Reading Results

Read a result in this order: the grade, the risk summary, then the findings. A grade of ? means the scan could not be graded at all, and no amount of clean-looking detail below it changes that.

Result header

• Grade: A to F, or ? when the scan could not be graded.
• Risk score: 0–100, where 0 is clean and 100 is "do not use", calculated from active findings produced by completed checks.
• Status: running, completed, incomplete, or failed.
• Source: dashboard or CLI. Scans started by the retired Claude Code hook show Claude Code hook (retired).
• Target type: repository, local path, live server, or pasted configuration.
• MCP detected: whether the target is an MCP server. No only when Aevrin read the code and found no MCP server (no package to start and no MCP SDK); then the page says "This code is not an MCP server." and there is no grade. Yes when the server answered, or when the code uses an MCP SDK but Aevrin could not pick or start one server. Empty when Aevrin could not tell, for example when the repository could not be cloned.

Stage timeline

The stage list shows the five stages separately: resolving, launching, enumerating, analyzing and grading. Expand errors before acting on an empty findings list. Scanner stderr is redacted and shortened, but retains enough context to distinguish a finding exit code from a tool failure, timeout, image problem, or invalid response.

Findings

Each finding includes severity, rule id, title, the tools it affects, the evidence that made the rule fire, why it matters, and the fix. Open the detail page for the complete evidence rather than deciding from the list-row title alone.

A finding marked Confidence: low fired on a name or description heuristic that nothing independently confirmed. It is reported so you can judge it, at Info severity so the guess never moves your grade.

A finding showing ×5 is one rule verdict covering five tools, all named on the card. The risk score still counts all five; the grouping only stops the report burying what matters.

Beside the result

• A public report from an earlier scan: only on a scan that could not finish, when a public report exists for the same package or repository. It is someone else's earlier result and never changes this one. See Concepts.
• AI second look: on a finished scan with findings, your own AI provider can give each finding an opinion ("AI: likely real", "AI: maybe not real", "AI: not sure"). It never changes a finding or the grade. See AI explanations.
• Download full report (JSON): the scan engine's complete report behind the result. See Concepts.

Comparing scans

Repeat the same target type after remediation. A local-path scan and remote repository scan may see different files; a live URL scan has fundamentally less coverage. Resolve or dispute old findings with an audit reason instead of assuming a new score silently rewrites history.