From 45990986033e7c11be06b54c34fb1e225b25ea7a Mon Sep 17 00:00:00 2001
From: Algis Dumbris <a.dumbris@gmail.com>
Date: Sun, 23 Aug 2026 21:27:44 +0300
Subject: [PATCH 1/8] feat(security): scan_server/get_scan_report in
 quarantine_security + fix Scan-All visibility and Docker gating
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TPA scanning existed but was unreachable from where people actually are.

MCP: quarantine_security — the most-used security surface — never mentioned
scanning and had no way to run one. It gains two operations, `scan_server`
(runs the offline in-process baseline scan; returns the verdict when it settles,
otherwise the job id) and `get_scan_report` (latest verdict, counts, findings).
list_quarantined / inspect_quarantined / inspect_tools now carry a one-line
scan status, so an unscanned server reads as "never scanned — run scan_server
first" instead of looking clean. Neither operation adds a parameter (both reuse
`name`); the three frozen tool-surface goldens were regenerated deliberately and
their enumerated-delta gates widened to name quarantine_security.

Web UI: the Security page's "Scan All Servers" button never rendered on a fresh
install (the overview counted only BBolt-persisted scanners and missed the
always-on in-process baseline, reporting 0) and was disabled without Docker —
the same false gate already fixed for the per-server Scan Now button. The
overview now counts registry in-process scanners, and the button is no longer
gated on Docker; the tooltip and the Docker alert say what Docker actually
affects (optional deep scanners).

CLI: `mcpproxy security --help` opened with "Security scanners run as Docker
containers", which is only true of the optional layer.

Also fixes dispatch for the advertised `quarantine_server` operation name, which
only accepted the historical "quarantine" spelling.
---
 cmd/mcpproxy/security_cmd.go                  |  11 +-
 docs/features/security-quarantine.md          |  22 ++
 frontend/src/views/Security.vue               |  25 +-
 frontend/src/views/security/deepScanState.ts  |  17 +
 .../unit/security-scan-all-ungate.spec.ts     | 109 +++++++
 .../scanner/overview_baseline_test.go         |  72 +++++
 internal/security/scanner/service.go          |  24 +-
 internal/server/mcp.go                        |  39 ++-
 internal/server/mcp_menu_surface_test.go      |  74 +++++
 internal/server/mcp_quarantine_scan.go        | 269 ++++++++++++++++
 internal/server/mcp_quarantine_scan_test.go   | 301 +++++++++++++++++
 internal/server/scan_admission_test.go        |  61 +++-
 internal/server/server.go                     |  15 +
 .../code_execution_mode.json                  |  10 +-
 .../toolslist_goldens/default_server.json     |  10 +-
 .../pre099/code_execution_mode.json           | 304 ++++++++++++++++++
 .../retrieve_tools_mode.json                  |  10 +-
 internal/server/toolslist_snapshot_test.go    |  77 +++--
 18 files changed, 1384 insertions(+), 66 deletions(-)
 create mode 100644 frontend/tests/unit/security-scan-all-ungate.spec.ts
 create mode 100644 internal/security/scanner/overview_baseline_test.go
 create mode 100644 internal/server/mcp_quarantine_scan.go
 create mode 100644 internal/server/mcp_quarantine_scan_test.go
 create mode 100644 internal/server/testdata/toolslist_goldens/pre099/code_execution_mode.json

diff --git a/cmd/mcpproxy/security_cmd.go b/cmd/mcpproxy/security_cmd.go
index 688f2d392..87994062c 100644
--- a/cmd/mcpproxy/security_cmd.go
+++ b/cmd/mcpproxy/security_cmd.go
@@ -41,8 +41,15 @@ func GetSecurityCommand() *cobra.Command {
 		Long: `Commands for managing security scanners, scanning MCP servers,
 and reviewing scan results.
 
-Security scanners run as Docker containers and analyze upstream MCP servers
-for vulnerabilities, tool poisoning attacks, and other security issues.
+Scanning works out of the box: the offline baseline scanner is built into
+mcpproxy, runs in-process on every scan, and needs no Docker and no setup. It
+analyzes tool descriptions and schemas for tool poisoning attacks (TPAs),
+prompt injection, and data exfiltration.
+
+Deep scanners are the optional extra layer. They run as Docker containers for
+source and dependency analysis (CVEs, secrets), so they need Docker plus
+"deep scan" enabled — and when they are unavailable they are skipped, never
+blocking the baseline verdict.
 
