low Tool 'analyze_stock' has no annotations annotation_checker · 100%
low Tool 'optimize_portfolio' has no annotations annotation_checker · 100%
low Tool 'forecast_market_trends' has no annotations annotation_checker · 100%
low Tool 'analyze_economic_indicator' has no annotations annotation_checker · 100%
low Tool 'generate_investment_report' has no annotations annotation_checker · 100%
low Tool 'describeSqlSchema' has no annotations annotation_checker · 100%
low Tool 'executeSql' has no annotations annotation_checker · 100%
low Tool 'whoami' has no annotations annotation_checker · 100%
low Tool 'f' has no annotations annotation_checker · 100%
low Tool 'x' has no annotations annotation_checker · 100%
low Tool 'anything' has no annotations annotation_checker · 100%
low Tool 'list-readmes' has no annotations annotation_checker · 100%
low Tool 'get-readme' has no annotations annotation_checker · 100%
high Hardcoded OAuth client secret in Arize-ai-phoenix-4535030/tests/unit/server/api/mutations/test_generative_model_custom_provider_mutations.py auth_checker · 95%
high Hardcoded OAuth client ID in Arize-ai-phoenix-4535030/tests/unit/server/api/routers/test_oauth2.py auth_checker · 85%
high Hardcoded OAuth client secret in Arize-ai-phoenix-4535030/tests/unit/server/api/routers/test_oauth2.py auth_checker · 95%
high Hardcoded OAuth client ID in Arize-ai-phoenix-4535030/js/app/tests/oauth2-consent.spec.ts auth_checker · 85%
info Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium Excessive dependency count: 452 direct dependencies dependency_analyzer · 90%
medium Suspicious package name: react-aria dependency_analyzer · 60%
medium Suspicious package name: react-dom dependency_analyzer · 60%
medium Suspicious package name: react-relay dependency_analyzer · 60%
medium Suspicious package name: react-resizable dependency_analyzer · 60%
medium Suspicious package name: react-router dependency_analyzer · 60%
medium Suspicious package name: react-stately dependency_analyzer · 60%
medium Vulnerable dependency: @hono/node-server@2.0.8 (GHSA-9mqv-5hh9-4cgg) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-54fx-42gc-7vw4) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-79qm-7rj5-m7r9) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-8j4g-w8fx-2239) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-crvj-82cr-hjcx) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-f23p-vx2j-j53r) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-g6gw-c38x-mqfc) dependency_analyzer · 95%
medium Vulnerable dependency: hono@4.12.29 (GHSA-gqvv-2mrq-wpjv) dependency_analyzer · 95%
medium Vulnerable dependency: postcss@8.5.16 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium Vulnerable dependency: postcss@8.5.16 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
medium Vulnerable dependency: fastify@5.10.0 (GHSA-3m5p-2c4r-xxw2) dependency_analyzer · 95%
medium Vulnerable dependency: fastify@5.10.0 (GHSA-w2qp-rph6-63g4) dependency_analyzer · 95%
medium Vulnerable dependency: datasets@2.0 (PYSEC-2026-3716) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@0.2 (GHSA-g48c-2wqr-h844) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@0.2 (PYSEC-2026-2194) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@0.2 (PYSEC-2026-83) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@0.3 (GHSA-r7w7-9xr2-qq2r) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@0.3 (PYSEC-2026-76) dependency_analyzer · 95%
medium Vulnerable dependency: gradio@6.15.1 (PYSEC-2026-2179) dependency_analyzer · 95%
medium Vulnerable dependency: langchain@1.0.0 (GHSA-gr75-jv2w-4656) dependency_analyzer · 95%
medium Vulnerable dependency: langchain@1.0.0 (PYSEC-2026-2192) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@1.0.0 (GHSA-r7w7-9xr2-qq2r) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-openai@1.0.0 (PYSEC-2026-76) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@1.0.0 (GHSA-g48c-2wqr-h844) dependency_analyzer · 95%
medium Vulnerable dependency: langgraph@1.0.0 (PYSEC-2026-83) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-2g6r-c272-w58r) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-6qv9-48xg-fc7f) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-926x-3r5x-gfhw) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-c67j-w6g6-q2cm) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-pjwx-r37v-7724) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (GHSA-qh6h-p6c9-ff54) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-1518) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2193) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2562) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2563) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-2564) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-core@1.0.0 (PYSEC-2026-373) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-text-splitters@1.0.0 (GHSA-fv5p-p927-qmxr) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-text-splitters@1.0.0 (PYSEC-2026-77) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-anthropic@1.0.0 (GHSA-gr75-jv2w-4656) dependency_analyzer · 95%
