passive remote MCP scan · rubric v1.1
Target
https://api.usezn.com/mcp
NR
Not rated: requires authentication
2 of 13 checks scored
Scanned 2026-10-10T15:49:06.354Z
2 checks scored · 11 N/A (excluded from denominator)
Scan took 1248 ms
The endpoint requires authentication, so its tools cannot be listed passively. A letter grade needs at least one tool-level check; the observed transport and auth checks are shown below.
Checks · observed evidence
✓
TLS 1.2+ transport encryption
PASS
+12 pts · essential
https://api.usezn.com responded 401 (application/json), 0 redirects, transport: unknown.
RFC 5246 / RFC 8446
✓
Authenticated transport boundary
PASS
+12 pts · essential
Endpoint rejected unauthenticated initialize (HTTP 401): JSON-RPC error response.
MCP Authorization
○
Strict parameter schema typing
N/A
excluded · recommended
Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.
OWASP LLM05
○
Tool description hygiene
N/A
excluded · essential
Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.
OWASP LLM01
○
No unconstrained shell primitives
N/A
excluded · essential
Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.
OWASP LLM06
○
Filesystem mutation bounded
N/A
excluded · essential
Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.
OWASP LLM06
○
No plaintext credential parameters
N/A
excluded · essential
Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.
OWASP LLM02
○
Human gate on high-stakes mutations
N/A
excluded · recommended
Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.
OWASP LLM06
○
Input bounds and payload limits
N/A
excluded · essential
Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.
OWASP LLM10
○
Tool-output filtering capacity
N/A
excluded · recommended
Passive remote scan cannot observe this control; see methodology for manual verification steps.
OWASP LLM01
○
Tool namespace isolation
N/A
excluded · recommended
Passive remote scan cannot observe this control; see methodology for manual verification steps.
OWASP LLM01
○
Zero data retention policy published
N/A
excluded · bonus
Passive remote scan cannot observe this control; see methodology for manual verification steps.
OWASP LLM02
○
Cryptographic audit trail
N/A
excluded · bonus
Passive remote scan cannot observe this control; see methodology for manual verification steps.
OWASP LLM06