{
  "report": {
    "version": "1.1",
    "server": {
      "slug": "modelcontextprotocol-server-everything-20260910032240-1bff92",
      "name": "@modelcontextprotocol/server-everything",
      "github_url": null,
      "scan_id": "0d011be5-d736-4391-a1ac-11f6c141492b"
    },
    "framework": {
      "id": "eu_ai_act",
      "name": "EU AI Act",
      "version": "2024/1689",
      "last_updated": "2026-04-23",
      "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    "assessment": {
      "assessed_at": "2026-09-10T03:22:40.202Z",
      "rules_version": "2026-04-23",
      "sentinel_version": "0.4.0",
      "coverage_band": "low",
      "coverage_ratio": 0.58,
      "techniques_run": [
        "ast-taint",
        "composite",
        "cross-module",
        "dependency-audit",
        "similarity",
        "structural",
        "stub"
      ],
      "rule_execution_available": true,
      "rules_executed": 107,
      "rules_skipped": 76
    },
    "controls": [
      {
        "control_id": "Art.9",
        "control_name": "Risk Management System",
        "control_description": "High-risk AI providers must establish, implement, and maintain a risk management system covering the entire lifecycle, including analysis of reasonably foreseeable misuse and supply-chain risk.",
        "source_url": "https://artificialintelligenceact.eu/article/9/",
        "status": "unmet",
        "evidence": [
          {
            "finding_id": "ef3ea7db-2b79-45f3-9e84-072f5e948dfd",
            "rule_id": "D1",
            "rule_name": "Known CVEs in Dependencies",
            "severity": "high",
            "evidence_summary": "SOURCE: external-content at npm:vitest@4.1.8 — Third-party package dependencies are external content resolved from public registries. A version with a published CVE ships the vulnerable code path as-i",
            "confidence": 0.78
          },
          {
            "finding_id": "2208fdb2-04e4-41bb-91ca-a79db3875719",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:cors@2.8.5 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date remains ",
            "confidence": 0.7
          },
          {
            "finding_id": "f8718f42-5981-4f9b-92b3-1fd3e6d0127d",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:jszip@3.10.1 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date remain",
            "confidence": 0.7
          },
          {
            "finding_id": "cdec920e-ce2d-4d01-8561-98d9d5b34a14",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:zod@4.0.0 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date remains p",
            "confidence": 0.7
          },
          {
            "finding_id": "8f381261-1338-4c72-8f5a-9b2d618369a0",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:@types/cors@2.8.19 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date ",
            "confidence": 0.7
          },
          {
            "finding_id": "39e1f19a-53c6-4b73-9b9e-b4f792e816eb",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:prettier@2.8.8 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date rema",
            "confidence": 0.7
          },
          {
            "finding_id": "9ca53a83-ef21-4bc0-84d8-db69ab2bdc1a",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:shx@0.4.0 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date remains p",
            "confidence": 0.7
          },
          {
            "finding_id": "0c358727-409f-44af-85a8-38c8fd5102ce",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:typescript@5.6.2 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date re",
            "confidence": 0.7
          }
        ],
        "rationale": "20/22 mapped assessor rule(s) are proven to have executed; 8 finding(s) observed (1 high, 7 medium); at least one finding is at or above the high threshold (status: unmet). 2 mapped assessor(s) did not execute, so this finding-backed result does not imply complete control coverage.",
        "required_mitigations": [
          "Update the flagged dependency to a version that resolves every listed CVE. Consult the NVD or OSV advisory linked in the finding for the minimum safe version. Re-run `npm audit` / `pip-audit` / `osv-scanner` after the bump to confirm no residual advisories remain. Where a patched version is not yet released, apply an override (npm `overrides`, `resolutions`, `pnpm.overrides`, or a Python constraints file) to pin a compatible fix, and file a tracking issue so the override is removed when the upstream fix lands.",
          "Replace the abandoned dependency with an actively maintained alternative. Where no alternative exists, vendor the minimal code the project uses and delete the dependency. If the package is internal/private and legitimately stable, mark it as such in a repository-local allowlist so the scanner can skip it on future runs. Track the abandonment risk in the project's SBOM per ISO 27001 A.8.8."
