Findings · measured, dated, recomputable
How many raw static analysis hits does one reportable MCP finding survive out of, and who publishes that number?
| Raw static sink hits examined | 1,574 |
| Packages triaged | 98 |
| Individual assessments written | 101 |
| Reportable findings | 15 |
| Judged intended behaviour, not a finding | 32 |
| Undecided, pending reproduction | 51 |
| Flow could not be located in source | 5 |
| Reduction from raw hits to reportable | 99.0% |
A scanner report is not an audit. The published complaint about automated MCP scanning is its false-positive volume, so the number that matters to a buyer is how much gets discarded before anything reaches them — and no vendor publishes it. This is ours, derived from the triage ledger rather than asserted. It is a REDUCTION ratio, not a false-positive rate: a discarded candidate was never shown to anyone, so calling it a false positive would misstate what was measured.
Static analysis locates candidate sinks reachable from a tool-input field. Each candidate is then assessed in source and assigned one verdict: reportable, intended behaviour, undecided pending reproduction, or flow not located. Only reportable findings proceed to coordinated disclosure. Packages left undecided are counted SEPARATELY and are NOT treated as discards, because work that is unfinished is not work that cleared.
The files these figures were derived from, on the machine that published this page
/home/marcus/hunt/triage-verdicts.jsonl
The CVEs this pipeline produced
Built 2026-10-30T23:17:01.526Z · JSON