insecure-server.report.json

{
  "schema": {
    "id": "mcp-scorecard-report",
    "version": "1.0"
  },
  "generator": {
    "product_name": "MCP Scorecard",
    "tool_name": "mcp-scorecard",
    "package_name": "mcp-scorecard",
    "package_version": "1.0.0"
  },
  "scan": {
    "timestamp": "2026-04-09T16:08:35.505980+00:00",
    "target": {
      "raw": "stdio:[\".\\\\.venv\\\\Scripts\\\\python\",\"examples\\\\insecure-server\\\\server.py\"]",
      "transport": "stdio",
      "description": "Local MCP server launched over stdio.",
      "server_name": "Insecure Demo Server",
      "server_version": "0.1.0",
      "protocol_version": "2025-11-25",
      "metadata": {
        "mcp": {
          "protocolVersion": "2025-11-25",
          "capabilities": {
            "tools": {}
          },
          "transport": "stdio",
          "command": [
            ".\\.venv\\Scripts\\python",
            "examples\\insecure-server\\server.py"
          ],
          "instructions": "Demonstration-only MCP server with intentionally risky tools."
        }
      }
    }
  },
  "inventory": {
    "tool_count": 4,
    "tools": [
      {
        "name": "exec_command",
        "description": "Execute an arbitrary shell command on the host machine.",
        "input_schema": {
          "type": "object",
          "properties": {
            "command": {
              "type": "string",
              "description": "Shell command to execute exactly as provided."
            }
          },
          "required": [
            "command"
          ],
          "additionalProperties": false
        },
        "metadata": {}
      },
      {
        "name": "write_file",
        "description": "Write text content to any file path on disk.",
        "input_schema": {
          "type": "object",
          "properties": {
            "path": {
              "type": "string",
              "description": "Absolute or relative path to write."
            },
            "content": {
              "type": "string",
              "description": "Content to write to the target file."
            },
            "overwrite": {
              "type": "boolean",
              "description": "Overwrite the file if it already exists."
            }
          },
          "required": [
            "path",
            "content"
          ],
          "additionalProperties": false
        },
        "metadata": {}
      },
      {
        "name": "do_it",
        "description": "Helps with stuff.",
        "input_schema": {
          "type": "object",
          "properties": {
            "target": {
              "type": "string",
              "description": "Thing to process."
            }
          },
          "required": [
            "target"
          ],
          "additionalProperties": false
        },
        "metadata": {}
      },
      {
        "name": "debug_payload",
        "description": "Debug helper that accepts whatever input is available.",
        "input_schema": {
          "type": "object",
          "description": "Arbitrary debug payload.",
          "additionalProperties": true
        },
        "metadata": {}
      }
    ]
  },
  "scorecard": {
    "total_score": {
      "value": 10,
      "max": 100,
      "penalty_points": 90
    },
    "category_scores": {
      "conformance": {
        "score": 90,
        "max_score": 100,
        "penalty_points": 10,
        "finding_count": 1,
        "check_penalties": {
          "schema_allows_arbitrary_properties": 10
        }
      },
      "security": {
        "score": 60,
        "max_score": 100,
        "penalty_points": 40,
        "finding_count": 2,
        "check_penalties": {
          "dangerous_exec_tool": 20,
          "dangerous_fs_write_tool": 20
        }
      },
      "ergonomics": {
        "score": 60,
        "max_score": 100,
        "penalty_points": 40,
        "finding_count": 4,
        "check_penalties": {
          "overly_generic_tool_name": 10,
          "vague_tool_description": 10,
          "weak_input_schema": 10,
          "write_tool_without_scope_hint": 10
        }
      },
      "metadata": {
        "score": 100,
        "max_score": 100,
        "penalty_points": 0,
        "finding_count": 0,
        "check_penalties": {}
      }
    },
    "finding_counts": {
      "total": 7,
      "by_severity": {
        "info": 0,
        "warning": 5,
        "error": 2
      },
      "by_bucket": {
        "security": {
          "finding_count": 2,
          "penalty_points": 40
        },
        "ergonomics": {
          "finding_count": 4,
          "penalty_points": 40
        },
        "conformance": {
          "finding_count": 1,
          "penalty_points": 10
        }
      }
    },
    "why_this_score": "Score is driven mainly by security findings in command execution and file system and ergonomics findings.",
    "score_meaning": "Deterministic CI-first quality scorecard based on conformance, security-relevant capabilities, ergonomics, and metadata hygiene.",
    "limitations": [
      "Low score means more deterministic findings or higher-risk exposed surface, not malicious intent.",
      "High score means fewer deterministic findings, not a guarantee of safety."
