Raw scan report

Winforensics — the complete, unedited output of the deterministic mcptrustchecker engine v1.8.0, scanned . Every finding, capability tag and score component below is exactly what the engine produced — no AI, no post-processing.

← Back to the scan page
{
  "tool": {
    "name": "mcptrustchecker",
    "version": "1.8.0",
    "methodologyVersion": "mcptrustchecker-1.8"
  },
  "target": {
    "id": "winforensics-mcp",
    "source": {
      "kind": "package",
      "origin": "winforensics-mcp"
    },
    "server": {
      "name": "winforensics-mcp"
    }
  },
  "grade": "B",
  "score": {
    "score": 83,
    "threatScore": 98,
    "grade": "B",
    "band": "B",
    "categorySubtotals": {
      "injection": 0,
      "exfiltration": 0,
      "permissions": 0,
      "supply-chain": 2.1,
      "network": 0,
      "hygiene": 0
    },
    "vector": [
      {
        "kind": "threat",
        "ruleId": "MTC-SUP-011",
        "category": "supply-chain",
        "severity": "low",
        "confidence": "strong",
        "rawWeight": 3,
        "confidenceMult": 0.7,
        "diminishingFactor": 1,
        "appliedPenalty": 2.1
      },
      {
        "kind": "client",
        "term": "capability-exposure",
        "level": "critical",
        "label": "capability blast radius (critical) — client exposure if the model is manipulated",
        "appliedPenalty": 10
      },
      {
        "kind": "client",
        "term": "verification-discount",
        "level": "none",
        "label": "publisher verification (unlocatable) — no provenance and no public repository to inspect",
        "appliedPenalty": 5
      },
      {
        "kind": "client",
        "term": "coverage-honesty",
        "level": "source",
        "label": "inspection depth (source) — how much of the target the scan could see",
        "appliedPenalty": 0
      }
    ],
    "gatesFired": [],
    "methodologyVersion": "mcptrustchecker-1.8"
  },
  "capability": {
    "level": "critical",
    "reasons": [
      "ingests untrusted external content (a prompt-injection entry point)",
      "can send data / act on an external service",
      "reads sensitive or local data",
      "has a read → egress path (a data-exfiltration surface)",
      "can execute shell commands or code",
      "untrusted-input, sensitive-source and egress co-exist across tools (toxic-flow surface)",
      "untrusted input can reach code execution"
    ],
    "tags": [
      "sensitive-source",
      "external-sink",
      "untrusted-input",
      "code-exec"
    ]
  },
  "coverage": {
    "level": "source",
    "inputs": {
      "toolSurface": true,
      "implementationSource": true,
      "packageMetadata": true,
      "liveTransport": false
    },
    "caveats": [
      "Tools were statically extracted from the published source (61 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command \"npx -y <package>\"."
    ]
  },
  "findings": [
    {
      "ruleId": "MTC-FLOW-002",
      "title": "Completed toxic-flow trifecta across tools",
      "category": "exfiltration",
      "severity": "critical",
      "confidence": "strong",
      "description": "This server (without client built-ins) exposes a complete data-exfiltration chain: api_search_category → api_analyze_imports → pcap_get_http. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.",
      "remediation": "Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.",
      "location": {
        "kind": "flow",
        "name": "api_search_category → api_analyze_imports → pcap_get_http"
      },
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "references": [],
      "data": {
        "untrusted": [
          "api_search_category",
          "user_parse_shellbags"
        ],
        "sources": [
          "evtx_list_files",
          "evtx_get_stats",
          "evtx_search",
          "evtx_security_search",
          "evtx_attack_summary",
          "registry_get_key",
          "registry_search",
          "registry_get_users",
          "file_analyze_pe",
          "yara_scan_file",
          "vt_lookup_file",
          "pcap_get_stats",
          "pcap_get_conversations",
          "pcap_get_dns",
          "pcap_get_http",
          "pcap_search",
          "pcap_find_suspicious",
          "die_analyze_file",
          "die_scan_directory",
          "api_analyze_imports",
          "api_detect_patterns",
          "apmx_parse",
          "apmx_get_calls",
          "apmx_detect_patterns",
          "apmx_get_call_details",
          "apmx_correlate_handles",
          "apmx_injection_info",
          "apmx_calls_around",
          "apmx_search_params",
          "disk_parse_prefetch",
          "disk_parse_amcache",
          "disk_parse_srum",
          "investigate_execution",
          "build_timeline",
          "hunt_ioc_pack",
          "investigate_user_activity",
          "ingest_parsed_csv",
          "disk_parse_usn_journal",
          "browser_get_history",
          "user_parse_lnk_files",
          "user_parse_shellbags"
        ],
        "sinks": [
          "pcap_get_http"
        ],
        "path": [
          "api_search_category",
          "api_analyze_imports",
          "pcap_get_http"
        ],
        "edges": [
          {
            "from": "api_search_category",
            "to": "api_analyze_imports",
            "kind": "agent-mediated"
          },
          {
            "from": "api_analyze_imports",
            "to": "pcap_get_http",
            "kind": "agent-mediated"
          }
        ],
        "wired": false
      }
    },
    {
      "ruleId": "MTC-FLOW-003",
      "title": "Read-and-egress in one tool: \"pcap_get_http\"",
      "category": "exfiltration",
      "severity": "high",
      "confidence": "strong",
      "description": "Tool \"pcap_get_http\" can both read sensitive data and send data to an external destination. Even without an explicit untrusted-input leg, this is a single-call data-exfiltration path if the model is ever manipulated.",
