⚠️ This snapshot is over 30 days old — treat the grade as stale until the next refresh. Re-scan locally to verify.
Trust Card · Static snapshot
neondatabase__mcp-server-neon U
Ungraded — insufficient static coverage · 14 findings (11 critical) · scope excessive · Not ranked: insufficient static coverage.
Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream neondatabase/mcp-server-neon @ 1f341ee (2026-10-15)
Score breakdown
No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.
Insufficient static coverage: Unsupported source present; Symlinks or special files were not examined. Findings remain actionable; absence of findings is not evidence of safety.
Coverage: limited
Static-heuristic scope: 181 analyzed / 265 discovered files; 3 unsupported source files; 87 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.
- Unsupported source present
- Symlinks or special files were not examined
- Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
- Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
- Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
- Ignored directories, declarations, and non-implementation assets are outside rule scope.
File coverage, applied rules and scan limits
{
"mode": "static-heuristic",
"status": "limited",
"reasons": [
"Unsupported source present",
"Symlinks or special files were not examined"
],
"limitations": [
"Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
"Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
"Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
"Ignored directories, declarations, and non-implementation assets are outside rule scope."
],
"discoveredFiles": 265,
"analyzedFiles": [
{
"path": ".github/dependabot.yml",
"scope": "data",
"bytes": 259,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/claude.yml",
"scope": "data",
"bytes": 2446,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/deploy-preview.yml",
"scope": "data",
"bytes": 5620,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": ".github/workflows/pr.yml",
"scope": "data",
"bytes": 3149,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "app/.well-known/oauth-authorization-server/route.ts",
"scope": "code",
"bytes": 1584,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/.well-known/oauth-protected-resource/[...resource]/route.ts",
"scope": "code",
"bytes": 856,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/.well-known/oauth-protected-resource/route.ts",
"scope": "code",
"bytes": 852,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/api/[transport]/route.ts",
"scope": "code",
"bytes": 50141,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/api/authorize/route.ts",
"scope": "code",
"bytes": 12944,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/api/health/route.ts",
"scope": "code",
"bytes": 238,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/api/list-tools/route.ts",
"scope": "code",
"bytes": 5678,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/api/register/route.ts",
"scope": "code",
"bytes": 4483,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/api/revoke/route.ts",
"scope": "code",
"bytes": 3841,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/api/token/route.ts",
"scope": "code",
"bytes": 36623,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/callback/route.ts",
"scope": "code",
"bytes": 28249,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "app/layout.tsx",
"scope": "code",
"bytes": 1782,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/docs-fixture.ts",
"scope": "code",
"bytes": 2701,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/docs-only-mcp.spec.ts",
"scope": "code",
"bytes": 6969,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/global-setup.ts",
"scope": "code",
"bytes": 853,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/list-tools.spec.ts",
"scope": "code",
"bytes": 4070,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/mcp-response-integrity.spec.ts",
"scope": "code",
"bytes": 1521,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/oauth-consent-modes.spec.ts",
"scope": "code",
"bytes": 31125,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/oauth-helpers.ts",
"scope": "code",
"bytes": 2243,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/oauth-register-authorize.spec.ts",
"scope": "code",
"bytes": 14613,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/provision-oauth-db.ts",
"scope": "code",
"bytes": 2188,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "e2e/smoke.spec.ts",
"scope": "code",
"bytes": 2305,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "eslint.config.mjs",
"scope": "code",
"bytes": 1506,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "knip.json",
"scope": "data",
"bytes": 249,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "lib/assert.ts",
"scope": "code",
"bytes": 531,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "lib/config.ts",
"scope": "code",
"bytes": 1785,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "lib/errors.ts",
"scope": "code",
"bytes": 4839,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "lib/oauth/client.ts",
"scope": "code",
"bytes": 8823,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "lib/oauth/protected-resource-metadata.ts",
