Raw scan report

Mcpvault — the complete, unedited output of the deterministic mcptrustchecker engine v1.13.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.

← Back to the scan page
{
  "tool": {
    "name": "mcptrustchecker",
    "version": "1.13.0",
    "methodologyVersion": "mcptrustchecker-1.13"
  },
  "target": {
    "id": "@elraian/mcpvault",
    "source": {
      "kind": "package",
      "origin": "@elraian/mcpvault"
    },
    "server": {
      "name": "@elraian/mcpvault"
    }
  },
  "grade": "B",
  "score": {
    "score": 89,
    "threatScore": 100,
    "grade": "B",
    "band": "B",
    "categorySubtotals": {
      "injection": 0,
      "exfiltration": 0,
      "permissions": 0,
      "supply-chain": 0,
      "network": 0,
      "hygiene": 0
    },
    "vector": [
      {
        "kind": "client",
        "term": "capability-exposure",
        "level": "critical",
        "label": "capability blast radius (critical) — client exposure if the model is manipulated",
        "appliedPenalty": 10
      },
      {
        "kind": "client",
        "term": "verification-discount",
        "level": "repo",
        "label": "publisher verification (public source) — no provenance, but the source is public and inspectable",
        "appliedPenalty": 1
      },
      {
        "kind": "client",
        "term": "coverage-honesty",
        "level": "source",
        "label": "inspection depth (source) — how much of the target the scan could see",
        "appliedPenalty": 0
      }
    ],
    "gatesFired": [],
    "methodologyVersion": "mcptrustchecker-1.13"
  },
  "capability": {
    "level": "critical",
    "reasons": [
      "ingests untrusted external content (a prompt-injection entry point)",
      "can send data / act on an external service",
      "reads sensitive or local data",
      "has a read → egress path (a data-exfiltration surface)",
      "can execute shell commands or code",
      "untrusted-input, sensitive-source and egress co-exist across tools (toxic-flow surface)",
      "untrusted input can reach code execution"
    ],
    "tags": [
      "sensitive-source",
      "external-sink",
      "untrusted-input",
      "code-exec"
    ]
  },
  "coverage": {
    "level": "source",
    "inputs": {
      "toolSurface": true,
      "implementationSource": true,
      "packageMetadata": true,
      "liveTransport": false
    },
    "caveats": [
      "Tools were statically extracted from the published source (58 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
    ]
  },
  "findings": [
    {
      "ruleId": "MTC-FLOW-002",
      "title": "Completed toxic-flow trifecta across tools",
      "category": "exfiltration",
      "severity": "critical",
      "confidence": "strong",
      "description": "This server (without client built-ins) exposes a complete data-exfiltration chain: supabase_get_logs → export_redacted ⇒ github_create_issue. Untrusted input is ingested, private data is read, and it can be sent to an external sink — and at least one leg is a direct schema wire (⇒), where a producer's output drops straight into a free-text parameter of the next tool, so the chain needs little agent cooperation. Static analysis proves the primitive exists, not that a specific run will occur.",
      "remediation": "Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.",
      "location": {
        "kind": "flow",
        "name": "supabase_get_logs → export_redacted → github_create_issue"
      },
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "references": [],
      "data": {
        "untrusted": [
          "supabase_get_logs"
        ],
        "sources": [
          "export_redacted",
          "supabase_run_sql",
          "supabase_get_logs"
        ],
        "sinks": [
          "github_create_issue",
          "github_create_pull_request"
        ],
        "path": [
          "supabase_get_logs",
          "export_redacted",
          "github_create_issue"
        ],
        "edges": [
          {
            "from": "supabase_get_logs",
            "to": "export_redacted",
            "kind": "agent-mediated"
          },
          {
            "from": "export_redacted",
            "to": "github_create_issue",
            "kind": "schema-wired"
          }
        ],
        "wired": true
      }
    },
    {
      "ruleId": "MTC-SRC-002",
      "title": "Shell/command execution in server code (dist/cli/upgrade.js)",
      "category": "permissions",
      "severity": "high",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/cli/upgrade.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/cli/upgrade.js"
      },
      "evidence": "rt { spawn } from \"node:child_process\"; import { c, spinner, confirm } from \"./prompt.js\"; import { VERSION } from \"../v",
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "rule": "MTC-SRC-002",
        "file": "dist/cli/upgrade.js",
        "line": 2,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-002",
      "title": "Shell/command execution in server code (dist/proxies/runner.js)",
      "category": "permissions",
      "severity": "high",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/runner.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/runner.js"
      },
      "evidence": "rt { spawn } from \"node:child_process\"; import { getActiveCredentials } from \"../wrappers/common.js\"; import { logEvent",
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "rule": "MTC-SRC-002",
        "file": "dist/proxies/runner.js",
        "line": 1,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/cli/upgrade.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/cli/upgrade.js:8`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/cli/upgrade.js"
      },