      "remediation": "Separate reading from sending; require explicit user confirmation before egress of file/secret contents.",
      "location": {
        "kind": "flow",
        "name": "pcap_get_http"
      },
      "owasp": "LLM02:2025 Sensitive Information Disclosure",
      "references": [],
      "data": {
        "tags": [
          "external-sink",
          "sensitive-source"
        ]
      }
    },
    {
      "ruleId": "MTC-SRC-002",
      "title": "Shell/command execution in server code (parsers/die_analyzer.py)",
      "category": "permissions",
      "severity": "high",
      "confidence": "strong",
      "description": "In the server's implementation (`parsers/die_analyzer.py:72`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.",
      "remediation": "Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.",
      "location": {
        "kind": "server",
        "name": "parsers/die_analyzer.py"
      },
      "evidence": "subprocess.run(",
      "owasp": "LLM05:2025 Improper Output Handling",
      "data": {
        "rule": "MTC-SRC-002",
        "file": "parsers/die_analyzer.py",
        "line": 72
      }
    },
    {
      "ruleId": "MTC-CAP-007",
      "title": "Unconstrained URL/host parameter \"url_filter\" on \"pcap_get_http\"",
      "category": "network",
      "severity": "medium",
      "confidence": "heuristic",
      "description": "Tool \"pcap_get_http\" takes a URL/host parameter \"url_filter\" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).",
      "remediation": "Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.",
      "location": {
        "kind": "tool",
        "name": "pcap_get_http",
        "field": "inputSchema.properties.url_filter"
      },
      "owasp": "LLM06:2025 Excessive Agency",
      "data": {
        "param": "url_filter"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"directory\" on \"evtx_list_files\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"evtx_list_files\" takes a path parameter \"directory\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "evtx_list_files",
        "field": "inputSchema.properties.directory"
      },
      "data": {
        "param": "directory"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"evtx_path\" on \"evtx_get_stats\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"evtx_get_stats\" takes a path parameter \"evtx_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "evtx_get_stats",
        "field": "inputSchema.properties.evtx_path"
      },
      "data": {
        "param": "evtx_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"evtx_path\" on \"evtx_search\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"evtx_search\" takes a path parameter \"evtx_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "evtx_search",
        "field": "inputSchema.properties.evtx_path"
      },
      "data": {
        "param": "evtx_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"evtx_path\" on \"evtx_security_search\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"evtx_security_search\" takes a path parameter \"evtx_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "evtx_security_search",
        "field": "inputSchema.properties.evtx_path"
      },
      "data": {
        "param": "evtx_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"evtx_path\" on \"evtx_attack_summary\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"evtx_attack_summary\" takes a path parameter \"evtx_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "evtx_attack_summary",
        "field": "inputSchema.properties.evtx_path"
      },
      "data": {
        "param": "evtx_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"hive_path\" on \"registry_get_key\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"registry_get_key\" takes a path parameter \"hive_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "registry_get_key",
        "field": "inputSchema.properties.hive_path"
      },
      "data": {
        "param": "hive_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"key_path\" on \"registry_get_key\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"registry_get_key\" takes a path parameter \"key_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "registry_get_key",
        "field": "inputSchema.properties.key_path"
      },
      "data": {
        "param": "key_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"hive_path\" on \"registry_search\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"registry_search\" takes a path parameter \"hive_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "registry_search",
        "field": "inputSchema.properties.hive_path"
      },
      "data": {
        "param": "hive_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"sam_path\" on \"registry_get_users\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"registry_get_users\" takes a path parameter \"sam_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "registry_get_users",
        "field": "inputSchema.properties.sam_path"
      },
      "data": {
        "param": "sam_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"file_analyze_pe\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"file_analyze_pe\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "file_analyze_pe",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"yara_scan_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"yara_scan_file\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "yara_scan_file",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"vt_lookup_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"vt_lookup_file\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "vt_lookup_file",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"pcap_path\" on \"pcap_get_stats\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"pcap_get_stats\" takes a path parameter \"pcap_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "pcap_get_stats",
        "field": "inputSchema.properties.pcap_path"
      },
      "data": {
