{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": null,
    "view": "composite",
    "aggregate_verdict_withheld": false,
    "aggregate_verdict_withheld_reason": null,
    "scanner_badges": {
      "agentshield": "not_applicable",
      "cisco-skill-scanner": "Verified",
      "agent-audit-kit": "Verified",
      "bearer": "Unsafe",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Verified",
      "capslock": "not_applicable"
    },
    "finding_counts": {
      "critical": 1,
      "high": 0,
      "medium": 0,
      "low": 0,
      "informational": 2
    },
    "recommendation": "ableton-mcp-extended is NOT recommended for integration: the scan surfaced 1 critical and 0 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/RichieMiller-HU/ableton-mcp-extended",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "Siddharth Ahuja",
    "name": "ableton-mcp-extended",
    "version": "0.1.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.286327215959318,
      "status": "not_applicable",
      "examined": {
        "unit": "scan_targets",
        "count": 0
      },
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": []
      },
      "display_score": null,
      "display_badge": "not_applicable"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 99.0,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 8.154438760015182,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 1
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 0,
          "critical": 0,
          "informational": 2
        },
        "artifact_type_policy": "mcp_server",
        "downweighted_findings": 1
      },
      "display_score": 99.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 1.910421326989308,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 13
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "bearer",
      "scanner_version": "2.0.2",
      "score": 59.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "bearer",
          "severity": "critical",
          "category": null,
          "file_path": "/repo/AbletonMCP_Remote_Script/__init__.py",
          "line_number": 1907,
          "rule_identifier": null,
          "title": "Unsanitized external input in code generation",
          "description": "## Description\n\nAllowing external input (dynamic or user-controlled) to directly influence code generation or scripting functions without proper sanitization can lead to code injection vulnerabilities. This occurs when an attacker is able to insert malicious code into your application, which is then executed, potentially leading to unauthorized actions or data access.\n\n## Remediations\n\n- **Do not** pass unsanitized external input to functions or methods that dynamically execute code.\n- **Do** al",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 19.02439419995062,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 5
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/Bearer/bearer",
        "report_type": "security",
        "rules_loaded": 554,
        "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 0,
          "critical": 1,
          "informational": 0
        }
      },
      "display_score": 59.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 4.189642342971638,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 3
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 4.190054933016654,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 5
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "capslock",
      "scanner_version": "v0.3.2",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 0.16965539200464264,
      "status": "not_applicable",
      "examined": {
        "unit": "packages",
        "count": 0
      },
      "metadata": {
        "source": "go-module-proxy",
        "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
        "report_type": "go-capability",
        "vendor_mode": false,
        "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
        "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
        "go_files_present": 0,
        "artifact_type_policy": "mcp_server",
        "expected_capabilities": [
          "CAPABILITY_FILES",
          "CAPABILITY_NETWORK",
          "CAPABILITY_READ_SYSTEM_STATE",
          "CAPABILITY_REFLECT",
          "CAPABILITY_RUNTIME"
        ],
        "artifact_type_explicit": true
      },
      "display_score": null,
      "display_badge": "not_applicable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "c7fe868a-1090-4e58-bb74-f9b72a5e89f6",
    "scan_completed_at": "2026-08-12T13:48:30.005189+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "bearer": "2.0.2",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "capslock": "v0.3.2"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:d5aaefa8b517d1f03832091ab094e20dc73160a07ae1102af1b2e395ce6ce852",
    "ai_decision_log_ids": [
      "9a44d09c-9714-4ac5-98ca-86d857d7282b"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.286327215959318,
        "status": "not_applicable",
        "examined": {
          "unit": "scan_targets",
          "count": 0
        },
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": []
        },
        "display_score": null,
        "display_badge": "not_applicable"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 99.0,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 8.154438760015182,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 1
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 0,
            "critical": 0,
            "informational": 2
          },
          "artifact_type_policy": "mcp_server",
          "downweighted_findings": 1
        },
        "display_score": 99.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 1.910421326989308,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 13
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "bearer",
        "scanner_version": "2.0.2",
        "score": 59.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "bearer",
            "severity": "critical",
            "category": null,
            "file_path": "/repo/AbletonMCP_Remote_Script/__init__.py",
            "line_number": 1907,
            "rule_identifier": null,
            "title": "Unsanitized external input in code generation",
            "description": "## Description\n\nAllowing external input (dynamic or user-controlled) to directly influence code generation or scripting functions without proper sanitization can lead to code injection vulnerabilities. This occurs when an attacker is able to insert malicious code into your application, which is then executed, potentially leading to unauthorized actions or data access.\n\n## Remediations\n\n- **Do not** pass unsanitized external input to functions or methods that dynamically execute code.\n- **Do** al",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 19.02439419995062,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 5
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/Bearer/bearer",
          "report_type": "security",
          "rules_loaded": 554,
          "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"",
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 0,
            "critical": 1,
            "informational": 0
          }
        },
        "display_score": 59.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 4.189642342971638,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 3
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 4.190054933016654,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 5
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "capslock",
        "scanner_version": "v0.3.2",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 0.16965539200464264,
        "status": "not_applicable",
        "examined": {
          "unit": "packages",
          "count": 0
        },
        "metadata": {
          "source": "go-module-proxy",
          "source_url": "https://github.com/google/capslock/releases/tag/v0.3.2",
          "report_type": "go-capability",
          "vendor_mode": false,
          "install_command": "GOTOOLCHAIN=local GOFLAGS=-mod=mod GOSUMDB=sum.golang.org GOBIN=/usr/local/bin go install github.com/google/capslock/cmd/capslock@v0.3.2  # github.com/google/capslock v0.3.2 h1:0ZQa9YR8s9ewFu1g5w6Rgd/lW/4dga7qJew3K6Ql7aM=",
          "environment_note": "capslock found no .go files to analyze; reported not_applicable rather than a clean 100 \u2014 the scanner never ran, so it has no verdict to contribute",
          "go_files_present": 0,
          "artifact_type_policy": "mcp_server",
          "expected_capabilities": [
            "CAPABILITY_FILES",
            "CAPABILITY_NETWORK",
            "CAPABILITY_READ_SYSTEM_STATE",
            "CAPABILITY_REFLECT",
            "CAPABILITY_RUNTIME"
          ],
          "artifact_type_explicit": true
        },
        "display_score": null,
        "display_badge": "not_applicable"
      }
    ]
  },
  "report": {
    "report_id": "eb89d4ec-9169-405d-b3e2-f856e62f8174",
    "format": "json",
    "generated_at": "2026-08-12T16:58:18.000301+00:00",
    "scanner_filter": null,
    "signature": null
  }
}