{ "version": "1.0.0", "id": "e8890cc7-7cd3-4c7a-91ac-2a26e8633d66", "timestamp": "2026-09-20T02:01:05.771Z", "durationMs": 181, "cliVersion": "0.1.0-alpha.1", "scannerCommit": "2086b26b2122f822872f38b860d6af36f56fa247", "scanMode": "full-active", "scoringFormulaVersion": "v4.0", "calibrationStatus": "CALIBRATED", "transport": { "type": "stdio", "command": "bun", "args": [ "scripts/gerfach/fixture.mjs" ], "protocol": "mcp" }, "server": { "serverInfo": { "name": "gerfach-portfolio-local-fixture", "version": "1.0.0" }, "protocolVersion": "2025-11-05", "capabilities": { "tools": { "listChanged": true } }, "tools": [ { "name": "write_file", "description": "Write text into a temporary local fixture directory. Intentionally inconsistent read-only annotation.", "inputSchema": { "type": "object", "properties": { "path": { "type": "string" }, "content": { "type": "string" } }, "required": [ "path", "content" ], "additionalProperties": false, "$schema": "http://json-schema.org/draft-07/schema#" }, "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": false }, "sourceProtocol": "mcp", "nativeType": "tool" } ], "resources": [], "prompts": [], "protocol": "mcp" }, "modules": [ { "moduleId": "state-oracle", "moduleName": "State Oracle (filesystem diff)", "moduleVersion": "1.0.0", "durationMs": 5, "checks": [ { "id": "CHAMBER-FS-001", "name": "Chamber state oracle proof", "status": "FAIL", "message": "1 canary-bearing change(s) observed in chamber workdir from 1 tool(s)", "finding": { "id": "CHAMBER-FS-001", "module": "state-oracle", "severity": "CRITICAL", "title": "Tool wrote attacker-canaried content into chamber workdir (state-corruption proof)", "description": "The state oracle planted 1 canary-laced write probes through tool input schemas. After probing, the chamber workdir contained file changes whose paths or contents included the canary token, proving the target executed the mutation. This is a downloadable proof artifact suitable for vendor disclosure.", "evidence": { "oracleId": "state-oracle-4cf67762", "fsDiffFile": "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json", "stateDiffFile": "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json", "firedCanaries": [ "chamber-state-0-a7673fc1" ], "hits": [ { "canary": "chamber-state-0-a7673fc1", "kind": "added", "path": "chamber-state-0-a7673fc1.txt", "matchedIn": [ "path", "content" ] } ], "summary": { "added": 1, "modified": 0, "deleted": 0 }, "verifiedBy": "state-oracle" }, "remediation": "Constrain write paths to a strict allowlist; reject paths containing user-controlled tokens; require explicit user confirmation for write/create/delete operations.", "cweId": "CWE-22", "confidence": 0.99, "affectedTools": [ "write_file" ], "affectedCount": 1, "toolName": "write_file", "dedupGroup": "CHAMBER-FS-001" } } ], "findings": [ { "id": "CHAMBER-FS-001", "module": "state-oracle", "severity": "CRITICAL", "title": "Tool wrote attacker-canaried content into chamber workdir (state-corruption proof)", "description": "The state oracle planted 1 canary-laced write probes through tool input schemas. After probing, the chamber workdir contained file changes whose paths or contents included the canary token, proving the target executed the mutation. This is a downloadable proof artifact suitable for vendor disclosure.", "evidence": { "oracleId": "state-oracle-4cf67762", "fsDiffFile": "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json", "stateDiffFile": "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json", "firedCanaries": [ "chamber-state-0-a7673fc1" ], "hits": [ { "canary": "chamber-state-0-a7673fc1", "kind": "added", "path": "chamber-state-0-a7673fc1.txt", "matchedIn": [ "path", "content" ] } ], "summary": { "added": 1, "modified": 0, "deleted": 0 }, "verifiedBy": "state-oracle" }, "remediation": "Constrain write paths to a strict allowlist; reject paths containing user-controlled tokens; require explicit user confirmation for write/create/delete operations.", "cweId": "CWE-22", "confidence": 0.99, "affectedTools": [ "write_file" ], "affectedCount": 1, "toolName": "write_file", "dedupGroup": "CHAMBER-FS-001" } ] } ], "findings": [ { "id": "CHAMBER-FS-001", "module": "state-oracle", "severity": "CRITICAL", "title": "Tool wrote attacker-canaried content into chamber workdir (state-corruption proof)", "description": "The state oracle planted 1 canary-laced write probes through tool input schemas. After probing, the chamber workdir contained file changes whose paths or contents included the canary token, proving the target executed the mutation. This is a downloadable proof artifact suitable for vendor disclosure.", "evidence": { "oracleId": "state-oracle-4cf67762", "fsDiffFile": "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json", "stateDiffFile": "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json", "firedCanaries": [ "chamber-state-0-a7673fc1" ], "hits": [ { "canary": "chamber-state-0-a7673fc1", "kind": "added", "path": "chamber-state-0-a7673fc1.txt", "matchedIn": [ "path", "content" ] } ], "summary": { "added": 1, "modified": 0, "deleted": 0 }, "verifiedBy": "state-oracle" }, "remediation": "Constrain write paths to a strict allowlist; reject paths containing user-controlled tokens; require explicit user confirmation for write/create/delete operations.", "cweId": "CWE-22", "confidence": 0.99, "affectedTools": [ "write_file" ], "affectedCount": 1, "toolName": "write_file", "dedupGroup": "CHAMBER-FS-001" } ], "summary": { "totalChecks": 1, "passed": 0, "warnings": 0, "checksWithFailStatus": 1, "skipped": 0, "errors": 0, "findingsBySeverity": { "CRITICAL": 1, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "INFO": 0 }, "securityScore": 70, "rawScore": 70, "penaltyPoints": 30 }, "riskProfile": { "exposure": 0.613, "exploitChainDepth": 0, "severityDensity": 0.99, "capabilityRisk": 0, "trustViolation": 0, "compositeRiskScore": 0.484, "umriScalar": 47.764, "riskLevel": "MEDIUM", "ssvcLabel": "Track*", "_scanTier": "schema-rich", "_inputs": { "toolCount": 1, "totalParams": 2, "unconstrainedParams": 2, "chainFindings": 0, "dualUseFindings": 0, "capConcentrationFindings": 0, "dangerousCapabilities": [], "rugPullCriticals": 0, "rugPullHighs": 0, "descInjectionFindings": 0, "ipiFindings": 0, "namespacePoisoningFindings": 0, "findingsBySeverity": { "CRITICAL": 1, "HIGH": 0, "MEDIUM": 0, "LOW": 0, "INFO": 0 }, "weightedFindingSum": 0.99, "cwas": 1, "totalToolRisk": 0.99 } }, "schemaHash": { "schemaHash": "4f89c79e22cc85191706d71912f71bdb8542a6576f5a1b3831d7c2975e8d5c44", "toolHashes": { "write_file": "4f89c79e22cc85191706d71912f71bdb8542a6576f5a1b3831d7c2975e8d5c44" }, "toolCount": 1 }, "provenance": { "cliFlags": [ "--active", "--format=terminal", "--protocol=mcp", "--transport=stdio", "--timeout=30000", "--probe-timeout=5000", "--llm-output-token-limit=8192", "--modules=state-oracle", "--output=/before.json", "--chamber-run-dir=/portfolio-before", "--context=sandboxed" ], "configHash": "9651a553f848678d", "runtimeVersion": "bun v24.3.0", "platform": "darwin-arm64", "envSnapshot": {} }, "peavReport": { "timestamp": "2026-09-20T02:01:05.763Z", "durationMs": 4, "results": [ { "toolName": "write_file", "hasEvidence": false, "signals": [], "responseTimeMs": 2, "callErrored": false } ], "toolsWithEvidence": [], "toolsNeedingFuzz": [ "write_file" ] }, "chamberSummary": { "runDir": "/portfolio-before", "networkName": "portfolio_before_net", "captureRoot": "/portfolio-before/captures", "captures": { "http": { "count": 0, "capturePath": "/portfolio-before/captures/http/requests.jsonl" }, "dns": { "count": 0, "capturePath": "/portfolio-before/captures/dns/queries.jsonl" }, "smtp": { "count": 0, "capturePath": "/portfolio-before/captures/smtp/sessions.jsonl" }, "metadata": { "count": 0, "capturePath": "/portfolio-before/captures/metadata/requests.jsonl" }, "netflow": { "count": 0, "capturePath": "/portfolio-before/captures/netflow/flows.jsonl" } }, "confirmedExfil": [], "ipiRelays": [], "severityCounts": { "critical": 1, "high": 0, "medium": 0, "low": 0 } }, "chamberReachability": { "status": "verified", "verified": true, "checkedAt": "2026-09-20T02:01:05.769Z", "method": "chamber-finding", "captureFile": "/portfolio-before/captures/http/requests.jsonl", "reason": "Verified by chamber-backed finding CHAMBER-FS-001; target produced captured evidence during active probing." }, "killChainSummary": { "chains": [ { "id": "KC-STATE-001", "title": "State mutation chain has oracle proof", "status": "complete", "impact": "state-corruption", "severity": "CRITICAL", "protocol": "mcp", "toolNames": [ "write_file" ], "findingIds": [ "CHAMBER-FS-001" ], "proofTypes": [ "state-delta" ], "proofArtifacts": [ { "proofType": "state-delta", "kind": "filesystem-diff", "path": "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json", "findingIds": [ "CHAMBER-FS-001" ], "proofId": "KC-STATE-001-PROOF-1", "downloadable": true } ], "stages": [ { "kind": "entrypoint", "status": "complete", "label": "Entrypoint surface: write_file.", "findingIds": [ "CHAMBER-FS-001" ], "evidence": { "protocol": "mcp", "toolCount": 1 } }, { "kind": "attacker-control", "status": "partial", "label": "Scanner identified stateful or annotation-sensitive behavior.", "findingIds": [ "CHAMBER-FS-001" ] }, { "kind": "capability", "status": "complete", "label": "Target exposes a stateful capability or safety-annotation mismatch.", "findingIds": [ "CHAMBER-FS-001" ] }, { "kind": "chamber-sensor", "status": "complete", "label": "State/fs oracle produced a delta.", "findingIds": [ "CHAMBER-FS-001" ] }, { "kind": "proof", "status": "complete", "label": "State