        ],
        "assessor_rule_ids": [
          "D1",
          "D2",
          "D3",
          "D4",
          "D5",
          "D6",
          "D7",
          "K9",
          "K10",
          "K11",
          "L1",
          "L2",
          "L3",
          "L5",
          "L6",
          "L7",
          "L8",
          "L10",
          "L12",
          "L13",
          "Q4",
          "Q13"
        ],
        "executed_assessor_rule_ids": [
          "D1",
          "D2",
          "D3",
          "D4",
          "D5",
          "D6",
          "D7",
          "K9",
          "K10",
          "K11",
          "L2",
          "L5",
          "L6",
          "L7",
          "L8",
          "L10",
          "L12",
          "L13",
          "Q4",
          "Q13"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "L1",
            "missing": [
              "source_files(ci-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "L3",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          }
        ]
      },
      {
        "control_id": "Art.12",
        "control_name": "Record-Keeping",
        "control_description": "High-risk AI systems must automatically record events ('logs') over the system lifetime to ensure traceability of the system's functioning appropriate for the intended purpose.",
        "source_url": "https://artificialintelligenceact.eu/article/12/",
        "status": "not_assessed",
        "evidence": [],
        "rationale": "4/5 mapped assessor rule(s) are proven to have executed; no adverse findings were observed, but the control is not assessed because execution evidence is incomplete. Unexecuted assessors: E3 (connection_metadata).",
        "required_mitigations": [],
        "assessor_rule_ids": [
          "K1",
          "K2",
          "K3",
          "K20",
          "E3"
        ],
        "executed_assessor_rule_ids": [
          "K1",
          "K2",
          "K3",
          "K20"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "E3",
            "missing": [
              "connection_metadata"
            ],
            "classification": "gap"
          }
        ]
      },
      {
        "control_id": "Art.13",
        "control_name": "Transparency & Provision of Information to Deployers",
        "control_description": "High-risk AI systems must be sufficiently transparent to enable deployers to interpret the system's output appropriately, including capabilities, limitations, and the conditions of intended use.",
        "source_url": "https://artificialintelligenceact.eu/article/13/",
        "status": "not_assessed",
        "evidence": [],
        "rationale": "4/14 mapped assessor rule(s) are proven to have executed; no adverse findings were observed, but the control is not assessed because execution evidence is incomplete. Unexecuted assessors: A2 (tools); A4 (tools); A6 (tools); A8 (tools); F2 (tools); G6 (scan_history); I1 (tool_attributes(annotations), tools); I2 (tool_attributes(annotations), tools); I5 (resource_templates, resources, tools); I16 (min_tools(10), tools).",
        "required_mitigations": [],
        "assessor_rule_ids": [
          "A2",
          "A4",
          "A6",
          "A8",
          "F2",
          "F5",
          "G6",
          "I1",
          "I2",
          "I5",
          "I16",
          "K12",
          "K13",
          "L15"
        ],
        "executed_assessor_rule_ids": [
          "F5",
          "K12",
          "K13",
          "L15"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "A2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A8",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G6",
            "missing": [
              "scan_history"
            ],
            "classification": "unknown"
          },
          {
            "rule_id": "I1",
            "missing": [
              "tool_attributes(annotations)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I2",
            "missing": [
              "tool_attributes(annotations)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I5",
            "missing": [
              "resource_templates",
              "resources",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I16",
            "missing": [
              "min_tools(10)",
              "tools"
            ],
            "classification": "gap"
          }
        ]
      },
      {
        "control_id": "Art.14",
        "control_name": "Human Oversight",
        "control_description": "High-risk AI systems must be designed so that they can be effectively overseen by natural persons during use. Covers the ability to fully understand, monitor, and intervene in the system's operation.",
        "source_url": "https://artificialintelligenceact.eu/article/14/",
        "status": "not_assessed",
        "evidence": [],
        "rationale": "5/13 mapped assessor rule(s) are proven to have executed; no adverse findings were observed, but the control is not assessed because execution evidence is incomplete. Unexecuted assessors: K4 (tools); I12 (declared_capabilities); M5 (tools); H3 (tools); F1 (tools); F6 (tools); K15 (min_tools(2), tools); Q10 (tools).",
        "required_mitigations": [],
        "assessor_rule_ids": [
          "K4",
          "K5",
          "I12",
          "M5",
          "M6",
          "Q15",
          "H3",
          "F1",
          "F6",
          "J1",
          "K14",
          "K15",
          "Q10"
        ],
        "executed_assessor_rule_ids": [
          "K5",
          "M6",
          "Q15",
          "J1",
          "K14"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "K4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I12",
            "missing": [
              "declared_capabilities"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "M5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "H3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "K15",
            "missing": [
              "min_tools(2)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "Q10",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          }
        ]
      },
      {
        "control_id": "Art.15",
        "control_name": "Accuracy, Robustness, and Cybersecurity",
        "control_description": "High-risk AI systems must achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle. Covers resilience against errors, faults, and adversarial manipulation.",
        "source_url": "https://artificialintelligenceact.eu/article/15/",
        "status": "not_assessed",
        "evidence": [],
        "rationale": "66/111 mapped assessor rule(s) are proven to have executed; no adverse findings were observed, but the control is not assessed because execution evidence is incomplete. Unexecuted assessors: A1 (tools); A3 (tools); A5 (tools); A7 (tools); A9 (tools); B1 (tools); B2 (tools); B3 (tools); B4 (tools); B5 (tools); B6 (tools); B7 (tools); E1 (connection_metadata); E2 (connection_metadata); E4 (min_tools(51), tools); F3 (tools); F4 (tools); F7 (min_tools(2), tools); G1 (tools); G2 (tools); G3 (tools); G4 (tools); G5 (tools); H2 (initialize_metadata); I3 (resource_templates, resources); I4 (resource_templates, resources); I6 (prompts); I7 (tools); I9 (tools); I10 (tools); I11 (roots); I13 (multi_server_tools, tools); J3 (tools); J6 (tools); K19 (source_files(container-config)); M1 (tools); M4 (tools); P1 (source_files(container-config)); P2 (source_files(container-config)); P5 (source_files(container-config)); P7 (source_files(container-config)); P9 (source_files(container-config)); P10 (source_files(container-config)); Q6 (tools); Q10 (tools).",