medium Vulnerable dependency: langchain-anthropic@1.0.0 (PYSEC-2026-2556) dependency_analyzer · 95%
medium Vulnerable dependency: pandas@1.0 (PYSEC-2020-73) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-2c2j-9gv5-cj73) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-82w8-qh3p-5jfq) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-86qp-5c8j-p5mr) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-f96h-pmfr-66vw) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-jp82-jpqv-5vv3) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-wqp7-x3pw-xc5r) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (GHSA-x746-7m8f-x49c) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-161) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-1941) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-1943) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-2280) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-2281) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-248) dependency_analyzer · 95%
medium Vulnerable dependency: starlette@0.37.0 (PYSEC-2026-249) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.1.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.1.0 (PYSEC-2026-1812) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.0.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium Vulnerable dependency: pydantic@2.0.0 (PYSEC-2026-1812) dependency_analyzer · 95%
medium Hex string literal (>50 chars) in Arize-ai-phoenix-4535030/js/app/tests/dataset-examples-overflow.spec.ts:11 entropy_analyzer · 70%
medium High-entropy string (5.98 bits/char) in Arize-ai-phoenix-4535030/js/app/stories/constants/spanInfoFixtures.ts:1231 entropy_analyzer · 54%
medium High-entropy string (5.99 bits/char) in Arize-ai-phoenix-4535030/js/app/stories/constants/spanInfoFixtures.ts:1268 entropy_analyzer · 54%
medium Buffer.from base64 in Arize-ai-phoenix-4535030/js/packages/phoenix-mcp/src/identifiers.ts:17 entropy_analyzer · 75%
medium Hex string literal (>50 chars) in Arize-ai-phoenix-4535030/src/phoenix/server/sandbox/_download.py:30 entropy_analyzer · 70%
medium Buffer.from base64 in Arize-ai-phoenix-4535030/scripts/docker/devops/oidc-server/src/oidc/server.ts:744 entropy_analyzer · 75%
medium Buffer.from base64 in Arize-ai-phoenix-4535030/scripts/docker/devops/oidc-server/src/oidc/server.ts:1637 entropy_analyzer · 75%
medium High-entropy string (5.95 bits/char) in Arize-ai-phoenix-4535030/tests/integration/_mock_llm_server.py:311 entropy_analyzer · 54%
medium High-entropy string (5.95 bits/char) in Arize-ai-phoenix-4535030/tests/integration/_mock_llm_server.py:317 entropy_analyzer · 54%
medium High-entropy string (6.04 bits/char) in Arize-ai-phoenix-4535030/tests/unit/server/test_oauth2_authorization_server.py:29 entropy_analyzer · 55%
medium High-entropy string (6.04 bits/char) in Arize-ai-phoenix-4535030/tests/unit/server/test_oauth2_authorization_server.py:42 entropy_analyzer · 55%
info package.json metadata manifest_parser · 100%
info pyproject.toml metadata manifest_parser · 100%
info Tool: analyze_stock manifest_parser · 90%
info Tool: optimize_portfolio manifest_parser · 90%
info Tool: forecast_market_trends manifest_parser · 90%
info Tool: analyze_economic_indicator manifest_parser · 90%
info Tool: generate_investment_report manifest_parser · 90%
info Tool: describeSqlSchema manifest_parser · 90%
info Tool: executeSql manifest_parser · 90%
info Tool: whoami manifest_parser · 90%
info Tool: f manifest_parser · 90%
info Tool: x manifest_parser · 90%
info Tool: anything manifest_parser · 90%
info Tool: list-readmes manifest_parser · 70%
info Tool: get-readme manifest_parser · 70%
info Transport: streamable-http manifest_parser · 80%
info Required env vars (184) manifest_parser · 80%
medium Hardcoded OAuth client ID in Arize-ai-phoenix-4535030/tests/unit/server/api/routers/test_oauth2.py oauth_scope_analyzer · 80%
high Deprecated implicit grant flow in Arize-ai-phoenix-4535030/tests/integration/auth/test_oauth2.py oauth_scope_analyzer · 85%
medium Hardcoded OAuth client ID in Arize-ai-phoenix-4535030/js/app/tests/oauth2-consent.spec.ts oauth_scope_analyzer · 80%
info Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium Permission: network access detected permission_analyzer · 90%
low Permission: filesystem access detected permission_analyzer · 90%
high Permission: shell access detected permission_analyzer · 95%
medium Permission: database access detected permission_analyzer · 90%
low Permission: env_vars access detected permission_analyzer · 90%
info SBOM generated: 427 components sbom_generator · 100%
critical Database URL with Password found in Arize-ai-phoenix-4535030/docker-compose.yml secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-4535030/helm/README.md secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-4535030/helm/values.yaml secret_scanner · 85%
