{
  "executive_summary": {
    "badge": "Unsafe",
    "security_score": 81.54,
    "view": "composite",
    "aggregate_verdict_withheld": false,
    "aggregate_verdict_withheld_reason": null,
    "scanner_badges": {
      "agentshield": "Verified",
      "cisco-skill-scanner": "Verified",
      "agent-audit-kit": "Unsafe",
      "nerlo-behavioral": "Verified",
      "nerlo-install-instruction": "Verified",
      "nerlo-multi-source": "Verified",
      "trivy": "Caution",
      "osv-scanner": "Caution"
    },
    "finding_counts": {
      "critical": 0,
      "high": 6,
      "medium": 4,
      "low": 3,
      "informational": 3
    },
    "recommendation": "@ainative/gtm-mcp is NOT recommended for integration: the scan surfaced 0 critical and 6 high-severity findings. Treat the Per-Scanner Detail section as a remediation worklist and re-scan before reconsidering."
  },
  "source_provenance": {
    "repository_url": "https://github.com/AINative-Studio/ainative-gtm-mcp",
    "commit_sha_scanned": null,
    "license": "MIT",
    "maintainer": "AINative Studio",
    "name": "@ainative/gtm-mcp",
    "version": "0.4.2"
  },
  "per_scanner_detail": [
    {
      "scanner_name": "agentshield",
      "scanner_version": "1.4.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 2.430713059991831,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "npm",
        "source_url": "https://www.npmjs.com/package/ecc-agentshield",
        "install_command": "npm install -g ecc-agentshield@1.4.0",
        "scans_performed": [
          "supply_chain"
        ]
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "cisco-skill-scanner",
      "scanner_version": "2.0.11",
      "score": 98.5,
      "scanner_badge": "Verified",
      "findings": [
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo",
          "line_number": null,
          "rule_identifier": "LOW_ANALYZABILITY",
          "title": "Critically low analyzability score",
          "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Only 36% of skill content could be analyzed. 13 of 21 files are opaque to the scanner. The safety assessment has low confidence.",
          "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "social_engineering",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
          "title": "Vague skill description",
          "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
          "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
        },
        {
          "tool_name": "cisco-skill-scanner",
          "severity": "informational",
          "category": "policy_violation",
          "file_path": "/repo/SKILL.md",
          "line_number": null,
          "rule_identifier": "MANIFEST_MISSING_LICENSE",
          "title": "Skill does not specify a license",
          "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
          "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
        }
      ],
      "execution_duration_seconds": 20.863546064996626,
      "status": "complete",
      "examined": {
        "unit": "skills",
        "count": 1
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
        "report_type": "cisco-skill-sast",
        "analyzers_used": [
          "bytecode",
          "pipeline",
          "static_analyzer"
        ],
        "skills_scanned": [
          "repo"
        ],
        "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
        "severity_counts": {
          "low": 0,
          "high": 0,
          "medium": 0,
          "critical": 0,
          "informational": 3
        },
        "artifact_type_policy": "mcp_server",
        "downweighted_findings": 2
      },
      "display_score": 98.5,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "agent-audit-kit",
      "scanner_version": "0.3.26",
      "score": 36.0,
      "scanner_badge": "Unsafe",
      "findings": [
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "src/lib/gtm-client.ts",
          "line_number": 10,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "secret-exposure",
          "file_path": "src/lib/gtm-client.ts",
          "line_number": 11,
          "rule_identifier": "AAK-SECRET-004",
          "title": "Generic high-entropy secret",
          "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
          "remediation": "Move to environment variables or secrets manager."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "AAK-SUPPLY-005",
          "title": "Dependency count exceeds threshold",
          "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.",
          "remediation": "Audit and remove unused dependencies. Consider lighter alternatives."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "low",
          "category": "supply-chain",
          "file_path": "SECURITY.md",
          "line_number": null,
          "rule_identifier": "AAK-SEC-MD-001",
          "title": "MCP server repo missing SECURITY.md or security_contact",
          "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
          "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "mcp-config",
          "file_path": "src/index.ts",
          "line_number": 2,
          "rule_identifier": "AAK-MCP-018",