    ]
  },
  "checks": [
    {
      "id": "duplicate_tool_names",
      "title": "Duplicate tool names",
      "bucket": "conformance",
      "severity": "error",
      "rationale": "Tool names should be unique within one MCP server.",
      "category": "tool-identity",
      "risk_category": "metadata_hygiene",
      "score_impact": 20,
      "tags": [
        "tools",
        "identity"
      ]
    },
    {
      "id": "missing_tool_description",
      "title": "Missing tool description",
      "bucket": "metadata",
      "severity": "warning",
      "rationale": "Each tool should include a non-empty description.",
      "category": "tool-description",
      "risk_category": "metadata_hygiene",
      "score_impact": 10,
      "tags": [
        "tools",
        "description"
      ]
    },
    {
      "id": "overly_generic_tool_name",
      "title": "Overly generic tool name",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Tool names should communicate behavior clearly.",
      "category": "tool-identity",
      "risk_category": "metadata_hygiene",
      "score_impact": 10,
      "tags": [
        "tools",
        "identity"
      ]
    },
    {
      "id": "vague_tool_description",
      "title": "Vague tool description",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Tool descriptions should clearly explain what the tool does.",
      "category": "tool-description",
      "risk_category": "metadata_hygiene",
      "score_impact": 10,
      "tags": [
        "tools",
        "description"
      ]
    },
    {
      "id": "missing_schema_type",
      "title": "Missing schema type",
      "bucket": "conformance",
      "severity": "warning",
      "rationale": "Tool input schemas should declare a top-level type.",
      "category": "input-schema",
      "risk_category": "schema_hygiene",
      "score_impact": 10,
      "tags": [
        "schema",
        "validation"
      ]
    },
    {
      "id": "schema_allows_arbitrary_properties",
      "title": "Schema allows arbitrary properties",
      "bucket": "conformance",
      "severity": "warning",
      "rationale": "Tool input schemas should not allow arbitrary top-level properties.",
      "category": "input-schema",
      "risk_category": "schema_hygiene",
      "score_impact": 10,
      "tags": [
        "schema",
        "validation"
      ]
    },
    {
      "id": "weak_input_schema",
      "title": "Weak input schema",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Tool input schemas should constrain free-form payloads clearly.",
      "category": "input-schema",
      "risk_category": "schema_hygiene",
      "score_impact": 10,
      "tags": [
        "schema",
        "validation"
      ]
    },
    {
      "id": "missing_required_for_critical_fields",
      "title": "Missing required critical fields",
      "bucket": "conformance",
      "severity": "warning",
      "rationale": "Critical schema fields such as path, command, or URL should be required.",
      "category": "input-schema",
      "risk_category": "schema_hygiene",
      "score_impact": 10,
      "tags": [
        "schema",
        "validation"
      ]
    },
    {
      "id": "dangerous_exec_tool",
      "title": "Dangerous execution tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that execute host shell commands are high risk.",
      "category": "capability",
      "risk_category": "command_execution",
      "score_impact": 20,
      "tags": [
        "capability",
        "execution"
      ]
    },
    {
      "id": "dangerous_shell_download_exec",
      "title": "Dangerous download-and-execute tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that combine remote download with shell execution are high risk.",
      "category": "capability",
      "risk_category": "command_execution",
      "score_impact": 20,
      "tags": [
        "capability",
        "execution",
        "network"
      ]
    },
    {
      "id": "dangerous_fs_write_tool",
      "title": "Dangerous filesystem write tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that write files on disk are high risk.",
      "category": "capability",
      "risk_category": "file_system",
      "score_impact": 20,
      "tags": [
        "capability",
        "filesystem"
      ]
    },
    {
      "id": "dangerous_fs_delete_tool",
      "title": "Dangerous filesystem delete tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that delete files or directories are high risk.",
      "category": "capability",
      "risk_category": "file_system",
      "score_impact": 20,
      "tags": [
        "capability",
        "filesystem",
        "destructive"
      ]
    },
    {
      "id": "dangerous_http_request_tool",
      "title": "Dangerous HTTP request tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that issue arbitrary HTTP requests are high risk.",
