# Security Audit Report — mcp-openapi-schema-explorer - **Report ID:** `9a1de25a-612f-4aea-bfbb-7c0ce69030b0` - **Generated:** 2026-07-21T23:10:30.827383+00:00 - **Signature:** unsigned (cosign keyless signing runs in CI; Req 22.4) ## 1. Executive Summary **Badge:** Caution (composite) **Security score:** 63.62 | Scanner | Badge | | --- | --- | | agent-audit-kit | Unsafe | | agentshield | Verified | | bearer | Verified | | cisco-skill-scanner | Caution | | nerlo-behavioral | Verified | | nerlo-install-instruction | Verified | | osv-scanner | Unsafe | | trivy | Verified | | Severity | Findings | | --- | --- | | critical | 0 | | high | 11 | | medium | 22 | | low | 9 | mcp-openapi-schema-explorer may be integrated with compensating controls: review the 11 high-severity findings below, restrict granted permissions to the minimum the manifest declares, and subscribe to monitoring alerts for score changes. ## 2. Source Provenance - **Repository:** https://github.com/kadykov/mcp-openapi-schema-explorer - **Commit scanned:** `unknown` - **License:** MIT - **Maintainer:** unknown - **Version:** 1.3.4 ## 3. Per-Scanner Detail ### agentshield (v1.4.0) — Verified / 100.0 No findings. ### cisco-skill-scanner (v2.0.11) — Caution / 63.5 - **[high] Critically low analyzability score** — Only 39% of skill content could be analyzed. 45 of 77 files are opaque to the scanner. The safety assessment has low confidence. (/repo:None) - **[low] Hidden data file detected** — Hidden file found: .prettierrc.json. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.prettierrc.json:None) - **[low] Hidden data file detected** — Hidden file found: .releaserc.json. Hidden files may contain concealed configuration or data that should be reviewed. (/repo/.releaserc.json:None) - **[low] Vague skill description** — Skill description is too short (16 chars). Provide detailed explanation. (/repo/SKILL.md:None) - **[informational] Skill does not specify a license** — Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms. (/repo/SKILL.md:None) - **[high] Node.js filesystem access that could read or write sensitive data** — Pattern detected: fs.writeFileSync( (/repo/scripts/generate-version.js:44) ### agent-audit-kit (v0.3.26) — Unsafe / 6.0 - **[low] Dependency count exceeds threshold** — More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision. (package-lock.json:None) - **[medium] Dependency uses install scripts** — package.json has install scripts (preinstall, postinstall, etc.) that execute arbitrary commands during npm install. (package.json:25) - **[low] MCP server repo missing SECURITY.md or security_contact** — A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a 'security_contact' entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel. (SECURITY.md:None) - **[medium] Missing rate limiting on MCP endpoint** — An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks. (src/index.ts:2) - **[medium] Repo depends on a third-party agent-platform SDK** — The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel × Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants. (package.json:43) - **[high] MCP server built on the upstream SDK without STDIO sanitizer** — Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python 'mcp' / 'modelcontextprotocol', TS '@modelcontextprotocol/sdk', Java 'io.modelcontextprotocol:*', Rust 'mcp' / 'modelcontextprotocol') and exposes a STDIO transport ('StdioServerTransport', 'stdio_server', etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed — sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L (src/index.ts:None) - **[high] MCP server built on the upstream SDK without STDIO sanitizer** — Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python 'mcp' / 'modelcontextprotocol', TS '@modelcontextprotocol/sdk', Java 'io.modelcontextprotocol:*', Rust 'mcp' / 'modelcontextprotocol') and exposes a STDIO transport ('StdioServerTransport', 'stdio_server', etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed — sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L (test/utils/mcp-test-helpers.ts:None) - **[high] Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)** — A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python 'mcp' >= 1.23.0, TS '@modelcontextprotocol/sdk' >= 1.21.1, Java 'io.modelcontextprotocol.sdk:mcp-core' >= 