"scope": "code",
"bytes": 4180,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "lib/oauth/redirect-uri.ts",
"scope": "code",
"bytes": 1835,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "lib/oauth/upstream-error.ts",
"scope": "code",
"bytes": 2986,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/__snapshots__/hosted-tools-list.json",
"scope": "data",
"bytes": 163655,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "mcp/__tests__/analytics-disable.test.ts",
"scope": "code",
"bytes": 938,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/analytics.test.ts",
"scope": "code",
"bytes": 1478,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/auth-transaction-fixtures.ts",
"scope": "code",
"bytes": 2145,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/auth-transaction-store.integration.test.ts",
"scope": "code",
"bytes": 4393,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/browser-binding.test.ts",
"scope": "code",
"bytes": 1422,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/client-application.test.ts",
"scope": "code",
"bytes": 6999,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/connection-string.test.ts",
"scope": "code",
"bytes": 2529,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/consent-approval.test.ts",
"scope": "code",
"bytes": 13000,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/consent-canonical-url.test.ts",
"scope": "code",
"bytes": 2455,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/consent-dialog.test.ts",
"scope": "code",
"bytes": 15753,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/consent-mode.test.ts",
"scope": "code",
"bytes": 3842,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/consent-tools.test.ts",
"scope": "code",
"bytes": 2483,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/docs-tools.integration.test.ts",
"scope": "code",
"bytes": 4104,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/docs-tools.test.ts",
"scope": "code",
"bytes": 8032,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/ensure-test-oauth-database.ts",
"scope": "code",
"bytes": 444,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/feedback-tool.test.ts",
"scope": "code",
"bytes": 3120,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/generated-result.test.ts",
"scope": "code",
"bytes": 2631,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/grant-context.test.ts",
"scope": "code",
"bytes": 9845,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/grant-filter.test.ts",
"scope": "code",
"bytes": 15019,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/handle-tool-error.test.ts",
"scope": "code",
"bytes": 4255,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/helpers/neon-auth-mocks.ts",
"scope": "code",
"bytes": 1727,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/hosted-tools-list.snapshot.test.ts",
"scope": "code",
"bytes": 3551,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/inspect-database-errors.test.ts",
"scope": "code",
"bytes": 3275,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/inspect-queries.test.ts",
"scope": "code",
"bytes": 8589,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/inspect-report.test.ts",
"scope": "code",
"bytes": 6959,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/inspect-targets.test.ts",
"scope": "code",
"bytes": 5027,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/issued-scopes.test.ts",
"scope": "code",
"bytes": 837,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/kv-store-reinit.test.ts",
"scope": "code",
"bytes": 1078,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/list-projects-org-id.test.ts",
"scope": "code",
"bytes": 4607,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/list-tools-endpoint.test.ts",
"scope": "code",
"bytes": 10077,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/live/mcp-server.live.e2e.test.ts",
"scope": "code",
"bytes": 38408,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/live/pinned-role.live.e2e.test.ts",
"scope": "code",
"bytes": 17311,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/mcp-server.e2e.test.ts",
"scope": "code",
"bytes": 12357,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/neon-auth-get-config.test.ts",
"scope": "code",
"bytes": 16358,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/oauth-api-key-fallback.integration.test.ts",
"scope": "code",
"bytes": 8689,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/oauth-authorize-route.integration.test.ts",
"scope": "code",
"bytes": 31726,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/oauth-callback-route.integration.test.ts",
"scope": "code",
"bytes": 24648,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/oauth-client-resource.integration.test.ts",
"scope": "code",
"bytes": 2511,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/oauth-register-route.integration.test.ts",
"scope": "code",
"bytes": 6193,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/oauth-token-route.integration.test.ts",
"scope": "code",
"bytes": 4494,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/pg-connect-retry.test.ts",
"scope": "code",
"bytes": 2939,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/pinned-role-route.integration.test.ts",