delta proof is attached to the referenced finding.", "findingIds": [ "CHAMBER-FS-001" ], "evidence": { "proofIds": [ "KC-STATE-001-PROOF-1" ], "proofArtifactPaths": [ "/portfolio-before/captures/state/state-oracle-4cf67762.delta.json" ], "verifiedBy": [ "state-oracle" ] } }, { "kind": "impact", "status": "complete", "label": "Attacker-controlled input caused observable state mutation.", "findingIds": [ "CHAMBER-FS-001" ] } ], "summary": "A state or filesystem oracle observed mutation, completing a state-corruption kill chain.", "whatWorked": [ "Modules identified stateful behavior worth validating." ], "whatDidNotWork": [] } ], "total": 1, "completed": 1, "partial": 0, "blocked": 0, "highestSeverity": "CRITICAL", "proofTypes": [ "state-delta" ] }, "chamberProofBundle": { "version": 1, "proofFile": "/portfolio-before/proofs/chamber-proofs.jsonl", "proofCount": 1, "missingArtifactCount": 0, "writtenAt": "2026-09-20T02:01:05.770Z" }, "egressMatrix": { "destinations": [ "chamber-direct", "localhost", "rfc1918", "cloud-metadata", "public-internet", "dns", "unclassified" ], "sinks": [ "http", "metadata", "dns", "smtp", "netflow" ], "cells": [ [ { "destination": "chamber-direct", "sink": "http", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "chamber-direct", "sink": "metadata", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "chamber-direct", "sink": "dns", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "chamber-direct", "sink": "smtp", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "chamber-direct", "sink": "netflow", "verified": false, "canaries": [], "variants": [], "findingIds": [] } ], [ { "destination": "localhost", "sink": "http", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "localhost", "sink": "metadata", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "localhost", "sink": "dns", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "localhost", "sink": "smtp", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "localhost", "sink": "netflow", "verified": false, "canaries": [], "variants": [], "findingIds": [] } ], [ { "destination": "rfc1918", "sink": "http", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "rfc1918", "sink": "metadata", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "rfc1918", "sink": "dns", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "rfc1918", "sink": "smtp", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "rfc1918", "sink": "netflow", "verified": false, "canaries": [], "variants": [], "findingIds": [] } ], [ { "destination": "cloud-metadata", "sink": "http", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "cloud-metadata", "sink": "metadata", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "cloud-metadata", "sink": "dns", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "cloud-metadata", "sink": "smtp", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "cloud-metadata", "sink": "netflow", "verified": false, "canaries": [], "variants": [], "findingIds": [] } ], [ { "destination": "public-internet", "sink": "http", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "public-internet", "sink": "metadata", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "public-internet", "sink": "dns", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "public-internet", "sink": "smtp", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "public-internet", "sink": "netflow", "verified": false, "canaries": [], "variants": [], "findingIds": [] } ], [ { "destination": "dns", "sink": "http", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "dns", "sink": "metadata", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "dns", "sink": "dns", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "dns", "sink": "smtp", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "dns", "sink": "netflow", "verified": false, "canaries": [], "variants": [], "findingIds": [] } ], [ { "destination": "unclassified", "sink": "http", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "unclassified", "sink": "metadata", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "unclassified", "sink": "dns", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "unclassified", "sink": "smtp", "verified": false, "canaries": [], "variants": [], "findingIds": [] }, { "destination": "unclassified", "sink": "netflow", "verified": false, "canaries": [], "variants": [], "findingIds": [] } ] ], "reachedDestinations": [], "activeSinks": [], "verifiedCellCount": 0 }, "_contextDisclaimer": "[SANDBOX — scores not comparable to production targets]. This scan was run against a target declared as sandboxed/non-production. Risk scores reflect schema-level analysis only and do not account for the absence of real execution capability in sandboxed environments." }