{
  "run_id": "ianewsfr-a11y--mcp-guard-gpt-6-luna-1792783408269659326",
  "checker": {
    "claims": [
      {
        "claim": "The audit identifies command execution capabilities in server tools.",
        "command": "<guest-path> inspect config_example.json",
        "evidence": "command-execution: bash,      \u2502\n\u2502        \u2502                        \u2502            \u2502 execute, shell                \u2502\n\u2502        \u2502                        \u2502            \u2502 privileged-access: root       \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 tool   \u2502 update_customer_record \u2502    HIGH    \u2502 write-operation: update       \u2502\n\u2502        \u2502                        \u2502            \u2502 database-write: update        \u2502\n\u2502        \u2502                        \u2502            \u2502 database: database, query,    \u2502\n\u2502        \u2502                        \u2502            \u2502 sql, table                    \u2502\n\u251c",
        "expected": "execute_bash_command classified as CRITICAL command-execution",
        "input": "config_example.json",
        "kind": "claim",
        "outcome": "Real input produced the expected result: command-execution: bash",
        "returncode": 0,
        "source": "`mcp-guard` reads your Model Context Protocol (MCP) configuration or a server's tools list and tells you, in one table, which tools can execute commands, write data, touch a database, reach the network, or run with elevated privileges, and which ones hide instructions for the model in their descriptions (**tool poisoning**).",
        "source_checked": true,
        "source_file": "README.md",
        "verdict": "yes"
      }
    ],
    "cycle_checks": [
      {
        "claim": "Scheduled or looping main behavior",
        "command": "",
        "evidence": "The README describes one-shot inspect and scan commands and no product scheduler, recurring loop, or webhook trigger; the documented inspect operation was run once.",
        "expected": "identify the product trigger",
        "input": "source inspection",
        "kind": "cycle",
        "outcome": "The README describes one-shot inspect and scan commands and no product scheduler, recurring loop, or webhook trigger; the documented inspect operation was run once.",
        "source": "repository entry points",
        "verdict": "yes"
      }
    ],
    "details": {
      "argv": [
        "<guest-path>",
        "inspect",
        "config_example.json"
      ],
      "kind": "cli",
      "needs_browser": false,
      "needs_credentials": false,
      "returncode": 0,
      "scope": "product operation",
      "stderr": "",
      "stdout": "                      mcp-guard audit: config_example.json                      \n\u250f\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2533\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2513\n\u2503 Type   \u2503 Name                   \u2503    Risk    \u2503 Findings                      \u2503\n\u2521\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2547\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2529\n\u2502 server \u2502 ops-toolbox            \u2502  CRITICAL  \u2502 privileged-access: sudo       \u2502\n\u2502        \u2502                        \u2502            \u2502 hardcoded-secret: env         \u2502\n\u2502        \u2502                        \u2502            \u2502 OPS_API_TOKEN=<redacted, 24   \u2502\n\u2502        \u2502                        \u2502            \u2502 chars>                        \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 tool   \u2502 execute_bash_command   \u2502  CRITICAL  \u2502 command-execution: bash,      \u2502\n\u2502        \u2502                        \u2502            \u2502 execute, shell                \u2502\n\u2502        \u2502                        \u2502            \u2502 privileged-access: root       \u2502\n[excerpt truncated]",
      "working": true
    },
    "evidence_strength": "readme_checked",
    "example_checks": [
      {
        "claim": "Audit the supplied example configuration",
        "command": "<guest-path> inspect config_example.json",
        "deferred": false,
        "evidence": "    \u2502            \u2502 http, url                     \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 server \u2502 filesystem             \u2502     LOW    \u2502 no risky capability detected  \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 tool   \u2502 read_user_file         \u2502     LOW    \u2502 no risky capability detected  \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\nformat: mcpServers (Claude Desktop / Cursor / Windsurf / Continue) + tools list \n\n6 item(s) audited   CRITICAL  2   HIGH  1   MEDIUM  1   LOW  2",
        "expected": "The output identifies critical command execution risk",
        "input": "config_example.json",
        "kind": "example",
        "outcome": "command completed successfully",
        "returncode": 0,
        "source": "README.md, Example",
        "verdict": "yes"
      }
    ],
    "status": "PASS"
  },
  "diagnosis": null
}