{
  "method": "structured-json (Cisco mcp-scanner --format raw)",
  "scored_against": "fixtures/vuln-mcp-server/truth.yaml (lab fixture, not published)",
  "tool_output_valid": true,
  "scanned_item_types": [
    "tool"
  ],
  "probes_total": 5,
  "expect_detect": 5,
  "probes_scanned": 3,
  "not_evaluated": 0,
  "not_scanned": 2,
  "true_positives": 3,
  "false_negatives": 0,
  "false_positives": 0,
  "true_negatives": 2,
  "clean_controls": 2,
  "clean_controls_scanned": 2,
  "clean_controls_not_evaluated": 0,
  "recall_scanned": 1.0,
  "coverage": 0.6,
  "note": "Recall ueber GESCANNTE und BEWERTETE Proben (probes_scanned = tp + fn); not_evaluated = gelistet, aber ohne is_safe/Analyzer-Ergebnis; not_scanned = Abdeckungsluecke (Items ausserhalb des Scan-Umfangs, z.B. prompts/instructions beim reinen tools-Remote-Scan). FP/TN nur gegen bewertete saubere Kontrollen."
}