{
  "executive_summary": {
    "badge": "Verified",
    "security_score": 88.33,
    "view": "composite",
    "scanner_badges": {
      "agentshield": "Verified",
      "cisco-skill-scanner": "Verified",
      "agent-audit-kit": "Unsafe",
      "bearer": "Verified",
      "nerlo-behavioral": "Unsafe",
      "nerlo-install-instruction": "Verified",
      "trivy": "Verified",
      "osv-scanner": "unavailable"
    },
    "finding_counts": {
      "critical": 0,
      "high": 4,
      "medium": 9,
      "low": 4
    },
    "recommendation": "ciphertrust-manager-mcp-server-testing may be integrated with compensating controls: review the 4 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes."
  },
  "source_provenance": {
    "repository_url": "https://github.com/sanyambassi/ciphertrust-manager-mcp-server",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "Your Name",
    "name": "ciphertrust-manager-mcp-server-testing",
    "version": "1.0.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 4.4082819979958,
      "status": "complete",
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": [
          "supply_chain"
        ]
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 88.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/.",
          "line_number": null,
          "rule_identifier": "EXCESSIVE_FILE_COUNT",
          "title": "Skill package contains many files",
          "description": "Skill package contains 150 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
          "remediation": "Review file inventory and remove unnecessary files."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/repo/README.md",
          "line_number": null,
          "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
          "title": "Undeclared network usage",
          "description": "Skill code uses network libraries but doesn't declare network requirement",
          "remediation": "Declare network usage in compatibility field or remove network calls"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/docs/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 74.66586094499507,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo",
          "docs"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 3,
          "high": 0,
          "medium": 1,
          "critical": 0,
          "informational": 2
        }
      },
      "display_score": 88.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 18.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "mcp-config",
          "file_path": "tests/mcp_inspector_config.json",
          "line_number": 9,
          "rule_identifier": "AAK-MCP-003",
          "title": "MCP server environment exposes secrets",
          "description": "Hardcoded secrets found in mcpServers env block. Secrets in project-scoped MCP config are committed to git.",
          "remediation": "Use environment variable references or a secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "tests/mcp_inspector_config.json",
          "line_number": 4,
          "rule_identifier": "AAK-MCP-006",
          "title": "MCP server command uses relative path",
          "description": "The command uses a relative path that can be hijacked via PATH manipulation.",
          "remediation": "Use absolute paths for MCP server executables."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "mcp-config",
          "file_path": "tests/mcp_inspector_config.json",
          "line_number": 9,
          "rule_identifier": "AAK-MCP-003",
          "title": "MCP server environment exposes secrets",
          "description": "Hardcoded secrets found in mcpServers env block. Secrets in project-scoped MCP config are committed to git.",
          "remediation": "Use environment variable references or a secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "tests/mcp_inspector_config.json",
          "line_number": 4,
          "rule_identifier": "AAK-MCP-006",
          "title": "MCP server command uses relative path",
          "description": "The command uses a relative path that can be hijacked via PATH manipulation.",
          "remediation": "Use absolute paths for MCP server executables."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "secret-exposure",
          "file_path": "tests/mcp_inspector_config.json",
          "line_number": 9,
          "rule_identifier": "AAK-SECRET-007",
          "title": "Secret in MCP server environment block",
          "description": "Hardcoded secret values found in mcpServers env blocks in non-.mcp.json files.",
          "remediation": "Use environment variable references."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "secret-exposure",
          "file_path": "tests/mcp_inspector_config.json",
          "line_number": 9,
          "rule_identifier": "AAK-SECRET-007",
          "title": "Secret in MCP server environment block",
          "description": "Hardcoded secret values found in mcpServers env blocks in non-.mcp.json files.",
          "remediation": "Use environment variable references."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-004",
          "title": "No lockfile present",
          "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
          "remediation": "Generate and commit lockfile."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-004",
          "title": "No lockfile present",
          "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
          "remediation": "Generate and commit lockfile."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "SECURITY.md",
          "line_number": null,
          "rule_identifier": "AAK-SEC-MD-001",
          "title": "MCP server repo missing SECURITY.md or security_contact",
          "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
          "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": 2,
          "rule_identifier": "AAK-OAUTH-3P-001",
          "title": "Repo depends on a third-party agent-platform SDK",
          "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
          "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": 8,
          "rule_identifier": "AAK-DNS-REBIND-002",
          "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
          "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
          "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
        }
      ],
      "execution_duration_seconds": 71.34119766500953,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "files_scanned": 146,
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 1,
          "high": 3,
          "medium": 7,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 18.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 12.178201299000648,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 1,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 59.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "nerlo-behavioral",
          "severity": "high",
          "category": "dynamic-execution",
          "file_path": "/repo/scripts/run_tests.py",
          "line_number": 15,
          "rule_identifier": "opt.nerlo-rules.nerlo-py-dynamic-exec",
          "title": "opt.nerlo-rules.nerlo-py-dynamic-exec",
          "description": "Dynamic code/command execution (eval/exec/os.system/subprocess shell=True with a non-literal argument) \u2014 a backdoor primitive.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 55.01479207900411,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "files_scanned": 133,
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 1,
          "medium": 0,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 59.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 95.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "nerlo-install-instruction",
          "severity": "medium",
          "category": "install-instruction-run",
          "file_path": "/repo/README.md",
          "line_number": 80,
          "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
          "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 48.94762278300186,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "files_scanned": 4,
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 1,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 95.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 1.398189105995698,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "manifests_scanned": []
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.5498178809939418,
      "status": "not_applicable",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "manifests_scanned": [],
        "finding_id_aliases": {},
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": []
        }
      },
      "display_score": null,
      "display_badge": "unavailable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "60442a1e-0421-4808-b05e-6489ab4291c0",
