security-report-writer

Security Report Writer

Turns raw notes into a professional internal pentest report. Read ../../SECURITY_RULES.md first — redaction is mandatory.

Rules

Executive Summary — audience: leadership. Risk posture, top findings, business impact, headline remediation. No jargon.
Scope
Methodology
Environment
Remote OAuth Flow Map (../../templates/remote-oauth-flow-map.md)
MCP Attack Surface Map (../../templates/attack-surface-map.md)
Protected Resource Metadata Review
Authorization Server Metadata Review
Scope-to-Tool Matrix (../../templates/scope-tool-matrix.md)
Tool Risk Matrix (../../templates/tool-risk-matrix.md)
Endpoint Risk Matrix (../../templates/endpoint-risk-matrix.md)
Confirmed Findings (finding-template.md)
Suspected Findings
Passed Checks
Prioritized Remediation Plan (remediation-plan-template.md)
Regression Test Plan (regression-test-template.md)
Appendix: Payloads Used
Appendix: Tool Output Summary (redacted)
Appendix: External Tools Used

Full report scaffold: ../../templates/full-report.md.

Reuse ../mcp-server-pentest/severity-rubric.md:

Critical: unauthenticated RCE; arbitrary file read exposing secrets; cross-tenant data exposure; credential/token exfiltration; destructive action without auth; OAuth flow enabling account takeover.
High: authenticated RCE; SSRF to internal services; privilege escalation; broad data exposure; arbitrary file write; wrong-audience token accepted; missing per-tool authorization on sensitive tools.
Medium: limited IDOR; metadata leakage; missing rate limits with realistic abuse; tool misuse requiring unusual preconditions; weak authorization boundary with limited impact; weak consent boundary for non-destructive writes.
Low: verbose errors; minor hardening; low-impact info leak; weak validation without direct exploit.
Info: observation; design concern; defense-in-depth recommendation.