 Examples:
   mcpproxy security scanners
diff --git a/docs/features/security-quarantine.md b/docs/features/security-quarantine.md
index 309021335..c053553b7 100644
--- a/docs/features/security-quarantine.md
+++ b/docs/features/security-quarantine.md
@@ -172,6 +172,28 @@ Manage held prompts with the `quarantine_security` MCP tool:
 
 ## Managing Quarantine
 
+### Scan a Server for TPAs (MCP)
+
+The `quarantine_security` tool can also run and read the TPA scan, so an agent
+reviewing a held server does not have to leave for the CLI or web UI:
+
+```jsonc
+// run the offline baseline scan (in-process, no Docker required)
+{ "operation": "scan_server", "name": "github" }
+// read the latest verdict + findings
+{ "operation": "get_scan_report", "name": "github" }
+```
+
+`scan_server` answers with the verdict when the scan settles quickly, otherwise
+with the job id and `"status": "scan started"` — poll `get_scan_report` for the
+result. Every `list_quarantined`, `inspect_quarantined` and `inspect_tools`
+response also carries a one-line `scan_status`, so a server nobody ever scanned
+reads as `never scanned — run scan_server first` instead of looking clean.
+
+The optional Docker-based deep scanners are a separate layer: they run only when
+[deep scan](/features/security-scanner-plugins) is enabled, and when they are
+unavailable they are skipped without changing the baseline verdict.
+
 ### View Quarantined Servers
 
 **Web UI:**
diff --git a/frontend/src/views/Security.vue b/frontend/src/views/Security.vue
index c289a6862..6467f6a03 100644
--- a/frontend/src/views/Security.vue
+++ b/frontend/src/views/Security.vue
@@ -7,12 +7,16 @@
         <p class="text-base-content/70 mt-1">Configure security scanner plugins and review scan results</p>
       </div>
       <div class="flex gap-2">
-        <div
-          v-if="(overview?.scanners_enabled ?? overview?.scanners_installed ?? 0) > 0"
-          class="tooltip"
-          :data-tip="!overview?.docker_available ? 'Docker is required to run security scanners' : ''"
-        >
-          <button @click="startScanAll" :disabled="loading || scanAllRunning || !overview?.docker_available" class="btn btn-primary">
+        <!-- The offline baseline scanner is built in and always runs, so this
+             action is never gated on Docker or on an installed deep scanner
+             (mirrors the per-server Scan Now button, spec 088 FR-016). -->
+        <div class="tooltip" :data-tip="scanAllTooltip(overview?.docker_available)">
+          <button
+            @click="startScanAll"
+            :disabled="loading || scanAllRunning"
+            class="btn btn-primary"
+            data-test="scan-all-button"
+          >
             <span v-if="scanAllRunning" class="loading loading-spinner loading-sm"></span>
             {{ scanAllRunning ? 'Scanning...' : 'Scan All Servers' }}
           </button>
@@ -151,12 +155,13 @@
       </div>
     </div>
 
-    <!-- Docker unavailable warning (only after overview has loaded) -->
-    <div v-if="overviewLoaded && overview.docker_available === false" class="alert alert-warning">
+    <!-- Docker unavailable warning (only after overview has loaded). Scanning
+         still works: only the optional deep scanners need Docker. -->
+    <div v-if="overviewLoaded && overview.docker_available === false" class="alert alert-warning" data-test="docker-unavailable-alert">
       <svg class="w-5 h-5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
         <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-2.5L13.732 4c-.77-.833-1.964-.833-2.732 0L4.082 16.5c-.77.833.192 2.5 1.732 2.5z" />
       </svg>
-      <span>Docker is not running. Security scanners require Docker to analyze MCP servers.</span>
+      <span>Docker is not running, so the optional deep scanners are skipped. The built-in offline baseline scan still runs.</span>
     </div>
 
     <!-- Docker isolation nudge: show only when Docker is available, global
@@ -513,7 +518,7 @@ import { refreshSecurityScannerStatus } from '@/composables/useSecurityScannerSt
 import { useSystemStore } from '@/stores/system'
 import { scanReportPath } from '@/utils/serverRoute'
 import { formatSignatureBundle } from '@/utils/signatureBundle'
-import { deepScanSummary, enabledDockerScanners, scannerWontRun } from './security/deepScanState'
+import { deepScanSummary, enabledDockerScanners, scanAllTooltip, scannerWontRun } from './security/deepScanState'
 
 const systemStore = useSystemStore()
 
diff --git a/frontend/src/views/security/deepScanState.ts b/frontend/src/views/security/deepScanState.ts
index ef05cb595..152340c05 100644
--- a/frontend/src/views/security/deepScanState.ts
+++ b/frontend/src/views/security/deepScanState.ts
@@ -47,6 +47,23 @@ export function enabledDockerScanners(scanners: ScannerLike[]): number {
   return scanners.filter(s => isDockerScanner(s) && isScannerEnabled(String(s.status ?? ''))).length
 }
 
