| { |
| "candidate_rules": [ |
| "LF-MCP-AUTH-ABSENT", |
| "LF-MCP-AUTH-METADATA-MISSING", |
| "LF-MCP-TOKEN-AUDIENCE-UNBOUND", |
| "LF-MCP-ORIGIN-UNRESTRICTED" |
| ], |
| "corpus_id": "LF-CORPUS-MCP-0001", |
| "description": "Static MCP configuration combining plaintext transport, URL credentials, fake env credentials, overbroad scopes, unpinned npx, auto-confirm and contradictory tool annotation.", |
| "expected_rules": [ |
| "LF-MCP-TLS-ABSENT", |
| "LF-MCP-CREDENTIAL-IN-URL", |
| "LF-MCP-CREDENTIAL-ENV-EXPOSURE", |
| "LF-MCP-SCOPE-OVERBROAD", |
| "LF-MCP-SUPPLY-CHAIN-AUTO-DOWNLOAD", |
| "LF-MCP-SUPPLY-CHAIN-AUTO-CONFIRM", |
| "LF-MCP-CONTRADICTORY-ANNOTATION", |
| "LF-MCP-TOKEN-PASSTHROUGH-RISK" |
| ], |
| "generator": "mcp.mcp_static_suite", |
| "ground_truth": "synthetic-generated", |
| "must_not_rules": [], |
| "repo_name": "mcp-static-security-suite", |
| "repo_type": "model", |
| "safety": "inert/canary-only", |
| "schema": 1, |
| "validation": { |
| "kind": "agent inspect", |
| "target": "mcp.json" |
| } |
| } |
|
|