          "title": "Missing rate limiting on MCP endpoint",
          "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
          "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "legal-compliance",
          "file_path": "README.md",
          "line_number": null,
          "rule_identifier": "AAK-HEALTHCARE-AI-004",
          "title": "Healthcare context without explicit AI-disclosure to user",
          "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
          "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "medium",
          "category": "supply-chain",
          "file_path": "package.json",
          "line_number": 58,
          "rule_identifier": "AAK-OAUTH-3P-001",
          "title": "Repo depends on a third-party agent-platform SDK",
          "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
          "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
        },
        {
          "tool_name": "agent-audit-kit",
          "severity": "high",
          "category": "supply-chain",
          "file_path": "src/index.ts",
          "line_number": null,
          "rule_identifier": "AAK-ANTHROPIC-SDK-001",
          "title": "MCP server built on the upstream SDK without STDIO sanitizer",
          "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
          "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
        }
      ],
      "execution_duration_seconds": 5.984572556975763,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 20
      },
      "metadata": {
        "source": "pypi",
        "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
        "report_type": "agent-audit-kit-sast",
        "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
        "rules_evaluated": 211,
        "severity_counts": {
          "low": 2,
          "high": 3,
          "medium": 3,
          "critical": 0,
          "informational": 0
        }
      },
      "display_score": 36.0,
      "display_badge": "Unsafe"
    },
    {
      "scanner_name": "nerlo-behavioral",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 38.5240100529918,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 11
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-behavioral",
        "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/exfiltration.yaml",
          "/opt/nerlo-rules/clipboard_exfiltration.yaml",
          "/opt/nerlo-rules/rce_endpoint.yaml",
          "/opt/nerlo-rules/taint_egress.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-install-instruction",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 38.52258611199795,
      "status": "complete",
      "examined": {
        "unit": "files",
        "count": 1
      },
      "metadata": {
        "source": "nerlo-original",
        "source_url": "https://github.com/nerlo-ai/nerlo",
        "report_type": "nerlo-install-instruction",
        "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
        "ruleset_paths": [
          "/opt/nerlo-rules/install_instructions.yaml",
          "/opt/nerlo-rules/cursor_rules.yaml"
        ],
        "install_command": "pip install 'semgrep==1.97.0'",
        "merged_invocation": true
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "nerlo-multi-source",
      "scanner_version": "0.1.0",
      "score": 100.0,
      "scanner_badge": "Verified",
      "findings": [],
      "execution_duration_seconds": 25.847836532018846,
      "status": "complete",
      "examined": null,
      "metadata": {
        "source": "nerlo-original",
        "per_source": [
          {
            "badge": "Verified",
            "label": "npm@0.4.2",
            "score": 100.0,
            "version": "0.4.2",
            "identifier": "@ainative/gtm-mcp",
            "provenance": "clean",
            "source_type": "npm",
            "artifact_type": "mcp_server",
            "finding_count": 0,
            "malware_status": "complete",
            "injected_rule_ids": []
          }
        ],
        "report_type": "nerlo-multi-source",
        "diverged_sources": [],
        "published_surfaces_scanned": 1
      },
      "display_score": 100.0,
      "display_badge": "Verified"
    },
    {
      "scanner_name": "trivy",
      "scanner_version": "0.71.0",
      "score": 80.0,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "trivy",
          "severity": "high",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-14257",
          "title": "brace-expansion through 5.0.7 is vulnerable to denial of service via m ...",
          "description": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i",
          "remediation": "Upgrade brace-expansion from 2.1.3 to 5.0.8 or later"
        },
        {
          "tool_name": "trivy",
          "severity": "medium",
          "category": "npm",
          "file_path": "package-lock.json",
          "line_number": null,
          "rule_identifier": "CVE-2026-41907",
          "title": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality",
          "description": "uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.",
          "remediation": "Upgrade uuid from 9.0.1 to 11.1.1, 12.0.1, 13.0.1 or later"
        }
      ],
      "execution_duration_seconds": 0.4875062329811044,
