{ "executive_summary": { "badge": "Unsafe", "security_score": 47.88, "view": "composite", "scanner_badges": { "agentshield": "Verified", "cisco-skill-scanner": "Unsafe", "agent-audit-kit": "Verified", "bearer": "Verified", "nerlo-behavioral": "Verified", "nerlo-install-instruction": "Verified", "trivy": "Unsafe", "osv-scanner": "Unsafe" }, "finding_counts": { "critical": 0, "high": 21, "medium": 18, "low": 15 }, "recommendation": "@chargebee/agentkit-repo is NOT recommended for integration: the scan surfaced 0 critical and 21 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering." }, "source_provenance": { "repository_url": "https://github.com/chargebee/agentkit", "commit_sha_scanned": null, "license": "MIT", "maintainer": "Chargebee, Inc. (https://chargebee.com)", "name": "@chargebee/agentkit-repo", "version": "0.0.0" }, "per_scanner_detail": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 8.936924153997097, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 1.5, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 62% of skill content could be analyzed. 14 of 38 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo/media/mcp-cursor-demo.mp4", "line_number": null, "rule_identifier": "UNANALYZABLE_BINARY", "title": "Unanalyzable binary file", "description": "Binary file 'media/mcp-cursor-demo.mp4' cannot be inspected by the scanner. Reason: Binary file (.mp4) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.", "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/media/mcp-cursor-demo.mp4", "line_number": null, "rule_identifier": "BINARY_FILE_DETECTED", "title": "Binary file detected in skill package", "description": "Binary file found: media/mcp-cursor-demo.mp4. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.", "remediation": "Review binary file necessity. Replace with auditable scripts if possible." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unicode_steganography", "file_path": "/repo/media/mcp-demo.gif", "line_number": 0, "rule_identifier": "YARA_prompt_injection_unicode_steganography", "title": "UNICODE STEGANOGRAPHY detected by YARA", "description": "Detects hidden Unicode characters used for invisible prompt injection and steganography: \u2028", "remediation": "Review and remove unicode steganography pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/media/mcp-demo.gif", "line_number": null, "rule_identifier": "OVERSIZED_FILE", "title": "Oversized file in skill package", "description": "File media/mcp-demo.gif is 5.1MB. Large files in skill packages may contain hidden content or serve as a vector for resource abuse.", "remediation": "Review large files and consider hosting externally." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.development", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: modelcontextprotocol/.env.development. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.production", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: modelcontextprotocol/.env.production. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/src/chargebee-ai-client/index.ts", "line_number": 36, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/tsup.config.ts", "line_number": 6, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.readFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo/modelcontextprotocol", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 41% of skill content could be analyzed. 13 of 22 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.development", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .env.development. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.production", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .env.production. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/modelcontextprotocol/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/modelcontextprotocol/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/src/chargebee-ai-client/index.ts", "line_number": 36, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/tsup.config.ts", "line_number": 6, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.readFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name '.github' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 26.523713468006463, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "modelcontextprotocol", ".github" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 8, "high": 4, "medium": 4, "critical": 0, "informational": 5 } }, "display_score": 1.5, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 95.