{
  "report": {
    "version": "1.1",
    "server": {
      "slug": "modelcontextprotocol-server-filesystem-20260910032117-412a16",
      "name": "@modelcontextprotocol/server-filesystem",
      "github_url": null,
      "scan_id": "35671e5d-3efa-4ed4-ba49-d871fbae7f2a"
    },
    "framework": {
      "id": "eu_ai_act",
      "name": "EU AI Act",
      "version": "2024/1689",
      "last_updated": "2026-04-23",
      "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689"
    },
    "assessment": {
      "assessed_at": "2026-09-10T03:21:18.068Z",
      "rules_version": "2026-04-23",
      "sentinel_version": "0.4.0",
      "coverage_band": "low",
      "coverage_ratio": 0.58,
      "techniques_run": [
        "ast-taint",
        "composite",
        "cross-module",
        "dependency-audit",
        "similarity",
        "structural",
        "stub"
      ],
      "rule_execution_available": true,
      "rules_executed": 107,
      "rules_skipped": 76
    },
    "controls": [
      {
        "control_id": "Art.9",
        "control_name": "Risk Management System",
        "control_description": "High-risk AI providers must establish, implement, and maintain a risk management system covering the entire lifecycle, including analysis of reasonably foreseeable misuse and supply-chain risk.",
        "source_url": "https://artificialintelligenceact.eu/article/9/",
        "status": "unmet",
        "evidence": [
          {
            "finding_id": "db973b28-bbf6-4605-b1ec-d54ae5e8ad57",
            "rule_id": "D1",
            "rule_name": "Known CVEs in Dependencies",
            "severity": "high",
            "evidence_summary": "SOURCE: external-content at npm:minimatch@10.0.1 — Third-party package dependencies are external content resolved from public registries. A version with a published CVE ships the vulnerable code path ",
            "confidence": 0.82
          },
          {
            "finding_id": "7f820de2-614d-45c3-86fb-d68330ac102d",
            "rule_id": "D1",
            "rule_name": "Known CVEs in Dependencies",
            "severity": "high",
            "evidence_summary": "SOURCE: external-content at npm:vitest@4.1.8 — Third-party package dependencies are external content resolved from public registries. A version with a published CVE ships the vulnerable code path as-i",
            "confidence": 0.78
          },
          {
            "finding_id": "071e6000-7011-42af-8f96-4b6db6d185c3",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:minimatch@10.0.1 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date re",
            "confidence": 0.7
          },
          {
            "finding_id": "488cc682-ff73-4225-9c8a-6ea88d158621",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:@types/diff@5.0.9 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date r",
            "confidence": 0.7
          },
          {
            "finding_id": "65bde637-5534-4a86-9191-7ba9947b4d80",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:@types/minimatch@5.1.2 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release d",
            "confidence": 0.7
          },
          {
            "finding_id": "977cfef1-6eea-4422-8d7e-e76999f23361",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:shx@0.4.0 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date remains p",
            "confidence": 0.7
          },
          {
            "finding_id": "518c35ef-6e79-4302-baef-a896d231befc",
            "rule_id": "D2",
            "rule_name": "Abandoned Dependencies",
            "severity": "medium",
            "evidence_summary": "SOURCE: external-content at npm:typescript@5.8.2 — An unmaintained dependency receives no patches for newly disclosed vulnerabilities. Every published CVE in the package after its last release date re",
            "confidence": 0.7
          }
        ],
        "rationale": "20/22 mapped assessor rule(s) are proven to have executed; 7 finding(s) observed (2 high, 5 medium); at least one finding is at or above the high threshold (status: unmet). 2 mapped assessor(s) did not execute, so this finding-backed result does not imply complete control coverage.",
        "required_mitigations": [
          "Update the flagged dependency to a version that resolves every listed CVE. Consult the NVD or OSV advisory linked in the finding for the minimum safe version. Re-run `npm audit` / `pip-audit` / `osv-scanner` after the bump to confirm no residual advisories remain. Where a patched version is not yet released, apply an override (npm `overrides`, `resolutions`, `pnpm.overrides`, or a Python constraints file) to pin a compatible fix, and file a tracking issue so the override is removed when the upstream fix lands.",
          "Replace the abandoned dependency with an actively maintained alternative. Where no alternative exists, vendor the minimal code the project uses and delete the dependency. If the package is internal/private and legitimately stable, mark it as such in a repository-local allowlist so the scanner can skip it on future runs. Track the abandonment risk in the project's SBOM per ISO 27001 A.8.8."
