Greybox · Snapshot Audit Report (Sample)

Deployment-layer snapshot: demo MCP server

Sanitized example of the deliverable for the free snapshot audit. All data below was produced by the open-source toolkit against our own target range — not a client engagement. Format, structure and check taxonomy are identical to real deliveries.

Targetdemo-mcp-server (owned range)

Authorizationself — owned test range

Modepassive observation only

Checks6 domains · 16 items

MappingOWASP Agentic AI Top 10 (ASI01–ASI10)

Turnaround48h from authorization

1 · Executive summary

Two sibling targets were scanned: a deliberately vulnerable MCP server and its hardened counterpart. The vulnerable side fails 6 of 16 checks; the hardened side passes 14, with 1 SKIPPED (out of scanner reach — see honesty note). Both results are shown because a check that cannot distinguish vulnerable from hardened proves nothing.

6/16FAIL · vulnerable target

14/16PASS · hardened target

1SKIPPED · out of passive reach

0false positives on hardened side

2 · Findings — vulnerable target

Domain	Check	Result	Observation
AuthZ	Authorization gate	FAIL	Tools/list and tools/call respond without any Authorization header.
Info disclosure	Server fingerprint	FAIL	Error responses leak server build string and internal paths.
Tool hygiene	Tool description injection	FAIL	Tool description contains instructions addressed to the model, not the caller.
Tool hygiene	Over-privileged tool	FAIL	A read-only named tool accepts arbitrary SQL — scope far beyond its label.
Session	Session token entropy	FAIL	Session IDs are sequential and predictable.
Transport	CORS policy	FAIL	Access-Control-Allow-Origin reflects any origin with credentials allowed.

3 · Hardened counterpart (control)

Result	Count	Meaning
PASS	14	Checks distinguish hardened configuration from the vulnerable one — the pair validates the scanner.
SKIPPED	1	One item requires active probing beyond passive scope. Skipped is never reported as passed.

4 · OWASP Agentic AI Top 10 mapping

ASI	Category	Coverage
ASI01	Agent impersonation & hijack	Partial — session entropy & fingerprint checks
ASI02	Tool misuse	Direct — over-privileged tool & description injection checks
ASI03	Identity & permission chaining	Partial — authorization gate & token scope
ASI07	Agentic supply chain	Indirect — via tool description inspection
Others	Full mapping table	Included in paid report (per-check ASI cross-reference)

5 · What this report cannot tell you

Honesty note

Reverse-mapping three real CVSS 9.x incidents with all 16 checks scored 1/16, 1/16, 0/16 — semantic paraphrase defeats pattern checks. Published as regression baseline.
This snapshot is not a security verdict and not a compliance certification.
Business logic, multi-step abuse chains and model-side risks are out of passive scope.

The paid report (¥3,000–8,000) adds: per-finding business impact, prioritized fix list (down to files), a retest after you ship fixes, and the full ASI cross-reference.