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "modelcontextprotocol/src/mcp.ts", "line_number": 2, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." } ], "execution_duration_seconds": 18.584167107008398, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 31, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 0, "medium": 1, "critical": 0, "informational": 0 } }, "display_score": 95.0, "display_badge": "Verified" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 16.805932479997864, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 45.21724913199432, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 13, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 44.78845552900748, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 7, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 26.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "high", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2025-66414", "title": "Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default", "description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest", "remediation": "Upgrade @modelcontextprotocol/sdk from 1.7.0 to 1.24.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-0621", "title": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability", "description": "Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.", "remediation": "Upgrade @modelcontextprotocol/sdk from 1.7.0 to 1.25.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-4926", "title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions", "description": "Impact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.", "remediation": "Upgrade path-to-regexp from 8.2.0 to 8.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-4923", "title": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards", "description": "Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too", "remediation": "Upgrade path-to-regexp from 8.2.0 to 8.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2025-15284", "title": "qs: qs: Denial of Service via improper input validation in array parsing", "description": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la", "remediation": "Upgrade qs from 6.13.0 to 6.14.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.13.0 to 6.15.2 or later" }, { "tool_name": "trivy", "severity": "low", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-2391", "title": "qs: qs's arrayLimit bypass in comma parsing allows denial of service", "description": "### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?", "remediation": "Upgrade qs from 6.13.0 to 6.14.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2025-15284", "title": "qs: qs: Denial of Service via improper input validation in array parsing", "description": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la", "remediation": "Upgrade qs from 6.14.0 to 6.14.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.14.0 to 6.15.2 or later" }, { "tool_name": "trivy", "severity": "low", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-2391", "title": "qs: qs's arrayLimit bypass in comma parsing allows denial of service", "description": "### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?", "remediation": "Upgrade qs from 6.14.0 to 6.14.2 or later" } ], "execution_duration_seconds": 0.904543183001806, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 2, "high": 3, "medium": 5, "critical": 0, "informational": 0 }, "manifests_scanned": [ "modelcontextprotocol/pnpm-lock.yaml" ] }, "display_score": 26.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-8r9q-7v3j-jr4g", "title": "GHSA-8r9q-7v3j-jr4g \u2014 npm @modelcontextprotocol/sdk@1.7.0", "description": "aliases: CVE-2026-0621, GHSA-8r9q-7v3j-jr4g | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-w48q-cv73-mx4w", "title": "GHSA-w48q-cv73-mx4w \u2014 npm @modelcontextprotocol/sdk@1.7.0", "description": "aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-v422-hmwv-36x6", "title": "GHSA-v422-hmwv-36x6 \u2014 npm body-parser@2.1.0", "description": "aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-f886-m6hf-6m8v", "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-v6h2-p8h4-qcjw", "title": "GHSA-v6h2-p8h4-qcjw \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | CVSS: 3.