{
 "server": "com.timzinin.api/us-brand-intelligence",
 "url": "https://api.timzinin.com/mcp/us-brand-intelligence",
 "verdict": "high-severity findings present",
 "current_tool_count": 21,
 "tools_ever_seen": 21,
 "drift_events": 21,
 "findings_by_severity": {
  "high": 6,
  "low": 6
 },
 "last_probe": {
  "status": "OK",
  "n_tools": 21,
  "ran_at": "2026-10-23T06:17:43.230Z"
 },
 "current_tools": [
  "pricing_info",
  "us-brand-action-queue",
  "us-brand-evidence-chronology-builder",
  "us-brand-evidence-citation-table",
  "us-brand-evidence-snapshot-diff",
  "us-brand-federal-award-snapshot",
  "us-brand-offer-evidence-normalizer",
  "us-brand-signal-batch-splitter",
  "us-brand-signal-brand-summary",
  "us-brand-signal-brief-composer",
  "us-brand-signal-confidence-gate",
  "us-brand-signal-cooccurrence-analyzer",
  "us-brand-signal-crm-field-mapper",
  "us-brand-signal-cross-tabulator",
  "us-brand-signal-merge-report",
  "us-brand-signal-metrics-aggregator",
  "us-brand-signal-policy-simulator",
  "us-brand-signal-rule-router",
  "us-brand-signal-sequence-transition-analyzer",
  "us-brand-signal-sla-checker",
  "us-brand-signal-webhook-payload-builder"
 ],
 "drift": [
  {
   "tool": "pricing_info",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-action-queue",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-evidence-chronology-builder",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-evidence-citation-table",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-evidence-snapshot-diff",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-federal-award-snapshot",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-offer-evidence-normalizer",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-batch-splitter",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-brand-summary",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-brief-composer",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-confidence-gate",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-cooccurrence-analyzer",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-crm-field-mapper",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-cross-tabulator",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-merge-report",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-metrics-aggregator",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-policy-simulator",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-rule-router",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-sequence-transition-analyzer",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-sla-checker",
   "kind": "mutated",
   "severity": "medium",
   "detected_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-webhook-payload-builder",
   "kind": "mutated",
   "severity": "high",
   "detected_at": "2026-10-23T06:17:43.230Z"
  }
 ],
 "findings": [
  {
   "tool": "us-brand-evidence-chronology-builder",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "inputSchema.properties.rows.items.properties.sourceUrl.description",
   "evidence": "itted HTTPS URL with a non-empty host and no credentials; the Actor does not fetch or verify it.",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-evidence-chronology-builder",
   "detector": "url_in_description",
   "severity": "low",
   "field": "inputSchema.properties.rows.items.properties.sourceUrl.pattern",
   "evidence": "https://[A-Za-z0-9",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-evidence-citation-table",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "inputSchema.properties.rows.description",
   "evidence": "trict UTC; source URLs must be HTTPS without credentials or fragments.",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-evidence-citation-table",
   "detector": "url_in_description",
   "severity": "low",
   "field": "inputSchema.properties.rows.items.properties.sourceUrl.pattern",
   "evidence": "https://[^\\s#",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-evidence-snapshot-diff",
   "detector": "url_in_description",
   "severity": "low",
   "field": "inputSchema.properties.primary.items.properties.sourceUrl.pattern",
   "evidence": "https://(?=[A-Za-z0-9",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-federal-award-snapshot",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "overnment-intelligence agents; no buyer URL, API key, browser, or LLM. — $0.05/call, x402 (USDC on base).",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-brand-summary",
   "detector": "url_in_description",
   "severity": "low",
   "field": "inputSchema.properties.rows.items.properties.sourceUrl.pattern",
   "evidence": "https://[\\x20-\\x7E",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-crm-field-mapper",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "description",
   "evidence": "ile preserving evidence IDs and URLs. No CRM credentials, network calls, proxy, LLM, identity resolution, or arbitrary e",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-crm-field-mapper",
   "detector": "url_in_description",
   "severity": "low",
   "field": "inputSchema.properties.rows.items.properties.sourceUrl.pattern",
   "evidence": "https://[^\\s#",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-merge-report",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "inputSchema.properties.left.items.properties.sourceUrl.description",
   "evidence": "pplied HTTPS provenance URL; runtime rejects credentials, fragments, bracketed hosts, and non-default ports; never fetch",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-merge-report",
   "detector": "url_in_description",
   "severity": "low",
   "field": "inputSchema.properties.left.items.properties.sourceUrl.pattern",
   "evidence": "https://(?![^/?#",
   "seen_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "tool": "us-brand-signal-webhook-payload-builder",
   "detector": "secret_material_reference",
   "severity": "high",
   "field": "inputSchema.properties.signal.properties.evidence.items.properties.url.description",
   "evidence": "HTTPS attribution URL without credentials or a non-default port.",
   "seen_at": "2026-10-23T06:17:43.230Z"
  }
 ],
 "probes": [
  {
   "status": "OK",
   "n_tools": 21,
   "ran_at": "2026-10-23T06:17:43.230Z"
  },
  {
   "status": "OK",
   "n_tools": 21,
   "ran_at": "2026-08-14T00:17:15.846Z"
  }
 ]
}