      "status": "complete",
      "examined": {
        "unit": "manifests",
        "count": 1
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
        "report_type": "filesystem-vulnerability",
        "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
        "severity_counts": {
          "low": 0,
          "high": 1,
          "medium": 1,
          "critical": 0,
          "informational": 0
        },
        "manifests_scanned": [
          "package-lock.json"
        ]
      },
      "display_score": 80.0,
      "display_badge": "Caution"
    },
    {
      "scanner_name": "osv-scanner",
      "scanner_version": "2.3.8",
      "score": 68.0,
      "scanner_badge": "Caution",
      "findings": [
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-mh99-v99m-4gvg",
          "title": "GHSA-mh99-v99m-4gvg \u2014 npm brace-expansion@2.1.3",
          "description": "aliases: CVE-2026-14257, GHSA-mh99-v99m-4gvg | CVSS: 7.5",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "low",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-g7r4-m6w7-qqqr",
          "title": "GHSA-g7r4-m6w7-qqqr \u2014 npm esbuild@0.27.7",
          "description": "aliases: GHSA-g7r4-m6w7-qqqr | CVSS: 2.5",
          "remediation": null
        },
        {
          "tool_name": "osv-scanner",
          "severity": "high",
          "category": "npm",
          "file_path": "/repo/package-lock.json",
          "line_number": null,
          "rule_identifier": "GHSA-w5hq-g745-h8pq",
          "title": "GHSA-w5hq-g745-h8pq \u2014 npm uuid@9.0.1",
          "description": "aliases: CVE-2026-41907, CVE-2026-41988, GHSA-w5hq-g745-h8pq | CVSS: 7.5",
          "remediation": null
        }
      ],
      "execution_duration_seconds": 11.112379405007232,
      "status": "complete",
      "examined": {
        "unit": "manifests",
        "count": 1
      },
      "metadata": {
        "source": "github-releases",
        "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
        "report_type": "osv-vulnerability",
        "ecosystems_seen": [
          "npm"
        ],
        "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
        "severity_counts": {
          "low": 1,
          "high": 2,
          "medium": 0,
          "critical": 0,
          "informational": 0
        },
        "manifests_scanned": [
          "/repo/package-lock.json"
        ],
        "finding_id_aliases": {
          "GHSA-mh99-v99m-4gvg": [
            "CVE-2026-14257"
          ],
          "GHSA-w5hq-g745-h8pq": [
            "CVE-2026-41907",
            "CVE-2026-41988"
          ]
        },
        "cross_scanner_correlation": {
          "only_osv": [
            "GHSA-g7r4-m6w7-qqqr"
          ],
          "only_trivy": [],
          "intersection_ids": [
            "CVE-2026-14257",
            "CVE-2026-41907"
          ]
        }
      },
      "display_score": 68.0,
      "display_badge": "Caution"
    }
  ],
  "threat_model": "Threat model synthesis has not yet run for this scan. This section is generated by the registry's LLM pipeline (Req 22.3) and will appear in the next regeneration of this report.",
  "audit_chain": {
    "scan_job_id": "cc2fd89a-795a-40c9-bdec-09fc30ab4646",
    "scan_completed_at": "2026-08-01T07:42:35.231165+00:00",
    "scanner_versions": {
      "agentshield": "1.4.0",
      "cisco-skill-scanner": "2.0.11",
      "agent-audit-kit": "0.3.26",
      "nerlo-behavioral": "0.1.0",
      "nerlo-install-instruction": "0.1.0",
      "nerlo-multi-source": "0.1.0",
      "trivy": "0.71.0",
      "osv-scanner": "2.3.8"
    },
    "scanner_base_image": "us-central1-docker.pkg.dev/nerlo-vsk-prod/nerlo/scanner-base@sha256:5b605cdef65aaf3d8b562c388cdd6483d6922974476d23c1f8e4f6c5f6ae723e",
    "ai_decision_log_ids": [
      "8c3df911-a9b6-43ea-9a50-d9cca8387721",
      "0f4b1444-0fe5-4528-a692-6dde1b0d4bc0"
    ],
    "self_attestation_url": "http://localhost:8000/api/v1/registry/self-attestation"
  },
  "appendix": {
    "raw_scanner_reports": [
      {
        "scanner_name": "agentshield",
        "scanner_version": "1.4.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 2.430713059991831,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "npm",
          "source_url": "https://www.npmjs.com/package/ecc-agentshield",
          "install_command": "npm install -g ecc-agentshield@1.4.0",
          "scans_performed": [
            "supply_chain"
          ]
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "cisco-skill-scanner",
        "scanner_version": "2.0.11",
        "score": 98.5,
        "scanner_badge": "Verified",
        "findings": [
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo",
            "line_number": null,
            "rule_identifier": "LOW_ANALYZABILITY",
            "title": "Critically low analyzability score",
            "description": "[mcp_server policy: capability-matches-purpose class; severity high -> informational] Only 36% of skill content could be analyzed. 13 of 21 files are opaque to the scanner. The safety assessment has low confidence.",
            "remediation": "Replace opaque files (binaries, encrypted content) with inspectable source code to improve scan confidence."
