{
  "info": {
    "url": "https://golemreach.com/mcp",
    "ts": "2026-09-08T11:23:41Z",
    "tls_version": "TLSv1.3",
    "cert_expires": "Nov  6 01:22:14 2026 GMT",
    "cert_issuer": {
      "countryName": "US",
      "organizationName": "Let's Encrypt",
      "commonName": "YE2"
    },
    "unauth_initialize_status": 200,
    "headers": {
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "content-security-policy": null,
      "x-content-type-options": null,
      "access-control-allow-origin": "*",
      "server": null,
      "x-powered-by": null
    },
    "server_info": {
      "name": "golemreach",
      "version": "0.1.0"
    },
    "protocol": "2025-06-18",
    "capabilities": {
      "tools": {
        "listChanged": true
      },
      "resources": {
        "listChanged": true
      }
    },
    "tool_count": 13,
    "resources/list": 4,
    "scope": "Discovery and transport observations only; execution authorization, input validation and exploitability untested."
  },
  "findings": [
    {
      "severity": "LOW",
      "title": "Very long tool description: golemreach_attack",
      "evidence": "1674 chars",
      "fix": "Keep descriptions short; long ones hide injected instructions and burn context.",
      "basis": "observation"
    },
    {
      "severity": "LOW",
      "title": "Very long tool description: golemreach_use",
      "evidence": "1855 chars",
      "fix": "Keep descriptions short; long ones hide injected instructions and burn context.",
      "basis": "observation"
    },
    {
      "severity": "LOW",
      "title": "Very long tool description: golemreach_talk",
      "evidence": "1762 chars",
      "fix": "Keep descriptions short; long ones hide injected instructions and burn context.",
      "basis": "observation"
    },
    {
      "severity": "LOW",
      "title": "Very long tool description: golemreach_where",
      "evidence": "1568 chars",
      "fix": "Keep descriptions short; long ones hide injected instructions and burn context.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "Wildcard CORS observed; exploitability not tested",
      "evidence": "access-control-allow-origin: *",
      "fix": "Public APIs may intentionally allow cross-origin access. Browsers reject wildcard origins for credentialed responses. Review origin and authorization policy separately.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "Public tool discovery observed",
      "evidence": "13 tools listed unauthenticated: golemreach_guild, golemreach_connect, golemreach_look, golemreach_move, golemreach_attack, golemreach_cast, golemreach_use, golemreach_inventory, golemreach_talk, golemreach_trade, golemreach_where, golemreach_wait, golemreach_invite_administrator",
      "fix": "Public discovery can be intentional. Tool execution permissions were not tested. Restrict discovery only if its metadata is sensitive; authorize protected operations individually.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_guild",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_connect",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_look",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_move",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_attack",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_cast",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_use",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_inventory",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_talk",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_trade",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_where",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_wait",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    },
    {
      "severity": "INFO",
      "title": "No annotations on tool: golemreach_invite_administrator",
      "evidence": "",
      "fix": "Annotations are optional hints, not permissions or trusted safety controls. Add accurate hints where useful; enforce permissions server-side.",
      "basis": "observation"
    }
  ]
}