{
  "executive_summary": {
    "badge": "Verified",
    "security_score": 93.85,
    "view": "composite",
    "scanner_badges": {
      "agentshield": "unavailable",
      "cisco-skill-scanner": "Caution",
      "agent-audit-kit": "Caution",
      "bearer": "Verified",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Verified",
      "trivy": "Verified",
      "osv-scanner": "unavailable"
    },
    "finding_counts": {
      "critical": 0,
      "high": 1,
      "medium": 7,
      "low": 5
    },
    "recommendation": "notion_mcp may be integrated with compensating controls: review the 1 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes."
  },
  "source_provenance": {
    "repository_url": "https://github.com/danhilse/notion_mcp",
    "commit_sha_scanned": null,
    "license": null,
    "maintainer": null,
    "name": "notion_mcp",
    "version": "0.1.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.7565084749949165,
      "status": "not_applicable",
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": []
      },
      "display_score": null,
      "display_badge": "unavailable"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 70.5,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "policy_violation",
          "file_path": "/repo",
          "line_number": null,
          "rule_identifier": "LOW_ANALYZABILITY",
          "title": "Moderate analyzability score",
          "description": "Only 82% of skill content could be analyzed. 2 of 13 files are opaque to the scanner. Some content could not be verified as safe.",
          "remediation": "Review opaque files and replace with inspectable formats where possible."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "policy_violation",
          "file_path": "/repo/.DS_Store",
          "line_number": null,
          "rule_identifier": "UNANALYZABLE_BINARY",
          "title": "Unanalyzable binary file",
          "description": "Binary file '.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
          "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/.DS_Store",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: .DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/.DS_Store",
          "line_number": null,
          "rule_identifier": "BINARY_FILE_DETECTED",
          "title": "Binary file detected in skill package",
          "description": "Binary file found: .DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
          "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "unauthorized_tool_use",
          "file_path": "/repo/repo/README.md",
          "line_number": null,
          "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
          "title": "Undeclared network usage",
          "description": "Skill code uses network libraries but doesn't declare network requirement",
          "remediation": "Declare network usage in compatibility field or remove network calls"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "medium",
          "category": "policy_violation",
          "file_path": "/repo/src/.DS_Store",
          "line_number": null,
          "rule_identifier": "UNANALYZABLE_BINARY",
          "title": "Unanalyzable binary file",
          "description": "Binary file 'src/.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
          "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "obfuscation",
          "file_path": "/repo/src/.DS_Store",
          "line_number": null,
          "rule_identifier": "HIDDEN_DATA_FILE",
          "title": "Hidden data file detected",
          "description": "Hidden file found: src/.DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.",
          "remediation": "Move file to a visible location or document its purpose."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/src/.DS_Store",
          "line_number": null,
          "rule_identifier": "BINARY_FILE_DETECTED",
          "title": "Binary file detected in skill package",
          "description": "Binary file found: src/.DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
          "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "low",
          "category": "policy_violation",
          "file_path": "/repo/src/notion_mcp/__pycache__",
          "line_number": null,
          "rule_identifier": "PYCACHE_FILES_DETECTED",
          "title": "Python bytecode cache directory detected",
          "description": "__pycache__ directory found at src/notion_mcp/__pycache__/ containing 3 bytecode file(s). Pre-compiled bytecode should not be distributed in skill packages.",
          "remediation": "Remove __pycache__ directories from skill packages. Ship source code only."
