{
 "server": "app.zooza/mcp-server",
 "url": "https://mcp.zooza.app/mcp",
 "verdict": "CRITICAL findings present",
 "current_tool_count": 18,
 "tools_ever_seen": 38,
 "drift_events": 38,
 "findings_by_severity": {
  "low": 3,
  "high": 12,
  "critical": 4
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 18,
  "ran_at": "2026-10-22T18:17:43.445Z"
 },
 "current_tools": [
  "bookings_copy_booking",
  "bookings_find",
  "call_tool",
  "classes_find_classes",
  "classes_find_courses",
  "classes_find_resource",
  "classes_update",
  "comms_send_message",
  "get_skill",
  "get_terminology",
  "get_tool_schema",
  "reports_get_data",
  "sessions_cancel",
  "sessions_find_events",
  "sessions_get_attendance",
  "sessions_mark_attendance",
  "sessions_update",
  "whoami"
 ],
 "drift": [
  {
   "tool": "get_terminology",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "whoami",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_courses",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_resource",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_classes",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "bookings_find",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_find_events",
   "kind": "mutated",
   "severity": "critical",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_get_attendance",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_mark_attendance",
   "kind": "mutated",
   "severity": "critical",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_update",
   "kind": "added",
   "severity": "critical",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_update",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_cancel",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "bookings_copy_booking",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_send_message",
   "kind": "added",
   "severity": "critical",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "reports_get_data",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "get_skill",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "get_tool_schema",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "call_tool",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "explain_data_model",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_list_merge_vars",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_list_schedule_patterns",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "negotiate_terminology",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_billing_periods",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "trainers_find_rate_types",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "trainers_find",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_places",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_add_summary",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_preview_schedule",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_preview_events",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_commit_class",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_prepare_update",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_commit_update",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_prepare_update",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_commit_update",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_list_templates",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_prepare_message",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_commit_message",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "submit_feedback",
   "kind": "removed",
   "severity": "info",
   "detected_at": "2026-10-22T18:17:43.445Z"
  }
 ],
 "findings": [
  {
   "tool": "whoami",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'sessions_find_events'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "whoami",
   "detector": "oversized_description",
   "severity": "low",
   "field": "description",
   "evidence": "4088 chars",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_courses",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_resource",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "description",
   "evidence": "lace_id, course_id. **Virtual trainers** are always included regardless of place/course filters — they are system-wide place",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_resource",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_courses'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_classes",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_classes",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_courses'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_find_classes",
   "detector": "oversized_description",
   "severity": "low",
   "field": "description",
   "evidence": "4060 chars",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "bookings_find",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "bookings_find",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_courses'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_find_events",
   "detector": "user_concealment",
   "severity": "critical",
   "field": "description",
   "evidence": "is `member` or `external_member`, the server silently auto-scopes to their assignments anyway; `meta.scoped_to` in the",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_find_events",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "description",
   "evidence": "EIR OWN sessions (any first-person framing), you MUST pass `trainer_id` matching `whoami.identity.user_id`. Without it",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_find_events",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_courses'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_find_events",
   "detector": "oversized_description",
   "severity": "low",
   "field": "description",
   "evidence": "4873 chars",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_get_attendance",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_get_attendance",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'sessions_find_events'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_mark_attendance",
   "detector": "user_concealment",
   "severity": "critical",
   "field": "description",
   "evidence": "tendance_management=\"limited\"`. - `ignore` — hide this event from the attendee's history (Zooza-specific; rare). `use_",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_mark_attendance",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_mark_attendance",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'sessions_find_events'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_update",
   "detector": "user_concealment",
   "severity": "critical",
   "field": "description",
   "evidence": "ir consequences and let them choose — do NOT silently pick a scope, and do NOT stall. If the operator asks what a casc",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_update",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "classes_update",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_resource'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_update",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_update",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_resource'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_cancel",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "sessions_cancel",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_resource'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "bookings_copy_booking",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "bookings_copy_booking",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_classes'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_send_message",
   "detector": "exfiltration_pattern",
   "severity": "critical",
   "field": "inputSchema.properties.bcc.description",
   "evidence": "Comma-separated BCC addresses.",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_send_message",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.company_id.description",
   "evidence": "an omit this field. With multiple companies, you MUST specify which; get the id list from `whoami.available_companies[",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "comms_send_message",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_find_courses'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "reports_get_data",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_skill'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "get_tool_schema",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'call_tool'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "tool": "call_tool",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'classes_update'",
   "seen_at": "2026-10-22T18:17:43.445Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 18,
   "ran_at": "2026-10-22T18:17:43.445Z"
  },
  {
   "status": "OK",
   "n_tools": 30,
   "ran_at": "2026-08-13T06:17:15.836Z"
  }
 ]
}