        "param": "pcap_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"pcap_path\" on \"pcap_get_conversations\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"pcap_get_conversations\" takes a path parameter \"pcap_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "pcap_get_conversations",
        "field": "inputSchema.properties.pcap_path"
      },
      "data": {
        "param": "pcap_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"pcap_path\" on \"pcap_get_dns\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"pcap_get_dns\" takes a path parameter \"pcap_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "pcap_get_dns",
        "field": "inputSchema.properties.pcap_path"
      },
      "data": {
        "param": "pcap_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"pcap_path\" on \"pcap_get_http\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"pcap_get_http\" takes a path parameter \"pcap_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "pcap_get_http",
        "field": "inputSchema.properties.pcap_path"
      },
      "data": {
        "param": "pcap_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"pcap_path\" on \"pcap_search\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"pcap_search\" takes a path parameter \"pcap_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "pcap_search",
        "field": "inputSchema.properties.pcap_path"
      },
      "data": {
        "param": "pcap_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"pcap_path\" on \"pcap_find_suspicious\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"pcap_find_suspicious\" takes a path parameter \"pcap_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "pcap_find_suspicious",
        "field": "inputSchema.properties.pcap_path"
      },
      "data": {
        "param": "pcap_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"die_analyze_file\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"die_analyze_file\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "die_analyze_file",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"dir_path\" on \"die_scan_directory\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"die_scan_directory\" takes a path parameter \"dir_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "die_scan_directory",
        "field": "inputSchema.properties.dir_path"
      },
      "data": {
        "param": "dir_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"api_analyze_imports\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"api_analyze_imports\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "api_analyze_imports",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"api_detect_patterns\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"api_detect_patterns\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "api_detect_patterns",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_parse\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_parse\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_parse",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_get_calls\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_get_calls\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_get_calls",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_detect_patterns\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_detect_patterns\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_detect_patterns",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_get_call_details\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_get_call_details\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_get_call_details",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_correlate_handles\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_correlate_handles\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_correlate_handles",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_injection_info\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_injection_info\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_injection_info",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_calls_around\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_calls_around\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_calls_around",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"file_path\" on \"apmx_search_params\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"apmx_search_params\" takes a path parameter \"file_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "apmx_search_params",
        "field": "inputSchema.properties.file_path"
      },
      "data": {
        "param": "file_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path\" on \"disk_parse_prefetch\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"disk_parse_prefetch\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "disk_parse_prefetch",
        "field": "inputSchema.properties.path"
      },
      "data": {
        "param": "path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"amcache_path\" on \"disk_parse_amcache\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"disk_parse_amcache\" takes a path parameter \"amcache_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "disk_parse_amcache",
        "field": "inputSchema.properties.amcache_path"
      },
      "data": {
        "param": "amcache_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path_filter\" on \"disk_parse_amcache\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"disk_parse_amcache\" takes a path parameter \"path_filter\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "disk_parse_amcache",
        "field": "inputSchema.properties.path_filter"
      },
      "data": {
        "param": "path_filter"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"srum_path\" on \"disk_parse_srum\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"disk_parse_srum\" takes a path parameter \"srum_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "disk_parse_srum",