        "required_mitigations": [],
        "assessor_rule_ids": [
          "A1",
          "A3",
          "A5",
          "A7",
          "A9",
          "B1",
          "B2",
          "B3",
          "B4",
          "B5",
          "B6",
          "B7",
          "C1",
          "C2",
          "C3",
          "C4",
          "C5",
          "C6",
          "C7",
          "C8",
          "C9",
          "C10",
          "C11",
          "C12",
          "C13",
          "C14",
          "C15",
          "C16",
          "E1",
          "E2",
          "E4",
          "F3",
          "F4",
          "F7",
          "G1",
          "G2",
          "G3",
          "G4",
          "G5",
          "G7",
          "H1",
          "H2",
          "I3",
          "I4",
          "I6",
          "I7",
          "I8",
          "I9",
          "I10",
          "I11",
          "I13",
          "I15",
          "J2",
          "J3",
          "J4",
          "J5",
          "J6",
          "J7",
          "K6",
          "K7",
          "K8",
          "K16",
          "K17",
          "K18",
          "K19",
          "L4",
          "L9",
          "L11",
          "L14",
          "M1",
          "M2",
          "M4",
          "M7",
          "M8",
          "M9",
          "N1",
          "N2",
          "N3",
          "N4",
          "N5",
          "N6",
          "N7",
          "N8",
          "N9",
          "N10",
          "N11",
          "N12",
          "N13",
          "N14",
          "N15",
          "O4",
          "O5",
          "O6",
          "O8",
          "O9",
          "O10",
          "P1",
          "P2",
          "P3",
          "P4",
          "P5",
          "P6",
          "P7",
          "P8",
          "P9",
          "P10",
          "Q3",
          "Q6",
          "Q7",
          "Q10",
          "Q15"
        ],
        "executed_assessor_rule_ids": [
          "C1",
          "C2",
          "C3",
          "C4",
          "C5",
          "C6",
          "C7",
          "C8",
          "C9",
          "C10",
          "C11",
          "C12",
          "C13",
          "C14",
          "C15",
          "C16",
          "G7",
          "H1",
          "I8",
          "I15",
          "J2",
          "J4",
          "J5",
          "J7",
          "K6",
          "K7",
          "K8",
          "K16",
          "K17",
          "K18",
          "L4",
          "L9",
          "L11",
          "L14",
          "M2",
          "M7",
          "M8",
          "M9",
          "N1",
          "N2",
          "N3",
          "N4",
          "N5",
          "N6",
          "N7",
          "N8",
          "N9",
          "N10",
          "N11",
          "N12",
          "N13",
          "N14",
          "N15",
          "O4",
          "O5",
          "O6",
          "O8",
          "O9",
          "O10",
          "P3",
          "P4",
          "P6",
          "P8",
          "Q3",
          "Q7",
          "Q15"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "A1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A7",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A9",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B7",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "E1",
            "missing": [
              "connection_metadata"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "E2",
            "missing": [
              "connection_metadata"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "E4",
            "missing": [
              "min_tools(51)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F7",
            "missing": [
              "min_tools(2)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "H2",
            "missing": [
              "initialize_metadata"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I3",
            "missing": [
              "resource_templates",
              "resources"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I4",
            "missing": [
              "resource_templates",
              "resources"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I6",
            "missing": [
              "prompts"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I7",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I9",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I10",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I11",
            "missing": [
              "roots"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I13",
            "missing": [
              "multi_server_tools",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "J3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "J6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "K19",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "M1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "M4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "P1",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P2",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P5",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P7",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P9",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P10",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "Q6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "Q10",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          }
        ]
      }
    ],
    "summary": {
      "total_controls": 5,
      "met": 0,
      "unmet": 1,
      "partial": 0,
      "not_assessed": 4,
      "not_applicable": 0,
      "overall_status": "non_compliant"
    },
    "kill_chains": [],
    "executive_summary": "Assessment of @modelcontextprotocol/server-everything against EU AI Act: overall status non compliant. Of 5 controls, 0 met, 1 unmet, 0 partial, 4 not assessed, 0 not applicable. 1 control(s) had complete mapped-assessor execution evidence; 4 lacked sufficient execution evidence and 0 were outside the current assessor mapping. Unmet controls have findings at or above the framework's mandatory severity threshold and should be remediated before relying on this server in a regulated deployment. All claims are traceable to individual finding rows via finding_id and to the governing rule via rule_id; the enclosing signed envelope commits MCP Sentinel to the exact bytes of this report."
  },
  "attestation": {
    "algorithm": "HMAC-SHA256",
    "signature": "1+qqJqmteWyPhR713D4fbx8U3ShsyHy/coBe4xngvYI=",
    "key_id": "mcps-hkdf-e8990a4e1526",
    "signed_at": "2026-09-11T05:32:56.834Z",
    "signer": "mcp-sentinel/v1",
    "canonicalization": "RFC8785"
  }
}