    "scan_completed_at": "2026-07-21T01:26:59.704535+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:5f2eb3b83083e1887537d1f7485cc3ceecdbc45a6a7b1ae17fb77f9e0e67a10b",
    "ai_decision_log_ids": [
      "3f553514-1d83-4171-97c4-5d630125ec6d"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 4.4082819979958,
        "status": "complete",
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": [
            "supply_chain"
          ]
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 88.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/.",
            "line_number": null,
            "rule_identifier": "EXCESSIVE_FILE_COUNT",
            "title": "Skill package contains many files",
            "description": "Skill package contains 150 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
            "remediation": "Review file inventory and remove unnecessary files."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/repo/README.md",
            "line_number": null,
            "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
            "title": "Undeclared network usage",
            "description": "Skill code uses network libraries but doesn't declare network requirement",
            "remediation": "Declare network usage in compatibility field or remove network calls"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/docs/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 74.66586094499507,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo",
            "docs"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 3,
            "high": 0,
            "medium": 1,
            "critical": 0,
            "informational": 2
          }
        },
        "display_score": 88.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 18.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "mcp-config",
            "file_path": "tests/mcp_inspector_config.json",
            "line_number": 9,
            "rule_identifier": "AAK-MCP-003",
            "title": "MCP server environment exposes secrets",
            "description": "Hardcoded secrets found in mcpServers env block. Secrets in project-scoped MCP config are committed to git.",
            "remediation": "Use environment variable references or a secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "tests/mcp_inspector_config.json",
            "line_number": 4,
            "rule_identifier": "AAK-MCP-006",
            "title": "MCP server command uses relative path",
            "description": "The command uses a relative path that can be hijacked via PATH manipulation.",
            "remediation": "Use absolute paths for MCP server executables."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "mcp-config",
            "file_path": "tests/mcp_inspector_config.json",
            "line_number": 9,
            "rule_identifier": "AAK-MCP-003",
            "title": "MCP server environment exposes secrets",
            "description": "Hardcoded secrets found in mcpServers env block. Secrets in project-scoped MCP config are committed to git.",
            "remediation": "Use environment variable references or a secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "tests/mcp_inspector_config.json",
            "line_number": 4,
            "rule_identifier": "AAK-MCP-006",
            "title": "MCP server command uses relative path",
            "description": "The command uses a relative path that can be hijacked via PATH manipulation.",
            "remediation": "Use absolute paths for MCP server executables."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "secret-exposure",
            "file_path": "tests/mcp_inspector_config.json",
            "line_number": 9,
            "rule_identifier": "AAK-SECRET-007",
            "title": "Secret in MCP server environment block",
            "description": "Hardcoded secret values found in mcpServers env blocks in non-.mcp.json files.",
            "remediation": "Use environment variable references."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "secret-exposure",
            "file_path": "tests/mcp_inspector_config.json",
            "line_number": 9,
            "rule_identifier": "AAK-SECRET-007",
            "title": "Secret in MCP server environment block",
            "description": "Hardcoded secret values found in mcpServers env blocks in non-.mcp.json files.",
            "remediation": "Use environment variable references."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-004",
            "title": "No lockfile present",
            "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
            "remediation": "Generate and commit lockfile."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-004",
            "title": "No lockfile present",
            "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
            "remediation": "Generate and commit lockfile."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "SECURITY.md",
            "line_number": null,
            "rule_identifier": "AAK-SEC-MD-001",
            "title": "MCP server repo missing SECURITY.md or security_contact",
            "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
            "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": 2,
            "rule_identifier": "AAK-OAUTH-3P-001",
            "title": "Repo depends on a third-party agent-platform SDK",
            "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
            "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": 8,
            "rule_identifier": "AAK-DNS-REBIND-002",
            "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
            "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
            "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
          }
        ],
        "execution_duration_seconds": 71.34119766500953,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "files_scanned": 146,
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 1,
            "high": 3,
            "medium": 7,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 18.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 12.178201299000648,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 1,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 59.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "nerlo-behavioral",
            "severity": "high",
            "category": "dynamic-execution",
            "file_path": "/repo/scripts/run_tests.py",
            "line_number": 15,
            "rule_identifier": "opt.nerlo-rules.nerlo-py-dynamic-exec",
            "title": "opt.nerlo-rules.nerlo-py-dynamic-exec",
            "description": "Dynamic code/command execution (eval/exec/os.system/subprocess shell=True with a non-literal argument) \u2014 a backdoor primitive.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 55.01479207900411,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "files_scanned": 133,
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 1,
            "medium": 0,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 59.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 95.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "nerlo-install-instruction",
            "severity": "medium",
            "category": "install-instruction-run",
            "file_path": "/repo/README.md",
            "line_number": 80,
            "rule_identifier": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "title": "opt.nerlo-rules.nerlo-install-run-bundled-artifact",
            "description": "Documentation instructs running or double-clicking a bundled/opaque artifact (e.g. \"run resource.txt\", \"execute install.sh\", \"double-click setup.exe\"). This is the FakeGit README shape, where the payload ships as a file the docs tell you to run. Verify the artifact is inspectable and expected \u2014 opaque bundled executables directed by docs warrant review.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 48.94762278300186,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "files_scanned": 4,
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 1,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 95.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 1.398189105995698,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "manifests_scanned": []
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.5498178809939418,
        "status": "not_applicable",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "manifests_scanned": [],
          "finding_id_aliases": {},
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": []
          }
        },
        "display_score": null,
        "display_badge": "unavailable"
      }
    ]
  },
  "report": {
    "report_id": "dea0293c-761e-471c-b8cd-d672b6bd1c3c",
    "format": "json",
    "generated_at": "2026-07-21T23:02:37.049255+00:00",
    "scanner_filter": null,
    "signature": null
  }
}