+/**
+ * Tooltip for the page-level "Scan All Servers" action.
+ *
+ * Docker is NOT a precondition for scanning: the offline baseline scanner is
+ * built into mcpproxy and runs in-process for every server. Only the optional
+ * deep scanners need Docker. The old copy ("Docker is required to run security
+ * scanners") came with a hard `disabled` on the button, which left a default
+ * install — no Docker, no installed scanner — with no way to scan at all, the
+ * same bug already fixed for the per-server Scan Now button (spec 088 FR-016).
+ */
+export function scanAllTooltip(dockerAvailable: boolean | null | undefined): string {
+  if (dockerAvailable === false) {
+    return 'Optional deep scanners need Docker; the offline baseline scan is built in'
+  }
+  return 'Runs the built-in offline baseline scan on every server'
+}
+
 /**
  * The master card's one-line status. Names what a scan will do right now,
  * from the operator's side of the screen.
diff --git a/frontend/tests/unit/security-scan-all-ungate.spec.ts b/frontend/tests/unit/security-scan-all-ungate.spec.ts
new file mode 100644
index 000000000..1b8fa787f
--- /dev/null
+++ b/frontend/tests/unit/security-scan-all-ungate.spec.ts
@@ -0,0 +1,109 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { mount, flushPromises } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { createRouter, createWebHistory } from 'vue-router'
+import { scanAllTooltip } from '@/views/security/deepScanState'
+
+// "Scan All Servers" was unreachable on exactly the installs that had never
+// scanned anything: it only rendered when the overview reported an installed
+// scanner (the always-on in-process baseline was not counted, so a fresh
+// install reported zero), and it was disabled without Docker — the same false
+// gate already fixed for the per-server Scan Now button (spec 088 FR-016).
+//
+// Every fixture here is that default install: zero scanners, no Docker.
+
+let overviewPayload: Record<string, unknown>
+
+vi.mock('@/services/api', () => {
+  const ok = (data: unknown = {}) => Promise.resolve({ success: true, data })
+  return {
+    default: {
+      getSecurityOverview: vi.fn(() => ok(overviewPayload)),
+      listScanners: vi.fn(() => ok([])),
+      listScanHistory: vi.fn(() => ok({ scans: [], total: 0 })),
+      getQueueProgress: vi.fn(() => ok({ status: 'idle' })),
+      getConfig: vi.fn(() => ok({ docker_isolation: { enabled: false }, security: { deep_scan: { enabled: false } } })),
+      getServers: vi.fn(() => ok({ servers: [] })),
+      scanAll: vi.fn(() => ok({ status: 'running', total: 1, completed: 0, running: 1 })),
+      installScanner: vi.fn(() => ok({})),
+      removeScanner: vi.fn(() => ok({})),
+      configureScanner: vi.fn(() => ok({})),
+      cancelAllScans: vi.fn(() => ok({})),
+      patchConfig: vi.fn(() => ok({})),
+      updateConfig: vi.fn(() => ok({})),
+    },
+  }
+})
+
+async function mountSecurity() {
+  const api = (await import('@/services/api')).default
+  const Security = (await import('@/views/Security.vue')).default
+  const router = createRouter({
+    history: createWebHistory(),
+    routes: [
+      { path: '/', component: { template: '<div/>' } },
+      { path: '/settings', component: { template: '<div/>' } },
+      { path: '/security/scans/:jobId', component: { template: '<div/>' } },
+    ],
+  })
+  await router.push('/')
+  await router.isReady()
+  const wrapper = mount(Security, { global: { plugins: [createPinia(), router] } })
+  await flushPromises()
+  await flushPromises()
+  return { wrapper, api }
+}
+
+beforeEach(() => {
+  setActivePinia(createPinia())
+  vi.clearAllMocks()
+  // A fresh install as the backend used to report it: nothing persisted.
+  overviewPayload = { scanners_enabled: 0, scanners_installed: 0, docker_available: false }
+})
+
+describe('Security page — Scan All is reachable on a default install', () => {
+  it('renders the Scan All button with zero reported scanners', async () => {
+    const { wrapper } = await mountSecurity()
+    expect(wrapper.find('[data-test="scan-all-button"]').exists()).toBe(true)
+    wrapper.unmount()
+  })
+
+  it('leaves it enabled when Docker is unavailable', async () => {
+    const { wrapper } = await mountSecurity()
+    expect(wrapper.find('[data-test="scan-all-button"]').attributes('disabled')).toBeUndefined()
+    wrapper.unmount()
+  })
+
+  it('starts a batch scan from the button on a default install', async () => {
+    const { wrapper, api } = await mountSecurity()
+    await wrapper.find('[data-test="scan-all-button"]').trigger('click')
+    await flushPromises()
+    expect(api.scanAll).toHaveBeenCalled()
+    wrapper.unmount()
+  })
+
+  it('explains Docker as a deep-scan-only requirement, not a scanning blocker', async () => {
+    const { wrapper } = await mountSecurity()
+    const tip = wrapper.find('[data-test="scan-all-button"]').element.parentElement?.getAttribute('data-tip') ?? ''
+    expect(tip).toContain('deep scanners need Docker')
+    expect(tip).toContain('baseline')
+    expect(tip).not.toContain('Docker is required')
+
+    const alert = wrapper.find('[data-test="docker-unavailable-alert"]')
+    expect(alert.exists()).toBe(true)
+    expect(alert.text()).toContain('baseline scan still runs')
+    wrapper.unmount()
+  })
+})
+
+describe('scanAllTooltip', () => {
+  it('names deep scanners — not scanning itself — as what Docker gates', () => {
+    expect(scanAllTooltip(false)).toBe('Optional deep scanners need Docker; the offline baseline scan is built in')
+  })
+
+  it('describes the baseline scan when Docker is present or unknown', () => {
+    expect(scanAllTooltip(true)).toContain('offline baseline scan')
+    expect(scanAllTooltip(undefined)).toContain('offline baseline scan')
+    expect(scanAllTooltip(null)).toContain('offline baseline scan')
+  })
+})
diff --git a/internal/security/scanner/overview_baseline_test.go b/internal/security/scanner/overview_baseline_test.go
new file mode 100644
index 000000000..b2db6637f
--- /dev/null
+++ b/internal/security/scanner/overview_baseline_test.go
@@ -0,0 +1,72 @@
+package scanner
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+)
+
+// newFreshInstallService builds a service over the REAL bundled registry and an
+// empty storage — i.e. exactly what a user gets on first launch, before any
+// Docker scanner has ever been installed.
+func newFreshInstallService(t *testing.T) *Service {
+	t.Helper()
+	logger := zap.NewNop()
+	dir := t.TempDir()
+	return NewService(newMockStorage(), NewRegistry(dir, logger), NewDockerRunner(logger), dir, logger)
+}
+
+// TestGetOverview_CountsAlwaysOnBaselineOnFreshInstall pins the fix for the
+// invisible "Scan All Servers" button: the overview counted only scanners
+// persisted in BBolt, so a fresh install reported scanners_enabled=0 even
+// though the in-process tpa-descriptions baseline is always installed and runs
+// on every scan. The web UI hides its scan-trigger button on 0.
+func TestGetOverview_CountsAlwaysOnBaselineOnFreshInstall(t *testing.T) {
+	svc := newFreshInstallService(t)
+
+	overview, err := svc.GetOverview(context.Background())
+	require.NoError(t, err)
+
+	assert.GreaterOrEqual(t, overview.ScannersEnabled, 1,
+		"the always-on in-process baseline must count as enabled on a fresh install")
+	assert.GreaterOrEqual(t, overview.ScannersInstalled, overview.ScannersEnabled,
+		"installed is a superset of enabled")
+
+	// The count is the in-process baseline, not the Docker scanners: those load
+	// as "available" and must stay uncounted until their image is pulled.
+	inProcessEnabled := 0
+	for _, sc := range svc.registry.List() {
+		if sc.InProcess && (sc.Status == ScannerStatusInstalled || sc.Status == ScannerStatusConfigured) {
+			inProcessEnabled++
+		}
+	}
+	assert.Equal(t, inProcessEnabled, overview.ScannersEnabled,
+		"only the in-process baseline is enabled before any Docker scanner is installed")
+}
+
+// TestGetOverview_DoesNotDoubleCountPersistedBaseline guards the other half:
+// once the baseline IS persisted (older builds saved it, and the healing path
+// in syncRegistryFromStorage rewrites it), the registry pass must not count it
+// a second time.
+func TestGetOverview_DoesNotDoubleCountPersistedBaseline(t *testing.T) {
+	logger := zap.NewNop()
+	dir := t.TempDir()
+	store := newMockStorage()
+	registry := NewRegistry(dir, logger)
+
+	baseline, err := registry.Get(inProcessTPAScannerID)
+	require.NoError(t, err)
+	persisted := *baseline
+	persisted.Status = ScannerStatusInstalled
+	require.NoError(t, store.SaveScanner(&persisted))
+
+	svc := NewService(store, registry, NewDockerRunner(logger), dir, logger)
+	overview, err := svc.GetOverview(context.Background())
+	require.NoError(t, err)
+
+	assert.Equal(t, 1, overview.ScannersEnabled, "the persisted baseline is counted exactly once")
+	assert.Equal(t, 1, overview.ScannersInstalled, "the persisted baseline is counted exactly once")
+}
diff --git a/internal/security/scanner/service.go b/internal/security/scanner/service.go
index 96f176b03..b107880dc 100644
--- a/internal/security/scanner/service.go
+++ b/internal/security/scanner/service.go
@@ -1840,18 +1840,36 @@ func (s *Service) GetOverview(ctx context.Context) (*SecurityOverview, error) {
 	overview := &SecurityOverview{}
 
