Demo data. Example Corp is fictitious, and nothing you do here is saved.

You are viewing as Léa M., Client software owner. Owns the Support assistant agent. Asks for access, can't approve it.

Example Corp assistant

Start a review

MCP server with 6 tools and 11 API operations. No approved baseline yet.

Critical

Warnings

Notes

Scopes

15 of 46 findings

Critical1

Finding	Who acts
getMonthlyReportThe API accepts tokens from the password flowScopeNeat recommendation: Remove the password flow from the scheme. Clients move to the authorization code flow, or to client credentials when no user is involved.Next step: IAM engineering turns the password flow off at the identity provider, client owners move to the authorization code flow, and the developer removes it from the description.Sources: RFC 9700 §2.4. Defined by the standard References (3) A finding supports evidence for these requirements. On its own it does not make an organization compliant. DORA Art. 9(4)(d) Supports evidence implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers. RTS 2024/1774 Art. 21(f)(ii) Supports evidence the use of strong authentication methods in accordance with leading practices and techniques for remote access to the financial entity’s network, for privileged access, for access to ICT assets supporting critical or important functions or ICT assets that are publicly accessible Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. ISO/IEC 27001 A.8.5 Supports evidence Secure authentication Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.	Accountable, Responsible: IAM engineeringResponsible: DeveloperConsulted: Security, Client software ownerInformed: Resource owner

Finding

Who acts

getMonthlyReportThe API accepts tokens from the password flowScopeNeat recommendation: Remove the password flow from the scheme. Clients move to the authorization code flow, or to client credentials when no user is involved.Next step: IAM engineering turns the password flow off at the identity provider, client owners move to the authorization code flow, and the developer removes it from the description.Sources: RFC 9700 §2.4. Defined by the standard

References (3)

A finding supports evidence for these requirements. On its own it does not make an organization compliant.

DORA Art. 9(4)(d) Supports evidence
implement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes
Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers.
RTS 2024/1774 Art. 21(f)(ii) Supports evidence
the use of strong authentication methods in accordance with leading practices and techniques for remote access to the financial entity’s network, for privileged access, for access to ICT assets supporting critical or important functions or ICT assets that are publicly accessible
Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.
ISO/IEC 27001 A.8.5 Supports evidence
Secure authentication
Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.

IAM engineering Developer Security, Client software owner Resource owner

Warnings4

Finding	Who acts
User.Read, user.readTwo scopes that differ only by caseScopeNeat recommendation: Keep one spelling, move its users to it, then delete the other.Next step: The steward keeps one spelling, client owners move to it, and IAM engineering deletes the other after the migration window.Sources: RFC 6749 §3.3. Defined by the standard	Accountable, Responsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Resource owner
adminA scope that grants everythingScopeNeat recommendation: Split it into scopes that each name a resource and an action, and give clients and tools only those they need.Next step: The steward proposes narrower scopes, the resource owner approves them with security consulted, and clients and tools move to them.Sources: MCP Security Best Practices Scope Minimization, RFC 9700 §2.3. Published security guidance References (4) A finding supports evidence for these requirements. On its own it does not make an organization compliant. DORA Art. 9(4)(c) Supports evidence implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers. RTS 2024/1774 Art. 21(a) Supports evidence the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. ISO/IEC 27001 A.8.2 Supports evidence Privileged access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. ISO/IEC 27001 A.5.15 Supports evidence Access control Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.	Accountable: Resource ownerResponsible: Scope stewardConsulted: MCP server owner, Client software owner, SecurityInformed: IAM engineering
files:*A scope that grants everythingScopeNeat recommendation: Split it into scopes that each name a resource and an action, and give clients and tools only those they need.Next step: The steward proposes narrower scopes, the resource owner approves them with security consulted, and clients and tools move to them.Sources: MCP Security Best Practices Scope Minimization, RFC 9700 §2.3. Published security guidance References (4) A finding supports evidence for these requirements. On its own it does not make an organization compliant. DORA Art. 9(4)(c) Supports evidence implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof Applies as: legal requirement. Binds EU financial entities such as banks, payment and e-money institutions, investment firms and insurers. RTS 2024/1774 Art. 21(a) Supports evidence the assignment of access rights to ICT assets based on need-to-know, need-to-use and least privilege principles, including for remote and emergency access Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21. ISO/IEC 27001 A.8.2 Supports evidence Privileged access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. ISO/IEC 27001 A.5.15 Supports evidence Access control Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.	Accountable: Resource ownerResponsible: Scope stewardConsulted: MCP server owner, Client software owner, SecurityInformed: IAM engineering
getMonthlyReportThe API accepts tokens from the implicit flowScopeNeat recommendation: Remove the implicit flow from the scheme. Browser apps move to the authorization code flow with PKCE.Next step: IAM engineering turns the implicit flow off at the identity provider, client owners move to the authorization code flow with PKCE, and the developer removes it from the description.Sources: RFC 9700 §2.1.2. Recommended by the standard (SHOULD) References (1) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.8.5 Related Secure authentication Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate.	Accountable, Responsible: IAM engineeringResponsible: DeveloperConsulted: Security, Client software ownerInformed: Resource owner

Notes10

Finding	Who acts
read_usersNot written like the other scopesScopeNeat recommendation: Rename it in the dominant convention when its users can follow, or record the exception in the dictionary.Next step: The steward renames it in the dominant convention, or records the exception in the dictionary.Sources: RFC 6749 §3.3. YogaSec practice	Accountable, Responsible: Scope stewardConsulted: Client software ownerInformed: Resource owner
getUsersNot written like the other scopesScopeNeat recommendation: Rename it in the dominant convention when its users can follow, or record the exception in the dictionary.Next step: The steward renames it in the dominant convention, or records the exception in the dictionary.Sources: RFC 6749 §3.3. YogaSec practice	Accountable, Responsible: Scope stewardConsulted: Client software ownerInformed: Resource owner
User.ReadNot written like the other scopesScopeNeat recommendation: Rename it in the dominant convention when its users can follow, or record the exception in the dictionary.Next step: The steward renames it in the dominant convention, or records the exception in the dictionary.Sources: RFC 6749 §3.3. YogaSec practice	Accountable, Responsible: Scope stewardConsulted: Client software ownerInformed: Resource owner
user.readNot written like the other scopesScopeNeat recommendation: Rename it in the dominant convention when its users can follow, or record the exception in the dictionary.Next step: The steward renames it in the dominant convention, or records the exception in the dictionary.Sources: RFC 6749 §3.3. YogaSec practice	Accountable, Responsible: Scope stewardConsulted: Client software ownerInformed: Resource owner
read_usersDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
getUsersDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
User.ReadDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
user.readDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
api:writeDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit
factures:créerDeclared but used by nothing hereScopeNeat recommendation: Find who still requests it. If nobody does, remove it from the authorization server and from the API description.Next step: The resource owner confirms retirement, and IAM engineering removes it after checking that no client still requests it.Sources: RFC 6749 §3.3. YogaSec practice References (2) A finding supports evidence for these requirements. On its own it does not make an organization compliant. ISO/IEC 27001 A.5.18 Related Access rights Applies as: certifiable standard. Binding only for a certified organization, on the scope of its certificate. RTS 2024/1774 Art. 21(e)(iii) Related withdrawal of access rights without undue delay upon termination of the employment or when the access is no longer necessary Applies as: legal requirement. Binds the EU financial entities under DORA. Entities under the simplified framework follow Article 33 instead of Article 21.	Accountable: Resource ownerResponsible: Scope stewardResponsible: IAM engineeringConsulted: Client software ownerInformed: Internal audit