{
 "slug": "static-finding-screening-ratio",
 "url": "https://stillosdigitalholdings.com/findings/static-finding-screening-ratio",
 "question": "How many raw static analysis hits does one reportable MCP finding survive out of, and who publishes that number?",
 "headline": "1,574 raw static sink hits across 98 MCP packages reduced to 15 reportable findings — a 99.0% reduction, published.",
 "cite_as": "1,574 raw static sink hits across 98 MCP (Model Context Protocol) packages reduced to 15 reportable findings, a 99.0% reduction, with 32 packages judged intended behaviour and 51 left undecided pending reproduction (Still OS Digital Holdings LLC, triage ledger, n=98 packages).",
 "numbers": {
  "Raw static sink hits examined": "1,574",
  "Packages triaged": "98",
  "Individual assessments written": "101",
  "Reportable findings": "15",
  "Judged intended behaviour, not a finding": "32",
  "Undecided, pending reproduction": "51",
  "Flow could not be located in source": "5",
  "Reduction from raw hits to reportable": "99.0%"
 },
 "method": "Static analysis locates candidate sinks reachable from a tool-input field. Each candidate is then assessed in source and assigned one verdict: reportable, intended behaviour, undecided pending reproduction, or flow not located. Only reportable findings proceed to coordinated disclosure. Packages left undecided are counted SEPARATELY and are NOT treated as discards, because work that is unfinished is not work that cleared.",
 "producers": [
  "/home/marcus/hunt/triage-verdicts.jsonl"
 ]
}