[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:08+00:00",
  "ms": 64,
  "reply": {
   "path": "compare.py",
   "engine": "FALSEWORK (cainwitness)",
   "scanned_ms": 13.3,
   "grade": "REAL",
   "findings": []
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:09+00:00",
  "ms": 61,
  "reply": {
   "path": "auth.py",
   "engine": "FALSEWORK (cainwitness)",
   "scanned_ms": 11.8,
   "grade": "PARTIAL",
   "findings": [
    {
     "check": "placeholder_marker",
     "severity": "MEDIUM",
     "line": 2,
     "detail": "Explicit placeholder/incomplete-work marker left in shipped code."
    },
    {
     "check": "check_cannot_fail",
     "severity": "MEDIUM",
     "line": 3,
     "detail": "`verify_token` returns True on every path without examining its inputs (token): the check cannot fail."
    },
    {
     "check": "fixed_result",
     "severity": "MEDIUM",
     "line": 3,
     "detail": "`verify_token` takes `token` but never reads it, and returns the same fixed answer whatever it is given: the result is hard-coded, not computed."
    }
   ]
  }
 },
 {
  "id": "C03",
  "http_status": 200,
  "recorded_at": "2026-11-03T22:46:10+00:00",
  "ms": 96,
  "reply": {
   "engine": "mcp-security-scanner (CAINWitness MCP)",
   "name": "get_weather",
   "scanned_ms": 38.4,
   "findings": [
    {
     "type": "hidden_instruction_block",
     "location": "tool[get_weather].description",
     "detail": "markup that frames text as a hidden instruction block for the model: '<IMPORTANT>'",
     "severity": "high"
    },
    {
     "type": "sensitive_file_reference",
     "location": "tool[get_weather].description",
     "detail": "references a local secret or credential file the tool has no business reading: '~/.ssh'",
     "severity": "high"
    },
    {
     "type": "tool_poisoning",
     "location": "tool[get_weather]",
     "detail": "2 independent poisoning signals in one tool (hidden_instruction_block, sensitive_file_reference): this definition is written to manipulate the calling model -- do not connect it",
     "severity": "critical"
    }
   ],
   "finding_count": 3,
   "risk_score": 100,
   "risk_level": "high",
   "scanned_at": "2026-11-03T22:46:10.009667+00:00",
   "method": "heuristic regex/structural analysis of the supplied tool definition -- not a live probe, not a formal proof of safety"
  }
 }
]