{
  "scanId": "scan_491a06de293a457c",
  "scannedAt": "2026-10-10T15:49:06.354Z",
  "target": "https://api.usezn.com/mcp",
  "mode": "passive remote MCP scan",
  "rubricVersion": "1.1",
  "score": 100,
  "grade": "NR",
  "verdict": "Not rated: requires authentication",
  "notRatedReason": "auth_required",
  "protocol": "unknown",
  "toolCount": 0,
  "tookMs": 1248,
  "findings": [
    {
      "checkId": "tls_transport",
      "tier": "essential",
      "applicable": true,
      "passed": true,
      "weight": 12,
      "severity": "PASSED",
      "title": "TLS 1.2+ transport encryption",
      "evidence": "https://api.usezn.com responded 401 (application/json), 0 redirects, transport: unknown.",
      "remediation": "Terminate TLS at the edge with a managed certificate and redirect all cleartext requests.",
      "remediationOpen": "Let's Encrypt + Caddy or Nginx certbot with HSTS.",
      "owaspId": "RFC 5246 / RFC 8446"
    },
    {
      "checkId": "auth_boundary",
      "tier": "essential",
      "applicable": true,
      "passed": true,
      "weight": 12,
      "severity": "PASSED",
      "title": "Authenticated transport boundary",
      "evidence": "Endpoint rejected unauthenticated initialize (HTTP 401): JSON-RPC error response.",
      "remediation": "Require OAuth 2.1 authorization-code flow with PKCE on every MCP transport endpoint.",
      "remediationOpen": "Open-source identity providers (Keycloak, Ory Hydra, oauth2-proxy) expose the same flows.",
      "owaspId": "MCP Authorization"
    },
    {
      "checkId": "param_typing",
      "tier": "recommended",
      "applicable": false,
      "passed": null,
      "weight": 6,
      "severity": "NOT_APPLICABLE",
      "title": "Strict parameter schema typing",
      "evidence": "Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.",
      "remediation": "Declare types (string, integer, boolean) and required fields in every tool inputSchema.",
      "remediationOpen": "Zod, Pydantic, or vanilla JSON Schema generate strict schemas the same way.",
      "owaspId": "OWASP LLM05"
    },
    {
      "checkId": "tool_desc_hygiene",
      "tier": "essential",
      "applicable": false,
      "passed": null,
      "weight": 12,
      "severity": "NOT_APPLICABLE",
      "title": "Tool description hygiene",
      "evidence": "Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.",
      "remediation": "Rewrite descriptions as neutral capability statements; strip imperative clauses and invisible characters.",
      "remediationOpen": "mcp-scan (Invariant Labs) and LlamaFirewall both flag poisoned descriptions.",
      "owaspId": "OWASP LLM01"
    },
    {
      "checkId": "shell_primitives",
      "tier": "essential",
      "applicable": false,
      "passed": null,
      "weight": 12,
      "severity": "NOT_APPLICABLE",
      "title": "No unconstrained shell primitives",
      "evidence": "Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.",
      "remediation": "Replace open shell tools with granular scoped operations or run them inside a sandbox (Docker, Firecracker).",
      "remediationOpen": "Firecracker microVMs, gVisor, or Docker with read-only rootfs and dropped capabilities.",
      "owaspId": "OWASP LLM06"
    },
    {
      "checkId": "fs_mutation",
      "tier": "essential",
      "applicable": false,
      "passed": null,
      "weight": 12,
      "severity": "NOT_APPLICABLE",
      "title": "Filesystem mutation bounded",
      "evidence": "Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.",
      "remediation": "Bind the server to a single workspace root with respect for hidden-file exclusions.",
      "remediationOpen": "The reference MCP filesystem server scopes roots the same way.",
      "owaspId": "OWASP LLM06"
    },
    {
      "checkId": "credentials_exposure",
      "tier": "essential",
      "applicable": false,
      "passed": null,
      "weight": 12,
      "severity": "NOT_APPLICABLE",
      "title": "No plaintext credential parameters",
      "evidence": "Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.",
      "remediation": "Inject credentials at the gateway layer via environment or secret manager, never through tool arguments.",
      "remediationOpen": "Vault, AWS Secrets Manager, or Doppler with env-scoped injection.",
      "owaspId": "OWASP LLM02"
    },
    {
      "checkId": "financial_human_gate",
      "tier": "recommended",
      "applicable": false,
      "passed": null,
      "weight": 6,
      "severity": "NOT_APPLICABLE",
      "title": "Human gate on high-stakes mutations",
      "evidence": "Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.",
      "remediation": "Add a two-step confirmation flow with server-side approval tokens for mutation tools.",
      "remediationOpen": "Any webhook-based approval queue (Slack bot, Linear flow) implements the same gate.",
      "owaspId": "OWASP LLM06"
    },
    {
      "checkId": "input_bounds",
      "tier": "essential",
      "applicable": false,
      "passed": null,
      "weight": 12,
      "severity": "NOT_APPLICABLE",
      "title": "Input bounds and payload limits",
      "evidence": "Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored.",
      "remediation": "Constrain string parameters with maxLength, enum or pattern and reject oversize bodies at transport level.",
      "remediationOpen": "JSON Schema maxLength plus framework-level body size guards (e.g. express body-parser limits).",
      "owaspId": "OWASP LLM10"
    },
    {
      "checkId": "output_filter_capacity",
      "tier": "recommended",
      "applicable": false,
      "passed": null,
      "weight": 6,
      "severity": "NOT_APPLICABLE",
      "title": "Tool-output filtering capacity",
      "evidence": "Passive remote scan cannot observe this control; see methodology for manual verification steps.",
      "remediation": "Filter tool outputs inline (neural gate, regex policy, or framework middleware) before re-injecting into context.",
      "remediationOpen": "LlamaFirewall, LLM Guard, or Azure Prompt Shield provide equivalent capacity.",
      "owaspId": "OWASP LLM01"
    },
    {
      "checkId": "namespace_isolation",
      "tier": "recommended",
      "applicable": false,
      "passed": null,
      "weight": 6,
      "severity": "NOT_APPLICABLE",
      "title": "Tool namespace isolation",
      "evidence": "Passive remote scan cannot observe this control; see methodology for manual verification steps.",
      "remediation": "Rebuild the tool registry each turn and reject shadowed names.",
      "remediationOpen": "The reference MCP SDK keeps client-controlled tool names immutable.",
      "owaspId": "OWASP LLM01"
    },
    {
      "checkId": "zdr_policy",
      "tier": "bonus",
      "applicable": false,
      "passed": null,
      "weight": 2,
      "severity": "NOT_APPLICABLE",
      "title": "Zero data retention policy published",
      "evidence": "Passive remote scan cannot observe this control; see methodology for manual verification steps.",
      "remediation": "Publish a data-retention statement on the site.",
      "remediationOpen": "A public docs page or trust report satisfies this without any vendor.",
      "owaspId": "OWASP LLM02"
    },
    {
      "checkId": "audit_trail",
      "tier": "bonus",
      "applicable": false,
      "passed": null,
      "weight": 2,
      "severity": "NOT_APPLICABLE",
      "title": "Cryptographic audit trail",
      "evidence": "Passive remote scan cannot observe this control; see methodology for manual verification steps.",
      "remediation": "Log verdicts with hash chaining or append-only storage.",
      "remediationOpen": "Hash-chained logs with OpenSSL or an append-only Merkle log implement this pattern.",
      "owaspId": "OWASP LLM06"
    }
  ]
}