{
  "$schema": "https://json-schema.org/draft-07/schema#",
  "title": "mcpreflight endpoint trust report",
  "type": "object",
  "required": [
    "reportVersion",
    "scannedAt",
    "server",
    "endpoint",
    "trust"
  ],
  "properties": {
    "reportVersion": {
      "type": "integer",
      "const": 1
    },
    "generatedBy": {
      "type": "string"
    },
    "scannedAt": {
      "type": "string",
      "description": "ISO 8601 UTC timestamp of the scan that produced this file"
    },
    "server": {
      "type": "object",
      "properties": {
        "registryName": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "description": {
          "type": "string"
        },
        "registryVersion": {
          "type": "string"
        }
      }
    },
    "endpoint": {
      "type": "string",
      "description": "The remote MCP endpoint URL that was probed"
    },
    "trust": {
      "type": "object",
      "required": [
        "finalStatus",
        "findings"
      ],
      "properties": {
        "finalStatus": {
          "type": "string",
          "enum": [
            "PASS",
            "FAIL",
            "AUTH_GATED",
            "UNKNOWN"
          ]
        },
        "protocolVersion": {
          "type": [
            "string",
            "null"
          ],
          "description": "MCP protocolVersion negotiated in initialize, null when no handshake"
        },
        "serverInfo": {
          "type": [
            "object",
            "null"
          ]
        },
        "toolCount": {
          "type": [
            "integer",
            "null"
          ]
        },
        "findings": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "code",
              "severity",
              "message"
            ],
            "properties": {
              "code": {
                "type": "string"
              },
              "severity": {
                "type": "string",
                "enum": [
                  "INFO",
                  "WARN",
                  "ERROR"
                ]
              },
              "message": {
                "type": "string"
              }
            }
          }
        }
      }
    },
    "authGate": {
      "type": "object",
      "description": "Present only when finalStatus is AUTH_GATED"
    },
    "verify": {
      "type": "string",
      "description": "Command that reproduces this report locally"
    }
  }
}