 	// Count installed scanners. ScannersInstalled is the total number of
-	// scanners persisted in storage; ScannersEnabled is the subset the engine
-	// will actually run (status installed or configured). UI uses
-	// ScannersEnabled to decide whether to show scan-trigger buttons.
+	// scanners the proxy holds an install record for; ScannersEnabled is the
+	// subset the engine will actually run (status installed or configured). UI
+	// uses ScannersEnabled to decide whether to show scan-trigger buttons.
+	//
+	// Both counts have to include the in-process baseline scanner
+	// (tpa-descriptions), which is always installed+enabled and lives in the
+	// in-memory registry — nothing persists it to BBolt until a Docker scanner
+	// is installed. Counting storage alone reported 0/0 on a fresh install and
+	// hid the web UI's "Scan All Servers" button on exactly the installs that
+	// have never scanned anything.
+	seen := make(map[string]bool)
 	scanners, err := s.storage.ListScanners()
 	if err == nil {
 		overview.ScannersInstalled = len(scanners)
 		for _, sc := range scanners {
+			seen[sc.ID] = true
 			if sc.Status == ScannerStatusInstalled || sc.Status == ScannerStatusConfigured {
 				overview.ScannersEnabled++
 			}
 		}
 	}
+	for _, reg := range s.registry.List() {
+		if seen[reg.ID] || !reg.InProcess {
+			continue
+		}
+		if reg.Status == ScannerStatusInstalled || reg.Status == ScannerStatusConfigured {
+			overview.ScannersInstalled++
+			overview.ScannersEnabled++
+		}
+	}
 