0.11.0, '@apollo/mcp-server' >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug. (package.json:None) - **[medium] Third-party GitHub Action not pinned by full commit SHA** — A workflow in '.github/workflows/' uses a third-party Action ('owner/action@ref') where 'ref' is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision — the downstream repo consuming it will happily run the new code with 'GITHUB_TOKEN' and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy. (.github/workflows/ci.yml:28) - **[medium] Third-party GitHub Action not pinned by full commit SHA** — A workflow in '.github/workflows/' uses a third-party Action ('owner/action@ref') where 'ref' is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision — the downstream repo consuming it will happily run the new code with 'GITHUB_TOKEN' and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy. (.github/workflows/ci.yml:44) - **[medium] Third-party GitHub Action not pinned by full commit SHA** — A workflow in '.github/workflows/' uses a third-party Action ('owner/action@ref') where 'ref' is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision — the downstream repo consuming it will happily run the new code with 'GITHUB_TOKEN' and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy. (.github/workflows/ci.yml:111) - **[medium] Third-party GitHub Action not pinned by full commit SHA** — A workflow in '.github/workflows/' uses a third-party Action ('owner/action@ref') where 'ref' is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision — the downstream repo consuming it will happily run the new code with 'GITHUB_TOKEN' and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy. (.github/workflows/ci.yml:113) - **[medium] Third-party GitHub Action not pinned by full commit SHA** — A workflow in '.github/workflows/' uses a third-party Action ('owner/action@ref') where 'ref' is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision — the downstream repo consuming it will happily run the new code with 'GITHUB_TOKEN' and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy. (.github/workflows/ci.yml:115) - **[medium] Third-party GitHub Action not pinned by full commit SHA** — A workflow in '.github/workflows/' uses a third-party Action ('owner/action@ref') where 'ref' is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision — the downstream repo consuming it will happily run the new code with 'GITHUB_TOKEN' and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy. (.github/workflows/ci.yml:121) ### bearer (v2.0.2) — Verified / 100.0 No findings. ### nerlo-behavioral (v0.1.0) — Verified / 100.0 No findings. ### nerlo-install-instruction (v0.1.0) — Verified / 100.0 No findings. ### trivy (v0.71.0) — Verified / 98.0 - **[low] body-parser: body-parser: Denial of Service via invalid limit option** — Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars (package-lock.json:None) ### osv-scanner (v2.3.8) — Unsafe / 0.0 - **[medium] GHSA-42h9-826w-cgv3 — npm axios@1.16.0** — aliases: GHSA-42h9-826w-cgv3 \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-7q8q-rj6j-mhjq — npm axios@1.16.0** — aliases: GHSA-7q8q-rj6j-mhjq \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-f4gw-2p7v-4548 — npm axios@1.16.0** — aliases: GHSA-f4gw-2p7v-4548 \| CVSS: 6.9 (/repo/package-lock.json:None) - **[high] GHSA-gcfj-64vw-6mp9 — npm axios@1.16.0** — aliases: GHSA-gcfj-64vw-6mp9 \| CVSS: 8.3 (/repo/package-lock.json:None) - **[medium] GHSA-hcpx-6fm6-wx23 — npm axios@1.16.0** — aliases: GHSA-hcpx-6fm6-wx23 \| CVSS: 6.9 (/repo/package-lock.json:None) - **[medium] GHSA-jqh4-m9w3-8hp9 — npm axios@1.16.0** — aliases: GHSA-jqh4-m9w3-8hp9 \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-mmx7-hfxf-jppx — npm axios@1.16.0** — aliases: GHSA-mmx7-hfxf-jppx \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-mwf2-3pr3-8698 — npm axios@1.16.0** — aliases: GHSA-mwf2-3pr3-8698 \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-pmv8-rq9r-6j72 — npm axios@1.16.0** — aliases: GHSA-pmv8-rq9r-6j72 \| CVSS: 6.3 (/repo/package-lock.json:None) - **[medium] GHSA-xj6q-8x83-jv6g — npm axios@1.16.0** — aliases: GHSA-xj6q-8x83-jv6g \| CVSS: 6.3 (/repo/package-lock.json:None) - **[low] GHSA-v422-hmwv-36x6 — npm body-parser@2.2.2** — aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 \| CVSS: 3.7 (/repo/package-lock.json:None) - **[high] GHSA-3jxr-9vmj-r5cp — npm