh.write(_summary(code, target, fail_on, counts, message))
+            fh.write(_summary(code, target, fail_on, counts, message, chain_counts))
     return code
 
 

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/checks/auth.py

@@ -401,7 +401,7 @@ class Auth03AuthorizationServerMetadata(Check):
                 "metadata is missing (AUTH-02).",
                 related_to="AUTH-02",
             )
-        servers = [s for s in prm.get("authorization_servers") or [] if isinstance(s, str)]
+        servers = list(dict.fromkeys(s for s in prm.get("authorization_servers") or [] if isinstance(s, str)))
         if not servers:
             raise NotApplicable(
                 "The protected resource metadata lists no authorization server (AUTH-02).",
@@ -501,6 +501,7 @@ class Auth03AuthorizationServerMetadata(Check):
                         confidence=Confidence.HIGH,
                         evidence=evidence_of(*responses),
                         location=issuer,
+                        variant="plain-http-endpoints",
                         details={"insecure_endpoints": insecure},
                         affected=insecure,
                         proof=doc_proof,
@@ -511,6 +512,7 @@ class Auth03AuthorizationServerMetadata(Check):
                 findings.append(
                     self.finding(
                         title="Authorization server issuer mismatch",
+                        variant="issuer-mismatch",
                         description=f"Metadata issuer {doc['issuer']!r} differs from advertised {issuer!r}.",
                         severity=Severity.LOW,
                         confidence=Confidence.MEDIUM,
@@ -625,6 +627,8 @@ class Auth04TokenAudienceAndPassthrough(Check):
                         else "The response was 2xx but carried no JSON-RPC result, so acceptance is inferred from the status only.",
                         evidence=evidence_of(resp),
                         location=ctx.target,
+                        # Both self-minted tokens can be accepted; the second needs its own uid.
+                        variant=None if label == "HS256/random-key" else "alg-none",
                         details={"probe": label, "claims": now_claims},
                         affected=[label],
                         proof=proof.exchange(

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/checks/base.py

@@ -186,6 +186,7 @@ class Check(abc.ABC):
         confidence: Confidence = Confidence.HIGH,
         evidence: list[EvidenceRecord] | None = None,
         location: str | None = None,
+        variant: str | None = None,
         fix: str | None = None,
         details: dict[str, Any] | None = None,
         title: str | None = None,
@@ -198,7 +199,9 @@ class Check(abc.ABC):
         """Build a :class:`Finding` pre-filled from the check's metadata.
 
         ``excerpt`` overrides the evidence excerpt that is otherwise derived from
-        the first evidence record. A finding whose confidence is not high must
+        the first evidence record. ``variant`` must be set on every finding after
+        the first that the check can report at the same ``location`` in one scan,
+        so each finding keeps a distinct, stable ``uid``. A finding whose confidence is not high must
         say why (``confidence_reason``); this is enforced so no label goes unexplained.
         """
         records = [e for e in (evidence or []) if e is not None]
@@ -215,6 +218,7 @@ class Check(abc.ABC):
             evidence=records,
             evidence_excerpt=excerpt if excerpt is not None else evidence_excerpt(records),
             location=location,
+            variant=variant,
             details=details or {},
             false_positive_notes=self.false_positive_notes or None,
             confidence_reason=confidence_reason,

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/checks/baseline.py

@@ -204,6 +204,7 @@ class Meta02RugPullBaseline(Check):
             out.append(
                 self.finding(
                     title="Tools removed since baseline",
+                    variant="removed",
                     description="Removed tools: " + ", ".join(tools["removed"]) + ".",
                     severity=Severity.INFO,
                     confidence=Confidence.HIGH,