        ],
        "assessor_rule_ids": [
          "D1",
          "D2",
          "D3",
          "D4",
          "D5",
          "D6",
          "D7",
          "K9",
          "K10",
          "K11",
          "L1",
          "L2",
          "L3",
          "L5",
          "L6",
          "L7",
          "L8",
          "L10",
          "L12",
          "L13",
          "Q4",
          "Q13"
        ],
        "executed_assessor_rule_ids": [
          "D1",
          "D2",
          "D3",
          "D4",
          "D5",
          "D6",
          "D7",
          "K9",
          "K10",
          "K11",
          "L2",
          "L5",
          "L6",
          "L7",
          "L8",
          "L10",
          "L12",
          "L13",
          "Q4",
          "Q13"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "L1",
            "missing": [
              "source_files(ci-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "L3",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          }
        ]
      },
      {
        "control_id": "Art.12",
        "control_name": "Record-Keeping",
        "control_description": "High-risk AI systems must automatically record events ('logs') over the system lifetime to ensure traceability of the system's functioning appropriate for the intended purpose.",
        "source_url": "https://artificialintelligenceact.eu/article/12/",
        "status": "not_assessed",
        "evidence": [],
        "rationale": "4/5 mapped assessor rule(s) are proven to have executed; no adverse findings were observed, but the control is not assessed because execution evidence is incomplete. Unexecuted assessors: E3 (connection_metadata).",
        "required_mitigations": [],
        "assessor_rule_ids": [
          "K1",
          "K2",
          "K3",
          "K20",
          "E3"
        ],
        "executed_assessor_rule_ids": [
          "K1",
          "K2",
          "K3",
          "K20"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "E3",
            "missing": [
              "connection_metadata"
            ],
            "classification": "gap"
          }
        ]
      },
      {
        "control_id": "Art.13",
        "control_name": "Transparency & Provision of Information to Deployers",
        "control_description": "High-risk AI systems must be sufficiently transparent to enable deployers to interpret the system's output appropriately, including capabilities, limitations, and the conditions of intended use.",
        "source_url": "https://artificialintelligenceact.eu/article/13/",
        "status": "unmet",
        "evidence": [
          {
            "finding_id": "b21ffa44-4b39-4d72-905c-a79c659ca45e",
            "rule_id": "K13",
            "rule_name": "Unsanitized Tool Output",
            "severity": "high",
            "evidence_summary": "SOURCE: file-content at dist/index.js:139:24 — External-content read classified as `file-read`. Values returned by this call are outside the server's trust boundary — a web fetch may return attacker-c",
            "confidence": 0.9
          },
          {
            "finding_id": "21eca6f9-4fa1-46fd-8e3d-dcbc7b78d3fd",
            "rule_id": "K13",
            "rule_name": "Unsanitized Tool Output",
            "severity": "high",
            "evidence_summary": "SOURCE: file-content at dist/index.js:277:35 — External-content read classified as `file-read`. Values returned by this call are outside the server's trust boundary — a web fetch may return attacker-c",
            "confidence": 0.9
          },
          {
            "finding_id": "cbed527d-af0c-4b3e-8687-88b727aeb164",
            "rule_id": "K13",
            "rule_name": "Unsanitized Tool Output",
            "severity": "high",
            "evidence_summary": "SOURCE: file-content at dist/index.js:277:35 — External-content read classified as `file-read`. Values returned by this call are outside the server's trust boundary — a web fetch may return attacker-c",
            "confidence": 0.9
          }
        ],
        "rationale": "4/14 mapped assessor rule(s) are proven to have executed; 3 finding(s) observed (3 high); at least one finding is at or above the high threshold (status: unmet). 10 mapped assessor(s) did not execute, so this finding-backed result does not imply complete control coverage.",
        "required_mitigations": [
          "Tool responses must not carry raw external content to the AI client. Acceptable mitigations: (1) apply a sanitizer — sanitize(), sanitizeHtml(), escapeHtml(), DOMPurify.sanitize(), he.encode(), validator.escape(), stripTags() — to the returned value BEFORE emission, (2) when returning JSON, ensure every string field originating from external sources is coerced to plain text and never rendered as HTML or Markdown by the client, (3) attach a trust-boundary annotation that the client can use to quarantine the content. CoSAI MCP-T4 and OWASP ASI02 treat unsanitized tool output as a direct tool-poisoning substrate — the AI interprets the response as a trustworthy tool result and gives external content authority it never earned."
