Raw scan report

Exteragram — the complete, unedited output of the deterministic mcptrustchecker engine v1.8.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.

← Back to the scan page
{
  "tool": {
    "name": "mcptrustchecker",
    "version": "1.8.0",
    "methodologyVersion": "mcptrustchecker-1.8"
  },
  "target": {
    "id": "@catalystdev/exteragram-mcp",
    "source": {
      "kind": "package",
      "origin": "@catalystdev/exteragram-mcp"
    },
    "server": {
      "name": "@catalystdev/exteragram-mcp"
    }
  },
  "grade": "F",
  "score": {
    "score": 43,
    "threatScore": 50,
    "grade": "F",
    "band": "F",
    "categorySubtotals": {
      "injection": 50,
      "exfiltration": 0,
      "permissions": 0,
      "supply-chain": 0,
      "network": 0,
      "hygiene": 0
    },
    "vector": [
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 1,
        "appliedPenalty": 15.4
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.5,
        "appliedPenalty": 7.7
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.25,
        "appliedPenalty": 3.85
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "threat",
        "ruleId": "MTC-UNI-009",
        "category": "injection",
        "severity": "high",
        "confidence": "strong",
        "rawWeight": 22,
        "confidenceMult": 0.7,
        "diminishingFactor": 0.1,
        "appliedPenalty": 1.54
      },
      {
        "kind": "client",
        "term": "capability-exposure",
        "level": "high",
        "label": "capability blast radius (high) — client exposure if the model is manipulated",
        "appliedPenalty": 6
      },
      {
        "kind": "client",
        "term": "verification-discount",
        "level": "repo",
        "label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
        "appliedPenalty": 1
      },
      {
        "kind": "client",
        "term": "coverage-honesty",
        "level": "source",
        "label": "inspection depth (source) — how much of the target the scan could see",
        "appliedPenalty": 0
      }
    ],
    "gatesFired": [],
    "methodologyVersion": "mcptrustchecker-1.8"
  },
  "capability": {
    "level": "high",
    "reasons": [
      "can send data / act on an external service",
      "can create, modify or delete files",
      "reads sensitive or local data",
      "has a read → egress path (a data-exfiltration surface)",
      "can execute shell commands or code"
    ],
    "tags": [
      "sensitive-source",
      "code-exec",
      "external-sink",
      "file-write"
    ]
  },
  "coverage": {
    "level": "source",
    "inputs": {
      "toolSurface": true,
      "implementationSource": true,
      "packageMetadata": true,
      "liveTransport": false
    },
    "caveats": [
      "Tools were statically extracted from the published source (81 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
    ]
  },
  "findings": [
    {
      "ruleId": "MTC-FLOW-004",
      "title": "Sensitive-source and external-sink co-exist",
      "category": "exfiltration",
      "severity": "high",
      "confidence": "strong",
      "description": "Tools that read sensitive data ([adb_deploy_plugin, adb_get_logs, adb_push_file, adb_pull_file, generate_edit_message, set_plugin_context, generate_read_file, generate_write_file, generate_delete_file, generate_ensure_dir, generate_list_dir]) and tools that can send data out ([adb_remove_plugin, adb_shell, generate_send_message, generate_send_message_hook]) are exposed together. An agent can move private data to the sink.",
      "remediation": "Keep secret-reading and egress capabilities on separate, separately-approved servers.",
      "location": {
        "kind": "flow",
        "name": "adb_deploy_plugin → adb_remove_plugin"
      },
      "evidence": "sources [adb_deploy_plugin, adb_get_logs, adb_push_file, adb_pull_file, generate_edit_message, set_plugin_context, generate_read_file, generate_write_file, gene",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "references": [],
      "data": {
        "sources": [
          "adb_deploy_plugin",
          "adb_get_logs",
          "adb_push_file",
          "adb_pull_file",
          "generate_edit_message",
          "set_plugin_context",
          "generate_read_file",
          "generate_write_file",
          "generate_delete_file",
          "generate_ensure_dir",
          "generate_list_dir"
        ],
        "sinks": [
          "adb_remove_plugin",
          "adb_shell",
          "generate_send_message",
          "generate_send_message_hook"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "adb_check_devices",
        "field": "description"
      },
      "evidence": "Выполняет 'adb devices' и возвращает список подключённых Android-устройств. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_runnable",
        "field": "description"
      },
      "evidence": "Генерирует R(callable) — обёртку Python-функции в Java Runnable. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_java_subclass",
        "field": "description"
      },
      "evidence": "Генерирует Python-класс с @java_subclass декоратором, создающий реальный Java-подкласс. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_joverride",
        "field": "description"
      },
      "evidence": "Генерирует метод с @joverride или @joverload для переопределения Java-метода. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_jfield",
        "field": "description"
      },
      "evidence": "Генерирует jfield(...) — декларацию Java-поля с опциональными getter/setter. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_jmvel_method",
        "field": "description"
      },
      "evidence": "Генерирует jMVELmethod или jMVELoverride — Java-метод с MVEL-кодом вместо Python. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_java_helper",
        "field": "description"
      },
      "evidence": "Генерирует доступ к Java-объекту через J() (JavaHelper). ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_new_instance",
        "field": "description"
      },
      "evidence": "Генерирует new_instance() или new_java_instance() для создания объекта Java-подкласса. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_pyobj",
        "field": "description"
      },
      "evidence": "Генерирует PyObj.create(python_object) — оборачивает Python-объект ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_send_request",
        "field": "description"
      },
      "evidence": "Генерирует вызов send_request(request, callback) для произвольного Telegram TL-запроса. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "list_controllers",
        "field": "description"
      },
      "evidence": "Возвращает полный список getter-функций для доступа к контроллерам Telegram. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "list_standard_dirs",
        "field": "description"
      },
      "evidence": "Возвращает все стандартные getter-функции SDK с реальными путями на устройстве. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "list_available_libraries",
