Scoring
How Sievant rates findings
Sievant has no overall grade today. Every finding carries a severity (critical, high, medium, low or info), and CI can stop on a threshold.
Severity per scan rule
| Rule | Severity | Finds |
|---|---|---|
| SEC001 | critical | a credential in a recognizable format (GitHub, GitLab, Slack, Anthropic, OpenAI, Stripe, AWS, Google, Hugging Face, npm, Notion, Linear, private keys, JWTs, database URLs with a password) in env, args or headers |
| SEC002 | high | a literal value in a secret-named variable, header or flag |
| SEC003 | critical | a password in a server URL |
| SEC004 | high | a credential embedded in a URL's path or query (a "capability URL": UUID or high-entropy path segments, token-bearing query keys such as key, token, api_key, user_id, or a path on a known capability-URL provider), in url or in args |
| PERM001 / PERM002 | high / medium | the filesystem root / the whole home directory given to a server |
| PERM003 | medium | all permissions (Deno), host network, privileged container |
| SUP001 | medium | an unpinned package or image, or a moving tag (@latest) |
| SUP002 | high | a server fetched from a git repository or URL, or launched by a downloaded script (curl … | sh) |
| AUTH001 | medium | a remote server with no credential configured (it may still use OAuth) |
| NET001 | high | a remote server over plain HTTP |
| INJ001 | high/medium | with --inspect-tools: a tool description that reads like instructions to the model |
| MCP001 | info | with --inspect-tools: resources and prompts Sievant would withhold |
| MCP002 | info | with --inspect-tools: tools that need MCP tasks, on a server that does not declare tasks (docs/compatibility.md) |
| SVT001 / SVT002 | info | already launched through Sievant / could not be inspected |
From the Sievant repository: docs/scan-and-wrap.md at commit 8529db1.
Failing CI on a threshold
sievant scan --fail-on high exits with code 3 when a finding is high or worse, so CI can stop on it.
When Halotrcer combines Sievant’s findings with Tokvera’s, some rules carry a deal risk tag and rank first. See how Halotrcer ranks findings.
Planned: an exposure score
Planned (roadmap, not built): an exposure score, an A to F grade from weighted pillars (secrets, permissions, supply chain, prompt-injection exposure, auditability), with the weights published and versioned. It will be added beside the existing findings, and failing on a grade will be opt-in.