spec(g0): strategic pivot -- core problem is unprovable reachability; fix the eval target first

Named the core problem with the maintainer: the tool spots dangerous ops but cannot prove
attacker-reachability -- the trust boundary lives outside the changed library code. Chosen
strategic bet (of three): FIX THE EVALUATION TARGET FIRST.

LLM shape classification of the 49 public pool vulns ($0.033): reachability_in_repo only
24% (12/49); 76% are pure libraries. A legitimate change-scoped catch needs sound label AND
reachability in-repo -> just 5/49 (~10%): graphiti, desktopcommandermcp, malla,
document-merge-service, mcp-remote. Shape predicted the hunter outcome (graphiti app-shaped ->
caught; bedrock library -> missed). So record-07's 3/92 is scored against a ~90%-illegitimate
denominator -- the near-zero catch is largely a target mismatch.

Next: deep scan on the 5 fair targets for a per-tier catch rate; then an app-shaped eval set
from known-vulnerable apps. Artifacts: 2026-10-12-pool-p1-shape-classification/ (+ earlier
label-audit, hunter-sound-targets). Memory: evaluation-target-mismatch.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.kiro/specs/engine-change-scoped-analysis/brief.md

@@ -396,3 +396,24 @@ bedrock + graphiti, the two sound pilot targets the static engine missed. Artifa
 Next: (a) measure the proof arm (can it elevate graphiti's suspicion to proven?); (b) stand up the DSPy hint loop
 and re-run bedrock; (c) widen the hunter to the 23 sound targets for a catch rate; (d) then a change-scoped + proven
 run for the release-relevant shape.
+
+## STRATEGIC PIVOT: core problem = unprovable reachability; FIX THE EVALUATION TARGET FIRST (2026-10-12)
+
+**Core problem (named with the maintainer):** the tool can SPOT dangerous ops but cannot prove they are
+ATTACKER-REACHABLE — the trust boundary lives outside the changed library code, in the caller/application a
+change-scoped scan does not see; and the project rightly won't emit unproven alarms. Recall → ~0 from unprovable
+reachability, not blindness. Cost/latency/engine-wall/corpus-labels were all downstream noise.
+
+**Chosen bet (of three — fix-target / advisory-with-conditions / build-prover): FIX THE EVALUATION TARGET FIRST.**
+A pre-push hook runs inside a developer's APPLICATION (entry points present, request→sink in-repo), but the pool is
+library-heavy, so we measured the hardest/wrong case.
+
+**Shape classification (LLM, 49 public vulns, $0.033 — `benchmarks/measurements/2026-10-12-pool-p1-shape-classification/`):**
+reachability_in_repo True only 12/49 (24%); 37/49 are pure libraries. A legitimate catch needs sound label AND
+reachability in-repo → **5/49 (~10%)**: graphiti, desktopcommandermcp, malla, document-merge-service, mcp-remote.
+**Shape predicted the hunter result** (graphiti app-shaped→caught; bedrock library→missed). So record-07's 3/92 is
+scored against a ~90%-illegitimate denominator — the near-zero catch is largely a TARGET MISMATCH.
+
+**Next:** deep scan (regex/engine/hunter) on the 5 fair targets → per-tier catch rate on the corrected set; then
+stand up an app-shaped eval set from known-vulnerable apps (VAmPI/NodeGoat/DjanGoat/vibe-py) and recompute the
+floor. Deferred bets (advisory-with-conditions, reachability prover) revisited once the fair-target numbers land.

benchmarks/measurements/2026-10-12-pool-p1-shape-classification/NOTES.md

@@ -0,0 +1,27 @@
+# pool-p1 shape classification — application vs library (reachability in-repo) — 2026-10-12
+
+## Why
+Strategic decision (see memory evaluation-target-mismatch): the core problem is unprovable attacker-reachability —
+the trust boundary lives outside the changed library code. Chosen bet: FIX THE EVALUATION TARGET FIRST. This LLM
+pass (DeepSeek, reuses the label-audit cache, $0.033) classifies each of the 49 public pool vulns:
+application / mixed / library, and whether the attacker→source→sink path is resolvable IN-REPO.
+
+## Result
+- shape: library 37, application 6, mixed 6. **reachability_in_repo: True 12 (24%), False 37 (76%).**
+- A legitimate change-scoped pre-push catch needs BOTH a sound label AND reachability in-repo. That intersection is
+  **5/49 (~10%)**: getzep/graphiti, sorlen008/desktopcommandermcp, zenitram/malla, adfinis/document-merge-service,
+  punkpeye/mcp-remote. 18 more are sound-but-library (fair label, UNFAIR target — attacker source in an absent caller).
