{"id":570628,"recorded_at":"2026-10-27T22:24:09.999821Z","observed_at":"2026-10-27T22:24:09.999759Z","subject_kind":"endpoint","subject":"e72c7d0a-5808-4a52-a63f-6c0acfd9f818","kind":"mcp.tools","method":"probe.mcp/1","body":{"count":1,"tools":[{"description":"Scan a public GitHub MCP-server repository for security issues.\n\n    Clones the repo (shallow, <60s, <200 MB), runs compuute-scan v0.6.2 in\n    static analysis mode (no code execution from the target), and returns a\n    structured report with severity counts, a 0-100 score, and the 10 most\n    severe findings.\n\n    WHEN TO USE:\n      - Before connecting to an unknown MCP server discovered via Anthropic\n        Registry, Smithery, mcp.so, or a Discord recommendation.\n      - Before installing a third-party MCP-server package into a production\n        pipeline.\n      - As part of an agent's pre-commit / pre-deploy due-diligence step\n        when adding new dependencies.\n      - As one input to a multi-source trust evaluation (combine with\n        publisher reputation, package install count, last-update recency).\n\n    WHEN NOT TO USE:\n      - For private repos. Use the on-prem CLI instead:\n          `npx compuute-scan ./path-to-private-repo`\n      - For deep exploitability assessment of a specific code path. This is\n        pattern matching, not dataflow analysis. Book a manual L2-L4 audit\n        at https://compuute.se/audit for that depth.\n      - For non-GitHub hosts (GitLab, Bitbucket, self-hosted). v1 supports\n        github.com only.\n      - For repos > 200 MB or clone time > 60s. The endpoint returns a 413\n        or 504 in those cases — fall back to local CLI.\n\n    EXPECTED RESPONSE TIME:\n      - Median: ~1-2 seconds for small repos (<100 files).\n      - p99: ~10 seconds for medium repos.\n      - Hard timeout at clone=60s, scan=120s combined.\n\n    EXPECTED COST:\n      - Free tier in MVP. Future Pro tier may charge per-scan or per-month.\n\n    DATA FRESHNESS:\n      - Scanner version is reported in response.scanner.version.\n      - L1 rule set freshness reflects compuute-scan releases — see\n        github.com/Compuute/compuute-scan/CHANGELOG.md for the latest CVE\n        and threat-intel response timeline.\n\n    EXAMPLES:\n\n      Example 1 — scan an MCP server you're evaluating:\n        github_url = \"https://github.com/modelcontextprotocol/servers\"\n        → score: 0, summary: {critical: 1, high: 94, medium: 22}\n        → top_findings include SSRF, eval, etc.\n        → recommendation: \"AVOID — 1 critical and 94 high finding(s)...\"\n\n      Example 2 — scan a clean reference implementation:\n        github_url = \"https://github.com/microsoft/azure-devops-mcp\"\n        → score: 90+, summary: {critical: 0, high: 1}\n        → recommendation: \"REVIEW — 1 high finding(s)...\"\n\n      Example 3 — scan your own dev MCP-server before publishing:\n        github_url = \"https://github.com/yourorg/your-mcp\"\n        → audit your own surface before others install it\n\n    OUTPUT FIELDS (stable schema):\n      - repo_url (str): canonical URL of the scanned repo.\n      - score (int): 0-100, higher safer. Coarse summary, not a precision claim.\n      - summary (object): {critical, high, medium, low, info, files_scanned}.