# Security Report: https://api.usezn.com/mcp

- Rating: **Not rated** (Not rated: requires authentication): no tool-level check could be scored
- Coverage: 2 of 13 checks scored (N/A checks are excluded, not passed)
- Mode: passive remote MCP scan
- Rubric: v1.1
- Scanned: 2026-10-10T15:49:06.354Z
- Transport: unknown
- Passive: no tools invoked, no payloads sent

| Tier | Check | Status | Evidence |
|------|-------|--------|----------|
| essential | TLS 1.2+ transport encryption | PASS | https://api.usezn.com responded 401 (application/json), 0 redirects, transport: unknown. |
| essential | Authenticated transport boundary | PASS | Endpoint rejected unauthenticated initialize (HTTP 401): JSON-RPC error response. |
| recommended | Strict parameter schema typing | N/A | Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored. |
| essential | Tool description hygiene | N/A | Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored. |
| essential | No unconstrained shell primitives | N/A | Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored. |
| essential | Filesystem mutation bounded | N/A | Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored. |
| essential | No plaintext credential parameters | N/A | Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored. |
| recommended | Human gate on high-stakes mutations | N/A | Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored. |
| essential | Input bounds and payload limits | N/A | Endpoint requires authentication: tools cannot be listed passively, so tool checks are not scored. |
| recommended | Tool-output filtering capacity | N/A | Passive remote scan cannot observe this control; see methodology for manual verification steps. |
| recommended | Tool namespace isolation | N/A | Passive remote scan cannot observe this control; see methodology for manual verification steps. |
| bonus | Zero data retention policy published | N/A | Passive remote scan cannot observe this control; see methodology for manual verification steps. |
| bonus | Cryptographic audit trail | N/A | Passive remote scan cannot observe this control; see methodology for manual verification steps. |

Methodology: https://scan.usezn.com/methodology/
Dispute a result: security@usezn.com (quote scan_491a06de293a457c). Reports are deleted after 90 days.