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "social_engineering",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "SOCIAL_ENG_VAGUE_DESCRIPTION",
            "title": "Vague skill description",
            "description": "[mcp_server policy: capability-matches-purpose class; severity low -> informational] Skill description is too short (16 chars). Provide detailed explanation.",
            "remediation": "Provide a clear, detailed description of what the skill does and when to use it"
          },
          {
            "tool_name": "cisco-skill-scanner",
            "severity": "informational",
            "category": "policy_violation",
            "file_path": "/repo/SKILL.md",
            "line_number": null,
            "rule_identifier": "MANIFEST_MISSING_LICENSE",
            "title": "Skill does not specify a license",
            "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.",
            "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)"
          }
        ],
        "execution_duration_seconds": 20.863546064996626,
        "status": "complete",
        "examined": {
          "unit": "skills",
          "count": 1
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/cisco-ai-skill-scanner/2.0.11/",
          "report_type": "cisco-skill-sast",
          "analyzers_used": [
            "bytecode",
            "pipeline",
            "static_analyzer"
          ],
          "skills_scanned": [
            "repo"
          ],
          "install_command": "pip install --require-hashes -r docker/scanner-base/cisco-skill-scanner/requirements.txt",
          "severity_counts": {
            "low": 0,
            "high": 0,
            "medium": 0,
            "critical": 0,
            "informational": 3
          },
          "artifact_type_policy": "mcp_server",
          "downweighted_findings": 2
        },
        "display_score": 98.5,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "agent-audit-kit",
        "scanner_version": "0.3.26",
        "score": 36.0,
        "scanner_badge": "Unsafe",
        "findings": [
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "src/lib/gtm-client.ts",
            "line_number": 10,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "secret-exposure",
            "file_path": "src/lib/gtm-client.ts",
            "line_number": 11,
            "rule_identifier": "AAK-SECRET-004",
            "title": "Generic high-entropy secret",
            "description": "A value assigned to a secret-like key has high Shannon entropy, indicating a likely credential or API key.",
            "remediation": "Move to environment variables or secrets manager."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "AAK-SUPPLY-005",
            "title": "Dependency count exceeds threshold",
            "description": "More than 200 direct + transitive dependencies in lockfile. Each dependency is a trust decision.",
            "remediation": "Audit and remove unused dependencies. Consider lighter alternatives."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "low",
            "category": "supply-chain",
            "file_path": "SECURITY.md",
            "line_number": null,
            "rule_identifier": "AAK-SEC-MD-001",
            "title": "MCP server repo missing SECURITY.md or security_contact",
            "description": "A repository whose name or pyproject keywords declare it as an MCP server ships without a top-level SECURITY.md AND without a `security_contact` entry in marketplace.json / pyproject.toml / package.json. Anthropic's April 2026 SECURITY.md guidance makes this the baseline expectation so researchers have a channel.",
            "remediation": "Add SECURITY.md at the repo root with a disclosure email and response SLA; OR add `security_contact` to the project manifest."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "mcp-config",
            "file_path": "src/index.ts",
            "line_number": 2,
            "rule_identifier": "AAK-MCP-018",
            "title": "Missing rate limiting on MCP endpoint",
            "description": "An MCP server endpoint does not declare rate limiting. Unrestricted access allows credential stuffing and enumeration attacks.",
            "remediation": "Add per-IP and per-token rate limits. Reject bursts above the limit with 429."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "legal-compliance",
            "file_path": "README.md",
            "line_number": null,
            "rule_identifier": "AAK-HEALTHCARE-AI-004",
            "title": "Healthcare context without explicit AI-disclosure to user",
            "description": "Text mentions patient / clinical / mental-health / therapy / diagnosis but the tool never explicitly says the responder is an AI. Multiple 2026 state laws (TN, WA, UT) expect clear AI disclosure in clinical interactions.",
            "remediation": "Add a visible 'You are talking to an AI; this is not medical advice and is not a substitute for licensed care' disclosure."