\n      - recommendation (str): action guidance derived from severity counts.\n      - findings_count (int): total raw findings (may include false positives).\n      - top_findings (list): up to 10 most severe, each with {id, title,\n        severity, file, line, owasp, cwe}.\n      - l0_discovery (object): MCP transport, tool count, dependency pinning.\n      - performance (object): clone_seconds, scan_seconds, repo_size_bytes.\n      - scanner (object): {name, version, layers_covered}.\n      - _disclaimer (str): MANDATORY triage disclaimer. Read it.\n\n    Args:\n      github_url: Public GitHub HTTPS URL (e.g. https://github.com/org/repo).\n                  Must be public and < 200 MB. v1 is github.com only.\n\n    Returns:\n      Structured scan result. On error, returns {\"error\": code, \"message\": ...}\n      with HTTP-style code (invalid_url, clone_failed, scan_timeout, etc.).\n    ","inputSchema":{"properties":{"github_url":{"title":"Github Url","type":"string"}},"required":["github_url"],"title":"scan_mcp_serverArguments","type":"object"},"name":"scan_mcp_server"}]},"body_sha256":"4eb5fc8aa6989b8aa38ca1aba975f4b5b701ace425fb8d5bf75a273456924fdb","prev_id":null,"leaf":"0xa694f9d75a91fe8721ea2668b134e134c4f7c8117d750bbb42bbc461a2004416","leaf_text":"{\"body\":\"4eb5fc8aa6989b8aa38ca1aba975f4b5b701ace425fb8d5bf75a273456924fdb\",\"id\":570628,\"kind\":\"mcp.tools\",\"method\":\"probe.mcp/1\",\"observed_us\":1793139849999759,\"prev\":null,\"subject\":\"e72c7d0a-5808-4a52-a63f-6c0acfd9f818\",\"subject_kind\":\"endpoint\"}","day":{"day":"2026-10-27","leaves":273461,"root":"0xdd77e5e99da32c3f154180d63e3c3e6fe11e896a2c6896412ef6b5c4bcf7e795","chained":"0x23bb4dfd09f55c15ac3962f53578e02c6114d5bfd9bb451cf8794fb6e2817ef4","anchor_chain":"eip155:5042002","anchor_tx":"0xb2ebd83aafeb765a0ce66e76aefb133ed06606c98038fd56191e2bcd1dcb77b4","anchor_block":69414147},"proof":["0xa694e58dd30adad21b53f6c15cd616040e735059617d868a1ac2c8085d3c6574","0xcd173097afa68452ef17d77b3f526beea932f915e19bc8ee68c4336c4c7a03c2","0x4899a569a48cdc7691262d14aa723bd577e12cb446f1dd617610029157ae2268","0xd10bf27fff6d8dbfaaf8a70b54d6a794581d5f8b81bc4a6f88b93b7b1ae03cd2","0x391a0ddd257abfe7e6150b3271815ef667a1a251068a26d20d394e1f469c9086","0x48ad30e6bb86c84291df9c35985b239f4671595168413031b7018d2a6252e346","0x759a95e452a113c1d3c3ba572cf1514ab0d1857a7a835ef6f3d2e8aee76f638e","0x337ee481ceb958ef92f02338008f7110c79062e8cb33a3d1942c0861adffeccf","0x25d3dd26600ddd40f9fd4339f485e0abe36a1deab802f4e5f09b51343231088b","0x5ae263265777ee62431de587d377c20bb922d60cc6fb48094a7f3cdb8a3b231e","0x84d44ad9f2c04577b96d73f7fdc6010e8b93e5b318136ae9ea601cf365fad041","0x98f564dcc2f0d0fd67cbc3a17211687e12a4becc9b9c47ef78c02ff7431b734a","0xb37156a04839055daed26674da38864f8dae598cab9742c6fb3e74eb3178f2d4","0x0644f7e2a4b5bf9b66f185cc3fbb766d456ad94490183852f4c6db5855114cc5","0xa3fff4662cd48659f5bafd0612931759a90e53a7b4209ed8f26f6594a07bb547","0x64c405a28e8819716221eb2529fe4ce277ab08025e17e685cbd5ece75ceb75c7","0xf30fddbf4811226c58e8f0daf36fddd79fc5f1356b592bb1d99a8061ddbabe66","0x2bf8151e5f157dd183b9de6fa00469551932a7a6e3f33a694895000ac9061197","0x9fc354c0ea3efc3f1b6548bb77ea902a50f2c9647647ea61592efce2bd795699"]}