{
  "entrypoint_kind": "endpoint",
  "entrypoint_detail": "POST /api/tool/protected-tool/invoke",
  "service_started": true,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "mcp-toolbox v1.4.0 (vulnerable)",
    "mcp-toolbox v1.5.0 (fixed)",
    "python3 oidc_stub"
  ],
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/vuln_server.log",
    "logs/vuln_api_invoke_status.txt",
    "logs/vuln_api_invoke_body.json",
    "logs/vuln_mcp_noauth_status.txt",
    "logs/vuln_mcp_noauth_body.json",
    "logs/fixed_server.log",
    "logs/oidc_stub.log"
  ],
  "notes": "CVE-2026-14537: v1.4.0 legacy HTTP API invoked scope-protected tool without Authorization (HTTP 200); MCP endpoint returned 401 without token; v1.5.0 refused --enable-api + MCP auth combo (refused=1)."
}