+- **Shape predicts the hunter outcome:** graphiti (mixed/reach=True/sound) was CAUGHT by the hunter; bedrock
+  (library/reach=False/sound) was MISSED (reachability not in-repo); banks/launch-editor/socketio (library/unsound)
+  correctly quiet. The one caught pilot repo is the one app-shaped+sound target.
+
+## Implication
+record 07's floor (catch 3/92) is scored against a denominator ~90% of which is illegitimate for a change-scoped,
+reachability-based hook. The near-zero catch is LARGELY a target mismatch, not pure detection failure. The fair
+local eval set is the 5 app-shaped+sound public targets (expand via known-vulnerable apps: VAmPI, NodeGoat,
+DjanGoat, vibe-py). Next: run the deep scan (regex/engine/hunter) on the 5 fair targets for a per-tier catch rate on
+the corrected target set.
+
+## Caveats
+LLM classification (DeepSeek, general model); confidence per row in shape.jsonl. "mixed" = a library that also ships
+a runnable app/CLI exercising the sink. Private 51/100 pool entries un-auditable (no code).

benchmarks/measurements/2026-10-12-pool-p1-shape-classification/shape.jsonl

@@ -0,0 +1,49 @@
+{"repo": "jenkinsci/metrics-plugin", "family": "config_secrets", "ecosystem": "maven", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Jenkins plugin (library) whose access key is stored in a config file; the untrusted input is filesystem access by an external Jenkins controller user, not an in-repo entry point.", "error": null}
+{"repo": "aws/bedrock-agentcore-sdk-python", "family": "injection", "ecosystem": "pip", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "This is an SDK client library where install_packages() is a public API method invoked by external consuming applications, so reachability depends on how callers wire untrusted input into it.", "error": null}
+{"repo": "kludex/starlette", "family": "path", "ecosystem": "pip", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "Starlette is a framework library; StaticFiles is a public API whose untrusted path input comes from a consuming application's ASGI scope, not from an in-repo entry point.", "error": null}
+{"repo": "contentful/contentful-mcp-server", "family": "untrusted_destination", "ecosystem": "npm", "label_sound": false, "shape": "application", "reachability_in_repo": true, "entry_point": "MCP server tool registration in registerAllTools (exportSpace/importSpace tools invoked via MCP protocol)", "confidence": 0.85, "note": "This repo is the Contentful MCP server itself, which registers and exposes the export_space/import_space tools as MCP entry points that accept LLM-controlled host/proxy args flowing to the CMA client.", "error": null}
+{"repo": "flarum/tags", "family": "access_control", "ecosystem": "composer", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "Flarum Tags is a plugin/library whose SaveTagsToDatabase listener is invoked by the Flarum core discussion-saving pipeline, so the untrusted REST input entry point lives in the consuming Flarum application, not this repo.", "error": null}
+{"repo": "matrix-org/matrix-appservice-bridge", "family": "access_control", "ecosystem": "npm", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "matrix-appservice-bridge is a framework/SDK; the tombstone event and roomUpgradeOpts are supplied by an external bridge application, so reachability depends on how a consuming app wires the handler.", "error": null}
+{"repo": "jenkinsci/active-choices-plugin", "family": "output_encoding", "ecosystem": "maven", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Jenkins plugin (library) whose XSS sink is reached via Jenkins job configuration UI supplied by an external host application, not an entry point defined in this repo.", "error": null}
+{"repo": "jenkinsci/ontrack-plugin", "family": "access_control", "ecosystem": "maven", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "This is a Jenkins plugin whose DSL definitions are supplied by external callers/jobs, so the untrusted-input entry point is not contained in this repo.", "error": null}
+{"repo": "simonhaenisch/md-to-pdf", "family": "injection", "ecosystem": "npm", "label_sound": false, "shape": "mixed", "reachability_in_repo": true, "entry_point": "CLI command (md-to-pdf) that reads a markdown file path/content and passes it to convertMdToPdf", "confidence": 0.9, "note": "The repo ships a CLI that reads untrusted markdown input and passes it to grayMatter without disabling the JS engine, so the sink is reachable in-repo via the CLI.", "error": null}
+{"repo": "imzbf/md-editor-v3", "family": "output_encoding", "ecosystem": "npm", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "md-editor-v3 is a Vue Markdown editor component library; the XSS sink is reached only when an external consuming application passes attacker-controlled Markdown to MdPreview, so reachability cannot be resolved from this repo alone.", "error": null}
+{"repo": "jupyter-lsp/jupyterlab-lsp", "family": "path", "ecosystem": "pip", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.85, "note": "jupyterlab-lsp is a JupyterLab extension/plugin whose LSP handlers are wired by the external jupyter-server/jupyterlab host, so untrusted input reachability depends on the consuming server configuration rather than this repo alone.", "error": null}