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@2.0.1", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-f886-m6hf-6m8v", "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@2.0.1", "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-v6h2-p8h4-qcjw", "title": "GHSA-v6h2-p8h4-qcjw \u2014 npm brace-expansion@2.0.1", "description": "aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | CVSS: 3.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-5j98-mcp5-4vw2", "title": "GHSA-5j98-mcp5-4vw2 \u2014 npm glob@10.4.5", "description": "aliases: CVE-2025-64756, GHSA-5j98-mcp5-4vw2 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-23c5-xmqv-rm74", "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3ppc-4f35-3m26", "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-7r86-cg39-jmmj", "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-23c5-xmqv-rm74", "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@9.0.5", "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3ppc-4f35-3m26", "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@9.0.5", "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-7r86-cg39-jmmj", "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@9.0.5", "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-27v5-c462-wpq7", "title": "GHSA-27v5-c462-wpq7 \u2014 npm path-to-regexp@8.2.0", "description": "aliases: CVE-2026-4923, GHSA-27v5-c462-wpq7 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-j3q9-mxjg-w52f", "title": "GHSA-j3q9-mxjg-w52f \u2014 npm path-to-regexp@8.2.0", "description": "aliases: CVE-2026-4926, GHSA-j3q9-mxjg-w52f | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3v7f-55p6-f55p", "title": "GHSA-3v7f-55p6-f55p \u2014 npm picomatch@4.0.2", "description": "aliases: CVE-2026-33672, GHSA-3v7f-55p6-f55p | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-c2c7-rcm5-vvqj", "title": "GHSA-c2c7-rcm5-vvqj \u2014 npm picomatch@4.0.2", "description": "aliases: CVE-2026-33671, GHSA-c2c7-rcm5-vvqj | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-6rw7-vpxm-498p", "title": "GHSA-6rw7-vpxm-498p \u2014 npm qs@6.13.0", "description": "aliases: CVE-2025-15284, GHSA-6rw7-vpxm-498p | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.13.0", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-w7fw-mjwx-w883", "title": "GHSA-w7fw-mjwx-w883 \u2014 npm qs@6.13.0", "description": "aliases: CVE-2026-2391, GHSA-w7fw-mjwx-w883 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-6rw7-vpxm-498p", "title": "GHSA-6rw7-vpxm-498p \u2014 npm qs@6.14.0", "description": "aliases: CVE-2025-15284, GHSA-6rw7-vpxm-498p | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.14.0", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-w7fw-mjwx-w883", "title": "GHSA-w7fw-mjwx-w883 \u2014 npm qs@6.14.0", "description": "aliases: CVE-2026-2391, GHSA-w7fw-mjwx-w883 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-mw96-cpmx-2vgc", "title": "GHSA-mw96-cpmx-2vgc \u2014 npm rollup@4.35.0", "description": "aliases: CVE-2026-27606, GHSA-mw96-cpmx-2vgc | CVSS: 8.8", "remediation": null } ], "execution_duration_seconds": 19.176953761998448, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 5, "high": 14, "medium": 8, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/modelcontextprotocol/pnpm-lock.yaml" ], "finding_id_aliases": { "GHSA-23c5-xmqv-rm74": [ "CVE-2026-27904", "CVE-2026-27904" ], "GHSA-27v5-c462-wpq7": [ "CVE-2026-4923" ], "GHSA-3jxr-9vmj-r5cp": [ "CVE-2026-13149", "CVE-2026-13149" ], "GHSA-3ppc-4f35-3m26": [ "CVE-2026-26996", "CVE-2026-26996" ], "GHSA-3v7f-55p6-f55p": [ "CVE-2026-33672" ], "GHSA-5j98-mcp5-4vw2": [ "CVE-2025-64756" ], "GHSA-6rw7-vpxm-498p": [ "CVE-2025-15284", "CVE-2025-15284" ], "GHSA-7r86-cg39-jmmj": [ "CVE-2026-27903", "CVE-2026-27903" ], "GHSA-8r9q-7v3j-jr4g": [ "CVE-2026-0621" ], "GHSA-c2c7-rcm5-vvqj": [ "CVE-2026-33671" ], "GHSA-f886-m6hf-6m8v": [ "CVE-2026-33750", "CVE-2026-33750" ], "GHSA-j3q9-mxjg-w52f": [ "CVE-2026-4926" ], "GHSA-mw96-cpmx-2vgc": [ "CVE-2026-27606" ], "GHSA-q8mj-m7cp-5q26": [ "CVE-2026-8723", "CVE-2026-8723" ], "GHSA-v422-hmwv-36x6": [ "CVE-2026-12590" ], "GHSA-v6h2-p8h4-qcjw": [ "CVE-2025-5889", "CVE-2025-5889" ], "GHSA-w48q-cv73-mx4w": [ "CVE-2025-66414" ], "GHSA-w7fw-mjwx-w883": [ "CVE-2026-2391", "CVE-2026-2391" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-23c5-xmqv-rm74", "GHSA-3jxr-9vmj-r5cp", "GHSA-3ppc-4f35-3m26", "GHSA-3v7f-55p6-f55p", "GHSA-5j98-mcp5-4vw2", "GHSA-7r86-cg39-jmmj", "GHSA-c2c7-rcm5-vvqj", "GHSA-f886-m6hf-6m8v", "GHSA-mw96-cpmx-2vgc", "GHSA-v422-hmwv-36x6", "GHSA-v6h2-p8h4-qcjw" ], "only_trivy": [], "intersection_ids": [ "CVE-2025-15284", "CVE-2025-66414", "CVE-2026-0621", "CVE-2026-2391", "CVE-2026-4923", "CVE-2026-4926", "CVE-2026-8723" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ], "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.", "audit_chain": { "scan_job_id": "ab0dcc7d-9662-4587-adfa-371a23956604", "scan_completed_at": "2026-07-21T01:25:22.344659+00:00", "scanner_versions": { "agentshield": "1.4.0", "cisco-skill-scanner": "2.0.11", "agent-audit-kit": "0.3.26", "bearer": "2.0.2", "nerlo-behavioral": "0.1.0", "nerlo-install-instruction": "0.1.0", "trivy": "0.71.0", "osv-scanner": "2.3.8" }, "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:229184f5b7dddaed2b5e2a60a9cd3eeecfc0a610ac8e28131e02a7d179fdc00f", "ai_decision_log_ids": [ "6a045193-144f-47dd-9e55-ed237d20d15f" ], "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation" }, "appendix": { "raw_scanner_reports": [ { "scanner_name": "agentshield", "scanner_version": "1.4.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 8.936924153997097, "status": "complete", "metadata": { "source": "npm", "source_url": "https://www.npmjs.com/package/ecc-agentshield", "install_command": "npm install -g ecc-agentshield@1.4.0", "scans_performed": [ "supply_chain" ] }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "cisco-skill-scanner", "scanner_version": "2.0.11", "score": 1.5, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 62% of skill content could be analyzed. 14 of 38 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "policy_violation", "file_path": "/repo/media/mcp-cursor-demo.mp4", "line_number": null, "rule_identifier": "UNANALYZABLE_BINARY", "title": "Unanalyzable binary file", "description": "Binary file 'media/mcp-cursor-demo.mp4' cannot be inspected by the scanner. Reason: Binary file (.mp4) - cannot inspect content. Binary files resist static analysis and may contain hidden functionality.", "remediation": "Replace binary files with source code, or submit the binary to VirusTotal for independent verification (--use-virustotal)." }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/media/mcp-cursor-demo.mp4", "line_number": null, "rule_identifier": "BINARY_FILE_DETECTED", "title": "Binary file detected in skill package", "description": "Binary file found: media/mcp-cursor-demo.mp4. Binary files cannot be inspected by static analysis. Consider using Python or Bash scripts for transparency.", "remediation": "Review binary file necessity. Replace with auditable scripts if possible." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "unicode_steganography", "file_path": "/repo/media/mcp-demo.gif", "line_number": 0, "rule_identifier": "YARA_prompt_injection_unicode_steganography", "title": "UNICODE STEGANOGRAPHY detected by YARA", "description": "Detects hidden Unicode characters used for invisible prompt injection and steganography: \u2028", "remediation": "Review and remove unicode steganography pattern" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "policy_violation", "file_path": "/repo/media/mcp-demo.gif", "line_number": null, "rule_identifier": "OVERSIZED_FILE", "title": "Oversized file in skill package", "description": "File media/mcp-demo.gif is 5.1MB. Large files in skill packages may contain hidden content or serve as a vector for resource abuse.", "remediation": "Review large files and consider hosting externally." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.development", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: modelcontextprotocol/.env.development. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.production", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: modelcontextprotocol/.env.production. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/src/chargebee-ai-client/index.ts", "line_number": 36, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/tsup.config.ts", "line_number": 6, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.readFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "policy_violation", "file_path": "/repo/modelcontextprotocol", "line_number": null, "rule_identifier": "LOW_ANALYZABILITY", "title": "Critically low analyzability score", "description": "Only 41% of skill content could be analyzed. 13 of 22 files are opaque to the scanner. The safety assessment has low confidence.", "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.development", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .env.development. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "obfuscation", "file_path": "/repo/modelcontextprotocol/.env.production", "line_number": null, "rule_identifier": "HIDDEN_DATA_FILE", "title": "Hidden data file detected", "description": "Hidden file found: .env.production. Hidden files may contain concealed configuration or data that should be reviewed.", "remediation": "Move file to a visible location or document its purpose." }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/modelcontextprotocol/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/modelcontextprotocol/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" }, { "tool_name": "cisco-skill-scanner", "severity": "medium", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/src/chargebee-ai-client/index.ts", "line_number": 36, "rule_identifier": "DATA_EXFIL_JS_NETWORK", "title": "Outbound network request primitives in JavaScript/TypeScript", "description": "Pattern detected: fetch(", "remediation": "Ensure network operations are necessary and document allowed destinations" }, { "tool_name": "cisco-skill-scanner", "severity": "high", "category": "data_exfiltration", "file_path": "/repo/modelcontextprotocol/tsup.config.ts", "line_number": 6, "rule_identifier": "DATA_EXFIL_JS_FS_ACCESS", "title": "Node.js filesystem access that could read or write sensitive data", "description": "Pattern detected: fs.readFileSync(", "remediation": "Review filesystem operations. Ensure they don't access sensitive system files or credential stores" }, { "tool_name": "cisco-skill-scanner", "severity": "low", "category": "social_engineering", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION", "title": "Vague skill description", "description": "Skill description is too short (16 chars). Provide detailed explanation.", "remediation": "Provide a clear, detailed description of what the skill does and when to use it" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_INVALID_NAME", "title": "Skill name does not follow agent skills naming rules", "description": "Skill name '.github' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.", "remediation": "Rename the skill to match `[a-z0-9-]{1,64}` (e.g., 'pdf-processing')" }, { "tool_name": "cisco-skill-scanner", "severity": "informational", "category": "policy_violation", "file_path": "/repo/.github/SKILL.md", "line_number": null, "rule_identifier": "MANIFEST_MISSING_LICENSE", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)" } ], "execution_duration_seconds": 26.523713468006463, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/", "report_type": "cisco-skill-sast", "analyzers_used": [ "bytecode", "pipeline", "static_analyzer" ], "skills_scanned": [ "repo", "modelcontextprotocol", ".github" ], "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt", "severity_counts": { "low": 8, "high": 4, "medium": 4, "critical": 0, "informational": 5 } }, "display_score": 1.5, "display_badge": "Unsafe" }, { "scanner_name": "agent-audit-kit", "scanner_version": "0.3.26", "score": 95.0, "scanner_badge": "Verified", "findings": [ { "tool_name": "agent-audit-kit", "severity": "medium", "category": "mcp-config", "file_path": "modelcontextprotocol/src/mcp.ts", "line_number": 2, "rule_identifier": "AAK-MCP-018", "title": "Missing rate limiting on MCP endpoint", "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.", "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429." } ], "execution_duration_seconds": 18.584167107008398, "status": "complete", "metadata": { "source": "pypi", "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/", "report_type": "agent-audit-kit-sast", "files_scanned": 