{"api_version":2,"receipt_profile":"zambo-hosted-receipt/1","schema_url":"https://zambo.dev/aer-1/hosted-profile.schema.json","id":"e117bb2f-154d-4f80-bfc2-abfacbe0fcd0","source_url":"https://zambo.dev/api/receipt/e117bb2f-154d-4f80-bfc2-abfacbe0fcd0","receipt":{"id":"e117bb2f-154d-4f80-bfc2-abfacbe0fcd0","created_at":"2026-09-17T14:18:20.649Z","receipt_schema_version":"0.2","job_summary":"MCP tool execution: provibe_audit","tools":["provibe_audit"],"steps":[{"tool":"provibe_audit","status":"success","started_at":"2026-09-17T14:18:14.178Z","completed_at":"2026-09-17T14:18:20.604Z"}],"output_hash":"sha256:49fe175f51b5b83f8d09271f208b9c32c5573bf543b4782a60579ecbbfc03d72","hash_algorithm":"sha256","canonical_bytes":"eyJhcmNoaXRlY3R1cmUiOiJBbnl0aGluZ01DUCBpcyBhIG1vbm9yZXBvIHVzaW5nIFlhcm4vTlBNIHdvcmtzcGFjZXMgd2l0aCBhIE5lc3RKUyBiYWNrZW5kIGFuZCBhIE5leHQuanMgZnJvbnRlbmQsIGJvdGggYnVpbHQgaW50byBhIHNpbmdsZSBtdWx0aeKAkXN0YWdlIERvY2tlciBpbWFnZS4gVGhlIGJhY2tlbmQgZXhwb3NlcyBhIG1pY3Jvc2VydmljZSBzdHJhdGVneSAoTUNQKSBhbmQgdXNlcyBjbGFzc+KAkXZhbGlkYXRvciwgY2xhc3PigJF0cmFuc2Zvcm1lciwgYW5kIE9wZW5UZWxlbWV0cnkgZm9yIG9ic2VydmFiaWxpdHksIHdoaWxlIHRoZSBmcm9udGVuZCBpcyBhIHN0YW5kYXJkIE5leHQuanMgYXBwLiBDb25maWd1cmF0aW9uIGlzIGRyaXZlbiBieSBlbnZpcm9ubWVudCB2YXJpYWJsZXMgdmFsaWRhdGVkIGF0IHN0YXJ0dXAsIGFuZCB0aGUgRG9ja2VyZmlsZSBpc29sYXRlcyBwcm9kdWN0aW9uIGRlcGVuZGVuY2llcyBwZXIgc2VydmljZS4gXG5Ib3dldmVyLCB0aGUgc2luZ2xl4oCRY29udGFpbmVyIGFwcHJvYWNoIGNvdXBsZXMgdGhlIGJhY2tlbmQgYW5kIGZyb250ZW5kIGxpZmVjeWNsZXMsIG1ha2luZyBpbmRlcGVuZGVudCBzY2FsaW5nIGRpZmZpY3VsdC4gVGhlIGxhY2sgb2YgYSBsb2NrIGZpbGUgYW5kIHRoZSBwcmVzZW5jZSBvZiBkZWZhdWx0IHNlY3JldHMgaW5jcmVhc2Ugc3VwcGx54oCRY2hhaW4gYW5kIHJ1bnRpbWUgcmlzay4gQXMgdGhlIGFkYXB0ZXIgY2F0YWxvZyBncm93cywgdGhlIGN1cnJlbnQgZ2xvYmFsIFZhbGlkYXRpb25QaXBlIGFuZCBzaW5nbGXigJFwcm9jZXNzIG1vZGVsIG1heSBiZWNvbWUgYm90dGxlbmVja3MsIGFuZCB0aGUgdGlnaHQgY291cGxpbmcgb2YgdHJhY2luZywgU2VudHJ5LCBhbmQgdGhlIE5lc3QgYXBwIGluaXRpYWxpemF0aW9uIGNvdWxkIGhpbmRlciBtb2R1bGFyIHRlc3RpbmcgYW5kIGZ1dHVyZSBtaWdyYXRpb24gdG8gYSB0cnVseSBtaWNyb+KAkXNlcnZpY2UgYXJjaGl0ZWN0dXJlLiIsImJhZGdlIjp7Imh0bWwiOiI8YSBocmVmPVwiaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGVcIj48aW1nIHNyYz1cImh0dHBzOi8vemFtYm8uZGV2L2FwaS9vZy9iYWRnZT9zY29yZT02OFwiIGFsdD1cIlByb3ZpYmVDb2RlIFNjb3JlOiA2OC8xMDBcIiBzdHlsZT1cImhlaWdodDoyMHB4XCIgLz48L2E+IiwibWFya2Rvd24iOiJbIVtQcm92aWJlQ29kZSBTY29yZTogNjgvMTAwXShodHRwczovL3phbWJvLmRldi9hcGkvb2cvYmFkZ2U/c2NvcmU9NjgpXShodHRwczovL3phbWJvLmRldi9wcm92aWJlY29kZSkiLCJ0aXAiOiJBZGQgdGhpcyBiYWRnZSB0byB5b3VyIFJFQURNRSB0byBzaG93IHlvdXIgcmVwbydzIFByb3ZpYmVDb2RlIHNjb3JlIiwidXJsIjoiaHR0cHM6Ly96YW1iby5kZXYvYXBpL29nL2JhZGdlP3Njb3JlPTY4In0sImVzdGltYXRlZF9maXhfdGltZSI6IjM24oCTNTAgaG91cnMiLCJmaWxlX2NvdW50IjoxMTAyLCJmaW5kaW5ncyI6W3siY2F0ZWdvcnkiOiJTZWNyZXRzIiwiZGVzY3JpcHRpb24iOiJkb2NrZXItY29tcG9zZS55bWwgZGVmaW5lcyBKV1RfU0VDUkVUIGFuZCBFTkNSWVBUSU9OX0tFWSB3aXRoIGhhcmTigJFjb2RlZCBwbGFjZWhvbGRlciB2YWx1ZXMgKGUuZy4sIFwiY2hhbmdlLW1lLWluLXByb2R1Y3Rpb24tbWluLTMyLWNoYXJzXCIpLiBJZiB0aGUgY29udGFpbmVyIGlzIHN0YXJ0ZWQgd2l0aG91dCBvdmVycmlkaW5nIHRoZXNlIGVudiB2YXJzLCB0aGUgYXBwbGljYXRpb24gcnVucyB3aXRoIHdlYWssIGtub3duIHNlY3JldHMsIGFsbG93aW5nIGF0dGFja2VycyB0byBmb3JnZSBKV1RzIG9yIGRlY3J5cHQgZGF0YS4iLCJmaWxlIjoiZG9ja2VyLWNvbXBvc2UueW1sIiwic2V2ZXJpdHkiOiJjcml0aWNhbCIsInN1Z2dlc3RlZEZpeCI6IlJlbW92ZSB0aGUgZGVmYXVsdCB2YWx1ZXMgYW5kIHJlcXVpcmUgdGhlIHZhcmlhYmxlcyBhdCBydW50aW1lLiBBZGQgYSB2YWxpZGF0aW9uIHN0ZXAgaW4gdGhlIHN0YXJ0dXAgY29kZSAoZS5nLiwgdmFsaWRhdGVSZXF1aXJlZFNlY3JldHNBdFN0YXJ0dXApIHRoYXQgdGhyb3dzIGlmIEpXVF9TRUNSRVQgb3IgRU5DUllQVElPTl9LRVkgYXJlIG1pc3Npbmcgb3IgbWF0Y2ggdGhlIHBsYWNlaG9sZGVyIHBhdHRlcm4uIiwidGl0bGUiOiJEZWZhdWx0IEpXVCBhbmQgRU5DUllQVElPTiBrZXlzIGluIGRvY2tlci1jb21wb3NlLnltbCJ9LHsiY2F0ZWdvcnkiOiJNYWludGFpbmFiaWxpdHkiLCJkZXNjcmlwdGlvbiI6IlRoZSBwcmXigJFzY2FuIHJlcG9ydHMgMTYgb2NjdXJyZW5jZXMgb2YgdGhlIFR5cGVTY3JpcHQgJ2FueScgdHlwZSBhY3Jvc3MgdGhlIGNvZGViYXNlIChlLmcuLCBpbiB1dGlsaXR5IGZ1bmN0aW9ucyBhbmQgRFRPcykuICdhbnknIGRpc2FibGVzIHR5cGUgc2FmZXR5LCBpbmNyZWFzaW5nIHRoZSByaXNrIG9mIHJ1bnRpbWUgZXJyb3JzIGFuZCBtYWtpbmcgZnV0dXJlIHJlZmFjdG9yaW5nIHBhaW5mdWwuIiwiZmlsZSI6InBhY2thZ2VzL2JhY2tlbmQvc3JjLyoqLyoudHMgKG11bHRpcGxlIGxvY2F0aW9ucykiLCJzZXZlcml0eSI6ImhpZ2giLCJzdWdnZXN0ZWRGaXgiOiJFbmFibGUgXCJub0ltcGxpY2l0QW55XCIgYW5kIFwic3RyaWN0XCIgaW4gdHNjb25maWcsIHRoZW4gcmVwbGFjZSBlYWNoICdhbnknIHdpdGggYSBjb25jcmV0ZSBpbnRlcmZhY2Ugb3IgZ2VuZXJpYyB0eXBlLiBVc2UgdXRpbGl0eSB0eXBlcyBsaWtlIFBhcnRpYWw8VD4gb3IgUmVjb3JkPHN0cmluZywgdW5rbm93bj4gd2hlcmUgYXBwcm9wcmlhdGUuIiwidGl0bGUiOiJFeGNlc3NpdmUgdXNlIG9mIHRoZSAnYW55JyB0eXBlIn0seyJjYXRlZ29yeSI6IlNlY3VyaXR5IiwiZGVzY3JpcHRpb24iOiJUaGUgcmVwb3NpdG9yeSBkb2VzIG5vdCBjb21taXQgYSBsb2NrIGZpbGUsIHNvIG5wbSBpbnN0YWxsIGNhbiByZXNvbHZlIHRvIGRpZmZlcmVudCB2ZXJzaW9ucyBvbiBlYWNoIGJ1aWxkLiBUaGlzIG9wZW5zIHRoZSBkb29yIHRvIHN1cHBseeKAkWNoYWluIGF0dGFja3MgYW5kIG1ha2VzIHJlcHJvZHVjaW5nIHByb2R1Y3Rpb24gYnVpbGRzIHVucmVsaWFibGUuIiwiZmlsZSI6InBhY2thZ2UuanNvbiIsInNldmVyaXR5IjoibWVkaXVtIiwic3VnZ2VzdGVkRml4IjoiUnVuICducG0gaSAtLXBhY2thZ2UtbG9jaycgKG9yICducG0gY2knIGFmdGVyIGdlbmVyYXRpbmcgYSBsb2NrIGZpbGUpIGxvY2FsbHksIGNvbW1pdCB0aGUgcmVzdWx0aW5nIHBhY2thZ2UtbG9jay5qc29uLCBhbmQgYWRkIGl0IHRvIHZlcnNpb24gY29udHJvbC4gVXBkYXRlIENJIHRvIHVzZSAnbnBtIGNpJyB3aGljaCB3aWxsIG5vdyBiZSBkZXRlcm1pbmlzdGljLiIsInRpdGxlIjoiTWlzc2luZyBwYWNrYWdlIGxvY2sgZmlsZSAobm8gcGFja2FnZS1sb2NrLmpzb24pIn1dLCJpbnB1dF90eXBlIjoicmVwb191cmwiLCJtYWluX2xhbmd1YWdlIjoiVHlwZVNjcmlwdCIsInByb3ZpYmVfc2NvcmUiOjY4LCJyZXBvX21ldGEiOnsiaXNfYXJjaGl2ZWQiOmZhbHNlLCJsYW5ndWFnZSI6IlR5cGVTY3JpcHQiLCJsYXN0X3B1c2hlZF9kYXlzX2FnbyI6MCwibGljZW5zZSI6IkdOVSBBZmZlcm8gR2VuZXJhbCBQdWJsaWMgTGljZW5zZSB2My4wIiwib3Blbl9pc3N1ZXMiOjIxLCJzdGFycyI6MjE2fSwicmVzdWx0X2lkIjoiOGEwNWQxMjEtYTI4My00MDVmLWI2ODAtZGM2YWMxZWZhMGMzIiwicmVzdWx0X3VybCI6Imh0dHBzOi8vemFtYm8uZGV2L3Byb3ZpYmVjb2RlP2lkPThhMDVkMTIxLWEyODMtNDA1Zi1iNjgwLWRjNmFjMWVmYTBjMyIsInJpc2tfbGV2ZWwiOiJMT1ciLCJzY29yZV9icmVha2Rvd24iOnsiYXJjaGl0ZWN0dXJlIjo4MCwiZGVhZENvZGUiOjg1LCJtYWludGFpbmFiaWxpdHkiOjYwLCJzZWN1cml0eSI6NzB9LCJzdW1tYXJ5IjoiVGhlIHJlcG8gc2hpcHMgd2l0aCBpbnNlY3VyZSBkZWZhdWx0IEpXVC9FTkNSWVBUSU9OIGtleXMgaW4gZG9ja2VyLWNvbXBvc2UueW1sIGFuZCBhIGZsb29kIG9mIFwiYW55XCIgdHlwZXMsIHBsdXMgaXQgbGFja3MgYSBsb2NrIGZpbGUgd2hpY2ggbWFrZXMgcHJvZHVjdGlvbiBidWlsZHMgbm9u4oCRZGV0ZXJtaW5pc3RpYyBkZXNwaXRlIGhhdmluZyBhIHNvbGlkIHRlc3Qgc3VpdGUuIiwidXBncmFkZV9ub3RlIjoiRnVsbCBhdWRpdDogY29tcGxldGUgc2VjdXJpdHkgc2NhbiwgZGVhZCBjb2RlIG1hcCwgdGVjaCBkZWJ0IHJlcG9ydCwgZXhlY3V0aW9uIHBsYW4sIGV4cG9ydCBzdXBlci1wcm9tcHQg4oCUICQ0OSBvbmUtdGltZSIsInVwZ3JhZGVfdXJsIjoiaHR0cHM6Ly96YW1iby5kZXYvcHJvdmliZWNvZGU/aWQ9OGEwNWQxMjEtYTI4My00MDVmLWI2ODAtZGM2YWMxZWZhMGMzIiwidmliZV9zaWduYWxzIjp7ImFueV90eXBlX2NvdW50IjoxNiwiYXN5bmNfd2l0aG91dF90cnlfY2F0Y2giOjAsImNvbnNvbGVfbG9ncyI6MCwiZW1wdHlfY2F0Y2hfYmxvY2tzIjowLCJlbnZfZmlsZV9jb21taXR0ZWQiOmZhbHNlLCJoYXNfdGVzdHMiOnRydWUsInN1c3BlY3RlZF9zZWNyZXRfbGVha3MiOjAsInRlc3RfZmlsZV9jb3VudCI6MjU4LCJ0b2RvX2NvbW1lbnRzIjowLCJ0c19pZ25vcmVfY291bnQiOjB9LCJ2aWJlX3ZlcmRpY3QiOiJERUNFTlQifQ==","canonical_byte_length":4573,"verification_status":"verification_failed","session_trail":[],"result_preview":"{\"provibe_score\":68,\"vibe_verdict\":\"DECENT\",\"risk_level\":\"LOW\",\"estimated_fix_time\":\"36–50 hours\",\"score_breakdown\":{\"security\":70,\"maintainability\":60,\"deadCode\":85,\"architecture\":80},\"summary\":\"The repo ships with insecure default JWT/ENCRYPTION keys in docker-compose.yml and a flood of \\\"any\\\" types, plus it lacks a lock file which makes production builds non‑deterministic despite having a solid test suite.\",\"architecture\":\"AnythingMCP is a monorepo using Yarn/NPM workspaces with a NestJS backend and a Next.js frontend, both built into a single multi‑stage Docker image. The backend exposes a microservice strategy (MCP) and uses class‑validator, class‑transformer, and OpenTelemetry for observability, while the frontend is a standard Next.js app. Configuration is driven by environment variables validated at startup, and the Dockerfile isolates production dependencies per service. \\nHowever, the single‑container approach couples the backend and frontend lifecycles, making independent scaling difficult. The lack of a lock file and the presence of default secrets increase supply‑chain and runtime risk. As the adapter catalog grows, the current global ValidationPipe and single‑process model may become bottlenecks, and the tight coupling of tracing, Sentry, and the Nest app initialization could hinder modular testing and future migration to a truly micro‑service architecture.