{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": 37.71,
    "view": "composite",
    "scanner_badges": {
      "agentshield": "Verified",
      "cisco-skill-scanner": "Verified",
      "agent-audit-kit": "Unsafe",
      "nerlo-behavioral": "Unsafe",
      "nerlo-install-instruction": "Verified",
      "nerlo-multi-source": "Verified",
      "trivy": "Unsafe",
      "osv-scanner": "Unsafe",
      "trivy_image": "unavailable"
    },
    "finding_counts": {
      "critical": 0,
      "high": 17,
      "medium": 39,
      "low": 5
    },
    "recommendation": "@agishub/mcp is NOT recommended for integration: the scan surfaced 0 critical and 17 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/agishub/agishub-mcp",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "AgisHub (agishub.com)",
    "name": "@agishub/mcp",
    "version": "2.1.0"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 3.386725229007425,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": [
          "supply_chain"
        ]
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 93.5,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo",
          "line_number": null,
          "rule_identifier": "LOW_ANALYZABILITY",
          "title": "Critically low analyzability score",
          "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Only 25% of skill content could be analyzed. 32 of 42 files are opaque to the scanner. The safety assessment has low confidence.",
          "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/index.ts",
          "line_number": 61,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/index.ts",
          "line_number": 66,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/index.ts",
          "line_number": 67,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/index.ts",
          "line_number": 68,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/index.ts",
          "line_number": 74,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/index.ts",
          "line_number": 81,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/services/timezone/core/holidays.ts",
          "line_number": 24,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/services/web/core/extract.ts",
          "line_number": 2,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch (",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/services/web/core/extract.ts",
          "line_number": 75,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "data_exfiltration",
          "file_path": "/repo/src/services/web/core/extract.ts",
          "line_number": 127,
          "rule_identifier": "DATA_EXFIL_JS_NETWORK",
          "title": "Outbound network request primitives in JavaScript/TypeScript",
          "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
          "remediation": "Ensure network operations are necessary and document allowed destinations"
        }
      ],
      "execution_duration_seconds": 27.92579132199171,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 0,
          "critical": 0,
          "informational": 13
        },
        "artifact_type_policy": "mcp_server",
        "downweighted_findings": 12
      },
      "display_score": 93.5,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-005",
          "title": "Dependency count exceeds threshold",
          "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.",
          "remediation": "Audit and remove unused dependencies. Consider lighter alternatives."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "SECURITY.md",
          "line_number": null,
          "rule_identifier": "AAK-SEC-MD-001",
          "title": "MCP server repo missing SECURITY.md or security_contact",
          "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
          "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "src/stdio.ts",
          "line_number": 7,
          "rule_identifier": "AAK-MCP-018",
          "title": "Missing rate limiting on MCP endpoint",
          "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
          "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "src/index.ts",
          "line_number": 4,
          "rule_identifier": "AAK-MCP-018",
          "title": "Missing rate limiting on MCP endpoint",
          "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
          "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "src/adapters/mcp.ts",
          "line_number": 9,
          "rule_identifier": "AAK-MCP-018",
          "title": "Missing rate limiting on MCP endpoint",
          "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
          "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "mcp-config",
          "file_path": "src/context.ts",
          "line_number": 27,
          "rule_identifier": "AAK-OAUTH-001",
          "title": "OAuth flow without PKCE",
          "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
          "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "mcp-config",
          "file_path": "src/adapters/http.ts",
          "line_number": 40,
          "rule_identifier": "AAK-OAUTH-001",
          "title": "OAuth flow without PKCE",
          "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
          "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "mcp-config",
          "file_path": "src/adapters/mcp.ts",
          "line_number": 38,
          "rule_identifier": "AAK-OAUTH-001",
          "title": "OAuth flow without PKCE",
          "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
          "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "mcp-config",
          "file_path": "src/billing/types.ts",
          "line_number": 4,
          "rule_identifier": "AAK-OAUTH-001",
          "title": "OAuth flow without PKCE",
          "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
          "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "mcp-config",
          "file_path": "src/billing/index.ts",
          "line_number": 2,
          "rule_identifier": "AAK-OAUTH-001",
          "title": "OAuth flow without PKCE",
          "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
          "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": 48,
          "rule_identifier": "AAK-OAUTH-3P-001",
          "title": "Repo depends on a third-party agent-platform SDK",
          "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
          "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "src/stdio.ts",
          "line_number": null,
          "rule_identifier": "AAK-ANTHROPIC-SDK-001",
          "title": "MCP server built on the upstream SDK without STDIO sanitizer",
          "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
          "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": null,
          "rule_identifier": "AAK-DNS-REBIND-002",
          "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
          "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
          "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
        }
      ],
      "execution_duration_seconds": 9.857234588009305,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "files_scanned": 39,