      "category": "capability",
      "risk_category": "network",
      "score_impact": 20,
      "tags": [
        "capability",
        "network",
        "http"
      ]
    },
    {
      "id": "dangerous_network_tool",
      "title": "Dangerous network tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that expose generic network access are high risk.",
      "category": "capability",
      "risk_category": "network",
      "score_impact": 20,
      "tags": [
        "capability",
        "network"
      ]
    },
    {
      "id": "write_tool_without_scope_hint",
      "title": "Write tool without scope hint",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Filesystem mutation tools should document scope constraints clearly.",
      "category": "capability",
      "risk_category": "external_side_effects",
      "score_impact": 10,
      "tags": [
        "capability",
        "filesystem",
        "scope"
      ]
    },
    {
      "id": "tool_description_mentions_destructive_access",
      "title": "Description mentions destructive access",
      "bucket": "metadata",
      "severity": "warning",
      "rationale": "Tool descriptions should make destructive broad-scope access easy to spot.",
      "category": "capability",
      "risk_category": "external_side_effects",
      "score_impact": 10,
      "tags": [
        "tools",
        "description",
        "destructive"
      ]
    }
  ],
  "findings": [
    {
      "check_id": "overly_generic_tool_name",
      "title": "Overly generic tool name",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Tool names should communicate behavior clearly.",
      "category": "tool-identity",
      "risk_category": "metadata_hygiene",
      "tool_name": "do_it",
      "message": "Tool 'do_it' uses an overly generic name that hides its behavior.",
      "evidence": [
        "tool_name='do_it'"
      ],
      "score_impact": 10,
      "metadata": {}
    },
    {
      "check_id": "vague_tool_description",
      "title": "Vague tool description",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Tool descriptions should clearly explain what the tool does.",
      "category": "tool-description",
      "risk_category": "metadata_hygiene",
      "tool_name": "do_it",
      "message": "Tool 'do_it' uses a vague description that does not explain its behavior clearly.",
      "evidence": [
        "description='Helps with stuff.'",
        "word_count=3",
        "matched_phrase='helps with stuff'"
      ],
      "score_impact": 10,
      "metadata": {}
    },
    {
      "check_id": "schema_allows_arbitrary_properties",
      "title": "Schema allows arbitrary properties",
      "bucket": "conformance",
      "severity": "warning",
      "rationale": "Tool input schemas should not allow arbitrary top-level properties.",
      "category": "input-schema",
      "risk_category": "schema_hygiene",
      "tool_name": "debug_payload",
      "message": "Tool 'debug_payload' allows arbitrary additional input properties.",
      "evidence": [
        "additionalProperties=True",
        "property_count=0"
      ],
      "score_impact": 10,
      "metadata": {}
    },
    {
      "check_id": "weak_input_schema",
      "title": "Weak input schema",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Tool input schemas should constrain free-form payloads clearly.",
      "category": "input-schema",
      "risk_category": "schema_hygiene",
      "tool_name": "debug_payload",
      "message": "Tool 'debug_payload' exposes a weak input schema that leaves free-form input underconstrained.",
      "evidence": [
        "matched_heuristic=inputful_tool_with_empty_object_schema"
      ],
      "score_impact": 10,
      "metadata": {}
    },
    {
      "check_id": "dangerous_exec_tool",
      "title": "Dangerous execution tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that execute host shell commands are high risk.",
      "category": "capability",
      "risk_category": "command_execution",
      "tool_name": "exec_command",
      "message": "Tool 'exec_command' appears to expose host command execution.",
      "evidence": [
        "name_markers=['exec', 'command']",
        "description_markers=['execute', 'shell command', 'host machine']",
        "input_keys=['command']"
      ],
      "score_impact": 20,
      "metadata": {}
    },
    {
      "check_id": "dangerous_fs_write_tool",
      "title": "Dangerous filesystem write tool",
      "bucket": "security",
      "severity": "error",
      "rationale": "Tools that write files on disk are high risk.",
      "category": "capability",
      "risk_category": "file_system",
      "tool_name": "write_file",
      "message": "Tool 'write_file' appears to provide filesystem write access.",
      "evidence": [
        "write_markers=['write']",