        "field": "inputSchema.properties.srum_path"
      },
      "data": {
        "param": "srum_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"artifacts_dir\" on \"investigate_execution\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_execution\" takes a path parameter \"artifacts_dir\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_execution",
        "field": "inputSchema.properties.artifacts_dir"
      },
      "data": {
        "param": "artifacts_dir"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"prefetch_path\" on \"investigate_execution\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_execution\" takes a path parameter \"prefetch_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_execution",
        "field": "inputSchema.properties.prefetch_path"
      },
      "data": {
        "param": "prefetch_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"amcache_path\" on \"investigate_execution\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_execution\" takes a path parameter \"amcache_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_execution",
        "field": "inputSchema.properties.amcache_path"
      },
      "data": {
        "param": "amcache_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"srum_path\" on \"investigate_execution\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_execution\" takes a path parameter \"srum_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_execution",
        "field": "inputSchema.properties.srum_path"
      },
      "data": {
        "param": "srum_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"artifacts_dir\" on \"build_timeline\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"build_timeline\" takes a path parameter \"artifacts_dir\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "build_timeline",
        "field": "inputSchema.properties.artifacts_dir"
      },
      "data": {
        "param": "artifacts_dir"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"mft_path\" on \"build_timeline\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"build_timeline\" takes a path parameter \"mft_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "build_timeline",
        "field": "inputSchema.properties.mft_path"
      },
      "data": {
        "param": "mft_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"usn_path\" on \"build_timeline\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"build_timeline\" takes a path parameter \"usn_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "build_timeline",
        "field": "inputSchema.properties.usn_path"
      },
      "data": {
        "param": "usn_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"prefetch_path\" on \"build_timeline\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"build_timeline\" takes a path parameter \"prefetch_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "build_timeline",
        "field": "inputSchema.properties.prefetch_path"
      },
      "data": {
        "param": "prefetch_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"amcache_path\" on \"build_timeline\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"build_timeline\" takes a path parameter \"amcache_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "build_timeline",
        "field": "inputSchema.properties.amcache_path"
      },
      "data": {
        "param": "amcache_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"evtx_path\" on \"build_timeline\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"build_timeline\" takes a path parameter \"evtx_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "build_timeline",
        "field": "inputSchema.properties.evtx_path"
      },
      "data": {
        "param": "evtx_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"artifacts_dir\" on \"hunt_ioc_pack\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"hunt_ioc_pack\" takes a path parameter \"artifacts_dir\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "hunt_ioc_pack",
        "field": "inputSchema.properties.artifacts_dir"
      },
      "data": {
        "param": "artifacts_dir"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"pack_path\" on \"hunt_ioc_pack\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"hunt_ioc_pack\" takes a path parameter \"pack_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "hunt_ioc_pack",
        "field": "inputSchema.properties.pack_path"
      },
      "data": {
        "param": "pack_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"max_file_size\" on \"hunt_ioc_pack\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"hunt_ioc_pack\" takes a path parameter \"max_file_size\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "hunt_ioc_pack",
        "field": "inputSchema.properties.max_file_size"
      },
      "data": {
        "param": "max_file_size"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"artifacts_dir\" on \"investigate_user_activity\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_user_activity\" takes a path parameter \"artifacts_dir\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_user_activity",
        "field": "inputSchema.properties.artifacts_dir"
      },
      "data": {
        "param": "artifacts_dir"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"browser_path\" on \"investigate_user_activity\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_user_activity\" takes a path parameter \"browser_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_user_activity",
        "field": "inputSchema.properties.browser_path"
      },
      "data": {
        "param": "browser_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"lnk_path\" on \"investigate_user_activity\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_user_activity\" takes a path parameter \"lnk_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_user_activity",
        "field": "inputSchema.properties.lnk_path"
      },
      "data": {
