{
 "server": "com.leap-labs/discovery-engine",
 "url": "https://disco.leap-labs.com/mcp",
 "verdict": "high-severity findings present",
 "current_tool_count": 14,
 "tools_ever_seen": 14,
 "drift_events": 14,
 "findings_by_severity": {
  "high": 14,
  "low": 1
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 14,
  "ran_at": "2026-10-23T00:17:43.435Z"
 },
 "current_tools": [
  "discovery_account",
  "discovery_add_payment_method",
  "discovery_analyze",
  "discovery_estimate",
  "discovery_get_results",
  "discovery_list_plans",
  "discovery_login",
  "discovery_login_verify",
  "discovery_purchase_credits",
  "discovery_signup",
  "discovery_signup_verify",
  "discovery_status",
  "discovery_subscribe",
  "discovery_upload"
 ],
 "drift": [
  {
   "tool": "discovery_list_plans",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_estimate",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_upload",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_analyze",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_status",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_get_results",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_account",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_signup",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_signup_verify",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_login",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_login_verify",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_add_payment_method",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_purchase_credits",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_subscribe",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T00:17:43.435Z"
  }
 ],
 "findings": [
  {
   "tool": "discovery_estimate",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ts. No authentication required — when an API key is supplied, also returns the caller's available credits.",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_estimate",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_analyze'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_upload",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "h file_content. Default: \"data.csv\". api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_upload",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_analyze'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_analyze",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "description",
   "evidence": ". Only applies to private runs — public runs always use LLMs. Default false. api_key: Disco API key (disco_...).",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_analyze",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "s used to create the account (email code, no password needed). Call discovery_upload first to upload your file, t",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_analyze",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_estimate'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_status",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "un ID returned by discovery_analyze. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_status",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_analyze'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_get_results",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "un ID returned by discovery_analyze. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_get_results",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_analyze'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_account",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "nning a private analysis. Args: api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_signup",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Create a Disco account and get an API key. Provide an email address to start the signup flow. If emai",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_signup",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_signup_verify'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_signup_verify",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "address used in discovery_signup. Returns an API key on success. Args: email: Email address used in the",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_signup_verify",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_signup'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_login",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Get a new API key for an existing Disco account. Sends a 6-digit verification",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_login",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_signup'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_login_verify",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Complete login and receive a new API key. Call this after discovery_login returns {\"status\": \"verifi",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_login_verify",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_login'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_add_payment_method",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ethod ID (pm_...) from Stripe's API. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_add_payment_method",
   "detector": "url_in_description",
   "severity": "low",
   "field": "description",
   "evidence": "https://api.stripe.com/v1/payment_methods",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_purchase_credits",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "credit packs to purchase. Default 1. api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_purchase_credits",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'discovery_add_payment_method'",
   "seen_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "tool": "discovery_subscribe",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "\"free_tier\", \"tier_1\", or \"tier_2\"). api_key: Disco API key (disco_...). Optional if DISCOVERY_API_KEY env va",
   "seen_at": "2026-10-23T00:17:43.435Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 14,
   "ran_at": "2026-10-23T00:17:43.435Z"
  },
  {
   "status": "OK",
   "n_tools": 14,
   "ran_at": "2026-08-13T18:17:15.851Z"
  }
 ]
}