{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-99b8ae69b6fff0c9", "name": "`truncate` class without `title=` for hover reveal \u2014 src/App.tsx:249", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/App.tsx:249"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8987d6d1c30c7202", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-961309c4ae90339b", "name": "Possible secret in src/AIClientConnections.tsx", "shortDescription": {"text": "Possible secret in src/AIClientConnections.tsx"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fe1fc82bbee3ea4d", "name": "Very large file: src/App.tsx (1435 lines)", "shortDescription": {"text": "Very large file: src/App.tsx (1435 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ad73ad34e0e9267", "name": "Very large file: src/server/mcpServerFactory.ts (1524 lines)", "shortDescription": {"text": "Very large file: src/server/mcpServerFactory.ts (1524 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "10 tests / 41 src (ratio 0.24)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1229cd0c74a9a2b9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/App.tsx:1095", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/App.tsx:1095"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DISABLE_HMR`, `FIREBASE_PROJECT_ID`, `FIRESTORE_DATABASE_ID`, `GOOGLE_APPLICATION_CREDENTIALS`, `LOG_LEVEL`, `NODE_ENV`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71e8f143efba253c", "name": "Dangling fetch: GET /api/mcp/observability/metrics (src/Observability.tsx:219)", "shortDescription": {"text": "Dangling fetch: GET /api/mcp/observability/metrics (src/Observability.tsx:219)"}, "fullDescription": {"text": "`src/Observability.tsx:219` calls `GET /api/mcp/observability/metrics` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/observability/metrics`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3ca97d7c0c2aba26", "name": "Dangling fetch: GET /api/mcp/observability/alerts (src/Observability.tsx:235)", "shortDescription": {"text": "Dangling fetch: GET /api/mcp/observability/alerts (src/Observability.tsx:235)"}, "fullDescription": {"text": "`src/Observability.tsx:235` calls `GET /api/mcp/observability/alerts` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/observability/alerts`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3ff31a625c4723f8", "name": "Dangling fetch: POST /api/mcp/observability/alerts/${alertId}/resolve (src/Observability.tsx:252)", "shortDescription": {"text": "Dangling fetch: POST /api/mcp/observability/alerts/${alertId}/resolve (src/Observability.tsx:252)"}, "fullDescription": {"text": "`src/Observability.tsx:252` calls `POST /api/mcp/observability/alerts/${alertId}/resolve` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/observability/alerts/<p>/resolve`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0313acf6059bacfa", "name": "Dangling fetch: POST /api/mcp/oauth/complete (src/App.tsx:343)", "shortDescription": {"text": "Dangling fetch: POST /api/mcp/oauth/complete (src/App.tsx:343)"}, "fullDescription": {"text": "`src/App.tsx:343` calls `POST /api/mcp/oauth/complete` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/oauth/complete`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf8b06be25e3a94a", "name": "Dangling fetch: POST /api/mcp/keys (src/App.tsx:427)", "shortDescription": {"text": "Dangling fetch: POST /api/mcp/keys (src/App.tsx:427)"}, "fullDescription": {"text": "`src/App.tsx:427` calls `POST /api/mcp/keys` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/keys`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ba18d870d247dd3e", "name": "Dangling fetch: DELETE /api/mcp/keys/${id} (src/App.tsx:449)", "shortDescription": {"text": "Dangling fetch: DELETE /api/mcp/keys/${id} (src/App.tsx:449)"}, "fullDescription": {"text": "`src/App.tsx:449` calls `DELETE /api/mcp/keys/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/keys/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-079db7d008d6ecd7", "name": "Dangling fetch: GET /api/mcp/mcp-servers (src/App.tsx:619)", "shortDescription": {"text": "Dangling fetch: GET /api/mcp/mcp-servers (src/App.tsx:619)"}, "fullDescription": {"text": "`src/App.tsx:619` calls `GET /api/mcp/mcp-servers` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/mcp-servers`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1a3583e4f68ad40", "name": "Dangling fetch: GET /api/mcp/data-providers (src/App.tsx:797)", "shortDescription": {"text": "Dangling fetch: GET /api/mcp/data-providers (src/App.tsx:797)"}, "fullDescription": {"text": "`src/App.tsx:797` calls `GET /api/mcp/data-providers` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/data-providers`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5fb81b1907e49f4e", "name": "Dangling fetch: PUT /api/mcp/data-providers/${provider} (src/App.tsx:905)", "shortDescription": {"text": "Dangling fetch: PUT /api/mcp/data-providers/${provider} (src/App.tsx:905)"}, "fullDescription": {"text": "`src/App.tsx:905` calls `PUT /api/mcp/data-providers/${provider}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/data-providers/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bfa3027de2bb73a0", "name": "Dangling