        "field": "description"
      },
      "evidence": "Возвращает список pre-installed Python-библиотек и инструкцию ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "list_common_classes",
        "field": "description"
      },
      "evidence": "Возвращает FQN-пути наиболее используемых Java-классов Telegram и Android. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "get_plugin_template",
        "field": "description"
      },
      "evidence": "Возвращает готовый Python-код шаблона плагина. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_pre_request_hook",
        "field": "description"
      },
      "evidence": "Генерирует хук перехвата Telegram-запроса ДО отправки на сервер. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_post_request_hook",
        "field": "description"
      },
      "evidence": "Генерирует хук обработки ответа Telegram-запроса ПОСЛЕ получения ответа. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_on_update_hook",
        "field": "description"
      },
      "evidence": "Генерирует хук перехвата отдельного Telegram-обновления. ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_on_updates_hook",
        "field": "description"
      },
      "evidence": "Генерирует хук перехвата контейнера Telegram-обновлений (Updates). ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "list_html_tags",
        "field": "description"
      },
      "evidence": "Возвращает таблицу всех поддерживаемых HTML-тегов и Markdown-синтаксиса ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-UNI-009",
      "title": "Mixed-script (homoglyph) text in description",
      "category": "injection",
      "severity": "high",
      "confidence": "strong",
      "description": "A single token mixes multiple scripts (Latin, Cyrillic). This is the signature of a homoglyph attack — visually identical characters from another script used to impersonate a trusted name or slip past keyword filters.",
      "remediation": "Restrict metadata to a single script, or normalize confusables before display.",
      "location": {
        "kind": "tool",
        "name": "generate_method_hook",
        "field": "description"
      },
      "evidence": "Генерирует полный паттерн Xposed-хука в 3 шага: ",
      "owasp": "LLM01:2025 Prompt Injection",
      "references": [
        "https://unicode.org/reports/tr39/"
      ],
      "data": {
        "scripts": [
          "Latin",
          "Cyrillic"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-001",
      "title": "Tool \"adb_remove_plugin\" exposes command/code execution",
      "category": "permissions",
      "severity": "high",
      "confidence": "strong",
      "description": "Tool \"adb_remove_plugin\" appears to run shell commands or evaluate code (keyword \"shell\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
      "remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
      "location": {
        "kind": "tool",
        "name": "adb_remove_plugin"
      },
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "tags": [
          "code-exec"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-001",
      "title": "Tool \"adb_shell\" exposes command/code execution",
      "category": "permissions",
      "severity": "high",
      "confidence": "strong",
      "description": "Tool \"adb_shell\" appears to run shell commands or evaluate code (keyword \"shell\", parameter \"command\"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.",
      "remediation": "Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.",
      "location": {
        "kind": "tool",
        "name": "adb_shell"
      },
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "tags": [
          "code-exec"
        ]
      }
    },
    {
      "ruleId": "MTC-SRC-002",
      "title": "Shell/command execution in server code (dist/tools/adb.d.ts)",
      "category": "permissions",
      "severity": "high",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/tools/adb.d.ts:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/tools/adb.d.ts"
      },
      "evidence": "child_process",
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "rule": "MTC-SRC-002",
        "file": "dist/tools/adb.d.ts",
        "line": 11
      }
    },
    {
      "ruleId": "MTC-SRC-002",
      "title": "Shell/command execution in server code (dist/tools/adb.js)",
      "category": "permissions",
      "severity": "high",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/tools/adb.js:11`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/tools/adb.js"
      },
      "evidence": "child_process",
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "rule": "MTC-SRC-002",
        "file": "dist/tools/adb.js",
        "line": 11
      }
    },
    {
      "ruleId": "MTC-CAP-002",
      "title": "Tool \"generate_write_file\" can modify the filesystem",
      "category": "permissions",
      "severity": "medium",
      "confidence": "strong",
      "description": "Tool \"generate_write_file\" can write, overwrite or delete files (keyword \"write_file\"). Verify it is scoped to a safe directory.",
      "remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
      "location": {
        "kind": "tool",
        "name": "generate_write_file"
      },
      "data": {
        "tags": [
          "file-write",
          "sensitive-source"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-002",
      "title": "Tool \"generate_delete_file\" can modify the filesystem",
      "category": "permissions",
      "severity": "medium",
      "confidence": "strong",
      "description": "Tool \"generate_delete_file\" can write, overwrite or delete files (keyword \"delete_file\"). Verify it is scoped to a safe directory.",
      "remediation": "Constrain file operations to an explicit, non-sensitive root; reject path traversal.",
      "location": {
        "kind": "tool",
        "name": "generate_delete_file"
      },
      "data": {
        "tags": [
          "file-write",
          "sensitive-source"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-006",
      "title": "Unconstrained command parameter \"command\" on \"adb_shell\"",
      "category": "permissions",
      "severity": "medium",
      "confidence": "heuristic",
      "description": "Tool \"adb_shell\" takes a command-shaped parameter \"command\" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.",
      "remediation": "Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.",
      "location": {
        "kind": "tool",
        "name": "adb_shell",
        "field": "inputSchema.properties.command"
      },
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "param": "command"
      }
    },
    {
      "ruleId": "MTC-CAP-005",
      "title": "Mutating tool \"adb_remove_plugin\" declares no destructiveHint",
      "category": "hygiene",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"adb_remove_plugin\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