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "medium",
            "category": "supply-chain",
            "file_path": "package.json",
            "line_number": 58,
            "rule_identifier": "AAK-OAUTH-3P-001",
            "title": "Repo depends on a third-party agent-platform SDK",
            "description": "The project depends on an agent-platform SDK (context-ai, langsmith, helicone, langfuse, humanloop, MCP SDK). Informational finding so reviewers audit the vendor's OAuth-scope footprint before merging. Raised to MEDIUM because the April 19 2026 Vercel \u00d7 Context.ai incident showed a single vendor compromise can turn into a production breach via transitive OAuth grants.",
            "remediation": "Pin the SDK to an exact version, audit the OAuth scopes it requests, and keep any deployment-level grants (Vercel, GCP, Workspace) in a secrets vault \u2014 never in a committed env file. See Vercel's bulletin for sensitive-env-var guidance: https://vercel.com/kb/bulletin/vercel-april-2026-security-incident"
          },
          {
            "tool_name": "agent-audit-kit",
            "severity": "high",
            "category": "supply-chain",
            "file_path": "src/index.ts",
            "line_number": null,
            "rule_identifier": "AAK-ANTHROPIC-SDK-001",
            "title": "MCP server built on the upstream SDK without STDIO sanitizer",
            "description": "Repository declares a dependency on the upstream Anthropic / ModelContextProtocol SDK (Python `mcp` / `modelcontextprotocol`, TS `@modelcontextprotocol/sdk`, Java `io.modelcontextprotocol:*`, Rust `mcp` / `modelcontextprotocol`) and exposes a STDIO transport (`StdioServerTransport`, `stdio_server`, etc.) without a sanitizer on argv assembly. Anthropic declined to CVE this as working as designed \u2014 sanitization is the developer's responsibility. The OX Security disclosure on 2026-04-15 rolled up L",
            "remediation": "Wrap every argv the STDIO transport builds in an allow-list sanitizer \u2014 `shlex.quote` in Python, `execFile` with an explicit argv array in Node, equivalent in Java/Rust. OR switch the transport off STDIO (`transports=['http']` / `['sse']`). If you have deliberately accepted the risk, add `accepts_stdio_risk: true` plus a `justification:` field in `.agent-audit-kit.yml`."
          }
        ],
        "execution_duration_seconds": 5.984572556975763,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 20
        },
        "metadata": {
          "source": "pypi",
          "source_url": "https://pypi.org/project/agent-audit-kit/0.3.26/",
          "report_type": "agent-audit-kit-sast",
          "install_command": "pip install --require-hashes -r docker/scanner-base/agent-audit-kit/requirements.txt",
          "rules_evaluated": 211,
          "severity_counts": {
            "low": 2,
            "high": 3,
            "medium": 3,
            "critical": 0,
            "informational": 0
          }
        },
        "display_score": 36.0,
        "display_badge": "Unsafe"
      },
      {
        "scanner_name": "nerlo-behavioral",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 38.5240100529918,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 11
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-behavioral",
          "ruleset_path": "/opt/nerlo-rules/exfiltration.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/exfiltration.yaml",
            "/opt/nerlo-rules/clipboard_exfiltration.yaml",
            "/opt/nerlo-rules/rce_endpoint.yaml",
            "/opt/nerlo-rules/taint_egress.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-install-instruction",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 38.52258611199795,
        "status": "complete",
        "examined": {
          "unit": "files",
          "count": 1
        },
        "metadata": {
          "source": "nerlo-original",
          "source_url": "https://github.com/nerlo-ai/nerlo",
          "report_type": "nerlo-install-instruction",
          "ruleset_path": "/opt/nerlo-rules/install_instructions.yaml",
          "ruleset_paths": [
            "/opt/nerlo-rules/install_instructions.yaml",
            "/opt/nerlo-rules/cursor_rules.yaml"
          ],
          "install_command": "pip install 'semgrep==1.97.0'",
          "merged_invocation": true
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "nerlo-multi-source",
        "scanner_version": "0.1.0",
        "score": 100.0,
        "scanner_badge": "Verified",
        "findings": [],
        "execution_duration_seconds": 25.847836532018846,
        "status": "complete",
        "examined": null,
        "metadata": {
          "source": "nerlo-original",
          "per_source": [
            {
              "badge": "Verified",
              "label": "npm@0.4.2",
              "score": 100.0,
              "version": "0.4.2",
              "identifier": "@ainative/gtm-mcp",
              "provenance": "clean",
              "source_type": "npm",
              "artifact_type": "mcp_server",
              "finding_count": 0,
              "malware_status": "complete",