        "param": "lnk_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"usrclass_path\" on \"investigate_user_activity\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_user_activity\" takes a path parameter \"usrclass_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_user_activity",
        "field": "inputSchema.properties.usrclass_path"
      },
      "data": {
        "param": "usrclass_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"ntuser_path\" on \"investigate_user_activity\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"investigate_user_activity\" takes a path parameter \"ntuser_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "investigate_user_activity",
        "field": "inputSchema.properties.ntuser_path"
      },
      "data": {
        "param": "ntuser_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"csv_path\" on \"ingest_parsed_csv\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"ingest_parsed_csv\" takes a path parameter \"csv_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "ingest_parsed_csv",
        "field": "inputSchema.properties.csv_path"
      },
      "data": {
        "param": "csv_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"usn_path\" on \"disk_parse_usn_journal\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"disk_parse_usn_journal\" takes a path parameter \"usn_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "disk_parse_usn_journal",
        "field": "inputSchema.properties.usn_path"
      },
      "data": {
        "param": "usn_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"filename_filter\" on \"disk_parse_usn_journal\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"disk_parse_usn_journal\" takes a path parameter \"filename_filter\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "disk_parse_usn_journal",
        "field": "inputSchema.properties.filename_filter"
      },
      "data": {
        "param": "filename_filter"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"history_path\" on \"browser_get_history\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"browser_get_history\" takes a path parameter \"history_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "browser_get_history",
        "field": "inputSchema.properties.history_path"
      },
      "data": {
        "param": "history_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path\" on \"user_parse_lnk_files\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"user_parse_lnk_files\" takes a path parameter \"path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "user_parse_lnk_files",
        "field": "inputSchema.properties.path"
      },
      "data": {
        "param": "path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"usrclass_path\" on \"user_parse_shellbags\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"user_parse_shellbags\" takes a path parameter \"usrclass_path\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "user_parse_shellbags",
        "field": "inputSchema.properties.usrclass_path"
      },
      "data": {
        "param": "usrclass_path"
      }
    },
    {
      "ruleId": "MTC-CAP-008",
      "title": "Unconstrained path parameter \"path_filter\" on \"user_parse_shellbags\"",
      "category": "permissions",
      "severity": "low",
      "confidence": "heuristic",
      "description": "Tool \"user_parse_shellbags\" takes a path parameter \"path_filter\" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.",
      "remediation": "Resolve and verify the path stays within an allowed root; reject traversal sequences.",
      "location": {
        "kind": "tool",
        "name": "user_parse_shellbags",
        "field": "inputSchema.properties.path_filter"
      },
      "data": {
        "param": "path_filter"
      }
    },
    {
      "ruleId": "MTC-SUP-011",
      "title": "Package has no source repository",
      "category": "supply-chain",
      "severity": "low",
      "confidence": "strong",
      "description": "\"winforensics-mcp\" declares no repository URL, so its published artifact cannot be compared against reviewable source.",
      "remediation": "Prefer packages that link to public, reviewable source.",
      "location": {
        "kind": "package",
        "name": "winforensics-mcp"
      }
    }
  ],
  "toxicFlows": [
    {
      "id": "flow-1",
      "severity": "critical",
      "confidence": "strong",
      "untrustedInput": [
        "api_search_category",
        "user_parse_shellbags"
      ],
      "sensitiveSource": [
        "evtx_list_files",
        "evtx_get_stats",
        "evtx_search",
        "evtx_security_search",
        "evtx_attack_summary",
        "registry_get_key",
        "registry_search",
        "registry_get_users",
        "file_analyze_pe",
        "yara_scan_file",
        "vt_lookup_file",
        "pcap_get_stats",
        "pcap_get_conversations",
        "pcap_get_dns",
        "pcap_get_http",
        "pcap_search",
        "pcap_find_suspicious",
        "die_analyze_file",
        "die_scan_directory",
        "api_analyze_imports",
        "api_detect_patterns",
        "apmx_parse",
        "apmx_get_calls",
        "apmx_detect_patterns",
        "apmx_get_call_details",
        "apmx_correlate_handles",
        "apmx_injection_info",
        "apmx_calls_around",
        "apmx_search_params",
        "disk_parse_prefetch",
        "disk_parse_amcache",
        "disk_parse_srum",
        "investigate_execution",
        "build_timeline",
        "hunt_ioc_pack",
        "investigate_user_activity",
        "ingest_parsed_csv",
        "disk_parse_usn_journal",
        "browser_get_history",
        "user_parse_lnk_files",
        "user_parse_shellbags"
      ],
      "externalSink": [
        "pcap_get_http"
      ],
      "selfContained": false,
      "path": [
        "api_search_category",
        "api_analyze_imports",
        "pcap_get_http"
      ],
      "pathWired": false,
      "description": "A cross-tool exfiltration chain exists: api_search_category → api_analyze_imports → pcap_get_http."