      "remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
      "location": {
        "kind": "tool",
        "name": "adb_remove_plugin"
      },
      "data": {
        "tags": [
          "code-exec"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-005",
      "title": "Mutating tool \"adb_shell\" declares no destructiveHint",
      "category": "hygiene",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"adb_shell\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
      "remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
      "location": {
        "kind": "tool",
        "name": "adb_shell"
      },
      "data": {
        "tags": [
          "code-exec"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-005",
      "title": "Mutating tool \"generate_write_file\" declares no destructiveHint",
      "category": "hygiene",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_write_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
      "remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
      "location": {
        "kind": "tool",
        "name": "generate_write_file"
      },
      "data": {
        "tags": [
          "file-write",
          "sensitive-source"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-005",
      "title": "Mutating tool \"generate_delete_file\" declares no destructiveHint",
      "category": "hygiene",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_delete_file\" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.",
      "remediation": "Declare accurate annotations, and gate destructive tools on user confirmation regardless.",
      "location": {
        "kind": "tool",
        "name": "generate_delete_file"
      },
      "data": {
        "tags": [
          "file-write",
          "sensitive-source"
        ]
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"adb_deploy_plugin\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"adb_deploy_plugin\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "adb_deploy_plugin",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"local_path\" on \"adb_push_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"adb_push_file\" takes a path parameter \"local_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "adb_push_file",
        "field": "inputSchema.properties.local_path"
      },
      "data": {
        "param": "local_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"remote_path\" on \"adb_push_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"adb_push_file\" takes a path parameter \"remote_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "adb_push_file",
        "field": "inputSchema.properties.remote_path"
      },
      "data": {
        "param": "remote_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"remote_path\" on \"adb_pull_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"adb_pull_file\" takes a path parameter \"remote_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "adb_pull_file",
        "field": "inputSchema.properties.remote_path"
      },
      "data": {
        "param": "remote_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"local_path\" on \"adb_pull_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"adb_pull_file\" takes a path parameter \"local_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "adb_pull_file",
        "field": "inputSchema.properties.local_path"
      },
      "data": {
        "param": "local_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"generate_edit_message\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_edit_message\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "generate_edit_message",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"set_plugin_context\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"set_plugin_context\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "set_plugin_context",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path_expr\" on \"generate_read_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_read_file\" takes a path parameter \"path_expr\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "generate_read_file",
        "field": "inputSchema.properties.path_expr"
      },
      "data": {
        "param": "path_expr"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path_expr\" on \"generate_write_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_write_file\" takes a path parameter \"path_expr\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "generate_write_file",
        "field": "inputSchema.properties.path_expr"
      },
      "data": {
        "param": "path_expr"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"ensure_dir\" on \"generate_write_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_write_file\" takes a path parameter \"ensure_dir\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "generate_write_file",
        "field": "inputSchema.properties.ensure_dir"
      },
      "data": {
        "param": "ensure_dir"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path_expr\" on \"generate_delete_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_delete_file\" takes a path parameter \"path_expr\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "generate_delete_file",
        "field": "inputSchema.properties.path_expr"
      },
      "data": {
        "param": "path_expr"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path_expr\" on \"generate_ensure_dir\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_ensure_dir\" takes a path parameter \"path_expr\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "generate_ensure_dir",
        "field": "inputSchema.properties.path_expr"
      },
      "data": {
        "param": "path_expr"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path_expr\" on \"generate_list_dir\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"generate_list_dir\" takes a path parameter \"path_expr\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "generate_list_dir",
        "field": "inputSchema.properties.path_expr"
      },
      "data": {
        "param": "path_expr"
      }
    }
  ],
  "toxicFlows": [
    {
      "id": "flow-1",
      "severity": "high",
      "confidence": "strong",
      "untrustedInput": [],
      "sensitiveSource": [
        "adb_deploy_plugin",
        "adb_get_logs",
        "adb_push_file",
        "adb_pull_file",
        "generate_edit_message",
        "set_plugin_context",
        "generate_read_file",
        "generate_write_file",
        "generate_delete_file",
        "generate_ensure_dir",
        "generate_list_dir"
      ],
      "externalSink": [
        "adb_remove_plugin",
        "adb_shell",
        "generate_send_message",
        "generate_send_message_hook"
      ],
      "selfContained": false,
      "path": [
        "adb_deploy_plugin",
        "adb_remove_plugin"
      ],
      "pathWired": false,
      "description": "A sensitive-source → external-sink chain exists: adb_deploy_plugin → adb_remove_plugin."
