{
  "reportVersion": 1,
  "rulesetVersion": "1.0.2",
  "profile": "balanced-v1",
  "analyzedAt": "2026-09-27T00:00:00.000Z",
  "toolCount": 1,
  "exposureIndex": 18,
  "counts": {
    "critical": 0,
    "high": 1,
    "medium": 0,
    "low": 0,
    "info": 0
  },
  "findings": [
    {
      "id": "1:secret-reference",
      "ruleId": "secret-reference",
      "toolName": "read_record",
      "severity": "high",
      "confidence": "medium",
      "evidence": "read record Read the name of an environment variable, never its value. {\"additionalProperties\":false,\"properties\":{\"id\":{\"maxLength\":80,\"type\":\"string\"}},\"required\":[\"id\"],\"type\":\"",
      "source": {
        "label": "MCP · Security best practices",
        "url": "https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices"
      }
    }
  ],
  "limitations": [
    "static-metadata-only",
    "no-runtime-observation",
    "annotations-untrusted",
    "no-safety-certification"
  ],
  "example": {
    "synthetic": true,
    "reviewDate": "2026-09-27",
    "timestampIsFixedForReproducibility": true,
    "serverExecuted": false,
    "rawWeight": 18
  }
}