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 2,
          "high": 7,
          "medium": 4,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 59.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "nerlo-behavioral",
          "severity": "medium",
          "category": "undisclosed-egress",
          "file_path": "/repo/src/index.ts",
          "line_number": 61,
          "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
          "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
          "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.",
          "remediation": null
        },
        {
          "tool_name": "nerlo-behavioral",
          "severity": "high",
          "category": "data-exfiltration",
          "file_path": "/repo/src/services/web/core/extract.ts",
          "line_number": 127,
          "rule_identifier": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
          "title": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
          "description": "A secret / environment variable / token value flows into a network request (fetch / axios / XMLHttpRequest). This is the postmark-mcp supply-chain exfiltration shape reproduced in Node/JS: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 44.01770322601078,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "files_scanned": 31,
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "severity_counts": {
          "low": 0,
          "high": 1,
          "medium": 1,
          "critical": 0,
          "informational": 0
        },
        "merged_invocation": true
      },
      "display_score": 59.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 44.021795065986225,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "files_scanned": 1,
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-multi-source",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 22.700270619010553,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "per_source": [
          {
            "badge": "Verified",
            "label": "npm@2.1.0",
            "score": 100.0,
            "version": "2.1.0",
            "identifier": "@agishub/mcp",
            "provenance": "clean",
            "source_type": "npm",
            "artifact_type": "mcp_server",
            "finding_count": 0,
            "malware_status": "complete",
            "injected_rule_ids": []
          }
        ],
        "report_type": "nerlo-multi-source",
        "diverged_sources": [],
        "published_surfaces_scanned": 1
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "trivy",
          "severity": "low",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-8769",
          "title": "@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",
          "description": "A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
          "remediation": null
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-frvp-7c67-39w9",
          "title": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
          "description": "The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t",
          "remediation": "Upgrade @hono/node-server from 1.19.14 to 2.0.5 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-1664",
          "title": "Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing",
          "description": "Summary\n\nAn Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue occurs because the `Message-ID` and `References` headers are parsed to derive the target agentName and agentId without proper validation or origin checks, allowing an external attacker with control of these headers to route inbound mail to arbitrary Durable Object instances and namespaces .\n\n\n\n\nRoot cause\n\nThe `createHeaderBasedEmailResol",
          "remediation": "Upgrade agents from 0.0.80 to 0.3.7 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-1721",
          "title": "Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler",
          "description": "Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\n\n\n\nRoot cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query p",
          "remediation": "Upgrade agents from 0.0.80 to 0.3.10 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-w5cr-2qhr-jqc5",
          "title": "Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site",
          "description": "## Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The error_description query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\n### Root cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query",
          "remediation": "Upgrade agents from 0.0.80 to 0.3.10 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "low",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2025-48985",
          "title": "Vercel\u2019s AI SDK's filetype whitelists can be bypassed when uploading files",
          "description": "A vulnerability in Vercel\u2019s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk",
          "remediation": "Upgrade ai from 4.3.19 to 5.0.52, 5.1.0-beta.9 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "high",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-gcfj-64vw-6mp9",
          "title": "Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",
          "description": "## Summary\n\nAxios\u2019 Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.proxy` is polluted and request configuration is materialized as a regular object before dispatch.\n\nRecent axios releases harden merged request config by creating a null-prototype object. However, request interceptors run after that merge and may return a replacement config. A common immutable interceptor pattern such as `{...config}` or `Object.assign({}, config)` converts the h",
          "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-42h9-826w-cgv3",
          "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service",
          "description": "## Summary\nAxios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.\n\nApplications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: ",
          "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-7q8q-rj6j-mhjq",
          "title": "Axios: Nested axios option objects can consume polluted prototype values",
          "description": "## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound re",
          "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-f4gw-2p7v-4548",
          "title": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",
          "description": "## Summary\n\nAxios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:<port>/` can be routed through the configured proxy instead of bypassing it.\n\nThe issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when th",
          "remediation": "Upgrade axios from 1.16.0 to 1.18.0, 0.33.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-hcpx-6fm6-wx23",
          "title": "Axios form serializer maxDepth bypass via {} metatoken",