fetch: POST /api/mcp/connections (src/App.tsx:1095)", "shortDescription": {"text": "Dangling fetch: POST /api/mcp/connections (src/App.tsx:1095)"}, "fullDescription": {"text": "`src/App.tsx:1095` calls `POST /api/mcp/connections` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/connections`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f41b0bf503110e3", "name": "Dangling fetch: DELETE /api/mcp/connections/${id} (src/App.tsx:1121)", "shortDescription": {"text": "Dangling fetch: DELETE /api/mcp/connections/${id} (src/App.tsx:1121)"}, "fullDescription": {"text": "`src/App.tsx:1121` calls `DELETE /api/mcp/connections/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/mcp/connections/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-502435253398ee20", "name": "Dangling fetch: GET https://api.coingecko.com/api/v3/search (src/server/mcpServerFactory.ts:1458)", "shortDescription": {"text": "Dangling fetch: GET https://api.coingecko.com/api/v3/search (src/server/mcpServerFactory.ts:1458)"}, "fullDescription": {"text": "`src/server/mcpServerFactory.ts:1458` calls `GET https://api.coingecko.com/api/v3/search` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/https:/api.coingecko.com/api/v3/search`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-76889df7c8e240c5", "name": "Unused endpoint: USE /api/", "shortDescription": {"text": "Unused endpoint: USE /api/"}, "fullDescription": {"text": "`server.ts` declares `USE /api/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`server.ts` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4df67aa27a99eee8", "name": "Unused endpoint: USE /api/mcp", "shortDescription": {"text": "Unused endpoint: USE /api/mcp"}, "fullDescription": {"text": "`server.ts` declares `USE /api/mcp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304b6f2b403d93f7", "name": "Unused endpoint: POST /register", "shortDescription": {"text": "Unused endpoint: POST /register"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d345fa90f5de3745", "name": "Unused endpoint: GET /authorize", "shortDescription": {"text": "Unused endpoint: GET /authorize"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /authorize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-358815753e8867f1", "name": "Unused endpoint: POST /token", "shortDescription": {"text": "Unused endpoint: POST /token"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4b8ab45c4aa4bc9", "name": "Unused endpoint: POST /revoke", "shortDescription": {"text": "Unused endpoint: POST /revoke"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /revoke` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e122d32e50f64310", "name": "Unused endpoint: POST /oauth/complete", "shortDescription": {"text": "Unused endpoint: POST /oauth/complete"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /oauth/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84e8d14936eb00f7", "name": "Unused endpoint: GET /mcp-servers/catalog", "shortDescription": {"text": "Unused endpoint: GET /mcp-servers/catalog"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /mcp-servers/catalog` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfcae07f4cfc8ede", "name": "Unused endpoint: GET /mcp-servers", "shortDescription": {"text": "Unused endpoint: GET /mcp-servers"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /mcp-servers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b819f0746ee199ef", "name": "Unused endpoint: PUT /mcp-servers/:serverId", "shortDescription": {"text": "Unused endpoint: PUT /mcp-servers/:serverId"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `PUT /mcp-servers/:serverId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9952686b8eb8c174", "name": "Unused endpoint: POST /mcp-servers/:serverId/test", "shortDescription": {"text": "Unused endpoint: POST /mcp-servers/:serverId/test"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /mcp-servers/:serverId/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d29e8f5d60bec61", "name": "Unused endpoint: DELETE /mcp-servers/:serverId", "shortDescription": {"text": "Unused endpoint: DELETE /mcp-servers/:serverId"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `DELETE /mcp-servers/:serverId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8a7cbeab63bd780", "name": "Unused endpoint: GET /data-providers", "shortDescription": {"text": "Unused endpoint: GET /data-providers"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /data-providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ebe202491ebeb71", "name": "Unused endpoint: PUT /data-providers/:provider", "shortDescription": {"text": "Unused endpoint: PUT /data-providers/:provider"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `PUT /data-providers/:provider` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14a59a941b290f3e", "name": "Unused endpoint: POST /data-providers/:provider/validate", "shortDescription": {"text": "Unused endpoint: POST /data-providers/:provider/validate"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /data-providers/:provider/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6b38014456b4734", "name": "Unused