31, "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt", "rules_evaluated": 211, "severity_counts": { "low": 0, "high": 0, "medium": 1, "critical": 0, "informational": 0 } }, "display_score": 95.0, "display_badge": "Verified" }, { "scanner_name": "bearer", "scanner_version": "2.0.2", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 16.805932479997864, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/Bearer/bearer", "report_type": "security", "rules_loaded": 1, "install_command": "curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh -s -- -b /usr/local/bin \"v2.0.2\"" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-behavioral", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 45.21724913199432, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-behavioral", "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml", "files_scanned": 13, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "nerlo-install-instruction", "scanner_version": "0.1.0", "score": 100.0, "scanner_badge": "Verified", "findings": [], "execution_duration_seconds": 44.78845552900748, "status": "complete", "metadata": { "source": "nerlo-original", "source_url": "https://github.com/nerlo-ai/nerlo", "report_type": "nerlo-install-instruction", "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml", "files_scanned": 7, "install_command": "pip install 'semgrep==1.97.0'" }, "display_score": 100.0, "display_badge": "Verified" }, { "scanner_name": "trivy", "scanner_version": "0.71.0", "score": 26.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "trivy", "severity": "high", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2025-66414", "title": "Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default", "description": "MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPServerTransport or SSEServerTransport and has not enabled enableDnsRebindingProtection, a malicious website could exploit DNS rebinding to bypass same-origin policy rest", "remediation": "Upgrade @modelcontextprotocol/sdk from 1.7.0 to 1.24.0 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-0621", "title": "Anthropic's MCP TypeScript SDK has a ReDoS vulnerability", "description": "Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service (ReDoS) vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested quantifiers that can trigger catastrophic backtracking on specially crafted inputs, resulting in excessive CPU consumption. An attacker can exploit this by supplying a malicious URI that causes the Node.", "remediation": "Upgrade @modelcontextprotocol/sdk from 1.7.0 to 1.25.2 or later" }, { "tool_name": "trivy", "severity": "high", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-4926", "title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions", "description": "Impact:\n\nA bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.\n\nPatches:\n\nFixed in version 8.4.0.\n\nWorkarounds:\n\nLimit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.", "remediation": "Upgrade path-to-regexp from 8.2.0 to 8.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-4923", "title": "path-to-regexp: path-to-regexp: Denial of Service via specially crafted paths with multiple wildcards", "description": "Impact:\n\nWhen using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.\n\nUnsafe examples:\n\n/*foo-*bar-:baz\n/*a-:b-*c-:d\n/x/*a-:b/*c/y\n\nSafe examples:\n\n/*foo-:bar\n/*foo-:bar-*baz\n\nPatches:\n\nUpgrade to version 8.4.0.\n\nWorkarounds:\n\nIf you are using multiple wildcard parameters, you can check the regex output with a too", "remediation": "Upgrade path-to-regexp from 8.2.0 to 8.4.0 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2025-15284", "title": "qs: qs: Denial of Service via improper input validation in array parsing", "description": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la", "remediation": "Upgrade qs from 6.13.0 to 6.14.