              "injected_rule_ids": []
            }
          ],
          "report_type": "nerlo-multi-source",
          "diverged_sources": [],
          "published_surfaces_scanned": 1
        },
        "display_score": 100.0,
        "display_badge": "Verified"
      },
      {
        "scanner_name": "trivy",
        "scanner_version": "0.71.0",
        "score": 80.0,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "trivy",
            "severity": "high",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-14257",
            "title": "brace-expansion through 5.0.7 is vulnerable to denial of service via m ...",
            "description": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i",
            "remediation": "Upgrade brace-expansion from 2.1.3 to 5.0.8 or later"
          },
          {
            "tool_name": "trivy",
            "severity": "medium",
            "category": "npm",
            "file_path": "package-lock.json",
            "line_number": null,
            "rule_identifier": "CVE-2026-41907",
            "title": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality",
            "description": "uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.",
            "remediation": "Upgrade uuid from 9.0.1 to 11.1.1, 12.0.1, 13.0.1 or later"
          }
        ],
        "execution_duration_seconds": 0.4875062329811044,
        "status": "complete",
        "examined": {
          "unit": "manifests",
          "count": 1
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/aquasecurity/trivy/releases/tag/v0.71.0",
          "report_type": "filesystem-vulnerability",
          "install_command": "curl -sfL -o /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.71.0/trivy_0.71.0_Linux-64bit.deb && echo '<sha256>  /tmp/trivy.deb' | sha256sum -c - && dpkg -i /tmp/trivy.deb",
          "severity_counts": {
            "low": 0,
            "high": 1,
            "medium": 1,
            "critical": 0,
            "informational": 0
          },
          "manifests_scanned": [
            "package-lock.json"
          ]
        },
        "display_score": 80.0,
        "display_badge": "Caution"
      },
      {
        "scanner_name": "osv-scanner",
        "scanner_version": "2.3.8",
        "score": 68.0,
        "scanner_badge": "Caution",
        "findings": [
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-mh99-v99m-4gvg",
            "title": "GHSA-mh99-v99m-4gvg \u2014 npm brace-expansion@2.1.3",
            "description": "aliases: CVE-2026-14257, GHSA-mh99-v99m-4gvg | CVSS: 7.5",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "low",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-g7r4-m6w7-qqqr",
            "title": "GHSA-g7r4-m6w7-qqqr \u2014 npm esbuild@0.27.7",
            "description": "aliases: GHSA-g7r4-m6w7-qqqr | CVSS: 2.5",
            "remediation": null
          },
          {
            "tool_name": "osv-scanner",
            "severity": "high",
            "category": "npm",
            "file_path": "/repo/package-lock.json",
            "line_number": null,
            "rule_identifier": "GHSA-w5hq-g745-h8pq",
            "title": "GHSA-w5hq-g745-h8pq \u2014 npm uuid@9.0.1",
            "description": "aliases: CVE-2026-41907, CVE-2026-41988, GHSA-w5hq-g745-h8pq | CVSS: 7.5",
            "remediation": null
          }
        ],
        "execution_duration_seconds": 11.112379405007232,
        "status": "complete",
        "examined": {
          "unit": "manifests",
          "count": 1
        },
        "metadata": {
          "source": "github-releases",
          "source_url": "https://github.com/google/osv-scanner/releases/tag/v2.3.8",
          "report_type": "osv-vulnerability",
          "ecosystems_seen": [
            "npm"
          ],
          "install_command": "curl -sfL -o /usr/local/bin/osv-scanner https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 && echo '<sha256>  /usr/local/bin/osv-scanner' | sha256sum -c - && chmod +x /usr/local/bin/osv-scanner",
          "severity_counts": {
            "low": 1,
            "high": 2,
            "medium": 0,
            "critical": 0,
            "informational": 0
          },
          "manifests_scanned": [
            "/repo/package-lock.json"
          ],
          "finding_id_aliases": {
            "GHSA-mh99-v99m-4gvg": [
              "CVE-2026-14257"
            ],
            "GHSA-w5hq-g745-h8pq": [
              "CVE-2026-41907",
              "CVE-2026-41988"
            ]
          },
          "cross_scanner_correlation": {
            "only_osv": [
              "GHSA-g7r4-m6w7-qqqr"
            ],
            "only_trivy": [],
            "intersection_ids": [
              "CVE-2026-14257",
              "CVE-2026-41907"
            ]
          }
        },
        "display_score": 68.0,
        "display_badge": "Caution"
      }
    ]
  },
  "report": {
    "report_id": "dd61bf09-1383-48ce-be17-29085a8195ab",
    "format": "json",
    "generated_at": "2026-08-02T07:03:04.229002+00:00",
    "scanner_filter": null,
    "signature": null
  }
}