{
 "server": "com.pinappai/mcp",
 "url": "https://mcp.pinappai.com/mcp",
 "verdict": "high-severity findings present",
 "current_tool_count": 38,
 "tools_ever_seen": 38,
 "drift_events": 24,
 "findings_by_severity": {
  "high": 24
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 38,
  "ran_at": "2026-08-14T00:17:15.846Z"
 },
 "current_tools": [
  "analyze_patterns",
  "archive_project",
  "create_project",
  "create_workspace",
  "delete_workspace",
  "export_my_data",
  "get_api_key",
  "get_change_request",
  "get_me",
  "get_project",
  "get_review_summary",
  "get_screenshot",
  "get_workspace",
  "invite_member",
  "invite_reviewer",
  "list_api_keys",
  "list_audit_events",
  "list_change_requests",
  "list_members",
  "list_projects",
  "list_reviewers",
  "list_workspaces",
  "pinappai_apply_change_requests",
  "pinappai_get_iteration_coverage",
  "pinappai_get_workflow",
  "pinappai_list_apply_inbox",
  "pinappai_list_iterations",
  "pinappai_register_change_items",
  "pinappai_reset_review_data",
  "remove_member",
  "restore_api_key",
  "revoke_api_key",
  "revoke_reviewer",
  "unarchive_project",
  "update_me_profile",
  "update_member_role",
  "update_project",
  "update_workspace"
 ],
 "drift": [
  {
   "tool": "list_projects",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_review_summary",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_change_requests",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_change_request",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "analyze_patterns",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_screenshot",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_project",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "create_project",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "update_project",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "archive_project",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "unarchive_project",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_workspaces",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "create_workspace",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_workspace",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "update_workspace",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "delete_workspace",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_members",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "invite_member",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "update_member_role",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "remove_member",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_reviewers",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "invite_reviewer",
   "kind": "added",
   "severity": "info",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "revoke_reviewer",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_audit_events",
   "kind": "added",
   "severity": "high",
   "detected_at": "2026-08-14T00:17:15.846Z"
  }
 ],
 "findings": [
  {
   "tool": "list_projects",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "List PinAppAI projects this API key can access. Returns one entry per project in the key's workspace",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_change_requests",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_change_request'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_change_request",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'list_change_requests'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "analyze_patterns",
   "detector": "model_directed_instruction",
   "severity": "high",
   "field": "inputSchema.properties.ai_model_preference.description",
   "evidence": "t's createMessage call (the sampling request always uses a fixed speed/intelligence preference); reserved for future use",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_screenshot",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'get_change_request'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_project",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ns, archive state, and the embeddable widget api_key. Scoped to the API key's workspace.",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "create_project",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Create a new PinAppAI project inside the API key's workspace. Returns the project plus its widget api_key for emb",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "update_project",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "inputSchema.properties.slug.description",
   "evidence": "t snippets keep working since they reference api_key, not slug).",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "archive_project",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'unarchive_project'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "unarchive_project",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'archive_project'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_workspaces",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "List all workspaces the API key's user is a member of, with role per workspace. The api-key rema",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "create_workspace",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Create a new workspace owned by the API key's user. Free/Pro plans cap at 1 workspace; Team/Business unlimit",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "get_workspace",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Get the API key's workspace details (slug, name, plan, tier) plus the user's rol",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "update_workspace",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Rename or re-slug the API key's workspace. Owner role required. Slug changes break existing da",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "delete_workspace",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Schedule the API key's workspace for permanent deletion (7-day grace window). Reversi",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_members",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "List members of the API key's workspace with their roles, sorted owner → admin → editor → vi",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_members",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'update_member_role'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "invite_member",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Invite a user to the API key's workspace as admin / editor / viewer (default editor). Admin r",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "update_member_role",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'list_members'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "remove_member",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Remove a member from the API key's workspace. Self-removal works for any role; cross-removal requ",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "remove_member",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'list_members'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_reviewers",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'invite_reviewer'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "revoke_reviewer",
   "detector": "cross_tool_reference",
   "severity": "high",
   "field": "description",
   "evidence": "references sibling tool 'list_reviewers'",
   "seen_at": "2026-08-14T00:17:15.846Z"
  },
  {
   "tool": "list_audit_events",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "Read audit log entries for the API key's workspace. Owner role + Business tier required. Returns newest",
   "seen_at": "2026-08-14T00:17:15.846Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 38,
   "ran_at": "2026-08-14T00:17:15.846Z"
  }
 ]
}