{
  "created_at": "2026-07-16T08:49:46Z",
  "entrypoint_detail": "ToolHive CLI remote MCP onboarding (`thv run <URL> --remote-auth`) with a direct RFC 9728 resource_metadata document whose authorization server metadata is later re-fetched by the DCR resolver and redirected to a separate loopback canary.",
  "entrypoint_kind": "authenticate",
  "healthcheck_passed": true,
  "notes": "confirmed bypass: the DCR resolver metadata re-fetch follows a cross-host/cross-port redirect to the loopback canary on fixed ToolHive v0.31.0; latest v0.38.0 result=1",
  "observations": {
    "fixed_0_31_0_canary_hit": true,
    "latest_0_38_0_canary_hit": true,
    "vulnerable_canary_hit": true
  },
  "proof_artifacts": [
    "logs/vuln_variant/reproduction_steps.log",
    "logs/vuln_variant/variant_attempts.jsonl",
    "logs/vuln_variant/vulnerable_thv.log",
    "logs/vuln_variant/fixed_thv.log",
    "logs/vuln_variant/latest_thv.log",
    "logs/vuln_variant/vulnerable_auth.log",
    "logs/vuln_variant/fixed_auth.log",
    "logs/vuln_variant/latest_auth.log",
    "logs/vuln_variant/vulnerable_canary.log",
    "logs/vuln_variant/fixed_canary.log",
    "logs/vuln_variant/latest_canary.log",
    "logs/vuln_variant/vulnerable_version.txt",
    "logs/vuln_variant/fixed_version.txt",
    "logs/vuln_variant/latest_version.txt",
    "logs/vuln_variant/source_revisions.txt"
  ],
  "runtime_stack": [
    "toolhive-thv",
    "malicious-remote-mcp-server",
    "malicious-oauth-metadata-server",
    "internal-loopback-canary"
  ],
  "service_started": true,
  "target_path_reached": true
}