"scope": "code",
"bytes": 11181,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/pinned-role.test.ts",
"scope": "code",
"bytes": 11577,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/project-scoped-injection.integration.test.ts",
"scope": "code",
"bytes": 9959,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/protected-resource-metadata.test.ts",
"scope": "code",
"bytes": 4011,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/read-only.test.ts",
"scope": "code",
"bytes": 2096,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/redirect-uri.test.ts",
"scope": "code",
"bytes": 1127,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/refresh-concurrency.bench.test.ts",
"scope": "code",
"bytes": 24836,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/refresh-lock.test.ts",
"scope": "code",
"bytes": 15893,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/retry.test.ts",
"scope": "code",
"bytes": 3917,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/route-head.integration.test.ts",
"scope": "code",
"bytes": 6322,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/route-session-binding.integration.test.ts",
"scope": "code",
"bytes": 5276,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/route-sse-binding.test.ts",
"scope": "code",
"bytes": 7075,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/route-sse-grant.integration.test.ts",
"scope": "code",
"bytes": 7799,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/sentry-utils.test.ts",
"scope": "code",
"bytes": 2223,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/server-grant-integration.test.ts",
"scope": "code",
"bytes": 6449,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/session-binding.integration.test.ts",
"scope": "code",
"bytes": 4738,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/session-binding.test.ts",
"scope": "code",
"bytes": 28072,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/singleflight.test.ts",
"scope": "code",
"bytes": 2383,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/stable-project-schema.test.ts",
"scope": "code",
"bytes": 6362,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/token-refresh.integration.test.ts",
"scope": "code",
"bytes": 31948,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/tool-call-user-agent.integration.test.ts",
"scope": "code",
"bytes": 6550,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/tool-definitions.test.ts",
"scope": "code",
"bytes": 28379,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/tool-registration-parity.test.ts",
"scope": "code",
"bytes": 2144,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/transport-dynamic-tools.integration.test.ts",
"scope": "code",
"bytes": 22752,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/__tests__/upstream-request-summary.test.ts",
"scope": "code",
"bytes": 4071,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/analytics/analytics.ts",
"scope": "code",
"bytes": 1375,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/constants.ts",
"scope": "code",
"bytes": 377,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/describeUtils.ts",
"scope": "code",
"bytes": 5260,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/inspect/queries.ts",
"scope": "code",
"bytes": 19684,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/inspect/report.ts",
"scope": "code",
"bytes": 4034,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/inspect/targets.ts",
"scope": "code",
"bytes": 2470,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/neon-client.ts",
"scope": "code",
"bytes": 16413,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/auth-transaction-store.ts",
"scope": "code",
"bytes": 11622,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/auth-transaction.ts",
"scope": "code",
"bytes": 5294,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/browser-binding.ts",
"scope": "code",
"bytes": 1766,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/consent-approval.ts",
"scope": "code",
"bytes": 10482,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/consent-canonical-url.ts",
"scope": "code",
"bytes": 1563,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/consent-dialog.ts",
"scope": "code",
"bytes": 41462,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/consent-html-headers.ts",
"scope": "code",
"bytes": 387,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/consent-mode.ts",
"scope": "code",
"bytes": 1304,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/consent-tools.ts",
"scope": "code",
"bytes": 1524,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/downstream-auth-request.ts",
"scope": "code",
"bytes": 2172,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/issued-scopes.ts",
"scope": "code",
"bytes": 672,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/kv-store.ts",
"scope": "code",
"bytes": 5311,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/model.ts",
"scope": "code",
"bytes": 5452,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/refresh-lock.ts",
"scope": "code",
"bytes": 14446,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/oauth/utils.ts",
"scope": "code",
