{
  "executive_summary": {
    "badge": "Caution",
    "security_score": 79.88,
    "view": "composite",
    "scanner_badges": {
      "agentshield": "Verified",
      "cisco-skill-scanner": "Verified",
      "agent-audit-kit": "Unsafe",
      "bearer": "Verified",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Verified",
      "trivy": "Caution",
      "osv-scanner": "Caution"
    },
    "finding_counts": {
      "critical": 0,
      "high": 6,
      "medium": 5,
      "low": 3
    },
    "recommendation": "mcp-server-langfuse may be integrated with compensating controls: review the 6 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes."
  },
  "source_provenance": {
    "repository_url": "https://github.com/langfuse/mcp-server-langfuse",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "marcklingen",
    "name": "mcp-server-langfuse",
    "version": "0.0.1"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 5.07969887299987,
      "status": "complete",
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": [
          "supply_chain"
        ]
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 85.5,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "policy_violation",
          "file_path": "/repo",
          "line_number": null,
          "rule_identifier": "LOW_ANALYZABILITY",
          "title": "Moderate analyzability score",
          "description": "Only 79% of skill content could be analyzed. 2 of 10 files are opaque to the scanner. Some content could not be verified as safe.",
          "remediation": "Review opaque files and replace with inspectable formats where possible."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "command_injection",
          "file_path": "/repo/.cursor/rules/mcp-llms-full.mdc",
          "line_number": 2,
          "rule_identifier": "PIPELINE_TAINT_FLOW",
          "title": "Dangerous data flow in command pipeline",
          "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
          "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "skill_discovery_abuse",
          "file_path": "/repo/.cursor/rules/mcp-llms-full.mdc",
          "line_number": 3011,
          "rule_identifier": "YARA_capability_inflation_generic",
          "title": "SKILL DISCOVERY ABUSE detected by YARA",
          "description": "Detects protocol manipulation via capability inflation in skill discovery: endorsed by Anthropic",
          "remediation": "Review and remove skill discovery abuse pattern"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 18.929912239997066,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 2,
          "high": 0,
          "medium": 2,
          "critical": 0,
          "informational": 1
        }
      },
      "display_score": 85.5,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 53.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "SECURITY.md",
          "line_number": null,
          "rule_identifier": "AAK-SEC-MD-001",
          "title": "MCP server repo missing SECURITY.md or security_contact",
          "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
          "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "src/index.ts",
          "line_number": 1,
          "rule_identifier": "AAK-MCP-018",
          "title": "Missing rate limiting on MCP endpoint",
          "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
          "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": 17,
          "rule_identifier": "AAK-OAUTH-3P-001",
          "title": "Repo depends on a third-party agent-platform SDK",
          "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
          "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": 2,
          "rule_identifier": "AAK-OAUTH-3P-001",
          "title": "Repo depends on a third-party agent-platform SDK",
          "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
          "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "src/index.ts",
          "line_number": null,
          "rule_identifier": "AAK-ANTHROPIC-SDK-001",
          "title": "MCP server built on the upstream SDK without STDIO sanitizer",
          "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
          "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": null,
          "rule_identifier": "AAK-DNS-REBIND-002",
          "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
          "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
          "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
        }
      ],
      "execution_duration_seconds": 5.876999240994337,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "files_scanned": 8,
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 1,
          "high": 2,
          "medium": 3,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 53.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 7.479574900993612,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 1,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 35.96519303400419,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "files_scanned": 2,
        "install_command": "pip install 'semgrep==1.97.0'"
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 35.80147194500023,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "files_scanned": 1,
        "install_command": "pip install 'semgrep==1.97.0'"
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 70.0,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "trivy",
          "severity": "high",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2025-66414",
          "title": "Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default",
          "description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest",
          "remediation": "Upgrade @modelcontextprotocol/sdk from 1.5.0 to 1.24.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "high",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-0621",
          "title": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
          "description": "Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.",
          "remediation": "Upgrade @modelcontextprotocol/sdk from 1.5.0 to 1.25.2 or later"
        }
      ],
      "execution_duration_seconds": 1.5871413799904985,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "severity_counts": {
          "low": 0,
          "high": 2,
          "medium": 0,
          "critical": 0,
          "informational": 0
        },
        "manifests_scanned": [
          "package-lock.json"
        ]
      },
      "display_score": 70.0,
      "display_badge": "Caution"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 70.0,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-8r9q-7v3j-jr4g",
          "title": "GHSA-8r9q-7v3j-jr4g \u2014 npm @modelcontextprotocol/sdk@1.5.0",
          "description": "aliases: CVE-2026-0621, GHSA-8r9q-7v3j-jr4g | CVSS: 8.7",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-w48q-cv73-mx4w",
          "title": "GHSA-w48q-cv73-mx4w \u2014 npm @modelcontextprotocol/sdk@1.5.0",
          "description": "aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w | CVSS: 7.6",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 43.12677768600406,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [
          "npm"
        ],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "severity_counts": {
          "low": 0,
          "high": 2,
          "medium": 0,
          "critical": 0,
          "informational": 0
        },
        "manifests_scanned": [
          "/repo/package-lock.json"
        ],
        "finding_id_aliases": {
          "GHSA-8r9q-7v3j-jr4g": [
            "CVE-2026-0621"
          ],
          "GHSA-w48q-cv73-mx4w": [
            "CVE-2025-66414"
          ]
        },
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": [
            "CVE-2025-66414",
            "CVE-2026-0621"
          ]
        }
      },
      "display_score": 70.0,