+{"repo": "masci/banks", "family": "path", "ecosystem": "pip", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "banks is a prompt-library/SDK; DirectoryPromptRegistry.set() is a public API whose prompt.name is supplied by an external consuming application, and no in-repo HTTP/CLI/event entry point feeds untrusted input to it.", "error": null}
+{"repo": "bytebase/dbhub", "family": "access_control", "ecosystem": "npm", "label_sound": false, "shape": "application", "reachability_in_repo": true, "entry_point": "HTTP /mcp endpoint (unauthenticated, binds 0.0.0.0) exposing the execute_sql tool", "confidence": 0.85, "note": "dbhub ships a runnable MCP server whose HTTP transport exposes execute_sql to network callers, so the untrusted-input entry point reaching the read-only bypass sink is present in-repo.", "error": null}
+{"repo": "laravel/pulse", "family": "injection", "ecosystem": "composer", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "Laravel Pulse is a package whose Livewire components are mounted by consuming applications; the vulnerable remember() method is a public API invoked by external callers, so reachability depends on how a host app wires the Pulse dashboard.", "error": null}
+{"repo": "webpack/webpack-bundle-analyzer", "family": "output_encoding", "ecosystem": "npm", "label_sound": false, "shape": "mixed", "reachability_in_repo": true, "entry_point": "startServer HTTP route '/' rendering viewer.ejs with JSON.stringify(chartData)", "confidence": 0.85, "note": "The package is primarily a library/CLI, but it ships a runnable Express server whose '/' route renders chartData via JSON.stringify into the viewer template, making the XSS sink reachable in-repo.", "error": null}
+{"repo": "ondata/ckan-mcp-server", "family": "untrusted_destination", "ecosystem": "npm", "label_sound": false, "shape": "mixed", "reachability_in_repo": true, "entry_point": "MCP server HTTP transport (POST /mcp) / MCP tool handlers accepting caller-supplied server_url", "confidence": 0.75, "note": "The repo ships a runnable MCP server (createServer/registerAll) whose tools take a caller-supplied server_url that flows to the SSRF sink, so reachability is resolvable in-repo, though the guard itself lives in a separate file not shown.", "error": null}
+{"repo": "geosolutions-it/jai-ext", "family": "injection", "ecosystem": "maven", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "jai-ext is a library whose Jiffle script compilation API is invoked by external consumers like GeoServer; no in-repo HTTP/CLI/event entry point feeds untrusted scripts to the Janino sink.", "error": null}
+{"repo": "neoteroi/blacksheep", "family": "output_encoding", "ecosystem": "pip", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "BlackSheep is an HTTP framework/library; the CRLF sink is in its client API, and exploitation requires an external consuming application to pass unsanitized user input into headers, so reachability is not resolvable from this repo alone.", "error": null}
+{"repo": "locize/i18next-locize-backend", "family": "path", "ecosystem": "npm", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "i18next-locize-backend is an npm backend plugin whose lng/ns/projectId/version values come from the consuming i18next app (query params, cookies, headers), so reachability depends on external wiring not present in this repo.", "error": null}
+{"repo": "jenkinsci/junit-plugin", "family": "output_encoding", "ecosystem": "maven", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "The JUnit plugin is a Jenkins plugin whose XSS sink is reached via Jenkins core rendering of test result descriptions supplied by external callers, so reachability depends on the consuming Jenkins instance, not this repo alone.", "error": null}
+{"repo": "langchain-ai/langchain-community", "family": "untrusted_destination", "ecosystem": "pip", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "EverNoteLoader is a document loader class whose file_path is supplied by an external consuming application, so the untrusted XML input entry point is not in this repo.", "error": null}
+{"repo": "jenkinsci/influxdb-plugin", "family": "config_secrets", "ecosystem": "maven", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Jenkins plugin whose credential storage is configured by Jenkins itself, so the untrusted-input entry point lies outside this repo.", "error": null}
+{"repo": "decentralized-identity/veramo", "family": "injection", "ecosystem": "npm", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "@veramo/data-store is an npm library whose FindArgs.order.column is supplied by external consuming applications, so reachability depends on how a caller wires untrusted input into the ORM query.", "error": null}
+{"repo": "mjmlio/mjml", "family": "path", "ecosystem": "npm", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "MJML is a library/framework whose MJMLParser receives XML and options (including filePath) from external callers, so the mj-include traversal sink is only reachable when a consuming app passes untrusted input.", "error": null}
