{
 "server": "ai.vaaya/mcp",
 "url": "https://vaaya.ai/mcp",
 "verdict": "high-severity findings present",
 "current_tool_count": 14,
 "tools_ever_seen": 14,
 "drift_events": 14,
 "findings_by_severity": {
  "high": 4,
  "low": 1
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 14,
  "ran_at": "2026-10-22T12:17:43.718Z"
 },
 "current_tools": [
  "buy",
  "close",
  "consult",
  "docs",
  "jobs",
  "llm",
  "result",
  "session",
  "stocks",
  "use",
  "vaaya_account",
  "vaaya_logout",
  "vaaya_onboard",
  "vaaya_test_connection"
 ],
 "drift": [
  {
   "tool": "stocks",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "jobs",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "vaaya_test_connection",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "vaaya_onboard",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "vaaya_account",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "vaaya_logout",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "docs",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "consult",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "use",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "result",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "buy",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "session",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "close",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "llm",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T12:17:43.718Z"
  }
 ],
 "findings": [
  {
   "tool": "vaaya_onboard",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'vaaya_test_connection'",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "use",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ies to the upstream — you never pass URLs or API keys. Call it directly when you know the exact (service, action, par",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "use",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'consult'",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "result",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "description",
   "evidence": "it never starts new work or double-charges. ALWAYS use this to retrieve an async result instead of re-running `use` (re",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "buy",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "se store_connection_id to select an account. Passwords and verification codes belong only on the merchant page, never",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "buy",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'session'",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "buy",
   "detector": "oversized_description",
   "severity": "low",
   "field": "description",
   "evidence": "4408 chars",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "close",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "description",
   "evidence": "l metered uptime cost and releases the hold. ALWAYS call this when finished with a session — an open session keeps billin",
   "seen_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "tool": "close",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'session'",
   "seen_at": "2026-10-22T12:17:43.718Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 14,
   "ran_at": "2026-10-22T12:17:43.718Z"
  },
  {
   "status": "OK",
   "n_tools": 10,
   "ran_at": "2026-08-13T06:17:15.836Z"
  }
 ]
}