 	// Count scan jobs
 	jobs, err := s.storage.ListScanJobs("")
diff --git a/internal/server/mcp.go b/internal/server/mcp.go
index 06a84b5e0..34071f561 100644
--- a/internal/server/mcp.go
+++ b/internal/server/mcp.go
@@ -1166,18 +1166,18 @@ func (p *MCPProxyServer) buildManagementTools() []mcpserver.ServerTool {
 	// quarantine_security - Security quarantine management
 	{
 		quarantineSecurityTool := mcp.NewTool("quarantine_security",
-			mcp.WithDescription("Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security."),
+			mcp.WithDescription("Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security."),
 			mcp.WithTitleAnnotation("Quarantine Security"),
 			mcp.WithDestructiveHintAnnotation(true),
 			mcp.WithReadOnlyHintAnnotation(false),
 			mcp.WithOpenWorldHintAnnotation(false),
 			mcp.WithString("operation",
 				mcp.Required(),
-				mcp.Description("Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved."),
-				mcp.Enum("list_quarantined", "inspect_quarantined", "quarantine_server", "inspect_tools", "approve_tool", "approve_all_tools", "block_tool", "block_all_tools", "enable_tool", "disable_tool", "inspect_prompts", "approve_prompt", "approve_all_prompts"),
+				mcp.Description("Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings."),
+				mcp.Enum("list_quarantined", "inspect_quarantined", "quarantine_server", "inspect_tools", "approve_tool", "approve_all_tools", "block_tool", "block_all_tools", "enable_tool", "disable_tool", "inspect_prompts", "approve_prompt", "approve_all_prompts", "scan_server", "get_scan_report"),
 			),
 			mcp.WithString("name",
-				mcp.Description("Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)"),
+				mcp.Description("Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)"),
 			),
 			mcp.WithString("tool_name",
 				mcp.Description("Tool name (required for approve_tool and block_tool operations)"),
@@ -3404,10 +3404,16 @@ func (p *MCPProxyServer) handleQuarantineSecurity(ctx context.Context, request m
 		result, opErr = p.handleListQuarantinedUpstreams(ctx)
 	case "inspect_quarantined":
 		result, opErr = p.handleInspectQuarantinedTools(ctx, request)
-	case "quarantine":
+	// "quarantine_server" is the name advertised in the operation enum;
+	// "quarantine" is the historical spelling kept working for older agents.
+	case "quarantine_server", "quarantine":
 		result, opErr = p.handleQuarantineUpstream(ctx, request)
 	case "inspect_tools":
-		result, opErr = p.handleInspectToolApprovals(request)
+		result, opErr = p.handleInspectToolApprovals(ctx, request)
+	case "scan_server":
+		result, opErr = p.handleScanServer(ctx, request)
+	case "get_scan_report":
+		result, opErr = p.handleGetScanReport(ctx, request)
 	case "approve_tool":
 		result, opErr = p.handleApproveToolByName(request)
 	case "approve_all_tools":
@@ -3457,7 +3463,7 @@ func (p *MCPProxyServer) handleQuarantineSecurity(ctx context.Context, request m
 }
 