"bytes": 848,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/resources.ts",
"scope": "code",
"bytes": 54,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/sentry/instrument.ts",
"scope": "code",
"bytes": 963,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/sentry/utils.ts",
"scope": "code",
"bytes": 915,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/server/account.ts",
"scope": "code",
"bytes": 2505,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/server/api.ts",
"scope": "code",
"bytes": 148,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/server/errors.ts",
"scope": "code",
"bytes": 3322,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/server/index.ts",
"scope": "code",
"bytes": 6688,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/server/session-binding.ts",
"scope": "code",
"bytes": 12857,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/definitions.ts",
"scope": "code",
"bytes": 14308,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/generated/adapt.ts",
"scope": "code",
"bytes": 13158,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/generated/names.ts",
"scope": "code",
"bytes": 5142,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/generated/operations.ts",
"scope": "code",
"bytes": 4353,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/generated/sanitize.ts",
"scope": "code",
"bytes": 1623,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/grant-filter.ts",
"scope": "code",
"bytes": 11486,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/connection-string.ts",
"scope": "code",
"bytes": 3384,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/decribe-project.ts",
"scope": "code",
"bytes": 433,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/describe-branch.ts",
"scope": "code",
"bytes": 3065,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/docs.ts",
"scope": "code",
"bytes": 1976,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/feedback.ts",
"scope": "code",
"bytes": 1520,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/fetch.ts",
"scope": "code",
"bytes": 5230,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/inspect-database.ts",
"scope": "code",
"bytes": 6305,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/list-orgs.ts",
"scope": "code",
"bytes": 678,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/list-projects.ts",
"scope": "code",
"bytes": 1600,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/neon-auth-branch.ts",
"scope": "code",
"bytes": 383,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/neon-auth-get-config.ts",
"scope": "code",
"bytes": 2656,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/neon-auth-settings-snapshot.ts",
"scope": "code",
"bytes": 10907,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/search.ts",
"scope": "code",
"bytes": 5017,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/urls.ts",
"scope": "code",
"bytes": 1001,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/handlers/utils.ts",
"scope": "code",
"bytes": 973,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/index.ts",
"scope": "code",
"bytes": 41,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/listed-schema.ts",
"scope": "code",
"bytes": 810,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/registration.ts",
"scope": "code",
"bytes": 2348,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/tool-definition.ts",
"scope": "code",
"bytes": 534,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/tools.ts",
"scope": "code",
"bytes": 37144,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/toolsSchema.ts",
"scope": "code",
"bytes": 13507,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/types.ts",
"scope": "code",
"bytes": 1045,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/tools/utils.ts",
"scope": "code",
"bytes": 6273,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/types/auth.ts",
"scope": "code",
"bytes": 535,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/types/context.ts",
"scope": "code",
"bytes": 568,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/utils/client-application.ts",
"scope": "code",
"bytes": 4265,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/utils/grant-context.ts",
"scope": "code",
"bytes": 6572,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/utils/logger.ts",
"scope": "code",
"bytes": 444,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/utils/read-only.ts",
"scope": "code",
"bytes": 2290,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/utils/retry.ts",
"scope": "code",
"bytes": 2137,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/utils/singleflight.ts",
"scope": "code",
"bytes": 610,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "mcp/utils/trace.ts",
"scope": "code",
"bytes": 307,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "next.config.ts",
"scope": "code",
"bytes": 894,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "package.json",
"scope": "data",
"bytes": 2361,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "playwright.config.ts",
"scope": "code",
"bytes": 2195,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "pnpm-lock.yaml",
"scope": "data",
"bytes": 252583,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "postcss.config.mjs",