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.13.0 to 6.15.2 or later" }, { "tool_name": "trivy", "severity": "low", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-2391", "title": "qs: qs's arrayLimit bypass in comma parsing allows denial of service", "description": "### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?", "remediation": "Upgrade qs from 6.13.0 to 6.14.2 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2025-15284", "title": "qs: qs: Denial of Service via improper input validation in array parsing", "description": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la", "remediation": "Upgrade qs from 6.14.0 to 6.14.1 or later" }, { "tool_name": "trivy", "severity": "medium", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-8723", "title": "### Summary `qs.stringify` throws `TypeError` when called with `arr ...", "description": "### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti", "remediation": "Upgrade qs from 6.14.0 to 6.15.2 or later" }, { "tool_name": "trivy", "severity": "low", "category": "pnpm", "file_path": "modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "CVE-2026-2391", "title": "qs: qs's arrayLimit bypass in comma parsing allows denial of service", "description": "### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?", "remediation": "Upgrade qs from 6.14.0 to 6.14.2 or later" } ], "execution_duration_seconds": 0.904543183001806, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0", "report_type": "filesystem-vulnerability", "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo ' /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb", "severity_counts": { "low": 2, "high": 3, "medium": 5, "critical": 0, "informational": 0 }, "manifests_scanned": [ "modelcontextprotocol/pnpm-lock.yaml" ] }, "display_score": 26.0, "display_badge": "Unsafe" }, { "scanner_name": "osv-scanner", "scanner_version": "2.3.8", "score": 0.0, "scanner_badge": "Unsafe", "findings": [ { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-8r9q-7v3j-jr4g", "title": "GHSA-8r9q-7v3j-jr4g \u2014 npm @modelcontextprotocol/sdk@1.7.0", "description": "aliases: CVE-2026-0621, GHSA-8r9q-7v3j-jr4g | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-w48q-cv73-mx4w", "title": "GHSA-w48q-cv73-mx4w \u2014 npm @modelcontextprotocol/sdk@1.7.0", "description": "aliases: CVE-2025-66414, GHSA-w48q-cv73-mx4w | CVSS: 7.6", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-v422-hmwv-36x6", "title": "GHSA-v422-hmwv-36x6 \u2014 npm body-parser@2.1.0", "description": "aliases: CVE-2026-12590, GHSA-v422-hmwv-36x6 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-f886-m6hf-6m8v", "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-v6h2-p8h4-qcjw", "title": "GHSA-v6h2-p8h4-qcjw \u2014 npm brace-expansion@1.1.11", "description": "aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | CVSS: 3.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3jxr-9vmj-r5cp", "title": "GHSA-3jxr-9vmj-r5cp \u2014 npm brace-expansion@2.0.1", "description": "aliases: CVE-2026-13149, GHSA-3jxr-9vmj-r5cp | CVSS: 7.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-f886-m6hf-6m8v", "title": "GHSA-f886-m6hf-6m8v \u2014 npm brace-expansion@2.0.1", "description": "aliases: CVE-2026-33750, GHSA-f886-m6hf-6m8v | CVSS: 6.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-v6h2-p8h4-qcjw", "title": "GHSA-v6h2-p8h4-qcjw \u2014 npm brace-expansion@2.0.1", "description": "aliases: CVE-2025-5889, GHSA-v6h2-p8h4-qcjw | CVSS: 3.1", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-5j98-mcp5-4vw2", "title": "GHSA-5j98-mcp5-4vw2 \u2014 npm glob@10.4.5", "description": "aliases: CVE-2025-64756, GHSA-5j98-mcp5-4vw2 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-23c5-xmqv-rm74", "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3ppc-4f35-3m26", "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-7r86-cg39-jmmj", "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@3.1.2", "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-23c5-xmqv-rm74", "title": "GHSA-23c5-xmqv-rm74 \u2014 npm minimatch@9.0.5", "description": "aliases: CVE-2026-27904, GHSA-23c5-xmqv-rm74 | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3ppc-4f35-3m26", "title": "GHSA-3ppc-4f35-3m26 \u2014 npm minimatch@9.0.5", "description": "aliases: CVE-2026-26996, GHSA-3ppc-4f35-3m26 | CVSS: 8.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-7r86-cg39-jmmj", "title": "GHSA-7r86-cg39-jmmj \u2014 npm minimatch@9.0.5", "description": "aliases: CVE-2026-27903, GHSA-7r86-cg39-jmmj | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-27v5-c462-wpq7", "title": "GHSA-27v5-c462-wpq7 \u2014 npm path-to-regexp@8.2.0", "description": "aliases: CVE-2026-4923, GHSA-27v5-c462-wpq7 | CVSS: 5.9", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-j3q9-mxjg-w52f", "title": "GHSA-j3q9-mxjg-w52f \u2014 npm path-to-regexp@8.2.0", "description": "aliases: CVE-2026-4926, GHSA-j3q9-mxjg-w52f | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-3v7f-55p6-f55p", "title": "GHSA-3v7f-55p6-f55p \u2014 npm picomatch@4.0.2", "description": "aliases: CVE-2026-33672, GHSA-3v7f-55p6-f55p | CVSS: 5.