 // handleInspectToolApprovals shows tool-level quarantine status for a server (Spec 032)
-func (p *MCPProxyServer) handleInspectToolApprovals(request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+func (p *MCPProxyServer) handleInspectToolApprovals(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 	serverName := request.GetString("name", "")
 	if serverName == "" {
 		return mcp.NewToolResultError("Missing required parameter 'name' (server name)"), nil
@@ -3468,8 +3474,10 @@ func (p *MCPProxyServer) handleInspectToolApprovals(request mcp.CallToolRequest)
 		return mcp.NewToolResultError(fmt.Sprintf("Failed to list tool approvals: %v", err)), nil
 	}
 
+	scanStatus := p.scanStatusLine(ctx, serverName)
+
 	if len(records) == 0 {
-		return mcp.NewToolResultText(fmt.Sprintf("No tool approval records found for server '%s'", serverName)), nil
+		return mcp.NewToolResultText(fmt.Sprintf("No tool approval records found for server '%s' (scan status: %s)", serverName, scanStatus)), nil
 	}
 
 	pendingCount, changedCount, approvedCount, disabledCount := 0, 0, 0, 0
@@ -3509,6 +3517,7 @@ func (p *MCPProxyServer) handleInspectToolApprovals(request mcp.CallToolRequest)
 
 	result := map[string]interface{}{
 		"server_name":    serverName,
+		"scan_status":    scanStatus,
 		"tools":          toolList,
 		"total":          len(records),
 		"approved_count": approvedCount,
@@ -4095,15 +4104,26 @@ func (p *MCPProxyServer) getDockerContainerInfo(client *managed.Client) map[stri
 	return result
 }
 
-func (p *MCPProxyServer) handleListQuarantinedUpstreams(_ context.Context) (*mcp.CallToolResult, error) {
+func (p *MCPProxyServer) handleListQuarantinedUpstreams(ctx context.Context) (*mcp.CallToolResult, error) {
 	servers, err := p.storage.ListQuarantinedUpstreamServers()
 	if err != nil {
 		return mcp.NewToolResultError(fmt.Sprintf("Failed to list quarantined upstreams: %v", err)), nil
 	}
 
+	names := make([]string, 0, len(servers))
+	for _, sc := range servers {
+		if sc != nil {
+			names = append(names, sc.Name)
+		}
+	}
+
 	jsonResult, err := json.Marshal(map[string]interface{}{
 		"servers": servers,
 		"total":   len(servers),
+		// One line per server so "nobody ever scanned this" is visible right
+		// here, next to the decision it should inform.
+		"scan_status": p.scanStatusLines(ctx, names),
+		"scan_hint":   "Use operation='scan_server' name='<server>' to run the offline TPA baseline scan, then operation='get_scan_report' for the findings.",
 	})
 	if err != nil {
 		return mcp.NewToolResultError(fmt.Sprintf("Failed to serialize quarantined upstreams: %v", err)), nil
@@ -4369,6 +4389,7 @@ func (p *MCPProxyServer) handleInspectQuarantinedTools(ctx context.Context, requ
 	response := map[string]interface{}{
 		"server":            serverName,
 		"quarantine_status": "ACTIVE",
+		"scan_status":       p.scanStatusLine(ctx, serverName),
 		"tools":             toolsAnalysis,
 		"total_tools":       len(toolsAnalysis),
 		"analysis_purpose":  "SECURITY_INSPECTION",
diff --git a/internal/server/mcp_menu_surface_test.go b/internal/server/mcp_menu_surface_test.go
index 568efe4cf..749fa3040 100644
--- a/internal/server/mcp_menu_surface_test.go
+++ b/internal/server/mcp_menu_surface_test.go
@@ -156,6 +156,8 @@ func TestMenuSurface_ExactDeltaFromPreFeature(t *testing.T) {
 					assertCallToolVariantDelta(t, surface, name, preM, curM)
 				case name == "code_execution":
 					assertCodeExecutionDelta(t, surface, preM, curM)
+				case name == "quarantine_security":
+					assertQuarantineSecurityDelta(t, surface, preM, curM)
 				default:
 					assert.Equal(t, preM, curM,
 						"surface %s: tool %q must be byte-identical to the pre-feature snapshot (SC-003)", surface, name)
@@ -260,6 +262,78 @@ func assertRetrieveToolsDelta(t *testing.T, surface string, preM, curM map[strin
 		"surface %s: retrieve_tools description must reference compact signatures (spec 085 FR-014)", surface)
 }
 
