{
  "schema": "csint-public-tool-verification/v1",
  "testedAt": "2026-08-22T09:00:08.000Z",
  "source": {
    "name": "Model Context Protocol Ruby SDK",
    "url": "https://github.com/modelcontextprotocol/ruby-sdk/archive/fcb1ac935da20696085b27a869526bb89e7c2ced.zip",
    "repository": "https://github.com/modelcontextprotocol/ruby-sdk",
    "revision": "fcb1ac935da20696085b27a869526bb89e7c2ced",
    "sha256": "dfa30dec9e86ace8b50db7984e739662b57b4304aa709aa0fe710ed582e0c289",
    "license": "Apache-2.0 / MIT licensing transition notice",
    "licenseUrl": "https://github.com/modelcontextprotocol/ruby-sdk/blob/fcb1ac935da20696085b27a869526bb89e7c2ced/LICENSE",
    "maxBytes": 2097152
  },
  "execution": {
    "sourceCodeExecuted": false,
    "archiveParsedLocally": true
  },
  "report": {
    "schema": "csint-ai-agent-surface/v1",
    "generatedAt": "2026-08-22T09:00:08.000Z",
    "archive": {
      "fileName": "modelcontextprotocol-ruby-sdk-fcb1ac9.zip",
      "compressedBytes": 563354,
      "entries": 279,
      "reviewedTextFiles": 56,
      "expandedBytesReviewed": 226366
    },
    "project": {
      "name": "modelcontextprotocol-ruby-sdk-fcb1ac9",
      "instructionFiles": [
        "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/AGENTS.md",
        "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/CLAUDE.md"
      ],
      "manifestFiles": [],
      "environmentFiles": []
    },
    "mcpServers": [],
    "workflows": [
      {
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/ci.yml",
        "triggers": [
          "pull_request",
          "push"
        ],
        "actionReferences": [
          "actions/checkout@v7",
          "ruby/setup-ruby@v1",
          "actions/checkout@v7",
          "ruby/setup-ruby@v1",
          "actions/checkout@v7",
          "ruby/setup-ruby@v1"
        ],
        "readsSecrets": false
      },
      {
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/conformance.yml",
        "triggers": [
          "push"
        ],
        "actionReferences": [
          "actions/checkout@v7",
          "ruby/setup-ruby@v1",
          "actions/setup-node@v7"
        ],
        "readsSecrets": false
      },
      {
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/release.yml",
        "triggers": [
          "push"
        ],
        "actionReferences": [
          "actions/checkout@v7",
          "ruby/setup-ruby@v1",
          "rubygems/release-gem@v1",
          "actions/checkout@v7"
        ],
        "readsSecrets": false
      }
    ],
    "capabilities": [
      {
        "id": "network",
        "paths": [
          "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/docs/_client/authorization.md",
          "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/docs/_server/multi-round-trip-results.md",
          "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/docs/_server/tools.md",
          "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/docs/examples.md",
          "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/examples/rails/README.md",
          "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/examples/README.md"
        ]
      }
    ],
    "findings": [
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "actions/checkout uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/ci.yml",
        "line": 22,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "actions/checkout, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "ruby/setup-ruby uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/ci.yml",
        "line": 23,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "ruby/setup-ruby, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "actions/checkout uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/conformance.yml",
        "line": 21,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "actions/checkout, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "ruby/setup-ruby uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/conformance.yml",
        "line": 22,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "ruby/setup-ruby, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "actions/setup-node uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/conformance.yml",
        "line": 26,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "actions/setup-node, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "actions/checkout uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/release.yml",
        "line": 19,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "actions/checkout, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "ruby/setup-ruby uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/release.yml",
        "line": 21,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "ruby/setup-ruby, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-203",
        "severity": "medium",
        "title": "Third-party action is not pinned to a full commit SHA",
        "evidence": "rubygems/release-gem uses a mutable reference.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/.github/workflows/release.yml",
        "line": 25,
        "action": "Pin the action to a reviewed full-length commit SHA and record the human-readable version in a comment.",
        "tr": {
          "title": "Üçüncü taraf action tam commit SHA ile sabitlenmemiş",
          "evidence": "rubygems/release-gem, değişebilir bir referans kullanıyor.",
          "action": "Action'ı incelenmiş tam uzunlukta commit SHA ile sabitle ve okunabilir sürümü yorumda kaydet."
        }
      },
      {
        "id": "AS-301",
        "severity": "info",
        "title": "Repository contains persistent agent instructions",
        "evidence": "An agent instruction or skill file can influence future tool use and code changes.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/AGENTS.md",
        "action": "Review instruction provenance, allowed tools, external-content handling, and change ownership.",
        "tr": {
          "title": "Depo kalıcı agent talimatları içeriyor",
          "evidence": "Bir agent talimatı veya skill dosyası gelecekteki araç kullanımını ve kod değişikliklerini etkileyebilir.",
          "action": "Talimat kaynağını izin verilen araçları dış içerik işlemeyi ve değişiklik sahipliğini incele."
        }
      },
      {
        "id": "AS-301",
        "severity": "info",
        "title": "Repository contains persistent agent instructions",
        "evidence": "An agent instruction or skill file can influence future tool use and code changes.",
        "path": "ruby-sdk-fcb1ac935da20696085b27a869526bb89e7c2ced/CLAUDE.md",
        "action": "Review instruction provenance, allowed tools, external-content handling, and change ownership.",
        "tr": {
          "title": "Depo kalıcı agent talimatları içeriyor",
          "evidence": "Bir agent talimatı veya skill dosyası gelecekteki araç kullanımını ve kod değişikliklerini etkileyebilir.",
          "action": "Talimat kaynağını izin verilen araçları dış içerik işlemeyi ve değişiklik sahipliğini incele."
        }
      }
    ],
    "summary": {
      "high": 0,
      "medium": 8,
      "review": 0,
      "info": 2
    },
    "limitations": [
      "The archive is parsed as data. Source files, scripts, actions, packages, and MCP servers are never executed.",
      "Pattern matches and configuration presence are review signals, not proof of exploitation, malware, safety, or project quality.",
      "Runtime permissions, remote server behavior, branch protection, repository settings, dependency advisories, and commit provenance are not verified from an archive.",
      "Secret-like values are not included in the report. Remove private data before retaining or sharing any archive."
    ]
  }
}