      "evidence": "const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, { headers: { Accept: \"applicat",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/cli/upgrade.js",
        "line": 8,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/airtable.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/airtable.js:12`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/airtable.js"
      },
      "evidence": "const res = await fetch(\"https://api.airtable.com/v0/meta/whoami\", { headers: {",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/airtable.js",
        "line": 12,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/brave.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/brave.js:11`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/brave.js"
      },
      "evidence": "const res = await fetch(\"https://api.search.brave.com/res/v1/web/search?q=ping&count=1\", { headers",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/brave.js",
        "line": 11,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/cloudflare.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/cloudflare.js:13`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/cloudflare.js"
      },
      "evidence": "const res = await fetch(\"https://api.cloudflare.com/client/v4/user/tokens/verify\", { headers: {",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/cloudflare.js",
        "line": 13,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/datadog.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/datadog.js:15`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/datadog.js"
      },
      "evidence": "const res = await fetch(`https://api.${site}/api/v1/validate`, { headers: { \"D",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/datadog.js",
        "line": 15,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/discord.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/discord.js:13`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/discord.js"
      },
      "evidence": "const res = await fetch(\"https://discord.com/api/v10/users/@me\", { headers: {",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/discord.js",
        "line": 13,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/figma.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/figma.js:12`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/figma.js"
      },
      "evidence": "const res = await fetch(\"https://api.figma.com/v1/me\", { headers: { \"X-Figma-T",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/figma.js",
        "line": 12,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/hubspot.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/hubspot.js:12`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/hubspot.js"
      },
      "evidence": "const res = await fetch(\"https://api.hubapi.com/oauth/v1/access-tokens/\" + encodeURIComponent(String(creds.access_",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/hubspot.js",
        "line": 12,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/linear.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/linear.js:11`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/linear.js"
      },
      "evidence": "const res = await fetch(\"https://api.linear.app/graphql\", { method: \"POST\", header",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/linear.js",
        "line": 11,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-003",
      "title": "Hardcoded egress to an external endpoint (dist/proxies/notion.js)",
      "category": "exfiltration",
      "severity": "medium",
      "confidence": "strong",
      "description": "In the server's implementation (`dist/proxies/notion.js:11`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "dist/proxies/notion.js"
      },
      "evidence": "const res = await fetch(\"https://api.notion.com/v1/users/me\", { headers: { Aut",
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "data": {
        "rule": "MTC-SRC-003",
        "file": "dist/proxies/notion.js",
        "line": 11,
        "nonRuntime": false
      }
    },
    {
      "ruleId": "MTC-SRC-002",
      "title": "Shell/command execution in packaging/dev tooling (examples/programmatic-usage/talk-to-vault-mcp.mjs)",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "In a packaging/dev/install script (shipped, but not the server runtime) (`examples/programmatic-usage/talk-to-vault-mcp.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "examples/programmatic-usage/talk-to-vault-mcp.mjs"
      },
      "evidence": "rt { spawn } from \"node:child_process\"; import { join } from \"node:path\"; const entry = join(process.cwd(), \"dist\",",
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "rule": "MTC-SRC-002",
        "file": "examples/programmatic-usage/talk-to-vault-mcp.mjs",
        "line": 3,
        "nonRuntime": true
      }
    },
    {
      "ruleId": "MTC-SRC-002",
      "title": "Shell/command execution in packaging/dev tooling (examples/programmatic-usage/talk-to-wrapper-mcp.mjs)",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "In a packaging/dev/install script (shipped, but not the server runtime) (`examples/programmatic-usage/talk-to-wrapper-mcp.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "examples/programmatic-usage/talk-to-wrapper-mcp.mjs"
      },
      "evidence": "rt { spawn } from \"node:child_process\"; import { join } from \"node:path\"; const entry = join(process.cwd(), \"dist\",",
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "rule": "MTC-SRC-002",
        "file": "examples/programmatic-usage/talk-to-wrapper-mcp.mjs",
        "line": 3,
        "nonRuntime": true
      }
    }
  ],
  "toxicFlows": [
    {