+// quarantineScanOperations are the operations that made TPA scanning reachable
+// from quarantine_security — the surface agents already use for held servers.
+var quarantineScanOperations = []string{"scan_server", "get_scan_report"}
+
+// assertQuarantineSecurityDelta: quarantine_security may grow the two scan
+// operations and the prose that documents them, and NOTHING else. In
+// particular it takes no new parameter — both operations reuse `name` — so the
+// parameter SET and every parameter schema except `operation` must be
+// byte-identical to the pre-feature snapshot.
+func assertQuarantineSecurityDelta(t *testing.T, surface string, preM, curM map[string]interface{}) {
+	t.Helper()
+
+	preProps, curProps := schemaProps(preM), schemaProps(curM)
+	require.NotNil(t, curProps, "surface %s: quarantine_security lost its inputSchema", surface)
+	assert.Equal(t, sortedKeys(preProps), sortedKeys(curProps),
+		"surface %s: the scan operations reuse existing parameters — none may be added", surface)
+
+	for p, preSchema := range preProps {
+		if p == "operation" {
+			continue
+		}
+		if p == "name" {
+			// `name` is now required for the scan ops too, so its description
+			// lists them; the rest of its schema must not move.
+			preName, _ := preSchema.(map[string]interface{})
+			curName, _ := curProps[p].(map[string]interface{})
+			require.NotNil(t, curName, "surface %s: quarantine_security lost its name parameter", surface)
+			assert.Equal(t, preName["type"], curName["type"], "surface %s: name stays a string", surface)
+			for _, op := range quarantineScanOperations {
+				assert.Contains(t, curName["description"], op,
+					"surface %s: name must document that %s requires it", surface, op)
+			}
+			continue
+		}
+		assert.Equal(t, preSchema, curProps[p],
+			"surface %s: pre-feature quarantine_security parameter %q must be preserved unchanged", surface, p)
+	}
+
+	// The operation enum grows by exactly the scan operations, appended after
+	// every pre-feature value in its original order.
+	preOp, _ := preProps["operation"].(map[string]interface{})
+	curOp, _ := curProps["operation"].(map[string]interface{})
+	require.NotNil(t, curOp, "surface %s: quarantine_security lost its operation parameter", surface)
+	preEnum, _ := preOp["enum"].([]interface{})
+	curEnum, _ := curOp["enum"].([]interface{})
+	wantEnum := append([]interface{}{}, preEnum...)
+	for _, op := range quarantineScanOperations {
+		wantEnum = append(wantEnum, op)
+	}
+	assert.Equal(t, wantEnum, curEnum,
+		"surface %s: the operation enum grows by exactly %v", surface, quarantineScanOperations)
+
+	// Annotations and required list unchanged.
+	assert.Equal(t, preM["annotations"], curM["annotations"],
+		"surface %s: quarantine_security annotations unchanged", surface)
+	preSchema, _ := preM["inputSchema"].(map[string]interface{})
+	curSchema, _ := curM["inputSchema"].(map[string]interface{})
+	assert.Equal(t, preSchema["required"], curSchema["required"],
+		"surface %s: quarantine_security required params unchanged", surface)
+
+	// The tool description must actually advertise scanning — the discovery
+	// gap this change exists to close (the tool never mentioned scanning, so
+	// agents never found the scanner).
+	curDesc, _ := curM["description"].(string)
+	assert.Contains(t, strings.ToLower(curDesc), "scan",
+		"surface %s: quarantine_security description must mention scanning", surface)
+	for _, op := range quarantineScanOperations {
+		assert.Contains(t, curDesc, op,
+			"surface %s: quarantine_security description must name %s", surface, op)
+	}
+}
+
 // FR-009: the three registrations are built independently, which is exactly
 // how the default one drifted into omitting the filter parameters. They must
 // now come from one shared helper — asserted by deep-comparing the produced
diff --git a/internal/server/mcp_quarantine_scan.go b/internal/server/mcp_quarantine_scan.go
new file mode 100644
index 000000000..63a179386
--- /dev/null
+++ b/internal/server/mcp_quarantine_scan.go
@@ -0,0 +1,269 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/security/scanner"
+)
+
+// Scanning through quarantine_security (the surface agents actually reach for
+// when a server is held). The TPA scanner shipped with no MCP entry point at
+// all: an agent could list, inspect and approve quarantined tools but had no
+// way to ask "has this server been scanned, and what did the scan say?" — the
+// answer lived only in the web UI and the CLI.
+
+const (
+	// scanVerdictWait is how long scan_server waits for the just-started
+	// Pass-1 scan to settle before answering "started, poll get_scan_report".
+	// The in-process baseline scan on a connected server finishes well inside
+	// this; anything slower (a cold upstream that has to connect first) is
+	// reported as async rather than holding the agent's call open.
+	scanVerdictWait = 8 * time.Second
+