          "description": "## Summary\n\nAxios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in `lib/helpers/toFormData.js`. When serializing an object with a top-level key ending in `{}`, axios calls `JSON.stringify()` on that value before the `formSerializer.maxDepth` guard can inspect the nested structure.\n\nAn attacker who can control object keys and nested values passed by an application into axios form or parameter serialization can trigger a raw `RangeError: Maximum",
          "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-jqh4-m9w3-8hp9",
          "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`",
          "description": "## Summary\n\naxios\u2019 fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: \"fetch\"` and rely on `maxBodyLength` to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.\n\nThis affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected.",
          "remediation": "Upgrade axios from 1.16.0 to 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-mmx7-hfxf-jppx",
          "title": "Axios: Prototype pollution gadgets can alter axios request construction",
          "description": "## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that ",
          "remediation": "Upgrade axios from 1.16.0 to 1.18.0, 0.33.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-mwf2-3pr3-8698",
          "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`",
          "description": "## Summary\n\nAxios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.\n\nThis affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.\n\n## Impact\n\nAn attacker who can control a stream passed to axios can c",
          "remediation": "Upgrade axios from 1.16.0 to 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-pmv8-rq9r-6j72",
          "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",
          "description": "## Summary\n\nAxios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.\n\nIf an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropr",
          "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-xj6q-8x83-jv6g",
          "title": "Axios: Prototype pollution auth subfields can inject Basic auth",
          "description": "## Summary\n\nAxios versions after the `GHSA-q8qp-cvcw-x6jj` fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own `auth` object that omits `username` or `password`, axios reads inherited `Object.prototype.username` and `Object.prototype.password` values and uses them to construct an outbound `Authorization: Basic ...` header.\n\nThis does not mean axios its",
          "remediation": "Upgrade axios from 1.16.0 to 1.18.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "high",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-16221",
          "title": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x  ...",
          "description": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f",
          "remediation": "Upgrade fast-uri from 3.1.3 to 2.4.3, 3.1.4, 4.1.1 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2025-9910",
          "title": "jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin",
          "description": "Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.",
          "remediation": "Upgrade jsondiffpatch from 0.6.0 to 0.7.2 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-41907",
          "title": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality",
          "description": "uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.",
          "remediation": "Upgrade uuid from 8.3.2 to 11.1.1, 12.0.1, 13.0.1 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-41907",
          "title": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality",
          "description": "uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.",
          "remediation": "Upgrade uuid from 9.0.1 to 11.1.1, 12.0.1, 13.0.1 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "high",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-48779",
          "title": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments",
          "description": "ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si",
          "remediation": "Upgrade ws from 8.18.0 to 5.2.5, 6.2.4, 7.5.11, 8.21.0 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-45736",
          "title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`",
          "description": "ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.",
          "remediation": "Upgrade ws from 8.18.0 to 8.20.1 or later"
        }
      ],
      "execution_duration_seconds": 1.2924997220106889,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "severity_counts": {
          "low": 2,
          "high": 3,
          "medium": 17,
          "critical": 0,
          "informational": 0
        },
        "manifests_scanned": [
          "package-lock.json"
        ]
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 0.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-866g-f22w-33x8",
          "title": "GHSA-866g-f22w-33x8 \u2014 npm @ai-sdk/provider-utils@2.2.8",
          "description": "aliases: CVE-2026-8769, GHSA-866g-f22w-33x8 | CVSS: 4.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-frvp-7c67-39w9",
          "title": "GHSA-frvp-7c67-39w9 \u2014 npm @hono/node-server@1.19.14",
          "description": "aliases: GHSA-frvp-7c67-39w9 | CVSS: 5.9",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-cvhv-6xm6-c3v4",
          "title": "GHSA-cvhv-6xm6-c3v4 \u2014 npm agents@0.0.80",
          "description": "aliases: CVE-2026-1721, GHSA-cvhv-6xm6-c3v4 | CVSS: 6.2",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-r7x9-8ph7-w8cg",
          "title": "GHSA-r7x9-8ph7-w8cg \u2014 npm agents@0.0.80",
          "description": "aliases: CVE-2026-1664, GHSA-r7x9-8ph7-w8cg | CVSS: 6.9",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-w5cr-2qhr-jqc5",
          "title": "GHSA-w5cr-2qhr-jqc5 \u2014 npm agents@0.0.80",
          "description": "aliases: GHSA-w5cr-2qhr-jqc5 | CVSS: 6.2",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "low",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-rwvc-j5jr-mgvh",
          "title": "GHSA-rwvc-j5jr-mgvh \u2014 npm ai@4.3.19",
          "description": "aliases: CVE-2025-48985, GHSA-rwvc-j5jr-mgvh | CVSS: 3.7",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-42h9-826w-cgv3",
          "title": "GHSA-42h9-826w-cgv3 \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-42h9-826w-cgv3 | CVSS: 6.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-7q8q-rj6j-mhjq",
          "title": "GHSA-7q8q-rj6j-mhjq \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-7q8q-rj6j-mhjq | CVSS: 6.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-f4gw-2p7v-4548",
          "title": "GHSA-f4gw-2p7v-4548 \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-f4gw-2p7v-4548 | CVSS: 6.9",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-gcfj-64vw-6mp9",
          "title": "GHSA-gcfj-64vw-6mp9 \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-gcfj-64vw-6mp9 | CVSS: 8.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-hcpx-6fm6-wx23",
          "title": "GHSA-hcpx-6fm6-wx23 \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-hcpx-6fm6-wx23 | CVSS: 6.9",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-jqh4-m9w3-8hp9",