"scope": "code",
"bytes": 81,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "scripts/e2e-setup.ts",
"scope": "code",
"bytes": 57,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "server.json",
"scope": "data",
"bytes": 1261,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "skills-lock.json",
"scope": "data",
"bytes": 293,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "tsconfig.json",
"scope": "data",
"bytes": 709,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "vercel.json",
"scope": "data",
"bytes": 230,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "vitest.config.ts",
"scope": "code",
"bytes": 278,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
}
],
"unsupportedSourceFiles": [
".env.test.example",
".github/CODEOWNERS",
"public/.well-known/openai-apps-challenge"
],
"excludedFiles": [
{
"path": ".claude/skills/claimable-postgres",
"reason": "non-regular-file"
},
{
"path": ".claude/skills/logging-best-practices",
"reason": "non-regular-file"
},
{
"path": ".git",
"reason": "ignored-directory"
},
{
"path": ".agents/skills/claimable-postgres/SKILL.md",
"reason": "skill-instructions-not-code-analyzed"
},
{
"path": ".agents/skills/logging-best-practices/SKILL.md",
"reason": "skill-instructions-not-code-analyzed"
},
{
"path": ".agents/skills/logging-best-practices/rules/context.md",
"reason": "outside-rule-scope"
},
{
"path": ".agents/skills/logging-best-practices/rules/pitfalls.md",
"reason": "outside-rule-scope"
},
{
"path": ".agents/skills/logging-best-practices/rules/structure.md",
"reason": "outside-rule-scope"
},
{
"path": ".agents/skills/logging-best-practices/rules/wide-events.md",
"reason": "outside-rule-scope"
},
{
"path": ".env.test.example",
"reason": "unsupported-implementation"
},
{
"path": ".github/CODEOWNERS",
"reason": "unsupported-implementation"
},
{
"path": ".gitignore",
"reason": "outside-rule-scope"
},
{
"path": ".npmrc",
"reason": "outside-rule-scope"
},
{
"path": ".nvmrc",
"reason": "outside-rule-scope"
},
{
"path": ".prettierignore",
"reason": "outside-rule-scope"
},
{
"path": ".prettierrc",
"reason": "outside-rule-scope"
},
{
"path": "AGENTS.md",
"reason": "outside-rule-scope"
},
{
"path": "CHANGELOG.md",
"reason": "outside-rule-scope"
},
{
"path": "CONTRIBUTING.md",
"reason": "outside-rule-scope"
},
{
"path": "LICENSE",
"reason": "outside-rule-scope"
},
{
"path": "README.md",
"reason": "outside-rule-scope"
},
{
"path": "ai-notes/SMOKE_TESTS.md",
"reason": "outside-rule-scope"
},
{
"path": "ai-notes/auth-callback-slo.md",
"reason": "outside-rule-scope"
},
{
"path": "ai-notes/refresh-slo.md",
"reason": "outside-rule-scope"
},
{
"path": "ai-notes/vercel-migration.md",
"reason": "outside-rule-scope"
},
{
"path": "app/globals.css",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A1-readonly-confirmation.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A2-writable-confirmation.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A3-client-read-confirmation.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A4-readonly-false-confirmation.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A4-readonly-false-vs-header.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A5-category-only.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A5-empty-category.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A5-project-only.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A6-mixed-unknown.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A6-unknown-only-project.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A6-unknown-only.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/A7-pinned-role-confirmation.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B1-bare-editable.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B1-client-details-expanded.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B2-legacy-readonly-header.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B2-omitted-resource.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B3-editable-read-scope.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B4-subset-writes-off.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B4-subset-writes-on.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B5-no-categories-all-projects.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B5-no-categories-one-project.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B6-missing-project-id.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B7-switch-back-to-all-projects.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B8-editable-role-collapsed.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B8-editable-role-read-only.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B8-editable-role-read-write.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/B9-invalid-role.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L1-confirmation-480-actions.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L1-confirmation-480-full.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L1-confirmation-720-actions.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L1-confirmation-720.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L1-editable-480-actions.