Trust Receipt trust receiptissues found

MCPAudit report: sample_audit_report

MCPAudit reported capability, drift, risk, and policy signals for configured MCP servers.

Verdict
failed
MCPAudit report summarized with policy and risk limitations.
Freshness
static_fixture
2026-05-09T09:00:00Z
Checks
6
2 passed, 3 failed, 0 not checked, 1 inconclusive
Receipt ID
tr_mcpaudit-sample-audit-report
2026-06-27T00:00:00Z

Boundary

This receipt is not a safety certification, security approval, or live health guarantee. It summarizes the public-safe evidence, checks, exclusions, freshness, and limitations listed below.

Failed

High-risk server count
failed
1 high-risk server(s) reported.
mcpaudit-json-report
Schema drift findings
failed
1 drift finding(s) reported.
mcpaudit-json-report
Policy gate
failed
Policy result failed with 1 violation(s).
  • max_risk (high): Server risk score 8.0 meets or exceeds policy limit 7.0.
mcpaudit-json-report

Inconclusive

Tool annotation coverage
inconclusive
Minimum annotation coverage was 0%; some risk may rely on scanner inference or MCP spec defaults.
mcpaudit-json-report

Passed

MCPAudit scan completed
passed
Report covers 1 discovered server(s).
  • servers_connected=1
  • total_tools=1
  • permission_findings=1
  • capability_findings=1
  • injection_findings=0
  • drift_findings=1
  • top_composite_risk=8.0
mcpaudit-json-report
Connection failures
passed
0 server(s) failed to connect.
mcpaudit-json-report

Evidence

Evidence entries are public-safe references and digests, not raw private reports.

IDTitleKindReferenceDigest
mcpaudit-json-reportMCPAudit JSON reportjsonlocal-public-safe-input:mcpaudit-json-report118c7a720361f424...

Intentionally Excluded

Credential values and raw private config
Receipts summarize report metadata and counts, not raw credential-bearing MCP client configs.
Server launch details and local paths
The adapter intentionally omits command arguments, config paths, resource URIs, and env key names from generated receipt text.
Raw tool schemas and prompt/resource text
The receipt records counts and normalized checks only. Inspect the source report for full scanner detail.

Limitations

MCPAudit risk is a capability and finding summary, not a claim that a server is malicious.
This receipt does not connect to MCP servers, verify package provenance, or download package artifacts itself.
Policy-gate meaning depends on the policy file used when the source report was generated.
Summary-only receipts may omit individual tool names, local paths, resource URIs, and credential key names for public safety.

Reproduce Or Inspect

Generate an MCPAudit report.
mcp-audit scan --json report.json
Generate this receipt.
trust-receipt mcpaudit --input report.json