{
 "server": "ai.chronary/mcp",
 "url": "https://api.chronary.ai/mcp",
 "verdict": "CRITICAL findings present",
 "current_tool_count": 54,
 "tools_ever_seen": 54,
 "drift_events": 54,
 "findings_by_severity": {
  "high": 23,
  "critical": 1
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 54,
  "ran_at": "2026-10-22T12:17:43.718Z"
 },
 "current_tools": [
  "accept_terms",
  "cancel_connection_link",
  "cancel_event",
  "cancel_proposal",
  "clear_availability_rules",
  "confirm_event",
  "create_agent",
  "create_booking_page",
  "create_calendar",
  "create_connection_link",
  "create_event",
  "create_proposal",
  "create_scoped_key",
  "create_webhook",
  "delete_agent",
  "delete_booking_page",
  "delete_calendar",
  "delete_ical_subscription",
  "delete_webhook",
  "find_meeting_time",
  "get_agent",
  "get_audit_log",
  "get_availability",
  "get_availability_rules",
  "get_booking_page",
  "get_calendar",
  "get_calendar_context",
  "get_connection_link",
  "get_event",
  "get_ical_subscription",
  "get_proposal",
  "get_usage",
  "get_webhook",
  "list_agents",
  "list_booking_pages",
  "list_calendars",
  "list_events",
  "list_ical_subscriptions",
  "list_proposals",
  "list_scoped_keys",
  "list_webhook_deliveries",
  "list_webhooks",
  "release_event",
  "resolve_proposal",
  "respond_to_proposal",
  "revoke_scoped_key",
  "set_availability_rules",
  "subscribe_ical",
  "sync_ical_subscription",
  "update_agent",
  "update_calendar",
  "update_event",
  "update_ical_subscription",
  "update_webhook"
 ],
 "drift": [
  {
   "tool": "create_agent",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_agents",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_calendar",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_event",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_events",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_event",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_event",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_availability",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "find_meeting_time",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "cancel_event",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "confirm_event",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "release_event",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "subscribe_ical",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_ical_subscriptions",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_ical_subscription",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_ical_subscription",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "delete_ical_subscription",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "sync_ical_subscription",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_calendar_context",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_proposal",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_proposals",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_proposal",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "respond_to_proposal",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "resolve_proposal",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "cancel_proposal",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "set_availability_rules",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_availability_rules",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "clear_availability_rules",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_scoped_key",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_scoped_keys",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "revoke_scoped_key",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_webhook",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_webhooks",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_webhook",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_webhook",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "delete_webhook",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_webhook_deliveries",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_agent",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_agent",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "delete_agent",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_calendars",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_calendar",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_calendar",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "delete_calendar",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_booking_page",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_booking_pages",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_booking_page",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "delete_booking_page",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_usage",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_audit_log",
   "kind": "mutated",
   "severity": "critical",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "accept_terms",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_connection_link",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_connection_link",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "cancel_connection_link",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T06:17:44.240Z"
  }
 ],
 "findings": [
  {
   "tool": "create_event",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'create_calendar'",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_event",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'confirm_event'",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "cancel_event",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'confirm_event'",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_calendar_context",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'list_events'",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_proposal",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ncels if all decline). Requires an org-level API key. Pro plan only.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_proposals",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "or organizer_agent_id. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_proposal",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "participant responses. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "respond_to_proposal",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ed in the normal flow. Requires an org-level API key. Pro plan only.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "resolve_proposal",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "for every participant. Requires an org-level API key. Pro plan only.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "cancel_proposal",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "\"organizer_cancelled\". Requires an org-level API key. Pro plan only.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_availability_rules",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_availability'",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_scoped_key",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Create an agent-scoped API key (chr_ak_*) that can only act on behalf of a single agent. Use th",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_scoped_keys",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "List all live (non-revoked) agent-scoped API keys for this org. Returns key metadata only (id, prefix, agent_id,",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "revoke_scoped_key",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Revoke an agent-scoped API key by ID. Revocation is permanent (cannot be un-revoked); the key s",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_webhook",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "on delivered payloads. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_webhooks",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ts are never returned. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_webhook",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ret is never returned. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_webhook",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ield must be supplied. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "delete_webhook",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "inst the per-plan cap. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_webhook_deliveries",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ug failing deliveries. Requires an org-level API key.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_agent",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "resource (e.g. a meeting room). Agent-scoped API keys may only read their own agent.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "update_agent",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "tatus (active/paused). Requires an org-level API key — agent-scoped keys cannot mutate agents.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "delete_agent",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "decommissioned and revokes all of its scoped API keys. Requires an org-level API key — agent-scoped keys cannot delet",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "list_calendars",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "List calendars in the org. Org-level API keys see every calendar (agent-owned and shared); agent-scoped keys",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_booking_page",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'create_calendar'",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_usage",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "oss-calendar queries). Requires an org-level API key (chr_sk_*); agent-scoped keys cannot read org-wide usage.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_audit_log",
   "detector": "user_concealment",
   "severity": "critical",
   "field": "inputSchema.properties.from.description",
   "evidence": "Start of the window (ISO 8601). Silently clamped to the plan retention window if older.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "get_audit_log",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "an's retention window. Requires an org-level API key (chr_sk_*); agent-scoped keys cannot read the org-wide audit log",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "accept_terms",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "1/auth/terms/current). Requires an org-level API key (chr_sk_*); agent-scoped keys cannot accept org-wide terms.",
   "seen_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "tool": "create_connection_link",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "l to a human; the agent never receives OAuth credentials, provider calendar names, or event data. The secret URL is retu",
   "seen_at": "2026-10-22T06:17:44.240Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 54,
   "ran_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "status": "OK",
   "n_tools": 54,
   "ran_at": "2026-10-22T06:17:44.240Z"
  },
  {
   "status": "OK",
   "n_tools": 54,
   "ran_at": "2026-08-13T06:17:15.836Z"
  }
 ]
}