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L1-editable-720-actions.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L2-editable-mobile-320px.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L2-editable-mobile-landscape.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L2-editable-mobile-portrait.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L2-mobile-320px.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L2-mobile-landscape.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/L2-mobile-portrait.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/S1-single-scroll-native-scrollbar.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/T1-above-threshold-after-writes.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/T1-visible-at-or-below-threshold.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/T2-collapsed.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/consent-screenshots/T2-expanded.png",
"reason": "outside-rule-scope"
},
{
"path": "e2e/fixtures/docs-index.txt",
"reason": "outside-rule-scope"
},
{
"path": "mcp/__tests__/__snapshots__/hosted-tools-catalog.md",
"reason": "outside-rule-scope"
},
{
"path": "public/.well-known/openai-apps-challenge",
"reason": "unsupported-implementation"
},
{
"path": "public/apple-touch-icon.png",
"reason": "outside-rule-scope"
},
{
"path": "public/favicon.ico",
"reason": "outside-rule-scope"
},
{
"path": "public/favicon.svg",
"reason": "outside-rule-scope"
},
{
"path": "public/fonts/inter/INTER-LICENSE.txt",
"reason": "outside-rule-scope"
},
{
"path": "public/fonts/inter/inter-latin.woff2",
"reason": "outside-rule-scope"
},
{
"path": "public/fonts/inter/inter.css",
"reason": "outside-rule-scope"
},
{
"path": "public/images/consent/check.svg",
"reason": "outside-rule-scope"
},
{
"path": "public/images/consent/chevron.svg",
"reason": "outside-rule-scope"
},
{
"path": "public/images/consent/dash.svg",
"reason": "outside-rule-scope"
},
{
"path": "public/images/consent/info-outline.svg",
"reason": "outside-rule-scope"
},
{
"path": "public/images/consent/key.svg",
"reason": "outside-rule-scope"
},
{
"path": "public/images/consent/neon.svg",
"reason": "outside-rule-scope"
},
{
"path": "public/llms.txt",
"reason": "outside-rule-scope"
},
{
"path": "public/og-image.png",
"reason": "outside-rule-scope"
}
],
"readErrors": [],
"truncation": [],
"limits": {
"maxFiles": 4000,
"maxDepth": 12,
"maxFileBytes": 1048576
}
}Fix first (14 critical/high)
| Severity | Rule | Finding | Remediation |
|---|---|---|---|
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/oauth-api-key-fallback.integration.test.ts:63Evidence: const OAUTH_BEARER = 'oauth-bearer-from-the-mcp-oauth-flow'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/pinned-role-route.integration.test.ts:18Evidence: const PASSWORD = 'FAKE_TEST_PASSWORD_123'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/pinned-role-route.integration.test.ts:19Evidence: const API_KEY = 'fake-api-key-for-tests'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/pinned-role.test.ts:52Evidence: const PASSWORD = 'FAKE_TEST_PASSWORD_123'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/transport-dynamic-tools.integration.test.ts:261Evidence: const oauthToken = 'oauth-client-application'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/transport-dynamic-tools.integration.test.ts:339Evidence: const oauthToken = 'oauth-unclassified-dcr'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/transport-dynamic-tools.integration.test.ts:419Evidence: const oauthToken = 'oauth-handshake-wins'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secretmcp/__tests__/transport-dynamic-tools.integration.test.ts:611Evidence: const oauthToken = 'oauth-unscoped-with-query'; | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-004 (ASI05) | eval() / Function Constructor Invocationmcp/oauth/refresh-lock.ts:216Evidence: redis.eval(HEARTBEAT_LUA, { | Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs). |
| CRITICAL | AT-SEC-004 (ASI05) | eval() / Function Constructor Invocationmcp/oauth/refresh-lock.ts:238Evidence: redis.eval(RELEASE_WITH_TRANSIENT_LUA, { | Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs). |
| CRITICAL | AT-SEC-004 (ASI05) | eval() / Function Constructor Invocationmcp/oauth/refresh-lock.ts:246Evidence: redis.eval(RELEASE_LUA, { keys: [lkey], arguments: [owner] }), | Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresslib/oauth/client.ts:191Evidence: return globalThis.fetch(input, init); | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresslib/oauth/client.ts:193Evidence: return globalThis.fetch(input, { | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egressmcp/tools/handlers/docs.ts:52Evidence: const response = await fetch(url, { | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
Permissions
Scope: excessive · Shell: disabled · Network egress: yes · File deletion: none · Human approval: none
Provenance
License: MIT · Lockfile: yes · Security policy: no · Signals: present (documentary, not a safety verdict)
Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/neondatabase/mcp-server-neon. Scores move with every upstream commit; pages refresh weekly. How scoring works.