brace-expansion@1.1.13** — aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp \| CVSS: 7.7 (/repo/package-lock.json:None) - **[high] GHSA-3jxr-9vmj-r5cp — npm brace-expansion@2.0.3** — aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp \| CVSS: 7.7 (/repo/package-lock.json:None) - **[medium] GHSA-2mjp-6q6p-2qxm — npm undici@5.29.0** — aliases: CVE-2026-1525, GHSA-2mjp-6q6p-2qxm \| CVSS: 6.5 (/repo/package-lock.json:None) - **[low] GHSA-35p6-xmwp-9g52 — npm undici@5.29.0** — aliases: CVE-2026-6733, GHSA-35p6-xmwp-9g52 \| CVSS: 3.7 (/repo/package-lock.json:None) - **[medium] GHSA-4992-7rv2-5pvq — npm undici@5.29.0** — aliases: CVE-2026-1527, GHSA-4992-7rv2-5pvq \| CVSS: 4.6 (/repo/package-lock.json:None) - **[low] GHSA-g8m3-5g58-fq7m — npm undici@5.29.0** — aliases: CVE-2026-11525, GHSA-g8m3-5g58-fq7m \| CVSS: 3.7 (/repo/package-lock.json:None) - **[medium] GHSA-g9mf-h72j-4rw9 — npm undici@5.29.0** — aliases: CVE-2026-22036, GHSA-g9mf-h72j-4rw9 \| CVSS: 5.9 (/repo/package-lock.json:None) - **[medium] GHSA-p88m-4jfj-68fv — npm undici@5.29.0** — aliases: CVE-2026-9679, GHSA-p88m-4jfj-68fv \| CVSS: 5.9 (/repo/package-lock.json:None) - **[high] GHSA-v9p9-hfj2-hcw8 — npm undici@5.29.0** — aliases: CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-vrm6-8vpv-qv8q — npm undici@5.29.0** — aliases: CVE-2026-1526, GHSA-vrm6-8vpv-qv8q \| CVSS: 7.5 (/repo/package-lock.json:None) - **[high] GHSA-vxpw-j846-p89q — npm undici@5.29.0** — aliases: CVE-2026-12151, GHSA-vxpw-j846-p89q \| CVSS: 7.5 (/repo/package-lock.json:None) ## 4. Threat Model Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report. ## 5. Audit Chain - **Scan job:** `5a0e7aa5-e966-45e6-a162-c9e45df27087` - **Completed:** 2026-07-21T02:41:28.002762+00:00 - **Scanner base image:** `us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:5f2eb3b83083e1887537d1f7485cc3ceecdbc45a6a7b1ae17fb77f9e0e67a10b` - **AI decision log entries:** 1 - `14ac2b78-e7b8-4eb4-8463-f23e2679cbc4` ## 6. Appendix — Raw Scanner Output ```json [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 17.879879368003458, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 63.5, "scanner_badge": "Caution", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 39% of skill content could be analyzed. 45 of 77 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.prettierrc.json", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .prettierrc.json. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/.releaserc.json", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .releaserc.json. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/scripts/generate-version.js", "line_number": 44, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.writeFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" } ], "execution_duration_seconds": 63.28385748800065, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 3, "high": 2, "medium": 0, "critical": 0, "informational": 1 } }, "display_score": 63.5, "display_badge": "Caution" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 6.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "AAK-SUPPLY-005", "title": "Dependency count exceeds threshold", "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.", "remediation": "Audit and remove unused dependencies. Consider lighter alternatives." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 25, "rule_identifier": "AAK-SUPPLY-003", "title": "Dependency uses install scripts", "description": "package.json has install scripts (preinstall, postinstall, etc.) that execute arbitrary commands during npm install.", "remediation": "Audit install scripts. Use --ignore-scripts flag and run scripts manually after review." }, { "tool_name": "agent-audit-kit", "severity": "low", "category": "supply-chain", "file_path": "SECURITY.md", "line_number": null, "rule_identifier": "AAK-SEC-MD-001", "title": "MCP server repo missing SECURITY.md or security_contact", "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.", "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "src/index.ts", "line_number": 2, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": "package.json", "line_number": 43, "rule_identifier": "AAK-OAUTH-3P-001", "title": "Repo depends on a third-party agent-platform