\",\"findings\":[{\"severity\":\"critical\",\"category\":\"Secrets\",\"title\":\"Default JWT and ENCRYPTION keys in docker-compose.yml\",\"description\":\"docker-compose.yml defines JWT_SECRET and ENCRYPTION_KEY with hard‑coded placeholder values (e.g., \\\"change-me-in-production-min-32-chars\\\"). If the container is started without overriding these env vars, the application runs with weak, known secrets, allowing attackers to forge JWTs or decrypt data.\",\"file\":\"docker-compose.yml\",\"suggestedFix\":\"Remove the default values and require the variables at runtime. Add a validation step in the startup code (e.g., validateRequiredSecretsAtStartup) that throws if JWT_SECRET or ENCRYPTION_KEY are missing or match the placeholder pattern.\"},{\"severity\":\"high\",\"category\":\"Maintainability\",\"title\":\"Excessive use of the 'any' type\",\"description\":\"The pre‑scan reports 16 occurrences of the TypeScript 'any' type across the codebase (e.g., in utility functions and DTOs). 'any' disables type safety, increasing the risk of runtime errors and making future refactoring painful.\",\"file\":\"packages/backend/src/**/*.ts (multiple locations)\",\"suggestedFix\":\"Enable \\\"noImplicitAny\\\" and \\\"strict\\\" in tsconfig, then replace each 'any' with a concrete interface or generic type. Use utility types like Partial<T> or Record<string, unknown> where appropriate.\"},{\"severity\":\"medium\",\"category\":\"Security\",\"title\":\"Missing package lock file (no package-lock.json)\",\"description\":\"The repository does not commit a lock file, so npm install can resolve to different versions on each build. This opens the door to supply‑chain attacks and makes reproducing production builds unreliable.\",\"file\":\"package.json\",\"suggestedFix\":\"Run 'npm i --package-lock' (or 'npm ci' after generating a lock file) locally, commit the resulting package-lock.json, and add it to version control. Update CI to use 'npm ci' which will now be deterministic.