          "title": "GHSA-jqh4-m9w3-8hp9 \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-jqh4-m9w3-8hp9 | CVSS: 6.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-mmx7-hfxf-jppx",
          "title": "GHSA-mmx7-hfxf-jppx \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-mmx7-hfxf-jppx | CVSS: 6.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-mwf2-3pr3-8698",
          "title": "GHSA-mwf2-3pr3-8698 \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-mwf2-3pr3-8698 | CVSS: 6.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-pmv8-rq9r-6j72",
          "title": "GHSA-pmv8-rq9r-6j72 \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-pmv8-rq9r-6j72 | CVSS: 6.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-xj6q-8x83-jv6g",
          "title": "GHSA-xj6q-8x83-jv6g \u2014 npm axios@1.16.0",
          "description": "aliases: GHSA-xj6q-8x83-jv6g | CVSS: 6.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-67mh-4wv8-2f99",
          "title": "GHSA-67mh-4wv8-2f99 \u2014 npm esbuild@0.24.2",
          "description": "aliases: GHSA-67mh-4wv8-2f99 | CVSS: 5.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-v2hh-gcrm-f6hx",
          "title": "GHSA-v2hh-gcrm-f6hx \u2014 npm fast-uri@3.1.3",
          "description": "aliases: CVE-2026-16221, GHSA-v2hh-gcrm-f6hx | CVSS: 7.5",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-33vc-wfww-vjfv",
          "title": "GHSA-33vc-wfww-vjfv \u2014 npm jsondiffpatch@0.6.0",
          "description": "aliases: CVE-2025-9910, GHSA-33vc-wfww-vjfv | CVSS: 5.3",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-f88m-g3jw-g9cj",
          "title": "GHSA-f88m-g3jw-g9cj \u2014 npm sharp@0.34.5",
          "description": "aliases: GHSA-f88m-g3jw-g9cj | CVSS: 7.0",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-w5hq-g745-h8pq",
          "title": "GHSA-w5hq-g745-h8pq \u2014 npm uuid@8.3.2",
          "description": "aliases: CVE-2026-41907, CVE-2026-41988, GHSA-w5hq-g745-h8pq | CVSS: 7.5",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-w5hq-g745-h8pq",
          "title": "GHSA-w5hq-g745-h8pq \u2014 npm uuid@9.0.1",
          "description": "aliases: CVE-2026-41907, CVE-2026-41988, GHSA-w5hq-g745-h8pq | CVSS: 7.5",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "medium",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-58qx-3vcg-4xpx",
          "title": "GHSA-58qx-3vcg-4xpx \u2014 npm ws@8.18.0",
          "description": "aliases: CVE-2026-45736, GHSA-58qx-3vcg-4xpx | CVSS: 4.4",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-96hv-2xvq-fx4p",
          "title": "GHSA-96hv-2xvq-fx4p \u2014 npm ws@8.18.0",
          "description": "aliases: CVE-2026-48779, GHSA-96hv-2xvq-fx4p | CVSS: 7.5",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 21.85087349000969,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [
          "npm"
        ],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "severity_counts": {
          "low": 1,
          "high": 6,
          "medium": 17,
          "critical": 0,
          "informational": 0
        },
        "manifests_scanned": [
          "/repo/package-lock.json"
        ],
        "finding_id_aliases": {
          "GHSA-33vc-wfww-vjfv": [
            "CVE-2025-9910"
          ],
          "GHSA-58qx-3vcg-4xpx": [
            "CVE-2026-45736"
          ],
          "GHSA-866g-f22w-33x8": [
            "CVE-2026-8769"
          ],
          "GHSA-96hv-2xvq-fx4p": [
            "CVE-2026-48779"
          ],
          "GHSA-cvhv-6xm6-c3v4": [
            "CVE-2026-1721"
          ],
          "GHSA-r7x9-8ph7-w8cg": [
            "CVE-2026-1664"
          ],
          "GHSA-rwvc-j5jr-mgvh": [
            "CVE-2025-48985"
          ],
          "GHSA-v2hh-gcrm-f6hx": [
            "CVE-2026-16221"
          ],
          "GHSA-w5hq-g745-h8pq": [
            "CVE-2026-41907",
            "CVE-2026-41988",
            "CVE-2026-41907",
            "CVE-2026-41988"
          ]
        },
        "cross_scanner_correlation": {
          "only_osv": [
            "GHSA-67mh-4wv8-2f99",
            "GHSA-f88m-g3jw-g9cj"
          ],
          "only_trivy": [],
          "intersection_ids": [
            "CVE-2025-48985",
            "CVE-2025-9910",
            "CVE-2026-16221",
            "CVE-2026-1664",
            "CVE-2026-1721",
            "CVE-2026-41907",
            "CVE-2026-45736",
            "CVE-2026-48779",
            "CVE-2026-8769",
            "GHSA-42h9-826w-cgv3",
            "GHSA-7q8q-rj6j-mhjq",
            "GHSA-f4gw-2p7v-4548",
            "GHSA-frvp-7c67-39w9",
            "GHSA-gcfj-64vw-6mp9",
            "GHSA-hcpx-6fm6-wx23",
            "GHSA-jqh4-m9w3-8hp9",
            "GHSA-mmx7-hfxf-jppx",
            "GHSA-mwf2-3pr3-8698",
            "GHSA-pmv8-rq9r-6j72",
            "GHSA-w5cr-2qhr-jqc5",
            "GHSA-xj6q-8x83-jv6g"
          ]
        }
      },
      "display_score": 0.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "trivy_image",
      "scanner_version": "0.71.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 1.9049999536946416e-05,
      "status": "not_applicable",
      "examined": null,
      "metadata": {
        "reason": "no OCI image acquired for this artifact"
      },
      "display_score": null,
      "display_badge": "unavailable"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "22842a52-5648-4fb2-81a4-0628f0443136",
    "scan_completed_at": "2026-07-29T01:03:49.367375+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "nerlo-multi-source": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8",
      "trivy_image": "0.71.0"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:05580105b6f4eef09aaef9c7d7c0ee0059e060ccc2d3f9fb2e7a39a3d9c94009",
    "ai_decision_log_ids": [
      "608be0e0-2da3-47ac-82bd-ad5a5e3dc9cb",
      "28b6b3e9-c65c-46ca-987f-901e0c5365bf"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 3.386725229007425,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": [
            "supply_chain"
          ]
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 93.5,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo",
            "line_number": null,
            "rule_identifier": "LOW_ANALYZABILITY",
            "title": "Critically low analyzability score",
            "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Only 25% of skill content could be analyzed. 32 of 42 files are opaque to the scanner. The safety assessment has low confidence.",
            "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/index.ts",
            "line_number": 61,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/index.ts",
            "line_number": 66,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/index.ts",
            "line_number": 67,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/index.ts",
            "line_number": 68,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/index.ts",
            "line_number": 74,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/index.ts",
            "line_number": 81,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/services/timezone/core/holidays.ts",
