Security
Integrity of the record, posture of the connectors that carry actions out, and an on-demand check of an MCP server’s advertised tools. Ordered by consequence.
Audit chain
Chain intact 47 record(s) verified
sha256:2735a53f8c20d0c24bf6a0d5f1dafb7b713b01f4dea0fac0c76ce67db9c6882c
Full verification and the records themselves →
Connector posture
| Connector | Health | Detail (as reported) |
|---|---|---|
| simulation | healthy | 3 simulated tool(s) |
An MCP connector reports drift when its advertised tool surface no longer matches the pinned manifest. The added, removed and modified tools are listed by arc mcp diff; the API exposes only this message.
MCP manifest scan
Results are not saved, and scanning registers nothing. The API computes a report and returns it; there is no findings store, so a reload scans again and leaves no trace. Run arc mcp scan in CI for a durable record.
Inert in this capture — a scan needs the live API. See a real scan of a poisoned manifest, produced by this build.
A scan fails when any finding is high or critical. Scanned 2026-10-26 09:18:31Z; this result exists only in this response.
| Severity | Finding | Tool |
|---|---|---|
| critical |
MCP-SEC-002 Tool description solicits credentials or conversation history
The description of "export_records" directs the agent toward secrets or transcript contents: "read ~/.aws/credentials".
Remediation: Do not expose this tool. A tool that needs a credential should receive it from the connector, never ask the agent for it. |
export_records |
| medium |
MCP-SEC-011 Tool accepts unconstrained input
"run" declares a schema with no properties, so any argument shape is acceptable to the server.
Remediation: Constrain the parameters in the ARC Control tool definition; undeclared parameters are then refused at the gateway. |
run |
| low |
MCP-SEC-012 Tool schema permits additional properties
"search" does not set additionalProperties to false, so the server will accept arguments it never documented.
Remediation: ARC Control rejects undeclared parameters regardless; ask the operator to tighten the published schema so the two agree. |
search |
| low |
MCP-SEC-012 Tool schema permits additional properties
"export_records" does not set additionalProperties to false, so the server will accept arguments it never documented.
Remediation: ARC Control rejects undeclared parameters regardless; ask the operator to tighten the published schema so the two agree. |
export_records |
| low |
MCP-SEC-004 Tool has no usable description
"run" publishes no meaningful description, so neither an operator nor a reviewer can tell what it does.
Remediation: Ask the server operator to document the tool before exposing it to agents. |
run |