\"}],\"vibe_signals\":{\"console_logs\":0,\"todo_comments\":0,\"ts_ignore_count\":0,\"any_type_count\":16,\"suspected_secret_leaks\":0,\"has_tests\":true,\"test_file_count\":258,\"env_file_committed\":false,\"async_without_try_catch\":0,\"empty_catch_blocks\":0},\"repo_meta\":{\"stars\":216,\"last_pushed_days_ago\":0,\"language\":\"TypeScript\",\"open_issues\":21,\"is_archived\":false,\"license\":\"GNU Affero General Public License v3.0\"},\"main_language\":\"TypeScript\",\"file_count\":1102,\"result_id\":\"8a05d121-a283-405f-b680-dc6ac1efa0c3\",\"result_url\":\"https://zambo.dev/provibecode?id=8a05d121-a283-405f-b680-dc6ac1efa0c3\",\"upgrade_note\":\"Full audit: complete security scan, dead code map, tech debt report, execution plan, export super-prompt — $49 one-time\",\"upgrade_url\":\"https://zambo.dev/provibecode?id=8a05d121-a283-405f-b680-dc6ac1efa0c3\",\"input_type\":\"repo_url\",\"badge\":{\"url\":\"https://zambo.dev/api/og/badge?score=68\",\"markdown\":\"[![ProvibeCode Score: 68/100](https://zambo.dev/api/og/badge?score=68)](https://zambo.dev/provibecode)\",\"html\":\"<a href=\\\"https://zambo.dev/provibecode\\\"><img src=\\\"https://zambo.dev/api/og/badge?score=68\\\" alt=\\\"ProvibeCode Score: 68/100\\\" style=\\\"height:20px\\\" /></a>\",\"tip\":\"Add this badge to your README to show your repo's ProvibeCode score\"}}","free_used":1,"free_remaining":19,"free_limit":20,"signal_handle":null,"evidence_sha256":"sha256:0219621db17ece2f0e30ec92d09526964bfab2e2892f8a610dc525ac4d6b836b","evidence_url":"/api/evidence/0219621db17ece2f0e30ec92d09526964bfab2e2892f8a610dc525ac4d6b836b","evidence_byte_length":4573,"evidence_content_type":"application/json","evidence_source_url":null,"evidence_status":"captured","external_evidence":[],"provenance":null,"provenance_class":"EXECUTED BY ZAMBO","metadata_hash":null,"anchor":{"event_id":"658b484ef459a1fcdb1af93e290e13dc77443ae46300af8e6af69ce2d46eeec5","pubkey":"e13475107d30c918ec664adf2ab1141024a22fb35190f82c9e933704fa49af41","relays":["wss://relay.damus.io","wss://nos.lol","wss://relay.primal.net"],"status":"partial","published_at":"2026-09-17T14:18:21.684Z"},"receipt_profile":"zambo-hosted-receipt/1","schema_url":"https://zambo.dev/aer-1/hosted-profile.schema.json","api_version":1,"verification_scope":"separate_sha256_commitment_and_provenance_binding_checks","checks":{"commitment_matches":{"label":"SHA-256 commitment","passed":true,"status":"pass","detail":"The exact decoded canonical bytes match the stored SHA-256 output hash."},"canonical_payload_matches":{"label":"Canonical payload reconstruction","passed":true,"status":"pass","detail":"The stored output and known call context reconstruct the exact canonical bytes."},"provenance_binding":{"label":"Provenance claim binding","status":"fail","passed":false,"detail":"The receipt schema version is missing or unsupported; provenance binding was not accepted."