            "line_number": 24,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/services/web/core/extract.ts",
            "line_number": 2,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch (",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/services/web/core/extract.ts",
            "line_number": 75,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "data_exfiltration",
            "file_path": "/repo/src/services/web/core/extract.ts",
            "line_number": 127,
            "rule_identifier": "DATA_EXFIL_JS_NETWORK",
            "title": "Outbound network request primitives in JavaScript/TypeScript",
            "description": "[mcp_server policy: capability-matches-purpose class; severity medium -> informational] Pattern detected: fetch(",
            "remediation": "Ensure network operations are necessary and document allowed destinations"
          }
        ],
        "execution_duration_seconds": 27.92579132199171,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 0,
            "critical": 0,
            "informational": 13
          },
          "artifact_type_policy": "mcp_server",
          "downweighted_findings": 12
        },
        "display_score": 93.5,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-005",
            "title": "Dependency count exceeds threshold",
            "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.",
            "remediation": "Audit and remove unused dependencies. Consider lighter alternatives."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "SECURITY.md",
            "line_number": null,
            "rule_identifier": "AAK-SEC-MD-001",
            "title": "MCP server repo missing SECURITY.md or security_contact",
            "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
            "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "src/stdio.ts",
            "line_number": 7,
            "rule_identifier": "AAK-MCP-018",
            "title": "Missing rate limiting on MCP endpoint",
            "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
            "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "src/index.ts",
            "line_number": 4,
            "rule_identifier": "AAK-MCP-018",
            "title": "Missing rate limiting on MCP endpoint",
            "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
            "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "src/adapters/mcp.ts",
            "line_number": 9,
            "rule_identifier": "AAK-MCP-018",
            "title": "Missing rate limiting on MCP endpoint",
            "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
            "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "mcp-config",
            "file_path": "src/context.ts",
            "line_number": 27,
            "rule_identifier": "AAK-OAUTH-001",
            "title": "OAuth flow without PKCE",
            "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
            "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "mcp-config",
            "file_path": "src/adapters/http.ts",
            "line_number": 40,
            "rule_identifier": "AAK-OAUTH-001",
            "title": "OAuth flow without PKCE",
            "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
            "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "mcp-config",
            "file_path": "src/adapters/mcp.ts",
            "line_number": 38,
            "rule_identifier": "AAK-OAUTH-001",
            "title": "OAuth flow without PKCE",
            "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
            "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "mcp-config",
            "file_path": "src/billing/types.ts",
            "line_number": 4,
            "rule_identifier": "AAK-OAUTH-001",
            "title": "OAuth flow without PKCE",
            "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
            "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "mcp-config",
            "file_path": "src/billing/index.ts",
            "line_number": 2,
            "rule_identifier": "AAK-OAUTH-001",
            "title": "OAuth flow without PKCE",
            "description": "An OAuth 2.1 client flow does not use PKCE. PKCE is mandatory for all MCP remote server clients per spec 2025-11-25, including confidential clients.",
            "remediation": "Add a code_verifier/code_challenge pair to every authorization request. Use code_challenge_method=S256."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": 48,
            "rule_identifier": "AAK-OAUTH-3P-001",
            "title": "Repo depends on a third-party agent-platform SDK",
            "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
            "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "src/stdio.ts",
            "line_number": null,
            "rule_identifier": "AAK-ANTHROPIC-SDK-001",
            "title": "MCP server built on the upstream SDK without STDIO sanitizer",
            "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
            "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": null,
            "rule_identifier": "AAK-DNS-REBIND-002",
            "title": "Vulnerable MCP SDK version pinned (DNS-rebinding fix missing)",
            "description": "A project dependency manifest (requirements.txt, pyproject.toml, package.json, pom.xml, build.gradle) pins an MCP SDK at a version below the DNS-rebinding fix. Patched versions: Python `mcp` >= 1.23.0, TS `@modelcontextprotocol/sdk` >= 1.21.1, Java `io.modelcontextprotocol.sdk:mcp-core` >= 0.11.0, `@apollo/mcp-server` >= 1.7.0. Even if the project never serves over StreamableHTTP itself, transitive servers built on the SDK inherit the bug.",
            "remediation": "Bump the SDK to the patched version listed in the rule title. If a bump is not yet possible, ensure every transport surface has its own Host-header allow-list (see AAK-DNS-REBIND-001 remediation)."
          }
        ],
        "execution_duration_seconds": 9.857234588009305,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "files_scanned": 39,
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 2,
            "high": 7,
            "medium": 4,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 59.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "nerlo-behavioral",
            "severity": "medium",
            "category": "undisclosed-egress",
            "file_path": "/repo/src/index.ts",
            "line_number": 61,
            "rule_identifier": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
            "title": "opt.nerlo-rules.nerlo-hardcoded-external-egress",
            "description": "Network request to a hardcoded external host/URL. Undisclosed egress in an MCP server is a common exfiltration channel \u2014 confirm it is expected.",
            "remediation": null
          },
          {
            "tool_name": "nerlo-behavioral",
            "severity": "high",
            "category": "data-exfiltration",
            "file_path": "/repo/src/services/web/core/extract.ts",
            "line_number": 127,
            "rule_identifier": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