SDK", "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.", "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident" }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "src/index.ts", "line_number": null, "rule_identifier": "AAK-ANTHROPIC-SDK-001", "title": "MCP server built on the upstream SDK without STDIO sanitizer", "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L", "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "test/utils/mcp-test-helpers.ts", "line_number": null, "rule_identifier": "AAK-ANTHROPIC-SDK-001", "title": "MCP server built on the upstream SDK without STDIO sanitizer", "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L", "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`." }, { "tool_name": "agent-audit-kit", "severity": "high", "category": "supply-chain", "file_path": "package.json", "line_number": null, "rule_identifier": "AAK-DNS-REBIND-002", "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)", "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.", "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 28, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 44, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 111, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 113, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 115, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." }, { "tool_name": "agent-audit-kit", "severity": "medium", "category": "supply-chain", "file_path": ".github/workflows/ci.yml", "line_number": 121, "rule_identifier": "AAK-GHA-IMMUTABLE-001", "title": "Third-party GitHub Action not pinned by full commit SHA", "description": "A workflow in `.github/workflows/` uses a third-party Action (`owner/action@ref`) where `ref` is a tag or branch name instead of a 40-character commit SHA. A repo-takeover of the Action's publisher can re-point the tag to a malicious revision \u2014 the downstream repo consuming it will happily run the new code with `GITHUB_TOKEN` and write permissions. GitHub's April 2026 Security Roadmap ships Immutable Actions and makes SHA pinning the default policy.", "remediation": "Repin third-party Actions to a 40-character commit SHA and add a `# v1.2.3`-style trailing comment for humans. First-party Actions under `actions/` and `github/` are exempt (they now ship Immutable Actions). Dependabot will auto-bump SHA pins when `update-type: all` is set." } ], "execution_duration_seconds": 45.572223062001285, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 71, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 2, "high": 3, "medium": 9, "critical": 0, "informational": 0 } }, "display_score": 6.0, "display_badge": "Unsafe" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 26.652241353993304, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 68.73866551999527, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 23, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 67.4822723249963, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 6, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 98.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "trivy", "severity": "low", "category": "npm", "file_path": "package-lock.json", "line_number": null, "rule_identifier": "CVE-2026-12590", "title": "body-parser: body-parser: Denial of Service via invalid limit option", "description": "Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars", "remediation": "Upgrade body-parser from 2.2.2 to 1.20.6, 2.3.0 or later" } ], "execution_duration_seconds": 1.4950733599980595, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 1, "high": 0, "medium": 0, "critical": 0, "informational": 0 }, "manifests_scanned": [ "package-lock.json" ] }, "display_score": 98.0, "display_badge": "Verified" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-42h9-826w-cgv3", "title": "GHSA-42h9-826w-cgv3 \u2014 npm axios@1.16.0", "description": "aliases: GHSA-42h9-826w-cgv3 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-7q8q-rj6j-mhjq", "title": "GHSA-7q8q-rj6j-mhjq \u2014 npm axios@1.16.0", "description": "aliases: GHSA-7q8q-rj6j-mhjq | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-f4gw-2p7v-4548", "title": "GHSA-f4gw-2p7v-4548 \u2014 npm axios@1.16.0", "description": "aliases: GHSA-f4gw-2p7v-4548 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-gcfj-64vw-6mp9", "title": "GHSA-gcfj-64vw-6mp9 \u2014 npm axios@1.16.0", "description": "aliases: GHSA-gcfj-64vw-6mp9 | CVSS: 8.