},"metadata_binding":{"label":"AER-1 metadata hash","status":"legacy","passed":false,"detail":"legacy receipt, metadata is not cryptographically bound"},"signature":{"label":"Ed25519 signature (not checked)","passed":false,"status":"not_checked","detail":"No Ed25519 signature or pinned signing key was checked."},"chain":{"label":"Receipt chain (not checked)","passed":false,"status":"not_checked","detail":"No append-only receipt-chain proof was checked."},"issued_by_zambo_dev":{"label":"Issuer authentication","passed":false,"status":"not_checked","detail":"A zambo.dev receipt URL does not authenticate the issuer; no pinned signature or trusted issuer key was checked."},"immutable_log_timestamp":{"label":"Stored timestamp","passed":true,"timestamp":"2026-09-17T14:18:20.649Z","detail":"The receipt store reports 2026-09-17T14:18:20.649Z; immutability is not checked here."},"receipt_schema_version":"0.2","signature_valid":{"label":"Ed25519 signature (not checked)","passed":false,"status":"not_checked","detail":"Compatibility field only. No Ed25519 signature was checked; use API v2 checks.commitment_matches for the SHA-256 commitment."},"chain_valid":{"label":"Receipt chain (not checked)","passed":false,"status":"not_checked","detail":"This endpoint does not verify an append-only chain."}}},"verification_status":"verification_failed","checks":{"commitment_matches":{"status":"pass","passed":true,"expected_hash":"sha256:49fe175f51b5b83f8d09271f208b9c32c5573bf543b4782a60579ecbbfc03d72","computed_hash":"sha256:49fe175f51b5b83f8d09271f208b9c32c5573bf543b4782a60579ecbbfc03d72","detail":"SHA-256 of the exact decoded canonical bytes matches output_hash."},"canonical_payload_matches":{"label":"Canonical payload reconstruction","passed":true,"status":"pass","detail":"The stored output and known call context reconstruct the exact canonical bytes."},"provenance_binding":{"label":"Provenance claim binding","status":"fail","passed":false,"detail":"The receipt schema version is missing or unsupported; provenance binding was not accepted."},"metadata_binding":{"label":"AER-1 metadata hash","status":"legacy","passed":false,"detail":"legacy receipt, metadata is not cryptographically bound"},"issuer_authentication":{"label":"Issuer authentication","passed":false,"status":"not_checked","detail":"A zambo.dev receipt URL does not authenticate the issuer; no pinned signature or trusted issuer key was checked."},"signature":{"status":"not_checked","detail":"No Ed25519 signature or pinned signing key is supplied."},"schema":{"status":"not_checked","detail":"Schema conformance is left to the client using the linked hosted-profile schema."},"chain":{"status":"not_checked","detail":"This endpoint does not verify an append-only receipt chain."}}}