    },
    {
      "id": "flow-2",
      "severity": "high",
      "confidence": "strong",
      "untrustedInput": [],
      "sensitiveSource": [
        "pcap_get_http"
      ],
      "externalSink": [
        "pcap_get_http"
      ],
      "selfContained": true,
      "description": "Tool \"pcap_get_http\" both reads sensitive data and can send it externally."
    }
  ],
  "capabilities": [
    {
      "tool": "evtx_list_files",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "keyword \"list_files\""
        ]
      }
    },
    {
      "tool": "evtx_get_stats",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "evtx_search",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "evtx_security_search",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "evtx_attack_summary",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "evtx_explain_event_id",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "registry_get_key",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "registry_search",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "registry_get_persistence",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "registry_get_users",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "registry_get_usb_history",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "registry_get_system_info",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "registry_get_network",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "forensics_list_important_events",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "forensics_list_registry_keys",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "file_analyze_pe",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "yara_scan_file",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "yara_scan_directory",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "yara_list_rules",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vt_lookup_hash",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vt_lookup_ip",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vt_lookup_domain",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "vt_lookup_file",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "pcap_get_stats",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "pcap_get_conversations",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "pcap_get_dns",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "pcap_get_http",
      "tags": [
        "external-sink",
        "sensitive-source"
      ],
      "reasons": {
        "external-sink": [
          "keyword \"http_request\""
        ],
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "pcap_search",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "pcap_find_suspicious",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "die_analyze_file",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "die_scan_directory",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "die_get_packer_info",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "api_analyze_imports",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "api_lookup",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "api_search_category",
      "tags": [
        "untrusted-input"
      ],
      "reasons": {
        "untrusted-input": [
          "keyword \"browse\""
        ]
      }
    },
    {
      "tool": "api_detect_patterns",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_parse",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_get_calls",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_detect_patterns",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_get_call_details",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_correlate_handles",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_injection_info",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_calls_around",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "apmx_search_params",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "disk_parse_prefetch",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "disk_parse_amcache",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "disk_parse_srum",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "investigate_execution",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "build_timeline",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "hunt_ioc",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "ioc_pack_list",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "hunt_ioc_pack",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "investigate_user_activity",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "ingest_parsed_csv",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "disk_parse_mft",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "disk_parse_usn_journal",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "browser_get_history",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "user_parse_lnk_files",
      "tags": [
        "sensitive-source"
      ],
      "reasons": {
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "user_parse_shellbags",
      "tags": [
        "untrusted-input",
        "sensitive-source"
      ],
      "reasons": {
        "untrusted-input": [
          "keyword \"browse\""
        ],
        "sensitive-source": [
          "parameter \"path\""
        ]
      }
    },
    {
      "tool": "remote_collect_artifacts",
      "tags": [],
      "reasons": {}
    },
    {
      "tool": "remote_get_system_info",
      "tags": [],
      "reasons": {}
    }
  ],
  "surfaceDigest": "38f2e7c25256fdda3f914649445b76add9d9b08c2980cf3fe90aa111875368cd",
  "stats": {
    "tools": 61,
    "prompts": 0,
    "resources": 0,
    "findingsBySeverity": {
      "critical": 1,
      "high": 2,
      "medium": 1,
      "low": 60,
      "info": 0
    }
  }
}