        }
      ],
      "execution_duration_seconds": 33.43710144099896,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 4,
          "high": 0,
          "medium": 4,
          "critical": 0,
          "informational": 3
        }
      },
      "display_score": 70.5,
      "display_badge": "Caution"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 68.0,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-004",
          "title": "No lockfile present",
          "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
          "remediation": "Generate and commit lockfile."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "SECURITY.md",
          "line_number": null,
          "rule_identifier": "AAK-SEC-MD-001",
          "title": "MCP server repo missing SECURITY.md or security_contact",
          "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
          "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "src/notion_mcp/server.py",
          "line_number": null,
          "rule_identifier": "AAK-TASKS-003",
          "title": "MCP task has no TTL or cancellation path",
          "description": "A task record has no expiration and no cancellation endpoint. Orphaned tasks accumulate forever, including their inputs.",
          "remediation": "Set a TTL on every task; expose a cancellation endpoint that zeroizes inputs and credentials."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "pyproject.toml",
          "line_number": 2,
          "rule_identifier": "AAK-OAUTH-3P-001",
          "title": "Repo depends on a third-party agent-platform SDK",
          "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
          "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "src/notion_mcp/server.py",
          "line_number": null,
          "rule_identifier": "AAK-ANTHROPIC-SDK-001",
          "title": "MCP server built on the upstream SDK without STDIO sanitizer",
          "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
          "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
        }
      ],
      "execution_duration_seconds": 8.103333478997229,
      "status": "complete",
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "files_scanned": 6,
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 1,
          "high": 1,
          "medium": 3,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 68.0,
      "display_badge": "Caution"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 7.996039400997688,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 1,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 39.48547613299161,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "files_scanned": 3,
        "install_command": "pip install 'semgrep==1.97.0'"
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 39.04511608299799,
      "status": "complete",
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "files_scanned": 1,
        "install_command": "pip install 'semgrep==1.97.0'"
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 1.0746929309971165,
      "status": "complete",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "manifests_scanned": []
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.6150902689987561,
      "status": "not_applicable",
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "manifests_scanned": [],
        "finding_id_aliases": {},
        "cross_scanner_correlation": {
          "only_osv": [],
          "only_trivy": [],
          "intersection_ids": []
        }
      },
      "display_score": null,
      "display_badge": "unavailable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "d502e5d1-4a0c-48cb-8f39-f515899f22ab",
    "scan_completed_at": "2026-07-21T03:23:51.115734+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:229184f5b7dddaed2b5e2a60a9cd3eeecfc0a610ac8e28131e02a7d179fdc00f",
    "ai_decision_log_ids": [
      "c308bd50-b3f4-4c6c-bf8f-53d601d0e8dc"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.7565084749949165,
        "status": "not_applicable",
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": []
        },
        "display_score": null,
        "display_badge": "unavailable"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 70.5,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "policy_violation",
            "file_path": "/repo",
            "line_number": null,
            "rule_identifier": "LOW_ANALYZABILITY",
            "title": "Moderate analyzability score",
            "description": "Only 82% of skill content could be analyzed. 2 of 13 files are opaque to the scanner. Some content could not be verified as safe.",
            "remediation": "Review opaque files and replace with inspectable formats where possible."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "policy_violation",
            "file_path": "/repo/.DS_Store",
            "line_number": null,
            "rule_identifier": "UNANALYZABLE_BINARY",
            "title": "Unanalyzable binary file",
            "description": "Binary file '.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
            "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/.DS_Store",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: .DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/.DS_Store",
            "line_number": null,
            "rule_identifier": "BINARY_FILE_DETECTED",
            "title": "Binary file detected in skill package",
            "description": "Binary file found: .DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
            "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "unauthorized_tool_use",
            "file_path": "/repo/repo/README.md",
            "line_number": null,
            "rule_identifier": "TOOL_ABUSE_UNDECLARED_NETWORK",
            "title": "Undeclared network usage",
            "description": "Skill code uses network libraries but doesn't declare network requirement",
            "remediation": "Declare network usage in compatibility field or remove network calls"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "medium",