            "title": "opt.nerlo-rules.nerlo-js-secret-to-network-egress",
            "description": "A secret / environment variable / token value flows into a network request (fetch / axios / XMLHttpRequest). This is the postmark-mcp supply-chain exfiltration shape reproduced in Node/JS: a credential read from the environment is shipped off-box. Confirm the egress is expected and the value is not being exfiltrated to an attacker-controlled host.",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 44.01770322601078,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "files_scanned": 31,
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "severity_counts": {
            "low": 0,
            "high": 1,
            "medium": 1,
            "critical": 0,
            "informational": 0
          },
          "merged_invocation": true
        },
        "display_score": 59.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 44.021795065986225,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "files_scanned": 1,
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-multi-source",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 22.700270619010553,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "per_source": [
            {
              "badge": "Verified",
              "label": "npm@2.1.0",
              "score": 100.0,
              "version": "2.1.0",
              "identifier": "@agishub/mcp",
              "provenance": "clean",
              "source_type": "npm",
              "artifact_type": "mcp_server",
              "finding_count": 0,
              "malware_status": "complete",
              "injected_rule_ids": []
            }
          ],
          "report_type": "nerlo-multi-source",
          "diverged_sources": [],
          "published_surfaces_scanned": 1
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "trivy",
            "severity": "low",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-8769",
            "title": "@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",
            "description": "A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.",
            "remediation": null
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-frvp-7c67-39w9",
            "title": "Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",
            "description": "The same as the `hono` core [Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)](https://github.com/honojs/hono/security/advisories/GHSA-wwfh-h76j-fc44).\n\n### Summary\n\nOn Windows hosts, an encoded backslash (`%5C`) in the request path decodes to `\\`, which the Windows path resolver treats as a separator. `serve-static` then resolves a single URL segment such as `admin\\secret.txt` into a nested file under the root and serves it, letting an attacker read static files meant t",
            "remediation": "Upgrade @hono/node-server from 1.19.14 to 2.0.5 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-1664",
            "title": "Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing",
            "description": "Summary\n\nAn Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue occurs because the `Message-ID` and `References` headers are parsed to derive the target agentName and agentId without proper validation or origin checks, allowing an external attacker with control of these headers to route inbound mail to arbitrary Durable Object instances and namespaces .\n\n\n\n\nRoot cause\n\nThe `createHeaderBasedEmailResol",
            "remediation": "Upgrade agents from 0.0.80 to 0.3.7 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-1721",
            "title": "Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler",
            "description": "Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\n\n\n\nRoot cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query p",
            "remediation": "Upgrade agents from 0.0.80 to 0.3.10 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-w5cr-2qhr-jqc5",
            "title": "Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site",
            "description": "## Summary\n\nA Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The error_description query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to execute arbitrary JavaScript in the context of the victim's session.\n\n### Root cause\n\nThe OAuth callback handler in `site/ai-playground/src/server.ts` directly interpolated the `authError` value, sourced from the `error_description` query",
            "remediation": "Upgrade agents from 0.0.80 to 0.3.10 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "low",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2025-48985",
            "title": "Vercel\u2019s AI SDK's filetype whitelists can be bypassed when uploading files",
            "description": "A vulnerability in Vercel\u2019s AI SDK has been fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta. This issue may have allowed users to bypass filetype whitelists when uploading files. All users are encouraged to upgrade.\r\n\r\nMore details: https://vercel.com/changelog/cve-2025-48985-input-validation-bypass-on-ai-sdk",
            "remediation": "Upgrade ai from 4.3.19 to 5.0.52, 5.1.0-beta.9 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "high",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-gcfj-64vw-6mp9",
            "title": "Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",
            "description": "## Summary\n\nAxios\u2019 Node.js HTTP adapter can route requests through an attacker-controlled proxy when `Object.prototype.proxy` is polluted and request configuration is materialized as a regular object before dispatch.\n\nRecent axios releases harden merged request config by creating a null-prototype object. However, request interceptors run after that merge and may return a replacement config. A common immutable interceptor pattern such as `{...config}` or `Object.assign({}, config)` converts the h",
            "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-42h9-826w-cgv3",
            "title": "Axios: Excessive recursion in formDataToJSON can cause denial of service",
            "description": "## Summary\nAxios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.\n\nApplications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: ",
            "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-7q8q-rj6j-mhjq",
            "title": "Axios: Nested axios option objects can consume polluted prototype values",
            "description": "## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound re",
            "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-f4gw-2p7v-4548",
            "title": "Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",
            "description": "## Summary\n\nAxios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:<port>/` can be routed through the configured proxy instead of bypassing it.\n\nThe issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when th",
            "remediation": "Upgrade axios from 1.16.0 to 1.18.0, 0.33.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-hcpx-6fm6-wx23",