endpoint: DELETE /data-providers/:provider", "shortDescription": {"text": "Unused endpoint: DELETE /data-providers/:provider"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `DELETE /data-providers/:provider` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff5506d508a76790", "name": "Unused endpoint: POST /connections", "shortDescription": {"text": "Unused endpoint: POST /connections"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /connections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c677c4e223a6fab", "name": "Unused endpoint: DELETE /connections/:id", "shortDescription": {"text": "Unused endpoint: DELETE /connections/:id"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `DELETE /connections/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f53365bbb1c16b8", "name": "Unused endpoint: POST /keys", "shortDescription": {"text": "Unused endpoint: POST /keys"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /keys` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d19dd7e4c3053a52", "name": "Unused endpoint: DELETE /keys/:id", "shortDescription": {"text": "Unused endpoint: DELETE /keys/:id"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `DELETE /keys/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77a487253c5b099b", "name": "Unused endpoint: GET /observability/metrics", "shortDescription": {"text": "Unused endpoint: GET /observability/metrics"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /observability/metrics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-22353ef04dfa7fc8", "name": "Unused endpoint: GET /observability/alerts", "shortDescription": {"text": "Unused endpoint: GET /observability/alerts"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /observability/alerts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7421e3c178491a04", "name": "Unused endpoint: POST /observability/alerts/:id/resolve", "shortDescription": {"text": "Unused endpoint: POST /observability/alerts/:id/resolve"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /observability/alerts/:id/resolve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-13451f35f0ddd1ca", "name": "Unused endpoint: GET /sse", "shortDescription": {"text": "Unused endpoint: GET /sse"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `GET /sse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cde167f60259e05e", "name": "Unused endpoint: POST /messages", "shortDescription": {"text": "Unused endpoint: POST /messages"}, "fullDescription": {"text": "`src/server/mcp.ts` declares `POST /messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24133"}, "properties": {"repository": "AmaLS367/TradeMcp", "repoUrl": "https://github.com/AmaLS367/TradeMcp", "branch": "main"}, "results": [{"ruleId": "scanner-99b8ae69b6fff0c9", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/App.tsx:249"}, "properties": {"repobilityId": "903e15ea3fb71cd0", "scanner": "scanner-primary", "fingerprint": "99b8ae69b6fff0c9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8987d6d1c30c7202", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "068fbf45727eac17", "scanner": "scanner-primary", "fingerprint": "8987d6d1c30c7202", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8987d6d1c30c7202", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "506a1fe61d987ee5", "scanner": "scanner-primary", "fingerprint": "8987d6d1c30c7202", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-961309c4ae90339b", "level": "error", "message": {"text": "Possible secret in src/AIClientConnections.tsx"}, "properties": {"repobilityId": "4f22b7583f1193b5", "scanner": "scanner-primary", "fingerprint": "961309c4ae90339b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/AIClientConnections.tsx"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-961309c4ae90339b", "level": "error", "message": {"text": "Possible secret in src/AIClientConnections.tsx"}, "properties": {"repobilityId": "4f22b7583f1193b5", "scanner": "scanner-primary", "fingerprint": "961309c4ae90339b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/AIClientConnections.tsx"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-fe1fc82bbee3ea4d", "level": "note", "message": {"text": "Very large file: src/App.tsx (1435 lines)"}, "properties": {"repobilityId": "57bfc71b44f5048a", "scanner": "scanner-primary", "fingerprint": "fe1fc82bbee3ea4d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ad73ad34e0e9267", "level": "note", "message": {"text": "Very large file: src/server/mcpServerFactory.ts (1524 lines)"}, "properties": {"repobilityId": "a5f92ab2dc4052ab", "scanner": "scanner-primary", "fingerprint": "3ad73ad34e0e9267", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "a447a3dd74c2c99e", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-1229cd0c74a9a2b9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/App.tsx:1095"}, "properties": {"repobilityId": "b91e3b28c869d902", "scanner": "scanner-primary", "fingerprint": "1229cd0c74a9a2b9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-71e8f143efba253c", "level": "error", "message": {"text": "Dangling fetch: GET /api/mcp/observability/metrics (src/Observability.tsx:219)"}, "properties": {"repobilityId": "fef28444d0666fd5", "scanner": "scanner-primary", "fingerprint": "71e8f143efba253c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3ca97d7c0c2aba26", "level": "error", "message": {"text": "Dangling fetch: GET /api/mcp/observability/alerts (src/Observability.tsx:235)"}, "properties": {"repobilityId": "77442ebe1f34b9db", "scanner": "scanner-primary", "fingerprint": "3ca97d7c0c2aba26", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3ff31a625c4723f8", "level": "error", "message": {"text": "Dangling fetch: POST /api/mcp/observability/alerts/${alertId}/resolve (src/Observability.tsx:252)"}, "properties": {"repobilityId": "ed73bb523ebea3d9", "scanner": "scanner-primary", "fingerprint": "3ff31a625c4723f8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0313acf6059bacfa", "level": "error", "message": {"text": "Dangling fetch: POST /api/mcp/oauth/complete (src/App.tsx:343)"}, "properties": {"repobilityId": "4d8acfed709cba6e", "scanner": "scanner-primary", "fingerprint": "0313acf6059bacfa", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-bf8b06be25e3a94a", "level": "error", "message": {"text": "Dangling fetch: POST /api/mcp/keys (src/App.tsx:427)"}, "properties": {"repobilityId": "9dce042f9cc5d997", "scanner": "scanner-primary", "fingerprint": "bf8b06be25e3a94a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ba18d870d247dd3e", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/mcp/keys/${id} (src/App.tsx:449)"}, "properties": {"repobilityId": "9fa548601300c899", "scanner": "scanner-primary", "fingerprint": "ba18d870d247dd3e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-079db7d008d6ecd7", "level": "error", "message": {"text": "Dangling fetch: GET /api/mcp/mcp-servers (src/App.tsx:619)"}, "properties": {"repobilityId": "6b0ebb56c516e9c3", "scanner": "scanner-primary", "fingerprint": "079db7d008d6ecd7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-e1a3583e4f68ad40", "level": "error", "message": {"text": "Dangling fetch: GET /api/mcp/data-providers (src/App.tsx:797)"}, "properties": {"repobilityId": "5da5a0b0acc1dd7f", "scanner": "scanner-primary", "fingerprint": "e1a3583e4f68ad40", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5fb81b1907e49f4e", "level": "error", "message": {"text": "Dangling fetch: PUT /api/mcp/data-providers/${provider} (src/App.tsx:905)"}, "properties": {"repobilityId": "e71b24b512912c9a", "scanner": "scanner-primary", "fingerprint": "5fb81b1907e49f4e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-bfa3027de2bb73a0", "level": "error", "message": {"text": "Dangling fetch: POST /api/mcp/connections (src/App.tsx:1095)"}, "properties": {"repobilityId": "1d2f81bbd48a0d16", "scanner": "scanner-primary", "fingerprint": "bfa3027de2bb73a0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3f41b0bf503110e3", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/mcp/connections/${id} (src/App.tsx:1121)"}, "properties": {"repobilityId": "ee7730929d327ba5", "scanner": "scanner-primary", "fingerprint": "3f41b0bf503110e3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-502435253398ee20", "level": "error", "message": {"text": "Dangling fetch: GET https://api.coingecko.com/api/v3/search (src/server/mcpServerFactory.ts:1458)"}, "properties": {"repobilityId": "66abc2bf21598028", "scanner": "scanner-primary", "fingerprint": "502435253398ee20", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-76889df7c8e240c5", "level": "note", "message": {"text": "Unused endpoint: USE /api/"}, "properties": {"repobilityId": "1dc8b316d9a84037", "scanner": "scanner-primary", "fingerprint": "76889df7c8e240c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "d280fd2cb4f5107b", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4df67aa27a99eee8", "level": "note", "message": {"text": "Unused endpoint: USE /api/mcp"}, "properties": {"repobilityId": "3688dd10bda82208", "scanner": "scanner-primary", "fingerprint": "4df67aa27a99eee8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-304b6f2b403d93f7", "level": "note", "message": {"text": "Unused endpoint: POST /register"}, "properties": {"repobilityId": "d39fdabebe56a30d", "scanner": "scanner-primary", "fingerprint": "304b6f2b403d93f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d345fa90f5de3745", "level": "note", "message": {"text": "Unused endpoint: GET /authorize"}, "properties": {"repobilityId": "da85bc61d535209f", "scanner": "scanner-primary", "fingerprint": "d345fa90f5de3745", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-358815753e8867f1", "level": "note", "message": {"text": "Unused endpoint: POST /token"}, "properties": {"repobilityId": "1da4878477c05d34", "scanner": "scanner-primary", "fingerprint": "358815753e8867f1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4b8ab45c4aa4bc9", "level": "note", "message": {"text": "Unused endpoint: POST /revoke"}, "properties": {"repobilityId": "f792fcd5fcbf6c69", "scanner": "scanner-primary", "fingerprint": "a4b8ab45c4aa4bc9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e122d32e50f64310", "level": "note", "message": {"text": "Unused endpoint: POST /oauth/complete"}, "properties": {"repobilityId": "cbb764199516efd3", "scanner": "scanner-primary", "fingerprint": "e122d32e50f64310", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84e8d14936eb00f7", "level": "note", "message": {"text": "Unused endpoint: GET /mcp-servers/catalog"}, "properties": {"repobilityId": "b11beefe087afcc5", "scanner": "scanner-primary", "fingerprint": "84e8d14936eb00f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dfcae07f4cfc8ede", "level": "note", "message": {"text": "Unused endpoint: GET /mcp-servers"}, "properties": {"repobilityId": "db548eddf8cc77ec", "scanner": "scanner-primary", "fingerprint": "dfcae07f4cfc8ede", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b819f0746ee199ef", "level": "note", "message": {"text": "Unused endpoint: PUT /mcp-servers/:serverId"}, "properties": {"repobilityId": "e16a8d20c08380e2", "scanner": "scanner-primary", "fingerprint": "b819f0746ee199ef", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9952686b8eb8c174", "level": "note", "message": {"text": "Unused endpoint: POST /mcp-servers/:serverId/test"}, "properties": {"repobilityId": "8c5fc0a84f0e2b3b", "scanner": "scanner-primary", "fingerprint": "9952686b8eb8c174", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3d29e8f5d60bec61", "level": "note", "message": {"text": "Unused endpoint: DELETE /mcp-servers/:serverId"}, "properties": {"repobilityId": "3c2840563fc41250", "scanner": "scanner-primary", "fingerprint": "3d29e8f5d60bec61", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8a7cbeab63bd780", "level": "note", "message": {"text": "Unused endpoint: GET /data-providers"}, "properties": {"repobilityId": "e67c7a90f7a0eed4", "scanner": "scanner-primary", "fingerprint": "e8a7cbeab63bd780", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ebe202491ebeb71", "level": "note", "message": {"text": "Unused endpoint: PUT /data-providers/:provider"}, "properties": {"repobilityId": "959e9806525967e2", "scanner": "scanner-primary", "fingerprint": "5ebe202491ebeb71", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14a59a941b290f3e", "level": "note", "message": {"text": "Unused endpoint: POST /data-providers/:provider/validate"}, "properties": {"repobilityId": "deec52a16f67df83", "scanner": "scanner-primary", "fingerprint": "14a59a941b290f3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b6b38014456b4734", "level": "note", "message": {"text": "Unused endpoint: DELETE /data-providers/:provider"}, "properties": {"repobilityId": "25bf24a1f3556106", "scanner": "scanner-primary", "fingerprint": "b6b38014456b4734", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ff5506d508a76790", "level": "note", "message": {"text": "Unused endpoint: POST /connections"}, "properties": {"repobilityId": "f04beaa791427828", "scanner": "scanner-primary", "fingerprint": "ff5506d508a76790", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2c677c4e223a6fab", "level": "note", "message": {"text": "Unused endpoint: DELETE /connections/:id"}, "properties": {"repobilityId": "c6bf7d9eb6ec97af", "scanner": "scanner-primary", "fingerprint": "2c677c4e223a6fab", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0f53365bbb1c16b8", "level": "note", "message": {"text": "Unused endpoint: POST /keys"}, "properties": {"repobilityId": "64151bb1632715b8", "scanner": "scanner-primary", "fingerprint": "0f53365bbb1c16b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d19dd7e4c3053a52", "level": "note", "message": {"text": "Unused endpoint: DELETE /keys/:id"}, "properties": {"repobilityId": "223e89b6a2602694", "scanner": "scanner-primary", "fingerprint": "d19dd7e4c3053a52", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-77a487253c5b099b", "level": "note", "message": {"text": "Unused endpoint: GET /observability/metrics"}, "properties": {"repobilityId": "0ac5bad9b235223b", "scanner": "scanner-primary", "fingerprint": "77a487253c5b099b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-22353ef04dfa7fc8", "level": "note", "message": {"text": "Unused endpoint: GET /observability/alerts"}, "properties": {"repobilityId": "aca6fd27bfb23eeb", "scanner": "scanner-primary", "fingerprint": "22353ef04dfa7fc8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7421e3c178491a04", "level": "note", "message": {"text": "Unused endpoint: POST /observability/alerts/:id/resolve"}, "properties": {"repobilityId": "4cb7508d34b9e078", "scanner": "scanner-primary", "fingerprint": "7421e3c178491a04", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "f3f4a01fcb16c591", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "00af356833d77b05", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-13451f35f0ddd1ca", "level": "note", "message": {"text": "Unused endpoint: GET /sse"}, "properties": {"repobilityId": "ec39106128809b8f", "scanner": "scanner-primary", "fingerprint": "13451f35f0ddd1ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cde167f60259e05e", "level": "note", "message": {"text": "Unused endpoint: POST /messages"}, "properties": {"repobilityId": "2bffb304b03d6df4", "scanner": "scanner-primary", "fingerprint": "cde167f60259e05e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}