+{"repo": "jenkinsci/docker-plugin", "family": "access_control", "ecosystem": "maven", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Jenkins plugin (library) whose DescriptorImpl#doTestConnection is invoked by the Jenkins core Stapler framework, not by an in-repo entry point, so reachability depends on the consuming Jenkins application.", "error": null}
+{"repo": "jenkinsci/role-strategy-plugin", "family": "access_control", "ecosystem": "maven", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "This is a Jenkins plugin (library) whose permission-check logic is invoked by the Jenkins core/other plugins, so the untrusted-input entry point is external to this repo.", "error": null}
+{"repo": "jenkinsci/jira-plugin", "family": "access_control", "ecosystem": "maven", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Jenkins plugin (library) whose JiraSite form-validation methods are invoked by the Jenkins core/Stapler framework outside this repo, so reachability depends on the consuming Jenkins instance.", "error": null}
+{"repo": "chriskacerguis/codeigniter-restserver", "family": "untrusted_destination", "ecosystem": "composer", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "codeigniter-restserver is an abstract REST_Controller library/framework that consuming CodeIgniter apps extend; the XXE sink is reached only when an external application wires untrusted request input into it, so reachability is not resolvable in this repo alone.", "error": null}
+{"repo": "ballcat-projects/ballcat-codegen", "family": "injection", "ecosystem": "maven", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.85, "note": "FreemarkerTemplateEngine is a Spring component whose render() takes templateContent from an external caller; the repo provides the template engine library, and reachability depends on how a consuming application exposes template editing/rendering to untrusted input.", "error": null}
+{"repo": "getzep/graphiti", "family": "injection", "ecosystem": "pip", "label_sound": true, "shape": "mixed", "reachability_in_repo": true, "entry_point": "Graphiti MCP server tool search_nodes (entity_types -> SearchFilters.node_labels)", "confidence": 0.75, "note": "Graphiti is primarily a library, but it ships an MCP server entry point that maps untrusted entity_types into the vulnerable node_labels Cypher construction, making the injection reachable in-repo.", "error": null}
+{"repo": "docsifyjs/docsify", "family": "output_encoding", "ecosystem": "npm", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "Docsify is a client-side documentation framework/library whose fetchMixin and isExternal are invoked by consuming sites, so the untrusted URL/HTML input is supplied by external callers, not by an in-repo entry point.", "error": null}
+{"repo": "nvbn/thefuck", "family": "path", "ecosystem": "pip", "label_sound": false, "shape": "application", "reachability_in_repo": true, "entry_point": "thefuck CLI command correction flow invoking side_effect on tar extract commands", "confidence": 0.85, "note": "Thefuck is a CLI tool whose correction flow calls side_effect on matched tar commands, so untrusted command input reaches the os.remove sink in-repo.", "error": null}
+{"repo": "i18next/i18next-http-middleware", "family": "output_encoding", "ecosystem": "npm", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "i18next-http-middleware is a middleware library; the untrusted lng parameter enters via an external consuming application's HTTP request, so reachability depends on how a host app wires the middleware.", "error": null}
+{"repo": "vitejs/launch-editor", "family": "injection", "ecosystem": "npm", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "launch-editor is a library whose launchEditor(file) API is called by external consumers (e.g., dev servers); the repo contains no HTTP route, CLI, or handler that feeds untrusted input to the sink.", "error": null}
+{"repo": "jenkinsci/sonar-gerrit-plugin", "family": "config_secrets", "ecosystem": "maven", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Jenkins plugin (library) whose credential-storing config class is wired by the Jenkins master/consuming job configuration, so the untrusted-input entry point is not contained in this repo.", "error": null}
+{"repo": "actions/toolkit", "family": "injection", "ecosystem": "npm", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "@actions/core is a library whose exportVariable is called by external action authors with their own untrusted input, so reachability depends on consuming workflows not present in this repo.", "error": null}
+{"repo": "i18next/i18next-http-backend", "family": "untrusted_destination", "ecosystem": "npm", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "i18next-http-backend is a plugin whose read(lng, ns) API is called by a consuming i18next app; the repo contains no HTTP route, CLI, or handler that supplies attacker-controlled language input, so reachability depends on external wiring.", "error": null}
