Why this verdict
- suspicious: unverified finding mcp-server:.:pyproject.toml:24:SUPPLY
Security findings 1
Supply chain
highUnverifiedlow confidencepyproject.toml declares the dependency 'httpx2', one edit from the popular 'httpx', which could be a look-alike package, although the code uses it consistently as its HTTP client and the lockfile resolves it from the official PyPI registry.
"httpx2>=2.13.0,<3"
vector:metadata
Open questions 1
What the analysis could not settle from the code alone.
The server's `instructions=INSTRUCTIONS` value is loaded into the agent context, but the INSTRUCTIONS constant text is not shown in this bundle. Does it contain steering beyond the declared logbook task?
Agent hijacking
