Demo data. Example Corp is fictitious, and nothing you do here is saved.

You are viewing as Inès D., Internal audit. Reads every decision, changes nothing.

Example Corp assistant

Start a review

MCP server with 6 tools and 11 API operations. No approved baseline yet.

Critical

Warnings

Notes

Scopes

8 of 46 findings

Warnings2

Finding	Who acts
reportsThe scope has no real descriptionScopeNeat recommendation: Write one plain sentence saying what the scope allows, and on which data.Next step: The steward writes what the scope allows, and the resource owner confirms it before approving the scope.Sources: OpenAPI 3.1.1 §4.8.29.1. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.9 Related Inventory of information and other associated assets Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.	Accountable: Resource ownerResponsible: Scope stewardInformed: Internal audit
process_refundThe tool can both start an action and approve itOperations: createRefund, approveRefundScopeNeat recommendation: Split the tool in two, and leave approving to another client or to a person. Or give approving the human approval mode.Next step: The MCP server owner splits the tool, security is consulted on who approves, and the resource owner approves the new mapping.Sources: NIST SP 800-53 AC-5. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. RTS 2024/1774 Art. 21(b) Supports evidence the segregation of duties designed to prevent unjustified access to critical data or to prevent the allocation of combinations of access rights that may be used to circumvent controls Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. ISO/IEC 27001 A.5.3 Supports evidence Segregation of duties Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.	Accountable: Resource ownerResponsible: MCP server ownerConsulted: SecurityInformed: Internal audit

Finding

Who acts

reportsThe scope has no real descriptionScopeNeat recommendation: Write one plain sentence saying what the scope allows, and on which data.Next step: The steward writes what the scope allows, and the resource owner confirms it before approving the scope.Sources: OpenAPI 3.1.1 §4.8.29.1. YogaSec practice

References (2)

A finding supports evidence for these requirements. On its own it does not make an organization compliant.

ISO/IEC 27001 A.5.9 Related
Inventory of information and other associated assets
Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.
ISO/IEC 27001 A.5.18 Related
Access rights
Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

Resource owner Scope steward Internal audit

process_refundThe tool can both start an action and approve itOperations: createRefund, approveRefundScopeNeat recommendation: Split the tool in two, and leave approving to another client or to a person. Or give approving the human approval mode.Next step: The MCP server owner splits the tool, security is consulted on who approves, and the resource owner approves the new mapping.Sources: NIST SP 800-53 AC-5. YogaSec practice

References (2)

A finding supports evidence for these requirements. On its own it does not make an organization compliant.

RTS 2024/1774 Art. 21(b) Supports evidence
the segregation of duties designed to prevent unjustified access to critical data or to prevent the allocation of combinations of access rights that may be used to circumvent controls
Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.
ISO/IEC 27001 A.5.3 Supports evidence
Segregation of duties
Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

Resource owner MCP server owner Security Internal audit

Notes6

Finding	Who acts
read_usersDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
getUsersDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
User.ReadDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
user.readDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
api:writeDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
factures:créerDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit