{
  "schemaVersion": "1.0.0",
  "deployment": {
    "id": "grep",
    "endpoint": "https://mcp.grep.app",
    "name": "Grep",
    "category": "Public code search",
    "source": {
      "url": "https://vercel.com/blog/grep-a-million-github-repositories-via-mcp",
      "reviewedAt": "2026-10-15"
    },
    "profile": "Public GitHub code search; documented HTTP setup supplies a URL without credentials"
  },
  "run": {
    "id": "66b4bd66-b993-496b-8738-5f67e89fddc4",
    "startedAt": "2026-10-15T07:14:20.980Z",
    "completedAt": "2026-10-15T07:14:22.145Z",
    "status": "completed",
    "client": {
      "name": "graphcanon-metadata-audit",
      "version": "1.1.0",
      "transport": "streamable-http",
      "requestedProtocol": "2025-11-25",
      "reportedProtocol": "2025-06-18",
      "negotiatedProtocol": "2025-06-18",
      "authentication": "none"
    },
    "limits": {
      "requestTimeoutMs": 5000,
      "runTimeoutMs": 30000,
      "responseBytes": 1048576,
      "requests": 7,
      "pages": 5,
      "tools": 200
    }
  },
  "checks": [
    {
      "id": "protocol-negotiation",
      "status": "passed",
      "summary": "Negotiated protocol 2025-06-18; this does not establish host compatibility.",
      "evidenceIds": ["request-1"]
    },
    {
      "id": "initialized-notification",
      "status": "passed",
      "summary": "The initialization notification received HTTP 202 with an empty body.",
      "evidenceIds": ["request-2"]
    },
    {
      "id": "tool-catalog",
      "status": "passed",
      "summary": "Observed the complete advertised catalog: 1 tools across 1 pages.",
      "evidenceIds": ["request-3"]
    },
    {
      "id": "tool-metadata-shape",
      "status": "passed",
      "summary": "SDK metadata shape checked for 1 observed tools. This is not complete JSON Schema validation or behavior verification.",
      "evidenceIds": ["request-3"]
    },
    {
      "id": "oauth-login",
      "status": "not-tested",
      "summary": "OAuth discovery, login, token refresh and authenticated access are outside this anonymous inspection.",
      "evidenceIds": []
    }
  ],
  "evidence": [
    {
      "id": "request-1",
      "method": "initialize",
      "observedAt": "2026-10-15T07:14:20.980Z",
      "durationMs": 643,
      "responseBytes": 209,
      "outcome": "response-received",
      "httpStatus": 200
    },
    {
      "id": "request-2",
      "method": "notifications/initialized",
      "observedAt": "2026-10-15T07:14:21.623Z",
      "durationMs": 286,
      "responseBytes": 0,
      "outcome": "notification-accepted",
      "httpStatus": 202
    },
    {
      "id": "request-3",
      "method": "tools/list",
      "observedAt": "2026-10-15T07:14:21.909Z",
      "durationMs": 236,
      "responseBytes": 3043,
      "outcome": "response-received",
      "httpStatus": 200
    }
  ],
  "catalog": {
    "tools": [
      {
        "name": "searchGitHub",
        "descriptionCharacters": 1537,
        "inputSchemaIsObject": true,
        "metadataShapeValid": true,
        "outputSchemaPresent": false,
        "declaredReadOnly": null,
        "declaredDestructive": null
      }
    ],
    "observedCount": 1,
    "complete": true,
    "sha256": "cd321be5eb52de5d2a312cb0f26c68434a56c03ebb6519627ac07a4c5b79c52d",
    "hashScope": "complete-catalog",
    "hashDefinition": "SHA-256 of all observed tool objects, recursively sorted object keys and sorted canonical tool strings; schema array order is preserved. Raw descriptions, schemas and headers are not persisted."
  },
  "coverage": {
    "attemptedChecks": 4,
    "totalChecks": 5,
    "passed": 4,
    "failed": 0,
    "unknown": 0,
    "notTested": 1,
    "notApplicable": 0,
    "catalogPages": 1,
    "toolCalls": 0,
    "levels": {
      "metadata": "passed",
      "authenticatedExecution": "not-tested",
      "modelApi": "not-tested",
      "chatgptHost": "not-tested",
      "claudeHost": "not-tested",
      "publicationApproval": "not-tested"
    }
  },
  "limitations": [
    "Metadata-only anonymous inspection. No tools/call, OAuth flow, API model calls, host UI or publication review was executed. No global quality or safety score is produced.",
    "Annotations are server declarations, not verified behavior. Metadata success does not establish task success, security, usefulness or ChatGPT/Claude compatibility.",
    "Only active exact HTTPS endpoints in the reviewed source registry are accepted. Redirects, supplied credentials, arbitrary endpoints and OAuth URL fetching are disabled. DNS/TLS use the local runtime: this is not a hardened multi-tenant SSRF sandbox and must not be exposed as a public scanner.",
    "Session identifiers are used only in memory. Request/response headers, raw error messages, raw descriptions and schemas are excluded from artifacts. Tool names and aggregate metadata remain untrusted server input.",
    "Only the recorded protocol versions and bounded catalog prefix are supported. Reaching a bound or lacking access means unknown, not a failed server or a passing full audit."
  ]
}