high Hardcoded Password found in Arize-ai-phoenix-4535030/helm/values.yaml secret_scanner · 65%
critical Database URL with Password found in Arize-ai-phoenix-4535030/helm/templates/_helpers.tpl secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-4535030/docs/phoenix/self-hosting/configuration.mdx secret_scanner · 85%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/docs/phoenix/evaluation/how-to-evals/configuring-the-llm.mdx secret_scanner · 75%
high Hardcoded Password found in Arize-ai-phoenix-4535030/docs/phoenix/self-hosting/features/email.mdx secret_scanner · 65%
high Hardcoded Password found in Arize-ai-phoenix-4535030/docs/phoenix/self-hosting/features/authentication.mdx secret_scanner · 65%
critical Database URL with Password found in Arize-ai-phoenix-4535030/docs/phoenix/self-hosting/deployment-options/docker.mdx secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-4535030/docs/phoenix/self-hosting/advanced/encryption.mdx secret_scanner · 85%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/docs/phoenix/integrations/platforms/langflow/langflow-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/docs/phoenix/integrations/python/portkey/portkey-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/docs/phoenix/integrations/llm-providers/orcarouter/openai-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/docs/phoenix/integrations/llm-providers/openrouter/openai-tracing.mdx secret_scanner · 75%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/docs/phoenix/sdk-api-reference/openinference-sdk/openinference-java.mdx secret_scanner · 75%
high Authorization Bearer Token found in Arize-ai-phoenix-4535030/js/benchmarks/evals-benchmarks/src/tool_response_handling.eval.ts secret_scanner · 70%
critical Database URL with Password found in Arize-ai-phoenix-4535030/js/benchmarks/evals-benchmarks/src/tool_response_handling.eval.ts secret_scanner · 85%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/js/app/scripts/setup-remote-export.ts secret_scanner · 75%
high Hardcoded Password found in Arize-ai-phoenix-4535030/js/app/src/pages/settings/UserActionMenu.tsx secret_scanner · 65%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/js/packages/phoenix-otel/src/register.ts secret_scanner · 75%
critical AWS Access Key ID found in Arize-ai-phoenix-4535030/tutorials/tracing/autogen_tutorial.ipynb secret_scanner · 95%
high Hardcoded Password found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/python-sdk/git-operations.md secret_scanner · 65%
critical RSA Private Key found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/python-sdk/vpn-connections.md secret_scanner · 95%
high Hardcoded Password found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/ruby-sdk/git-operations.md secret_scanner · 65%
critical RSA Private Key found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/ruby-sdk/vpn-connections.md secret_scanner · 95%
high Hardcoded Password found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/ruby-sdk/git.md secret_scanner · 65%
critical RSA Private Key found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/typescript-sdk/vpn-connections.md secret_scanner · 95%
high Hardcoded Password found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/typescript-sdk/sandbox.md secret_scanner · 65%
critical RSA Private Key found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/java-sdk/vpn-connections.md secret_scanner · 95%
critical RSA Private Key found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/go-sdk/vpn-connections.md secret_scanner · 95%
high Hardcoded Password found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/python-sdk/async/git.md secret_scanner · 65%
high Hardcoded Password found in Arize-ai-phoenix-4535030/.agents/skills/daytona/references/python-sdk/sync/git.md secret_scanner · 65%
high Generic API Key Assignment found in Arize-ai-phoenix-4535030/src/phoenix/config.py secret_scanner · 75%
critical Database URL with Password found in Arize-ai-phoenix-4535030/src/phoenix/config.py secret_scanner · 85%
high Hardcoded Password found in Arize-ai-phoenix-4535030/src/phoenix/config.py secret_scanner · 65%
high Hardcoded Password found in Arize-ai-phoenix-4535030/scripts/docker/devops/ldap-grafana.toml secret_scanner · 65%
critical Database URL with Password found in Arize-ai-phoenix-4535030/scripts/docker/devops/docker-compose.yml secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-4535030/scripts/docker/devops/k8s/phoenix-oidc-sidecar-patch.yml secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-4535030/scripts/docker/devops/overrides/toxiproxy.yml secret_scanner · 85%
critical Database URL with Password found in Arize-ai-phoenix-4535030/kustomize/base/phoenix.yaml secret_scanner · 85%
high Hardcoded Password found in Arize-ai-phoenix-4535030/internal_docs/vignettes/sqlalchemy/polymorphic_user/users.py secret_scanner · 65%
medium No build provenance detected (SLSA L0) slsa_assessor · 90%