      "id": "flow-1",
      "severity": "critical",
      "confidence": "strong",
      "untrustedInput": [
        "supabase_get_logs"
      ],
      "sensitiveSource": [
        "export_redacted",
        "supabase_run_sql",
        "supabase_get_logs"
      ],
      "externalSink": [
        "github_create_issue",
        "github_create_pull_request"
      ],
      "selfContained": false,
      "path": [
        "supabase_get_logs",
        "export_redacted",
        "github_create_issue"
      ],
      "pathWired": true,
      "description": "A cross-tool exfiltration chain exists: supabase_get_logs → export_redacted ⇒ github_create_issue."
    }
  ],
  "capabilities": [
    {
      "tool": "unlock_vault",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "lock_vault",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vault_status",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "list_accounts",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "find_account",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "get_active",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "activate_account",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "add_account",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "update_account",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "delete_account",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "export_redacted",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "keyword \"dump\""
        ]
      }
    },
    {
      "tool": "github_list_repos",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_get_repo",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_list_issues",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_create_issue",
      "tags": [
        "external-sink"
      ],
      "reasons": {
        "external-sink": [
          "keyword \"create_issue\""
        ]
      }
    },
    {
      "tool": "github_list_pulls",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_get_file",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_search_code",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_get_authenticated_user",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_list_branches",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_create_pull_request",
      "tags": [
        "external-sink"
      ],
      "reasons": {
        "external-sink": [
          "keyword \"create_pull_request\""
        ]
      }
    },
    {
      "tool": "github_list_workflow_runs",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "github_get_workflow_run",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "stripe_list_customers",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "stripe_retrieve_customer",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "stripe_list_charges",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "stripe_list_subscriptions",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "stripe_retrieve",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_list_organizations",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_list_projects",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_get_project",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_get_project_url",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_get_publishable_keys",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_run_sql",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "keyword \"run_sql\""
        ]
      }
    },
    {
      "tool": "supabase_list_tables",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_list_extensions",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_list_migrations",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_apply_migration",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_list_edge_functions",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_get_edge_function",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_deploy_edge_function",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_get_advisors",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_get_logs",
      "tags": [
        "untrusted-input",
        "sensitive-source"
      ],
      "reasons": {
        "untrusted-input": [
          "keyword \"fetch\""
        ],
        "sensitive-source": [
          "keyword \"get_logs\""
        ]
      }
    },
    {
      "tool": "supabase_generate_typescript_types",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_list_branches",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_create_branch",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_merge_branch",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "supabase_search_docs",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_list_projects",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_get_project",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_list_deployments",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_get_deployment",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_get_deployment_build_logs",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_get_runtime_logs",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_list_teams",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_list_domains",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_check_domain_availability",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vercel_list_env_vars",
      "tags": [],
      "reasons": {}
    }
  ],
  "surfaceDigest": "d269f947cd07b8dd98cbcd8d33085412e44920cf8793372c81f4074ba009a515",
  "stats": {
    "tools": 58,
    "prompts": 0,
    "resources": 0,
    "findingsBySeverity": {
      "critical": 1,
      "high": 2,
      "medium": 10,
      "low": 2,
      "info": 0
    }
  }
}