Predicate: static-scan-verdict (v1)
https://getprobity.dev/predicate/v1/static-scan-verdict
The Tier-1 detection verdict: the outcome of a STATIC scan of an MCP server / A2A agent — the scanner connects over the transport and analyses the declared surface (protocol/schema conformance, tool descriptions, annotations, known-bad static patterns) without booting a microVM and without executing the server's tools. It is the cheap, CI-safe, pre-merge rung of the containment ladder (the Tier-2 adversarial-execution-evidence attestation runs the thing in the box; this one never does).
Why it is a distinct type
adversarial-execution-evidence (Tier 2) REQUIRES runtime-only bindings a static scan cannot
honestly fill — the observationEnvironment substrate / catchPolicy / networkPosture bindings, the
runtime corpus manifest, attackResults, and the drained interceptRecords. A pure static scan
boots nothing and drains nothing, so reusing adversarial-execution-evidence would force
fabricated/empty substrate bindings — a verifier could not tell a real static scan from a
defenses-off runtime gate. static-scan-verdict carries only the fields a static scan genuinely
produces.
Predicate body
| Field | Req | Meaning |
|---|---|---|
verdict | REQUIRED | PASS / DEGRADED / FAIL. DEGRADED when a layer was NOT_RUNNABLE. |
tier | REQUIRED | always "static" — the containment-ladder rung this verdict was earned at. |
scan_engine | REQUIRED | the static scanner identity (e.g. mcp-test-toolkit). |
coverage_qualifier | REQUIRED | plain-English scope, e.g. "static surface only — no microVM, no runtime execution". |
layers | REQUIRED | array of the static pyramid layers, each {id, status, is_scorable, detail, findings[], metrics}; a finding is {check_id, severity, message}. |
coverage_map | REQUIRED | {static, runtime, hosting} booleans — which ladder rungs this verdict covers (static:true, the rest false). |
corpus_digest | OPTIONAL | SHA-256 of the static payload corpus the scan used (informational; pins the static check set). |
scorecard_ref | OPTIONAL | a reference to the full Tier-2 runtime evidence attestation. |
A producer MAY add fields additively within v1; a verifier MUST ignore unknown fields.
Binding contract
static-scan-verdict is verdict-bearing (it is in the admission-eligible predicate-name set) but
carries NO catch-policy binding — there is no substrate catch-policy in a static scan. It is
therefore in the verdict-bearing registry but NOT in the catch-policy-bound subset (the verdict
subset that MUST bind a 64-hex catch-policy digest). The verifier accepts a static-scan-verdict
whose DSSE signature verifies and whose predicateType is registered; it does NOT require any
runtime binding. The optional additive egress_posture field, if present, MUST be a known posture
(fail-closed), exactly as the Tier-2 evidence predicate's networkPosture.posture.
Honesty scope
Tier 1 is the BUILT, most-mature pillar (the mcp-test-toolkit static pyramid). A
static-scan-verdict says only what was visible without executing the server — it never claims a
runtime catch. The cross-tier story (a payload that PASSES static here and FAILS runtime in the
Tier-2 gate) is exactly why Tier 2 exists; this verdict is honest about being the static half.
Related
adversarial-execution-evidence— the Tier-2 runtime evidence attestation (the box).compliance-crosswalk— how a signed verdict maps to control catalogs.README— the predicate standard index + the predicate-name registry.