MCP Audit ──────────────────────────────────────────────────────────────────────── Target: gerfach-portfolio-local-fixture v1.0.0 Protocol: 2025-11-05 (mcp / stdio) Surface: 1 tools, 0 resources, 0 prompts Duration: 181ms ──────────────────────────────────────────────────────────────────────── Risk Overview MEDIUM CRS: 0.484 UMRI: 47.76 Legacy score: 70/100 SSVC: Track* CRIT 1 HIGH 0 MED 0 LOW 0 INFO 0 Check Summary pass 0 warn 0 fail 1 error 0 skip 0 total 1 Detonation Chamber ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ Reachability: VERIFIED via chamber-finding Verified by chamber-backed finding CHAMBER-FS-001; target produced captured evidence during active probing. Captures recorded: [CRITICAL] ? 0 event(s) Tool wrote attacker-canaried content into chamber workdir (state-corruption proof) Egress Matrix ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ 0 verified cell(s) reached: 0 destination class(es) active sinks: 0 Destination fake-http fake-metadata fake-dns fake-smtp netflow ─────────────────────────────────────────────────────────────────────────────────────────── Chamber-Direct Blocked Blocked Blocked Blocked Blocked Localhost Blocked Blocked Blocked Blocked Blocked RFC1918/Internal Blocked Blocked Blocked Blocked Blocked Cloud Metadata Blocked Blocked Blocked Blocked Blocked Public Internet Blocked Blocked Blocked Blocked Blocked DNS Blocked Blocked Blocked Blocked Blocked Kill Chains ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ ─ complete 1 partial 0 blocked 0 proofs: state-delta proof bundle: /portfolio-before/proofs/chamber-… records: 1 COMPLETE [CRITICAL] State mutation chain has oracle proof tools: write_file KC-STATE-001 impact: state-corruption proof: State delta proof is attached to the referenced finding. artifact: /portfolio-before/captures/state/stat… Top Findings [CRITICAL] Tool wrote attacker-canaried content into chamber workdir (state-corruption proof) CHAMBER-FS-001 state-oracle tool: write_file confidence: 99% Module Rollup FAIL State Oracle (filesystem diff) 5ms findings:1 fail:1 warn:0 skip:0 Legacy Score Gauge █████████████████████░░░░░░░░░ 70/100 Grade: C CRITICAL: 1 HIGH: 0 WARN: 0 PASS: 0 Raw score: 70; penalty points: 30. Prefer CRS for research comparisons. ──────────────────────────────────────────────────────────────────────── Report complete. Use --format research-json for the full machine-readable artifact. Report saved to: /before.json - Connecting via MCP (Model Context Protocol)... ✔ Connected to gerfach-portfolio-local-fixture v1.0.0 (1 tools, 0 resources, 0 prompts) - Running 1 audit module(s)... - Verifying chamber reachability... ⚠ Chamber reachability not-testable: No URL-like tool parameter was available for chamber reachability verification. - Running PEAV pre-flight analysis... ✔ PEAV: no passive evidence found — all tools will be fully fuzzed - Running module: state-oracle... ✔ Module complete: state-oracle