    }
  ],
  "capabilities": [
    {
      "tool": "adb_check_devices",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "adb_deploy_plugin",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "adb_list_plugins",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "adb_remove_plugin",
      "tags": [
        "code-exec"
      ],
      "reasons": {
        "code-exec": [
          "keyword \"shell\""
        ]
      }
    },
    {
      "tool": "adb_get_logs",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "keyword \"get_logs\""
        ]
      }
    },
    {
      "tool": "adb_restart_app",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "adb_push_file",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "adb_pull_file",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "adb_shell",
      "tags": [
        "code-exec"
      ],
      "reasons": {
        "code-exec": [
          "keyword \"shell\"",
          "parameter \"command\""
        ]
      }
    },
    {
      "tool": "generate_alert_dialog",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_ui_thread_call",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_click_listener",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_runnable",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_clipboard_copy",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_log",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_bulletin",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_java_subclass",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_joverride",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_jfield",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_jmvel_method",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_java_helper",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_new_instance",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_from_java",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_pyobj",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_jclassbuilder",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_send_message",
      "tags": [
        "external-sink"
      ],
      "reasons": {
        "external-sink": [
          "keyword \"send_message\""
        ]
      }
    },
    {
      "tool": "generate_edit_message",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "generate_send_request",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_notification_listener",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_queue_call",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_controllers",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_queue_constants",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "set_plugin_context",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "get_plugin_context",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "clear_plugin_context",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "validate_plugin_metadata",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_read_file",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "keyword \"read_file\"",
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "generate_write_file",
      "tags": [
        "file-write",
        "sensitive-source"
      ],
      "reasons": {
        "file-write": [
          "keyword \"write_file\""
        ],
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "generate_delete_file",
      "tags": [
        "file-write",
        "sensitive-source"
      ],
      "reasons": {
        "file-write": [
          "keyword \"delete_file\""
        ],
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "generate_ensure_dir",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "generate_list_dir",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "list_standard_dirs",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_find_class",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_get_field",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_set_field",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_on_plugin_load",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_on_plugin_unload",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_on_app_event",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_menu_item",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_send_message_hook",
      "tags": [
        "external-sink"
      ],
      "reasons": {
        "external-sink": [
          "keyword \"send_message\""
        ]
      }
    },
    {
      "tool": "generate_hook_result",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_hook_strategies",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_app_events",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_menu_types",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_settings_components",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_available_libraries",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_common_classes",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "get_plugin_template",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "explain_pitfalls",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_hook_filters",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_pre_request_hook",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_post_request_hook",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_on_update_hook",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_on_updates_hook",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_plugin_file",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_metadata_block",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_import_block",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_settings_ui",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_settings_component",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_get_setting",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_set_setting",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_export_import_settings",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_simple_setting_factory",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_parse_text",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_html_tags",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_method_hook",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_hook_param_usage",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_hook_filters",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_hook_all_methods",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_hook_all_constructors",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "generate_unhook",
      "tags": [],
      "reasons": {}
    }
  ],
  "surfaceDigest": "237e7d7844cbdd69ff14f3a1ae6d54685e1849746c612fee3a6c6ad7f60f1744",
  "stats": {
    "tools": 81,
    "prompts": 0,
    "resources": 0,
    "findingsBySeverity": {
      "critical": 0,
      "high": 26,
      "medium": 3,
      "low": 17,
      "info": 0
    }
  }
}