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-hcpx-6fm6-wx23", "title": "GHSA-hcpx-6fm6-wx23 \u2014 npm axios@1.16.0", "description": "aliases: GHSA-hcpx-6fm6-wx23 | CVSS: 6.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-jqh4-m9w3-8hp9", "title": "GHSA-jqh4-m9w3-8hp9 \u2014 npm axios@1.16.0", "description": "aliases: GHSA-jqh4-m9w3-8hp9 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-mmx7-hfxf-jppx", "title": "GHSA-mmx7-hfxf-jppx \u2014 npm axios@1.16.0", "description": "aliases: GHSA-mmx7-hfxf-jppx | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-mwf2-3pr3-8698", "title": "GHSA-mwf2-3pr3-8698 \u2014 npm axios@1.16.0", "description": "aliases: GHSA-mwf2-3pr3-8698 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-pmv8-rq9r-6j72", "title": "GHSA-pmv8-rq9r-6j72 \u2014 npm axios@1.16.0", "description": "aliases: GHSA-pmv8-rq9r-6j72 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-xj6q-8x83-jv6g", "title": "GHSA-xj6q-8x83-jv6g \u2014 npm axios@1.16.0", "description": "aliases: GHSA-xj6q-8x83-jv6g | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v422-hmwv-36x6", "title": "GHSA-v422-hmwv-36x6 \u2014 npm body-parser@2.2.2", "description": "aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.13", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@2.0.3", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-2mjp-6q6p-2qxm", "title": "GHSA-2mjp-6q6p-2qxm \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-1525, GHSA-2mjp-6q6p-2qxm | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-35p6-xmwp-9g52", "title": "GHSA-35p6-xmwp-9g52 \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-6733, GHSA-35p6-xmwp-9g52 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-4992-7rv2-5pvq", "title": "GHSA-4992-7rv2-5pvq \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-1527, GHSA-4992-7rv2-5pvq | CVSS: 4.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-g8m3-5g58-fq7m", "title": "GHSA-g8m3-5g58-fq7m \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-11525, GHSA-g8m3-5g58-fq7m | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-g9mf-h72j-4rw9", "title": "GHSA-g9mf-h72j-4rw9 \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-22036, GHSA-g9mf-h72j-4rw9 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-p88m-4jfj-68fv", "title": "GHSA-p88m-4jfj-68fv \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-9679, GHSA-p88m-4jfj-68fv | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-v9p9-hfj2-hcw8", "title": "GHSA-v9p9-hfj2-hcw8 \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-2229, GHSA-v9p9-hfj2-hcw8 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-vrm6-8vpv-qv8q", "title": "GHSA-vrm6-8vpv-qv8q \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-1526, GHSA-vrm6-8vpv-qv8q | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/package-lock.json", "line_number": null, "rule_identifier": "GHSA-vxpw-j846-p89q", "title": "GHSA-vxpw-j846-p89q \u2014 npm undici@5.29.0", "description": "aliases: CVE-2026-12151, GHSA-vxpw-j846-p89q | CVSS: 7.5", "remediation": null } ], "execution_duration_seconds": 27.00922215099854, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 3, "high": 6, "medium": 13, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/package-lock.json" ], "finding_id_aliases": { "GHSA-2mjp-6q6p-2qxm": [ "CVE-2026-1525" ], "GHSA-35p6-xmwp-9g52": [ "CVE-2026-6733" ], "GHSA-3jxr-9vmj-r5cp": [ "CVE-2026-13149", "CVE-2026-13149" ], "GHSA-4992-7rv2-5pvq": [ "CVE-2026-1527" ], "GHSA-g8m3-5g58-fq7m": [ "CVE-2026-11525" ], "GHSA-g9mf-h72j-4rw9": [ "CVE-2026-22036" ], "GHSA-p88m-4jfj-68fv": [ "CVE-2026-9679" ], "GHSA-v422-hmwv-36x6": [ "CVE-2026-12590" ], "GHSA-v9p9-hfj2-hcw8": [ "CVE-2026-2229" ], "GHSA-vrm6-8vpv-qv8q": [ "CVE-2026-1526" ], "GHSA-vxpw-j846-p89q": [ "CVE-2026-12151" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-2mjp-6q6p-2qxm", "GHSA-35p6-xmwp-9g52", "GHSA-3jxr-9vmj-r5cp", "GHSA-42h9-826w-cgv3", "GHSA-4992-7rv2-5pvq", "GHSA-7q8q-rj6j-mhjq", "GHSA-f4gw-2p7v-4548", "GHSA-g8m3-5g58-fq7m", "GHSA-g9mf-h72j-4rw9", "GHSA-gcfj-64vw-6mp9", "GHSA-hcpx-6fm6-wx23", "GHSA-jqh4-m9w3-8hp9", "GHSA-mmx7-hfxf-jppx", "GHSA-mwf2-3pr3-8698", "GHSA-p88m-4jfj-68fv", "GHSA-pmv8-rq9r-6j72", "GHSA-v9p9-hfj2-hcw8", "GHSA-vrm6-8vpv-qv8q", "GHSA-vxpw-j846-p89q", "GHSA-xj6q-8x83-jv6g" ], "only_trivy": [], "intersection_ids": [ "CVE-2026-12590" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] ```