{
  "source": "catalog/crowdstrike-falcon-mcp/entry.yaml, privileges.declared, copied unchanged (author statements at the pinned commit)",
  "method": "reach-v0.1",
  "axes": {
    "fs": 2,
    "net": 3,
    "exec": 1,
    "cred": 1,
    "persist": 2,
    "hitl": 0
  },
  "evidence": {
    "fs": "README.md#L48 the Quarantine module can release, unrelease or delete quarantined files on endpoints, i.e. restore or delete files on the target",
    "net": "README.md#L168-171 the documented container launch binds the streamable-http transport to every network interface, which declares a network-reachable listener beyond the loopback default",
    "exec": "README.md#L49 execution is declared as read-only RTR triage on endpoints",
    "cred": "server.json#L29-35 one CrowdStrike API client secret supplied by the user",
    "persist": "README.md#L47 the server creates, updates and deletes Falcon policies, i.e. changes target configuration",
    "hitl": "falcon_mcp/server.py#L49-51 the server instructions tell agents to confirm intent before any state-changing tool and declare no pre-approvals"
  }
}