low Tool 'list_projects' has no annotations annotation_checker · 100%
low Tool 'list_deploys' has no annotations annotation_checker · 100%
low Tool 'get_deploy' has no annotations annotation_checker · 100%
low Tool 'get_deploy_logs' has no annotations annotation_checker · 100%
low Tool 'cancel_deploy' has no annotations annotation_checker · 100%
low Tool 'rollback' has no annotations annotation_checker · 100%
low Tool 'start_app' has no annotations annotation_checker · 100%
low Tool 'stop_app' has no annotations annotation_checker · 100%
medium Excessive dependency count: 57 direct dependencies dependency_analyzer · 90%
low Tool 'restart_app' has no annotations annotation_checker · 100%
low Tool 'delete_lane' has no annotations annotation_checker · 100%
low Tool 'get_app_config' has no annotations annotation_checker · 100%
low Tool 'set_app_config' has no annotations annotation_checker · 100%
low Tool 'list_secrets' has no annotations annotation_checker · 100%
low Tool 'add_secret' has no annotations annotation_checker · 100%
low Tool 'remove_secret' has no annotations annotation_checker · 100%
low Tool 'list_promotions' has no annotations annotation_checker · 100%
low Tool 'approve_promotion' has no annotations annotation_checker · 100%
low Tool 'list_users' has no annotations annotation_checker · 100%
low Tool 'get_audit_log' has no annotations annotation_checker · 100%
low Tool 'get_server_config' has no annotations annotation_checker · 100%
low Tool 'set_server_config' has no annotations annotation_checker · 100%
low Tool 'list_buildpack_plugins' has no annotations annotation_checker · 100%
low Tool 'remove_buildpack_plugin' has no annotations annotation_checker · 100%
low Tool 'get_version' has no annotations annotation_checker · 100%
low Tool 'create_signed_link' has no annotations annotation_checker · 100%
low Tool 'list_companions' has no annotations annotation_checker · 100%
low Tool 'restart_companion' has no annotations annotation_checker · 100%
medium OAuth implementation without PKCE auth_checker · 75%
info Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium Suspicious package name: react-dom dependency_analyzer · 60%
medium Vulnerable dependency: @modelcontextprotocol/sdk@1.10.2 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium Vulnerable dependency: @modelcontextprotocol/sdk@1.10.2 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium Vulnerable dependency: @modelcontextprotocol/sdk@1.10.2 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium Vulnerable dependency: vite@7.1.9 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium Vulnerable dependency: vite@7.1.9 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium Vulnerable dependency: vite@7.1.9 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium Vulnerable dependency: vite@7.1.9 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium Vulnerable dependency: vite@7.1.9 (GHSA-v2wj-q39q-566r) dependency_analyzer · 95%
medium Vulnerable dependency: vite@7.1.9 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-2pvr-wf23-7pc7) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-4g3v-8h47-v7g6) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-5ff5-9fcw-vg88) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-7pw4-f3q4-r2p2) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-8hv8-536x-4wqp) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-cq8c-xv66-36gw) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-f48w-9m4c-m7f5) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-fvmw-cj7j-j39q) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-g735-7g2w-hh3f) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-ggxq-hp9w-j794) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-hr2q-hp5q-x767) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-j687-52p2-xcff) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-jrpj-wcv7-9fh9) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-w2vj-39qv-7vh7) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-whqg-ppgf-wp8c) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-wrwg-2hg8-v723) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-x3h8-62x9-952g) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-xf8x-j4p2-f749) dependency_analyzer · 95%