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-c2c7-rcm5-vvqj", "title": "GHSA-c2c7-rcm5-vvqj \u2014 npm picomatch@4.0.2", "description": "aliases: CVE-2026-33671, GHSA-c2c7-rcm5-vvqj | CVSS: 7.5", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-6rw7-vpxm-498p", "title": "GHSA-6rw7-vpxm-498p \u2014 npm qs@6.13.0", "description": "aliases: CVE-2025-15284, GHSA-6rw7-vpxm-498p | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.13.0", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-w7fw-mjwx-w883", "title": "GHSA-w7fw-mjwx-w883 \u2014 npm qs@6.13.0", "description": "aliases: CVE-2026-2391, GHSA-w7fw-mjwx-w883 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-6rw7-vpxm-498p", "title": "GHSA-6rw7-vpxm-498p \u2014 npm qs@6.14.0", "description": "aliases: CVE-2025-15284, GHSA-6rw7-vpxm-498p | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "medium", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-q8mj-m7cp-5q26", "title": "GHSA-q8mj-m7cp-5q26 \u2014 npm qs@6.14.0", "description": "aliases: CVE-2026-8723, GHSA-q8mj-m7cp-5q26 | CVSS: 6.3", "remediation": null }, { "tool_name": "osv-scanner", "severity": "low", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-w7fw-mjwx-w883", "title": "GHSA-w7fw-mjwx-w883 \u2014 npm qs@6.14.0", "description": "aliases: CVE-2026-2391, GHSA-w7fw-mjwx-w883 | CVSS: 3.7", "remediation": null }, { "tool_name": "osv-scanner", "severity": "high", "category": "npm", "file_path": "/repo/modelcontextprotocol/pnpm-lock.yaml", "line_number": null, "rule_identifier": "GHSA-mw96-cpmx-2vgc", "title": "GHSA-mw96-cpmx-2vgc \u2014 npm rollup@4.35.0", "description": "aliases: CVE-2026-27606, GHSA-mw96-cpmx-2vgc | CVSS: 8.8", "remediation": null } ], "execution_duration_seconds": 19.176953761998448, "status": "complete", "metadata": { "source": "github-releases", "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8", "report_type": "osv-vulnerability", "ecosystems_seen": [ "npm" ], "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo ' /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner", "severity_counts": { "low": 5, "high": 14, "medium": 8, "critical": 0, "informational": 0 }, "manifests_scanned": [ "/repo/modelcontextprotocol/pnpm-lock.yaml" ], "finding_id_aliases": { "GHSA-23c5-xmqv-rm74": [ "CVE-2026-27904", "CVE-2026-27904" ], "GHSA-27v5-c462-wpq7": [ "CVE-2026-4923" ], "GHSA-3jxr-9vmj-r5cp": [ "CVE-2026-13149", "CVE-2026-13149" ], "GHSA-3ppc-4f35-3m26": [ "CVE-2026-26996", "CVE-2026-26996" ], "GHSA-3v7f-55p6-f55p": [ "CVE-2026-33672" ], "GHSA-5j98-mcp5-4vw2": [ "CVE-2025-64756" ], "GHSA-6rw7-vpxm-498p": [ "CVE-2025-15284", "CVE-2025-15284" ], "GHSA-7r86-cg39-jmmj": [ "CVE-2026-27903", "CVE-2026-27903" ], "GHSA-8r9q-7v3j-jr4g": [ "CVE-2026-0621" ], "GHSA-c2c7-rcm5-vvqj": [ "CVE-2026-33671" ], "GHSA-f886-m6hf-6m8v": [ "CVE-2026-33750", "CVE-2026-33750" ], "GHSA-j3q9-mxjg-w52f": [ "CVE-2026-4926" ], "GHSA-mw96-cpmx-2vgc": [ "CVE-2026-27606" ], "GHSA-q8mj-m7cp-5q26": [ "CVE-2026-8723", "CVE-2026-8723" ], "GHSA-v422-hmwv-36x6": [ "CVE-2026-12590" ], "GHSA-v6h2-p8h4-qcjw": [ "CVE-2025-5889", "CVE-2025-5889" ], "GHSA-w48q-cv73-mx4w": [ "CVE-2025-66414" ], "GHSA-w7fw-mjwx-w883": [ "CVE-2026-2391", "CVE-2026-2391" ] }, "cross_scanner_correlation": { "only_osv": [ "GHSA-23c5-xmqv-rm74", "GHSA-3jxr-9vmj-r5cp", "GHSA-3ppc-4f35-3m26", "GHSA-3v7f-55p6-f55p", "GHSA-5j98-mcp5-4vw2", "GHSA-7r86-cg39-jmmj", "GHSA-c2c7-rcm5-vvqj", "GHSA-f886-m6hf-6m8v", "GHSA-mw96-cpmx-2vgc", "GHSA-v422-hmwv-36x6", "GHSA-v6h2-p8h4-qcjw" ], "only_trivy": [], "intersection_ids": [ "CVE-2025-15284", "CVE-2025-66414", "CVE-2026-0621", "CVE-2026-2391", "CVE-2026-4923", "CVE-2026-4926", "CVE-2026-8723" ] } }, "display_score": 0.0, "display_badge": "Unsafe" } ] }, "report": { "report_id": "c6e84fd5-5cff-42d5-94b8-559b58cb84c9", "format": "json", "generated_at": "2026-07-21T18:18:48.482424+00:00", "scanner_filter": null, "signature": null } }