        ],
        "assessor_rule_ids": [
          "A2",
          "A4",
          "A6",
          "A8",
          "F2",
          "F5",
          "G6",
          "I1",
          "I2",
          "I5",
          "I16",
          "K12",
          "K13",
          "L15"
        ],
        "executed_assessor_rule_ids": [
          "F5",
          "K12",
          "K13",
          "L15"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "A2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A8",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G6",
            "missing": [
              "scan_history"
            ],
            "classification": "unknown"
          },
          {
            "rule_id": "I1",
            "missing": [
              "tool_attributes(annotations)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I2",
            "missing": [
              "tool_attributes(annotations)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I5",
            "missing": [
              "resource_templates",
              "resources",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I16",
            "missing": [
              "min_tools(10)",
              "tools"
            ],
            "classification": "gap"
          }
        ]
      },
      {
        "control_id": "Art.14",
        "control_name": "Human Oversight",
        "control_description": "High-risk AI systems must be designed so that they can be effectively overseen by natural persons during use. Covers the ability to fully understand, monitor, and intervene in the system's operation.",
        "source_url": "https://artificialintelligenceact.eu/article/14/",
        "status": "not_assessed",
        "evidence": [],
        "rationale": "5/13 mapped assessor rule(s) are proven to have executed; no adverse findings were observed, but the control is not assessed because execution evidence is incomplete. Unexecuted assessors: K4 (tools); I12 (declared_capabilities); M5 (tools); H3 (tools); F1 (tools); F6 (tools); K15 (min_tools(2), tools); Q10 (tools).",
        "required_mitigations": [],
        "assessor_rule_ids": [
          "K4",
          "K5",
          "I12",
          "M5",
          "M6",
          "Q15",
          "H3",
          "F1",
          "F6",
          "J1",
          "K14",
          "K15",
          "Q10"
        ],
        "executed_assessor_rule_ids": [
          "K5",
          "M6",
          "Q15",
          "J1",
          "K14"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "K4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I12",
            "missing": [
              "declared_capabilities"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "M5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "H3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "K15",
            "missing": [
              "min_tools(2)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "Q10",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          }
        ]
      },
      {
        "control_id": "Art.15",
        "control_name": "Accuracy, Robustness, and Cybersecurity",
        "control_description": "High-risk AI systems must achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle. Covers resilience against errors, faults, and adversarial manipulation.",
        "source_url": "https://artificialintelligenceact.eu/article/15/",
        "status": "unmet",
        "evidence": [
          {
            "finding_id": "2381cbaf-bde1-40fb-8d86-280f995f076f",
            "rule_id": "K16",
            "rule_name": "Unbounded Recursion / Missing Depth Limits",
            "severity": "high",
            "evidence_summary": "SOURCE: file-content at dist/index.js:476:44 — Recursive call closing a cycle with entry `buildTree`: direct self-recursion on `buildTree`. The entry function declares no depth-comparison guard (Binar",
            "confidence": 0.88
          },
          {
            "finding_id": "fba87676-3f75-4379-ae7e-4b10be71c3e1",
            "rule_id": "K16",
            "rule_name": "Unbounded Recursion / Missing Depth Limits",
            "severity": "high",
            "evidence_summary": "SOURCE: file-content at dist/lib.js:383:27 — Recursive call closing a cycle with entry `search`: direct self-recursion on `search`. The entry function declares no depth-comparison guard (BinaryExpress",
            "confidence": 0.88
          }
        ],
        "rationale": "66/111 mapped assessor rule(s) are proven to have executed; 2 finding(s) observed (2 high); at least one finding is at or above the high threshold (status: unmet). 45 mapped assessor(s) did not execute, so this finding-backed result does not imply complete control coverage.",
        "required_mitigations": [
          "Every recursive handler must carry an explicit termination budget. For tree / DAG walks, thread a `depth` parameter with a comparison against an UPPER_SNAKE constant: `if (depth > MAX_DEPTH) return;`. For graphs with cycles, use a visited-set (`new Set()` / `new WeakSet()`) consulted with `.has()` before recursing and updated with `.add()` on entry. For MCP tool-call roundtrips (recursionA→callTool('B')→callTool('A')), pair the per-function guard with a session-level tool-call-depth counter carried through the tool arguments; the MCP spec does not enforce this client-side. OWASP ASI08 and EU AI Act Art.15 both require robustness against adversarial input-driven recursion."