            "category": "policy_violation",
            "file_path": "/repo/src/.DS_Store",
            "line_number": null,
            "rule_identifier": "UNANALYZABLE_BINARY",
            "title": "Unanalyzable binary file",
            "description": "Binary file 'src/.DS_Store' cannot be inspected by the scanner. Reason: Binary file () - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.",
            "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "obfuscation",
            "file_path": "/repo/src/.DS_Store",
            "line_number": null,
            "rule_identifier": "HIDDEN_DATA_FILE",
            "title": "Hidden data file detected",
            "description": "Hidden file found: src/.DS_Store. Hidden files may contain concealed configuration or data that should be reviewed.",
            "remediation": "Move file to a visible location or document its purpose."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/src/.DS_Store",
            "line_number": null,
            "rule_identifier": "BINARY_FILE_DETECTED",
            "title": "Binary file detected in skill package",
            "description": "Binary file found: src/.DS_Store. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.",
            "remediation": "Review binary file necessity. Replace with auditable scripts if possible."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "low",
            "category": "policy_violation",
            "file_path": "/repo/src/notion_mcp/__pycache__",
            "line_number": null,
            "rule_identifier": "PYCACHE_FILES_DETECTED",
            "title": "Python bytecode cache directory detected",
            "description": "__pycache__ directory found at src/notion_mcp/__pycache__/ containing 3 bytecode file(s). Pre-compiled bytecode should not be distributed in skill packages.",
            "remediation": "Remove __pycache__ directories from skill packages. Ship source code only."
          }
        ],
        "execution_duration_seconds": 33.43710144099896,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 4,
            "high": 0,
            "medium": 4,
            "critical": 0,
            "informational": 3
          }
        },
        "display_score": 70.5,
        "display_badge": "Caution"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 68.0,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-004",
            "title": "No lockfile present",
            "description": "A package manifest exists but no lockfile was found. Without lockfiles, dependency versions float and can be silently updated.",
            "remediation": "Generate and commit lockfile."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "SECURITY.md",
            "line_number": null,
            "rule_identifier": "AAK-SEC-MD-001",
            "title": "MCP server repo missing SECURITY.md or security_contact",
            "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
            "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "src/notion_mcp/server.py",
            "line_number": null,
            "rule_identifier": "AAK-TASKS-003",
            "title": "MCP task has no TTL or cancellation path",
            "description": "A task record has no expiration and no cancellation endpoint. Orphaned tasks accumulate forever, including their inputs.",
            "remediation": "Set a TTL on every task; expose a cancellation endpoint that zeroizes inputs and credentials."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "pyproject.toml",
            "line_number": 2,
            "rule_identifier": "AAK-OAUTH-3P-001",
            "title": "Repo depends on a third-party agent-platform SDK",
            "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
            "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "src/notion_mcp/server.py",
            "line_number": null,
            "rule_identifier": "AAK-ANTHROPIC-SDK-001",
            "title": "MCP server built on the upstream SDK without STDIO sanitizer",
            "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
            "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
          }
        ],
        "execution_duration_seconds": 8.103333478997229,
        "status": "complete",
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "files_scanned": 6,
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 1,
            "high": 1,
            "medium": 3,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 68.0,
        "display_badge": "Caution"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 7.996039400997688,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 1,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\""
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 39.48547613299161,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "files_scanned": 3,
          "install_command": "pip install 'semgrep==1.97.0'"
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 39.04511608299799,
        "status": "complete",
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "files_scanned": 1,
          "install_command": "pip install 'semgrep==1.97.0'"
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 1.0746929309971165,
        "status": "complete",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "manifests_scanned": []
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.6150902689987561,
        "status": "not_applicable",
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "manifests_scanned": [],
          "finding_id_aliases": {},
          "cross_scanner_correlation": {
            "only_osv": [],
            "only_trivy": [],
            "intersection_ids": []
          }
        },
        "display_score": null,
        "display_badge": "unavailable"
      }
    ]
  },
  "report": {
    "report_id": "dea431c2-59b7-4c53-b374-849ef3081b9a",
    "format": "json",
    "generated_at": "2026-07-21T18:18:48.108679+00:00",
    "scanner_filter": null,
    "signature": null
  }
}