medium Vulnerable dependency: astro@5.3.0 (GHSA-xr5h-phrj-8vxv) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-267c-6grr-h53f) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-26hh-7cqf-hhc6) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-36qx-fr4f-26g5) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-3g8h-86w9-wvmq) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-3x4c-7xq6-9pq8) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-4633-3j49-mh5q) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-492v-c6pp-mqqv) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-4c39-4ccg-62r3) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-68g3-v927-f742) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-6gpp-xcg3-4w24) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-89xv-2m56-2m9x) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-8h8q-6873-q5fj) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-955p-x3mx-jcvp) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-c4j6-fc7j-m34r) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-ffhc-5mcf-pf4q) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-ggv3-7p47-pfv8) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-gx5p-jg67-6x7h) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-h27x-g6w4-24gq) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-h64f-5h5j-jqjh) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-jcc7-9wpm-mj36) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-m99w-x7hq-7vfj) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-mg66-mrh9-m8jx) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-mq59-m269-xvcx) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-p9j2-gv94-2wf4) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-q4gf-8mx6-v5v3) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-q8wf-6r8g-63ch) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-vfv6-92ff-j949) dependency_analyzer · 95%
medium Vulnerable dependency: next@16.1.6 (GHSA-wfc6-r584-vfw7) dependency_analyzer · 95%
medium Vulnerable dependency: flask@3.1.0 (GHSA-4grg-w6v8-c28g) dependency_analyzer · 95%
medium Vulnerable dependency: flask@3.1.0 (GHSA-68rp-wp8r-4726) dependency_analyzer · 95%
medium Vulnerable dependency: flask@3.1.0 (PYSEC-2026-1377) dependency_analyzer · 95%
medium Vulnerable dependency: flask@3.1.0 (PYSEC-2026-2151) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/sys@0.33.0 (GO-2026-5024) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GHSA-44p7-9xx4-hf2g) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GHSA-q675-qj96-32m9) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-4815) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-4961) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-4962) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5031) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5032) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5061) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5062) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-5066) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/image@0.26.0 (GO-2026-6222) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/text@0.24.0 (GO-2026-5970) dependency_analyzer · 95%
medium Vulnerable dependency: github.com/klauspost/compress@1.17.6 (GO-2026-5841) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/sys@0.16.0 (GO-2026-5024) dependency_analyzer · 95%
medium Vulnerable dependency: golang.org/x/text@0.29.0 (GO-2026-5970) dependency_analyzer · 95%
info package.json metadata manifest_parser · 100%
info Tool: list_projects manifest_parser · 70%
info Tool: list_deploys manifest_parser · 70%
info Tool: get_deploy manifest_parser · 70%
info Tool: get_deploy_logs manifest_parser · 70%
info Tool: cancel_deploy manifest_parser · 70%
info Tool: rollback manifest_parser · 70%
info Tool: start_app manifest_parser · 70%
info Tool: stop_app manifest_parser · 70%
info Tool: restart_app manifest_parser · 70%
info Tool: delete_lane manifest_parser · 70%
info Tool: get_app_config manifest_parser · 70%
info Tool: set_app_config manifest_parser · 70%
info Tool: list_secrets manifest_parser · 70%
info Tool: add_secret manifest_parser · 70%
info Tool: remove_secret manifest_parser · 70%
info Tool: list_promotions manifest_parser · 70%
info Tool: approve_promotion manifest_parser · 70%
info Tool: list_users manifest_parser · 70%
info Tool: get_audit_log manifest_parser · 70%
info Tool: get_server_config manifest_parser · 70%
info Tool: set_server_config manifest_parser · 70%
info Tool: list_buildpack_plugins manifest_parser · 70%
info Tool: remove_buildpack_plugin manifest_parser · 70%
info Tool: get_version manifest_parser · 70%
info Tool: create_signed_link manifest_parser · 70%
info Tool: list_companions manifest_parser · 70%
info Tool: restart_companion manifest_parser · 70%
info Transport: stdio manifest_parser · 90%
info Required env vars (60) manifest_parser · 80%
info Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium Permission: network access detected permission_analyzer · 80%
low Permission: filesystem access detected permission_analyzer · 90%
high Permission: shell access detected permission_analyzer · 95%
low Permission: env_vars access detected permission_analyzer · 90%
info SBOM generated: 841 components sbom_generator · 100%
medium No build provenance detected (SLSA L0) slsa_assessor · 90%