        "file_markers=['file', 'disk', 'path']",
        "path_keys=['path']",
        "content_keys=['content']"
      ],
      "score_impact": 20,
      "metadata": {}
    },
    {
      "check_id": "write_tool_without_scope_hint",
      "title": "Write tool without scope hint",
      "bucket": "ergonomics",
      "severity": "warning",
      "rationale": "Filesystem mutation tools should document scope constraints clearly.",
      "category": "capability",
      "risk_category": "external_side_effects",
      "tool_name": "write_file",
      "message": "Tool 'write_file' modifies the filesystem without any visible scope hint.",
      "evidence": [
        "path_keys=['path']",
        "scope_hint=<missing>"
      ],
      "score_impact": 10,
      "metadata": {}
    }
  ],
  "grouped_findings": {
    "by_bucket": [
      {
        "bucket": "security",
        "label": "security",
        "finding_count": 2,
        "penalty_points": 40,
        "findings": [
          {
            "id": "dangerous_exec_tool",
            "title": "Dangerous execution tool",
            "severity": "error",
            "bucket": "security",
            "risk_category": "command_execution",
            "tool_name": "exec_command",
            "rationale": "Tools that execute host shell commands are high risk.",
            "message": "Tool 'exec_command' appears to expose host command execution.",
            "score_impact": 20
          },
          {
            "id": "dangerous_fs_write_tool",
            "title": "Dangerous filesystem write tool",
            "severity": "error",
            "bucket": "security",
            "risk_category": "file_system",
            "tool_name": "write_file",
            "rationale": "Tools that write files on disk are high risk.",
            "message": "Tool 'write_file' appears to provide filesystem write access.",
            "score_impact": 20
          }
        ]
      },
      {
        "bucket": "ergonomics",
        "label": "ergonomics",
        "finding_count": 4,
        "penalty_points": 40,
        "findings": [
          {
            "id": "weak_input_schema",
            "title": "Weak input schema",
            "severity": "warning",
            "bucket": "ergonomics",
            "risk_category": "schema_hygiene",
            "tool_name": "debug_payload",
            "rationale": "Tool input schemas should constrain free-form payloads clearly.",
            "message": "Tool 'debug_payload' exposes a weak input schema that leaves free-form input underconstrained.",
            "score_impact": 10
          },
          {
            "id": "overly_generic_tool_name",
            "title": "Overly generic tool name",
            "severity": "warning",
            "bucket": "ergonomics",
            "risk_category": "metadata_hygiene",
            "tool_name": "do_it",
            "rationale": "Tool names should communicate behavior clearly.",
            "message": "Tool 'do_it' uses an overly generic name that hides its behavior.",
            "score_impact": 10
          },
          {
            "id": "vague_tool_description",
            "title": "Vague tool description",
            "severity": "warning",
            "bucket": "ergonomics",
            "risk_category": "metadata_hygiene",
            "tool_name": "do_it",
            "rationale": "Tool descriptions should clearly explain what the tool does.",
            "message": "Tool 'do_it' uses a vague description that does not explain its behavior clearly.",
            "score_impact": 10
          },
          {
            "id": "write_tool_without_scope_hint",
            "title": "Write tool without scope hint",
            "severity": "warning",
            "bucket": "ergonomics",
            "risk_category": "external_side_effects",
            "tool_name": "write_file",
            "rationale": "Filesystem mutation tools should document scope constraints clearly.",
            "message": "Tool 'write_file' modifies the filesystem without any visible scope hint.",
            "score_impact": 10
          }
        ]
      },
      {
        "bucket": "conformance",
        "label": "conformance",
        "finding_count": 1,
        "penalty_points": 10,
        "findings": [
          {
            "id": "schema_allows_arbitrary_properties",
            "title": "Schema allows arbitrary properties",
            "severity": "warning",
            "bucket": "conformance",
            "risk_category": "schema_hygiene",
            "tool_name": "debug_payload",
            "rationale": "Tool input schemas should not allow arbitrary top-level properties.",
            "message": "Tool 'debug_payload' allows arbitrary additional input properties.",
            "score_impact": 10
          }
        ]
      }
    ]
  },
  "metadata": {}
}