patchbay audit findings
Every finding patchbay surfaces has an id. This page explains what each one means, when it fires and how to fix it. The scanner is in packages/audit-core.
| ID | Severity | What it catches |
|---|---|---|
| AUDIENCE-001 | critical | tools/list succeeded with a bearer token that was minted for a different resource on the same authorization server. |
| AUDIENCE-002 | critical | tools/list was accepted with a bearer token whose JWT payload has no aud claim at all. |
| AUTH-001 | critical | Server returns tools/list without any credential and at least one tool name looks mutating. |
| AUTH-002 | critical | Server accepts bearer or API-key auth but serves no .well-known OAuth metadata. |
| SECRET-001 | critical | A credential-shaped string literal is checked into a non-test source file. |
| AUTH-003 | high | OAuth metadata exists but code_challenge_methods_supported does not include "S256". |
| AUTH-005 | high | OAuth metadata is served but offers neither Client ID Metadata Documents nor a "registration_endpoint". |
| AUTH-006 | high | Dynamic Client Registration refused "http://127.0.0.1:PORT/callback" and "http://localhost:PORT/callback" as redirect URIs. |
| POISONING-001 | high | A tool description or input schema description contains hidden characters or text that addresses the model. |
| RESOURCE-001 | high | The server uses OAuth but serves no usable /.well-known/oauth-protected-resource document. |
| SCOPE-001 | high | Server advertises OAuth but tools either share one scope or declare none. |
| TRANSPORT-001 | high | The MCP endpoint URL starts with http:// and is not a localhost dev server. |
| AUTH-007 | medium | The server rejected a made-up bearer token with a status other than 401. |
| HEADERS-001 | medium | The server is missing one or more standard security headers on its responses, or opens itself to any browser origin. |
| MANIFEST-001 | medium | The set of tools this server exposes is different from the manifest patchbay pinned on an earlier run. |
| MANIFEST-002 | medium | The tool manifest changed since the pinned run and this check sorts the change into breaking, additive or semantic drift. |
| REDIRECT-001 | medium | The token endpoint responded with different status codes for redirect_uri=http://localhost/cb vs http://127.0.0.1/cb. |
| SCOPE-002 | medium | A scope that covers write/destructive tools also covers read tools. |
| SECRET-002 | medium | Code reads credentials from env but never calls a refresh_token flow. |
| ISS-001 | low | The authorization server does not set authorization_response_iss_parameter_supported to true. |
| TRANSPORT-002 | low | A tools/list call with Origin: https://attacker.example got a 2xx response. |
| AUTH-004 | info | OAuth metadata does not advertise "resource_indicators_supported": true. |
| CHECK-CRASHED | info | A patchbay check function threw an exception while evaluating this snapshot. |
| PROBE-001 | info | patchbay could reach the server but could not learn enough to judge auth posture. |
Run the auditor: npx -y @patchbay-nebius/agent audit <url-or-directory>