      "display_badge": "Caution"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "311a3220-0eb3-485f-8e2e-92e514838fda",
    "scan_completed_at": "2026-07-21T02:50:21.863013+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:229184f5b7dddaed2b5e2a60a9cd3eeecfc0a610ac8e28131e02a7d179fdc00f",
    "ai_decision_log_ids": [
      "f8c42dce-40b2-442f-a831-13a3d2cf8e05"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 5.07969887299987,
        "status": "complete",
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": [
            "supply_chain"
          ]
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 85.5,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "policy_violation",
            "file_path": "/repo",
            "line_number": null,
            "rule_identifier": "LOW_ANALYZABILITY",
            "title": "Moderate analyzability score",
            "description": "Only 79% of skill content could be analyzed. 2 of 10 files are opaque to the scanner. Some content could not be verified as safe.",
            "remediation": "Review opaque files and replace with inspectable formats where possible."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "command_injection",
            "file_path": "/repo/.cursor/rules/mcp-llms-full.mdc",
            "line_number": 2,
            "rule_identifier": "PIPELINE_TAINT_FLOW",
            "title": "Dangerous data flow in command pipeline",
            "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)",
            "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "skill_discovery_abuse",
            "file_path": "/repo/.cursor/rules/mcp-llms-full.mdc",
            "line_number": 3011,
            "rule_identifier": "YARA_capability_inflation_generic",
            "title": "SKILL DISCOVERY ABUSE detected by YARA",
            "description": "Detects protocol manipulation via capability inflation in skill discovery: endorsed by Anthropic",
            "remediation": "Review and remove skill discovery abuse pattern"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 18.929912239997066,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 2,
            "high": 0,
            "medium": 2,
            "critical": 0,
            "informational": 1
          }
        },
        "display_score": 85.5,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 53.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "SECURITY.md",
            "line_number": null,
            "rule_identifier": "AAK-SEC-MD-001",
            "title": "MCP server repo missing SECURITY.md or security_contact",
            "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
            "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "src/index.ts",
            "line_number": 1,
            "rule_identifier": "AAK-MCP-018",
            "title": "Missing rate limiting on MCP endpoint",
            "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
            "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": 17,
            "rule_identifier": "AAK-OAUTH-3P-001",
            "title": "Repo depends on a third-party agent-platform SDK",
            "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
            "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": 2,
            "rule_identifier": "AAK-OAUTH-3P-001",
            "title": "Repo depends on a third-party agent-platform SDK",
            "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
            "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "src/index.ts",
            "line_number": null,
            "rule_identifier": "AAK-ANTHROPIC-SDK-001",
            "title": "MCP server built on the upstream SDK without STDIO sanitizer",
            "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
            "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": null,
            "rule_identifier": "AAK-DNS-REBIND-002",
            "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
            "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
            "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
          }
        ],
        "execution_duration_seconds": 5.876999240994337,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "files_scanned": 8,
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 1,
            "high": 2,
            "medium": 3,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 53.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 7.479574900993612,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 1,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 35.96519303400419,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "files_scanned": 2,
          "install_command": "pip install 'semgrep==1.97.0'"
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 35.80147194500023,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "files_scanned": 1,
          "install_command": "pip install 'semgrep==1.97.0'"
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 70.0,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "trivy",
            "severity": "high",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2025-66414",
            "title": "Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default",
            "description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest",
            "remediation": "Upgrade @modelcontextprotocol/sdk from 1.5.0 to 1.24.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "high",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-0621",
            "title": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
            "description": "Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.",
            "remediation": "Upgrade @modelcontextprotocol/sdk from 1.5.0 to 1.25.2 or later"
          }
        ],
        "execution_duration_seconds": 1.5871413799904985,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "severity_counts": {
            "low": 0,
            "high": 2,
            "medium": 0,
            "critical": 0,
            "informational": 0
          },
          "manifests_scanned": [
            "package-lock.json"
          ]
        },
        "display_score": 70.0,
        "display_badge": "Caution"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 70.0,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-8r9q-7v3j-jr4g",
            "title": "GHSA-8r9q-7v3j-jr4g \u2014 npm @modelcontextprotocol/sdk@1.5.0",
            "description": "aliases: CVE-2026-0621, GHSA-8r9q-7v3j-jr4g | CVSS: 8.7",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-w48q-cv73-mx4w",
            "title": "GHSA-w48q-cv73-mx4w \u2014 npm @modelcontextprotocol/sdk@1.5.0",
            "description": "aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w | CVSS: 7.6",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 43.12677768600406,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [
            "npm"
          ],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "severity_counts": {
            "low": 0,
            "high": 2,
            "medium": 0,
            "critical": 0,
            "informational": 0
          },
          "manifests_scanned": [
            "/repo/package-lock.json"
          ],
          "finding_id_aliases": {
            "GHSA-8r9q-7v3j-jr4g": [
              "CVE-2026-0621"
            ],
            "GHSA-w48q-cv73-mx4w": [
              "CVE-2025-66414"
            ]
          },
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": [
              "CVE-2025-66414",
              "CVE-2026-0621"
            ]
          }
        },
        "display_score": 70.0,
        "display_badge": "Caution"
      }
    ]
  },
  "report": {
    "report_id": "dd1a85c9-6bf3-4993-8386-b930dc9205d4",
    "format": "json",
    "generated_at": "2026-07-21T18:20:56.211431+00:00",
    "scanner_filter": null,
    "signature": null
  }
}