            "title": "Axios form serializer maxDepth bypass via {} metatoken",
            "description": "## Summary\n\nAxios versions in the fixed lines for GHSA-62hf-57xw-28j9 still contain an incomplete depth-limit bypass in `lib/helpers/toFormData.js`. When serializing an object with a top-level key ending in `{}`, axios calls `JSON.stringify()` on that value before the `formSerializer.maxDepth` guard can inspect the nested structure.\n\nAn attacker who can control object keys and nested values passed by an application into axios form or parameter serialization can trigger a raw `RangeError: Maximum",
            "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-jqh4-m9w3-8hp9",
            "title": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`",
            "description": "## Summary\n\naxios\u2019 fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: \"fetch\"` and rely on `maxBodyLength` to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.\n\nThis affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected.",
            "remediation": "Upgrade axios from 1.16.0 to 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-mmx7-hfxf-jppx",
            "title": "Axios: Prototype pollution gadgets can alter axios request construction",
            "description": "## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that ",
            "remediation": "Upgrade axios from 1.16.0 to 1.18.0, 0.33.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-mwf2-3pr3-8698",
            "title": "Axios: HTTP/2 streamed uploads bypass `maxBodyLength`",
            "description": "## Summary\n\nAxios versions with Node.js HTTP/2 support allow streamed request bodies to bypass `maxBodyLength` enforcement when requests are sent with `httpVersion: 2`.\n\nThis affects applications that rely on `maxBodyLength` as a hard cap while forwarding attacker-controlled streams, such as upload endpoints proxying user data to an upstream HTTP/2 service. Buffered request bodies are still checked before the request is sent.\n\n## Impact\n\nAn attacker who can control a stream passed to axios can c",
            "remediation": "Upgrade axios from 1.16.0 to 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-pmv8-rq9r-6j72",
            "title": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",
            "description": "## Summary\n\nAxios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.\n\nIf an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropr",
            "remediation": "Upgrade axios from 1.16.0 to 0.33.0, 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-xj6q-8x83-jv6g",
            "title": "Axios: Prototype pollution auth subfields can inject Basic auth",
            "description": "## Summary\n\nAxios versions after the `GHSA-q8qp-cvcw-x6jj` fix still contain prototype-pollution read-side gadgets in Basic auth subfield handling. If a host application is already affected by prototype pollution and then makes an axios request with an own `auth` object that omits `username` or `password`, axios reads inherited `Object.prototype.username` and `Object.prototype.password` values and uses them to construct an outbound `Authorization: Basic ...` header.\n\nThis does not mean axios its",
            "remediation": "Upgrade axios from 1.16.0 to 1.18.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "high",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-16221",
            "title": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x  ...",
            "description": "Impact: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter. Node's native WHATWG URL parser, used by fetch, undici, and Node's http and https clients, normalizes the backslash to a forward slash for special schemes such as http, https, ws, wss, ftp, and file. As a result, the two parsers extract different hosts from the same input string. Applications that use f",
            "remediation": "Upgrade fast-uri from 3.1.3 to 2.4.3, 3.1.4, 4.1.1 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2025-9910",
            "title": "jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin",
            "description": "Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious scripts into HTML payloads that may lead to code execution if untrusted payloads were used as source for the diff, and the result renderer using the built-in html formatter on a private website.",
            "remediation": "Upgrade jsondiffpatch from 0.6.0 to 0.7.2 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-41907",
            "title": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality",
            "description": "uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.",
            "remediation": "Upgrade uuid from 8.3.2 to 11.1.1, 12.0.1, 13.0.1 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-41907",
            "title": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality",
            "description": "uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.",
            "remediation": "Upgrade uuid from 9.0.1 to 11.1.1, 12.0.1, 13.0.1 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "high",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-48779",
            "title": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments",
            "description": "ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si",
            "remediation": "Upgrade ws from 8.18.0 to 5.2.5, 6.2.4, 7.5.11, 8.21.0 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-45736",
            "title": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`",
            "description": "ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.",
            "remediation": "Upgrade ws from 8.18.0 to 8.20.1 or later"
          }
        ],
        "execution_duration_seconds": 1.2924997220106889,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "severity_counts": {
            "low": 2,
            "high": 3,
            "medium": 17,
            "critical": 0,
            "informational": 0
          },
          "manifests_scanned": [
            "package-lock.json"
          ]
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 0.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-866g-f22w-33x8",
            "title": "GHSA-866g-f22w-33x8 \u2014 npm @ai-sdk/provider-utils@2.2.8",
            "description": "aliases: CVE-2026-8769, GHSA-866g-f22w-33x8 | CVSS: 4.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-frvp-7c67-39w9",
            "title": "GHSA-frvp-7c67-39w9 \u2014 npm @hono/node-server@1.19.14",
            "description": "aliases: GHSA-frvp-7c67-39w9 | CVSS: 5.9",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-cvhv-6xm6-c3v4",
            "title": "GHSA-cvhv-6xm6-c3v4 \u2014 npm agents@0.0.80",
            "description": "aliases: CVE-2026-1721, GHSA-cvhv-6xm6-c3v4 | CVSS: 6.2",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-r7x9-8ph7-w8cg",
            "title": "GHSA-r7x9-8ph7-w8cg \u2014 npm agents@0.0.80",
            "description": "aliases: CVE-2026-1664, GHSA-r7x9-8ph7-w8cg | CVSS: 6.9",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-w5cr-2qhr-jqc5",