        ],
        "assessor_rule_ids": [
          "A1",
          "A3",
          "A5",
          "A7",
          "A9",
          "B1",
          "B2",
          "B3",
          "B4",
          "B5",
          "B6",
          "B7",
          "C1",
          "C2",
          "C3",
          "C4",
          "C5",
          "C6",
          "C7",
          "C8",
          "C9",
          "C10",
          "C11",
          "C12",
          "C13",
          "C14",
          "C15",
          "C16",
          "E1",
          "E2",
          "E4",
          "F3",
          "F4",
          "F7",
          "G1",
          "G2",
          "G3",
          "G4",
          "G5",
          "G7",
          "H1",
          "H2",
          "I3",
          "I4",
          "I6",
          "I7",
          "I8",
          "I9",
          "I10",
          "I11",
          "I13",
          "I15",
          "J2",
          "J3",
          "J4",
          "J5",
          "J6",
          "J7",
          "K6",
          "K7",
          "K8",
          "K16",
          "K17",
          "K18",
          "K19",
          "L4",
          "L9",
          "L11",
          "L14",
          "M1",
          "M2",
          "M4",
          "M7",
          "M8",
          "M9",
          "N1",
          "N2",
          "N3",
          "N4",
          "N5",
          "N6",
          "N7",
          "N8",
          "N9",
          "N10",
          "N11",
          "N12",
          "N13",
          "N14",
          "N15",
          "O4",
          "O5",
          "O6",
          "O8",
          "O9",
          "O10",
          "P1",
          "P2",
          "P3",
          "P4",
          "P5",
          "P6",
          "P7",
          "P8",
          "P9",
          "P10",
          "Q3",
          "Q6",
          "Q7",
          "Q10",
          "Q15"
        ],
        "executed_assessor_rule_ids": [
          "C1",
          "C2",
          "C3",
          "C4",
          "C5",
          "C6",
          "C7",
          "C8",
          "C9",
          "C10",
          "C11",
          "C12",
          "C13",
          "C14",
          "C15",
          "C16",
          "G7",
          "H1",
          "I8",
          "I15",
          "J2",
          "J4",
          "J5",
          "J7",
          "K6",
          "K7",
          "K8",
          "K16",
          "K17",
          "K18",
          "L4",
          "L9",
          "L11",
          "L14",
          "M2",
          "M7",
          "M8",
          "M9",
          "N1",
          "N2",
          "N3",
          "N4",
          "N5",
          "N6",
          "N7",
          "N8",
          "N9",
          "N10",
          "N11",
          "N12",
          "N13",
          "N14",
          "N15",
          "O4",
          "O5",
          "O6",
          "O8",
          "O9",
          "O10",
          "P3",
          "P4",
          "P6",
          "P8",
          "Q3",
          "Q7",
          "Q15"
        ],
        "skipped_assessor_rules": [
          {
            "rule_id": "A1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A7",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "A9",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "B7",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "E1",
            "missing": [
              "connection_metadata"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "E2",
            "missing": [
              "connection_metadata"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "E4",
            "missing": [
              "min_tools(51)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "F7",
            "missing": [
              "min_tools(2)",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G2",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "G5",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "H2",
            "missing": [
              "initialize_metadata"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I3",
            "missing": [
              "resource_templates",
              "resources"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I4",
            "missing": [
              "resource_templates",
              "resources"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I6",
            "missing": [
              "prompts"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I7",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I9",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I10",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I11",
            "missing": [
              "roots"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "I13",
            "missing": [
              "multi_server_tools",
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "J3",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "J6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "K19",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "M1",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "M4",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "P1",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P2",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P5",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P7",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P9",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "P10",
            "missing": [
              "source_files(container-config)"
            ],
            "classification": "negative"
          },
          {
            "rule_id": "Q6",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          },
          {
            "rule_id": "Q10",
            "missing": [
              "tools"
            ],
            "classification": "gap"
          }
        ]
      }
    ],
    "summary": {
      "total_controls": 5,
      "met": 0,
      "unmet": 3,
      "partial": 0,
      "not_assessed": 2,
      "not_applicable": 0,
      "overall_status": "non_compliant"
    },
    "kill_chains": [],
    "executive_summary": "Assessment of @modelcontextprotocol/server-filesystem against EU AI Act: overall status non compliant. Of 5 controls, 0 met, 3 unmet, 0 partial, 2 not assessed, 0 not applicable. 3 control(s) had complete mapped-assessor execution evidence; 2 lacked sufficient execution evidence and 0 were outside the current assessor mapping. Unmet controls have findings at or above the framework's mandatory severity threshold and should be remediated before relying on this server in a regulated deployment. All claims are traceable to individual finding rows via finding_id and to the governing rule via rule_id; the enclosing signed envelope commits MCP Sentinel to the exact bytes of this report."
  },
  "attestation": {
    "algorithm": "HMAC-SHA256",
    "signature": "NuUBK3BQaqx9ZBwGLDZnMv1jP2qSPNBQJ57BqfuiUX0=",
    "key_id": "mcps-hkdf-e8990a4e1526",
    "signed_at": "2026-09-11T05:32:50.680Z",
    "signer": "mcp-sentinel/v1",
    "canonicalization": "RFC8785"
  }
}