+{"repo": "jenkinsci/radargun-plugin", "family": "deserialization", "ecosystem": "maven", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "This is a Jenkins plugin whose YAML parsing is invoked by the Jenkins build step configured by an external user, so the untrusted-input entry point lives in the consuming Jenkins application, not in this repo.", "error": null}
+{"repo": "jenkinsci/gitlab-oauth-plugin", "family": "untrusted_destination", "ecosystem": "maven", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Jenkins authentication plugin (library) whose open-redirect sink is triggered by the Jenkins host application's HTTP login flow, not by an entry point defined within this repo.", "error": null}
+{"repo": "sorlen008/desktopcommandermcp", "family": "untrusted_destination", "ecosystem": "npm", "label_sound": true, "shape": "mixed", "reachability_in_repo": true, "entry_point": "MCP tool handler read_file (src/tools/filesystem.ts) invoked via the DesktopCommanderMCP server/CLI", "confidence": 0.75, "note": "DesktopCommanderMCP ships a runnable MCP server/CLI whose read_file tool handler passes an attacker-controlled url argument to readFileFromUrl, making the SSRF reachable in-repo, though the tool is also exposed as a library API.", "error": null}
+{"repo": "zereight/gitlab-mcp", "family": "path", "ecosystem": "npm", "label_sound": false, "shape": "application", "reachability_in_repo": true, "entry_point": "Express HTTP server exposing /sse and /messages endpoints (SSE transport) that invoke MCP tools including upload_markdown", "confidence": 0.95, "note": "The repo ships a runnable MCP server (src/index.ts) with an in-repo HTTP entry point that routes unauthenticated requests to the upload_markdown tool, so reachability is resolvable by scanning this repo alone.", "error": null}
+{"repo": "zenitram/malla", "family": "output_encoding", "ecosystem": "pip", "label_sound": true, "shape": "application", "reachability_in_repo": true, "entry_point": "MQTT NODEINFO_APP packet ingestion (malla-capture) storing node names, rendered in dashboard templates/JS", "confidence": 0.9, "note": "Malla is a runnable dashboard app that ingests untrusted MQTT node names in-repo and renders them into the DOM, so reachability is resolvable within this repository.", "error": null}
+{"repo": "fastapi-users/fastapi-users", "family": "access_control", "ecosystem": "pip", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "fastapi-users is a library/framework whose OAuth router is mounted by consuming applications; the vulnerable state-token logic is reachable only when an external app wires the router, so reachability cannot be resolved from this repo alone.", "error": null}
+{"repo": "adfinis/document-merge-service", "family": "injection", "ecosystem": "pip", "label_sound": true, "shape": "application", "reachability_in_repo": true, "entry_point": "document upload/render endpoint that processes user-supplied Jinja2 templates via get_jinja_env()", "confidence": 0.9, "note": "The repo is a Django service (document-merge-service) that renders user-uploaded documents through Jinja2, so the untrusted template input reaches the SSTI sink in-repo.", "error": null}
+{"repo": "punkpeye/mcp-remote", "family": "injection", "ecosystem": "npm", "label_sound": true, "shape": "mixed", "reachability_in_repo": true, "entry_point": "mcp-remote CLI binary that connects to a user-supplied MCP server URL and processes the authorization_endpoint response URL", "confidence": 0.85, "note": "mcp-remote ships a runnable CLI (npx mcp-remote <server-url>) that acts as an MCP client, so the untrusted authorization_endpoint URL from a malicious MCP server reaches the sink in-repo, though the package is also usable as a library.", "error": null}
+{"repo": "blackprint/engine-js", "family": "injection", "ecosystem": "npm", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "@blackprint/engine is a framework/library whose setDeepProperty is a public utility invoked by external consumers, so reachability depends on how a consuming app wires untrusted input to it.", "error": null}
+{"repo": "rap2hpoutre/laravel-log-viewer", "family": "config_secrets", "ecosystem": "composer", "label_sound": true, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.9, "note": "This is a Laravel/Lumen package whose LogViewerController is wired into routes by the consuming application, so the HTTP entry point and untrusted input flow are not present in this repo.", "error": null}
+{"repo": "nyariv/sandboxjs", "family": "injection", "ecosystem": "npm", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "@nyariv/sandboxjs is a sandboxing library whose compile()/run() API is invoked by external consuming applications, so the untrusted payload entry point is not in this repo.", "error": null}
+{"repo": "miguelgrinberg/python-socketio", "family": "deserialization", "ecosystem": "pip", "label_sound": false, "shape": "library", "reachability_in_repo": false, "entry_point": "none (external caller)", "confidence": 0.95, "note": "python-socketio is a library/framework; the vulnerable pickle.loads sink is reached only when a consuming application configures a RedisManager message queue and an attacker with queue access publishes a malicious message, so reachability depends on external wiring not present in this repo.", "error": null}