Run ID: 024be7cb-a8c7-4225-8d0d-d76bd30fd5b6
| 2026-10-03 02:10:39 UTC
| v3.6.0
Scope: Config Posture audits the supplied configuration, including MCP feature settings. It does not establish protection for discovered MCP servers. MCP discovery was skipped, so MCP Protection is excluded from the overall score. The config_valid deployment check confirms that the configuration loads; its PASS does not mean HTTPS content inspection is enabled. This sample leaves TLS interception disabled, with the resulting inspection limits listed under deployment verification.
ⓘ Informational Only
Signed summary. Not audit-grade. The assess tier adds server-specific findings, remediation commands, exposure analysis, compliance mappings, a badge, a full attestation, and the complete assessment package.
Method and Scope
The overall assessment score combines configuration posture, deployment verification and detection coverage. The configuration audit evidence separately reports 87/170 (51%, F); it supplies the Config Posture section, not the overall grade. MCP discovery was skipped.
Tool
pipelock assess v3.6.0 (build unknown)
Method versions
Scoring 2 · Renderer 2.0 · Schema 2
Target config
balanced.yaml · SHA-256 907c7f31920de261bfbb2d799da419bfa8fff74465050ee0521cf84a6faa8c56 · unchanged after init
Assessed with skipped primitives: discover · partial finalization explicitly allowed
Artifact validation
3 evidence artifact hashes verified before scoring; output hashes are recorded in manifest.json
Not assessed
assessment finalized with --allow-partial; framework coverage is only attached to fully-evidenced runs
Signature
Detached Ed25519 signature covers manifest.json and its artifact hashes
Assessment Sections
Section
Score
Grade
Scope
Config Posture
51/100
F
23/23 applicable
Deployment Verification
50/100
F
12/15 applicable
Detection Coverage
95/100
A
23/26 applicable
MCP Protection
N/A
N/A
0/0 applicable
MCP Server Coverage
0
Total Servers
0
Protected (Pipelock)
0
Unprotected
0
Unknown
Detection Coverage
95%
Attack scenarios detected
Top Findings
Severity
Category
Title
HIGH
Prompt Injection
Attack scenario "Credential solicitation" not detected
HIGH
scanning
Verification check "browser_shield" failed: browser_shield is disabled in config
HIGH
scanning
Verification check "file_sentry" failed: file_sentry is disabled in config
Get the complete assessment package with server-specific findings, exposure analysis, actionable fix guidance, compliance mappings, a badge, and a full attestation.
Learn more at pipelab.org/pipelock
Explicit Non-Claims
This summary does not identify individual MCP servers, provide deployment-specific exposure analysis or remediation commands, map results to individual compliance controls, issue a badge or full attestation, or constitute an audit or certification. The per-framework coverage counts above are totals, not a control-by-control mapping. A signature authenticates this manifest against the named signing key and shows the listed artifacts have not changed since it was written; it does not establish who operated the assessment, does not expand what was assessed, and carries no authority beyond whatever trust you already place in that key. A key generated locally on first use proves integrity only, until its public key is independently trusted.