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/checks/metadata.py

@@ -206,6 +206,7 @@ class Meta03DangerousCapabilitySurface(Check):
             findings.append(
                 self.finding(
                     title="High-impact tool capabilities exposed",
+                    variant="high-impact",
                     description="Tools classified as high-impact: "
                     + summary
                     + ". Review that each is necessary, scoped and gated by user approval.",
@@ -354,6 +355,7 @@ class Meta04SchemaHygiene(Check):
             findings.append(
                 self.finding(
                     title="Duplicate tool names",
+                    variant="duplicate-names",
                     description="Tool names listed more than once: " + ", ".join(dupes) + ".",
                     severity=Severity.MEDIUM,
                     confidence=Confidence.HIGH,

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/checks/robustness.py

@@ -165,6 +165,7 @@ class Err01VerboseErrors(Check):
             findings.append(
                 self.finding(
                     title="Server header discloses software version",
+                    variant="server-header",
                     description=f"Server: {server_header}",
                     severity=Severity.INFO,
                     confidence=Confidence.HIGH,
@@ -281,6 +282,7 @@ class Dos01UnboundedConsumption(Check):
                 findings.append(
                     self.finding(
                         title=f"Server struggled with {label} request",
+                        variant=f"{label}-probe",
                         description=f"The {label} probe produced: {problem}. Input limits may be missing.",
                         severity=Severity.LOW if "slow" in problem else Severity.MEDIUM,
                         confidence=Confidence.MEDIUM,

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/checks/transport_conformance.py

@@ -360,6 +360,7 @@ class Trans03SessionIdQuality(Check):
             findings.append(
                 self.finding(
                     title="Forged session ID accepted",
+                    variant="forged-session-id",
                     description=(
                         "tools/list with a random, never-issued Mcp-Session-Id was answered with a "
                         "result. The server does not validate session IDs (spec: 404 for unknown sessions)."
@@ -461,6 +462,7 @@ class Trans04DeprecatedTransport(Check):
             findings.append(
                 self.finding(
                     title="Pre-2025-06-18 protocol revision negotiated",
+                    variant="old-revision",
                     description=f"The server negotiated protocol revision {fp.protocol_version}, "
                     "which predates the current authorization and transport requirements.",
                     severity=Severity.INFO,
@@ -521,6 +523,7 @@ class Trans05TlsAndHeaders(Check):
             findings.append(
                 self.finding(
                     title="MCP endpoint served over plain HTTP",
+                    variant="plain-http",
                     description=(
                         "The endpoint is reachable over unencrypted HTTP; bearer tokens, session IDs "
                         "and tool data travel in the clear."
@@ -546,6 +549,7 @@ class Trans05TlsAndHeaders(Check):
             findings.append(
                 self.finding(
                     title="Weak TLS version negotiated",
+                    variant="weak-tls",
                     description=f"The connection negotiated {http.tls_version}.",
                     severity=Severity.MEDIUM,
                     confidence=Confidence.HIGH,

{mcpprobe_scanner-0.3.1 → mcpprobe_scanner-0.3.3}/mcpprobe/cli.py

@@ -2,8 +2,8 @@
 
 ``mcpprobe <target>`` is shorthand for ``mcpprobe scan <target>``.
 
-Exit codes: 0 = no findings at or above ``--fail-on``; 1 = findings at or
-above ``--fail-on``; 2 = error (unreachable target, opt-out, authorisation
+Exit codes: 0 = no finding or attack chain at or above ``--fail-on``; 1 = a
+finding or attack chain at or above ``--fail-on``; 2 = error (unreachable target, opt-out, authorisation
 refused, bad arguments).
 """
 
@@ -112,7 +112,7 @@ def _parse_kv(values: Sequence[str], what: str, sep: str) -> dict[str, str]:
     default="high",
     type=click.Choice(SEVERITIES),
     show_default=True,
-    help="Exit 1 if any finding is at or above this severity.",
+    help="Exit 1 if any finding or attack chain is at or above this severity.",
 )
 @click.option(
     "--json", "json_path", type=click.Path(dir_okay=False), help="Write the JSON report (with evidence) here."