            "title": "GHSA-w5cr-2qhr-jqc5 \u2014 npm agents@0.0.80",
            "description": "aliases: GHSA-w5cr-2qhr-jqc5 | CVSS: 6.2",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "low",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-rwvc-j5jr-mgvh",
            "title": "GHSA-rwvc-j5jr-mgvh \u2014 npm ai@4.3.19",
            "description": "aliases: CVE-2025-48985, GHSA-rwvc-j5jr-mgvh | CVSS: 3.7",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-42h9-826w-cgv3",
            "title": "GHSA-42h9-826w-cgv3 \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-42h9-826w-cgv3 | CVSS: 6.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-7q8q-rj6j-mhjq",
            "title": "GHSA-7q8q-rj6j-mhjq \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-7q8q-rj6j-mhjq | CVSS: 6.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-f4gw-2p7v-4548",
            "title": "GHSA-f4gw-2p7v-4548 \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-f4gw-2p7v-4548 | CVSS: 6.9",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-gcfj-64vw-6mp9",
            "title": "GHSA-gcfj-64vw-6mp9 \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-gcfj-64vw-6mp9 | CVSS: 8.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-hcpx-6fm6-wx23",
            "title": "GHSA-hcpx-6fm6-wx23 \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-hcpx-6fm6-wx23 | CVSS: 6.9",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-jqh4-m9w3-8hp9",
            "title": "GHSA-jqh4-m9w3-8hp9 \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-jqh4-m9w3-8hp9 | CVSS: 6.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-mmx7-hfxf-jppx",
            "title": "GHSA-mmx7-hfxf-jppx \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-mmx7-hfxf-jppx | CVSS: 6.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-mwf2-3pr3-8698",
            "title": "GHSA-mwf2-3pr3-8698 \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-mwf2-3pr3-8698 | CVSS: 6.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-pmv8-rq9r-6j72",
            "title": "GHSA-pmv8-rq9r-6j72 \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-pmv8-rq9r-6j72 | CVSS: 6.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-xj6q-8x83-jv6g",
            "title": "GHSA-xj6q-8x83-jv6g \u2014 npm axios@1.16.0",
            "description": "aliases: GHSA-xj6q-8x83-jv6g | CVSS: 6.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-67mh-4wv8-2f99",
            "title": "GHSA-67mh-4wv8-2f99 \u2014 npm esbuild@0.24.2",
            "description": "aliases: GHSA-67mh-4wv8-2f99 | CVSS: 5.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-v2hh-gcrm-f6hx",
            "title": "GHSA-v2hh-gcrm-f6hx \u2014 npm fast-uri@3.1.3",
            "description": "aliases: CVE-2026-16221, GHSA-v2hh-gcrm-f6hx | CVSS: 7.5",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-33vc-wfww-vjfv",
            "title": "GHSA-33vc-wfww-vjfv \u2014 npm jsondiffpatch@0.6.0",
            "description": "aliases: CVE-2025-9910, GHSA-33vc-wfww-vjfv | CVSS: 5.3",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-f88m-g3jw-g9cj",
            "title": "GHSA-f88m-g3jw-g9cj \u2014 npm sharp@0.34.5",
            "description": "aliases: GHSA-f88m-g3jw-g9cj | CVSS: 7.0",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-w5hq-g745-h8pq",
            "title": "GHSA-w5hq-g745-h8pq \u2014 npm uuid@8.3.2",
            "description": "aliases: CVE-2026-41907, CVE-2026-41988, GHSA-w5hq-g745-h8pq | CVSS: 7.5",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-w5hq-g745-h8pq",
            "title": "GHSA-w5hq-g745-h8pq \u2014 npm uuid@9.0.1",
            "description": "aliases: CVE-2026-41907, CVE-2026-41988, GHSA-w5hq-g745-h8pq | CVSS: 7.5",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "medium",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-58qx-3vcg-4xpx",
            "title": "GHSA-58qx-3vcg-4xpx \u2014 npm ws@8.18.0",
            "description": "aliases: CVE-2026-45736, GHSA-58qx-3vcg-4xpx | CVSS: 4.4",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-96hv-2xvq-fx4p",
            "title": "GHSA-96hv-2xvq-fx4p \u2014 npm ws@8.18.0",
            "description": "aliases: CVE-2026-48779, GHSA-96hv-2xvq-fx4p | CVSS: 7.5",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 21.85087349000969,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [
            "npm"
          ],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "severity_counts": {
            "low": 1,
            "high": 6,
            "medium": 17,
            "critical": 0,
            "informational": 0
          },
          "manifests_scanned": [
            "/repo/package-lock.json"
          ],
          "finding_id_aliases": {
            "GHSA-33vc-wfww-vjfv": [
              "CVE-2025-9910"
            ],
            "GHSA-58qx-3vcg-4xpx": [
              "CVE-2026-45736"
            ],
            "GHSA-866g-f22w-33x8": [
              "CVE-2026-8769"
            ],
            "GHSA-96hv-2xvq-fx4p": [
              "CVE-2026-48779"
            ],
            "GHSA-cvhv-6xm6-c3v4": [
              "CVE-2026-1721"
            ],
            "GHSA-r7x9-8ph7-w8cg": [
              "CVE-2026-1664"
            ],
            "GHSA-rwvc-j5jr-mgvh": [
              "CVE-2025-48985"
            ],
            "GHSA-v2hh-gcrm-f6hx": [
              "CVE-2026-16221"
            ],
            "GHSA-w5hq-g745-h8pq": [
              "CVE-2026-41907",
              "CVE-2026-41988",
              "CVE-2026-41907",
              "CVE-2026-41988"
            ]
          },
          "cross_scanner_correlation": {
            "only_osv": [
              "GHSA-67mh-4wv8-2f99",
              "GHSA-f88m-g3jw-g9cj"
            ],
            "only_trivy": [],
            "intersection_ids": [
              "CVE-2025-48985",
              "CVE-2025-9910",
              "CVE-2026-16221",
              "CVE-2026-1664",
              "CVE-2026-1721",
              "CVE-2026-41907",
              "CVE-2026-45736",
              "CVE-2026-48779",
              "CVE-2026-8769",
              "GHSA-42h9-826w-cgv3",
              "GHSA-7q8q-rj6j-mhjq",
              "GHSA-f4gw-2p7v-4548",
              "GHSA-frvp-7c67-39w9",
              "GHSA-gcfj-64vw-6mp9",
              "GHSA-hcpx-6fm6-wx23",
              "GHSA-jqh4-m9w3-8hp9",
              "GHSA-mmx7-hfxf-jppx",
              "GHSA-mwf2-3pr3-8698",
              "GHSA-pmv8-rq9r-6j72",
              "GHSA-w5cr-2qhr-jqc5",
              "GHSA-xj6q-8x83-jv6g"
            ]
          }
        },
        "display_score": 0.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "trivy_image",
        "scanner_version": "0.71.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 1.9049999536946416e-05,
        "status": "not_applicable",
        "examined": null,
        "metadata": {
          "reason": "no OCI image acquired for this artifact"
        },
        "display_score": null,
        "display_badge": "unavailable"
      }
    ]
  },
  "report": {
    "report_id": "12183647-5b27-46e4-8d79-30738d33e6ca",
    "format": "json",
    "generated_at": "2026-07-29T04:46:37.427769+00:00",
    "scanner_filter": null,
    "signature": null
  }
}