+	// scanVerdictPoll is the polling interval used while waiting.
+	scanVerdictPoll = 250 * time.Millisecond
+
+	// scanReportMaxFindings caps how many findings get inlined into a
+	// get_scan_report response. The full report stays available over REST and
+	// in the web UI; an MCP response is a token budget.
+	scanReportMaxFindings = 10
+
+	// neverScannedHint is the one-line status carried by list/inspect
+	// responses for a server with no scan on record.
+	neverScannedHint = "never scanned — run scan_server first"
+)
+
+// securityScanner returns the scanner service backing the scan operations, or
+// nil when this process has none (scanner disabled, or a test proxy without a
+// main server).
+func (p *MCPProxyServer) securityScanner() securityScannerService {
+	if p.mainServer == nil {
+		return nil
+	}
+	return p.mainServer.securityScannerSvc()
+}
+
+// scannerUnavailableResult is the shared "no scanner here" answer. It names the
+// reason rather than pretending the server is clean.
+func scannerUnavailableResult(operation string) *mcp.CallToolResult {
+	return mcp.NewToolResultError(fmt.Sprintf(
+		"Security scanning is unavailable in this process, so '%s' cannot run. Scanning requires the mcpproxy core (not a stdio-only proxy).", operation))
+}
+
+// handleScanServer triggers a Pass-1 (offline baseline) security scan for a
+// server and reports the verdict if the scan settles quickly.
+func (p *MCPProxyServer) handleScanServer(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	serverName := request.GetString("name", "")
+	if serverName == "" {
+		return mcp.NewToolResultError("Missing required parameter 'name' (server name)"), nil
+	}
+
+	svc := p.securityScanner()
+	if svc == nil {
+		return scannerUnavailableResult("scan_server"), nil
+	}
+
+	job, err := svc.StartScan(ctx, serverName, false, nil, "")
+	if err != nil {
+		return mcp.NewToolResultError(fmt.Sprintf("Failed to start scan for server '%s': %v", serverName, err)), nil
+	}
+
+	response := map[string]interface{}{
+		"operation":   "scan_server",
+		"server_name": serverName,
+		"scan_pass":   "baseline",
+		"note":        "The offline baseline scan runs in-process and needs no Docker. Optional deep scanners (Docker) run only when deep scan is enabled.",
+	}
+	jobID := ""
+	if job != nil {
+		jobID = job.ID
+		response["job_id"] = job.ID
+	}
+
+	if summary := p.awaitScanVerdict(ctx, svc, serverName, jobID); summary != nil {
+		response["status"] = "completed"
+		response["verdict"] = summary.Status
+		response["risk_score"] = summary.RiskScore
+		if summary.FindingCounts != nil {
+			response["finding_counts"] = summary.FindingCounts
+		}
+		if summary.LastScanAt != nil {
+			response["last_scan_at"] = summary.LastScanAt.UTC().Format(time.RFC3339)
+		}
+		response["next_steps"] = fmt.Sprintf("Use operation='get_scan_report' name='%s' for the findings.", serverName)
+	} else {
+		response["status"] = "scan started"
+		response["next_steps"] = fmt.Sprintf("Scan is still running. Use operation='get_scan_report' name='%s' to read the verdict.", serverName)
+	}
+
+	return jsonToolResult(response, "scan result")
+}
+
+// awaitScanVerdict polls until the scan job reaches a terminal state, then
+// returns the resulting summary. Returns nil on timeout, on context
+// cancellation, or when no summary is available — the caller then answers
+// "scan started" instead of inventing a verdict.
+func (p *MCPProxyServer) awaitScanVerdict(ctx context.Context, svc securityScannerService, serverName, jobID string) *scanner.ScanSummary {
+	deadline := time.Now().Add(scanVerdictWait)
+	ticker := time.NewTicker(scanVerdictPoll)
+	defer ticker.Stop()
+
+	for {
+		job, err := svc.GetScanStatus(ctx, serverName)
+		if err == nil && job != nil && scanJobSettled(job.Status) && (jobID == "" || job.ID == jobID) {
+			// The summary is derived from persisted jobs/reports, which the
+			// completion callback writes before flipping the job state.
+			return svc.GetScanSummary(ctx, serverName)
+		}
+
+		if time.Now().After(deadline) {
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func scanJobSettled(status string) bool {
+	switch status {
+	case scanner.ScanJobStatusCompleted, scanner.ScanJobStatusFailed, scanner.ScanJobStatusCancelled:
+		return true
+	default:
+		return false
+	}
+}
+
+// handleGetScanReport returns the latest scan verdict + findings for a server.
+func (p *MCPProxyServer) handleGetScanReport(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	serverName := request.GetString("name", "")
+	if serverName == "" {
+		return mcp.NewToolResultError("Missing required parameter 'name' (server name)"), nil
+	}
+
+	svc := p.securityScanner()
+	if svc == nil {
+		return scannerUnavailableResult("get_scan_report"), nil
+	}
+
+	summary := svc.GetScanSummary(ctx, serverName)
+	report, reportErr := svc.GetScanReport(ctx, serverName)
+	if summary == nil && (reportErr != nil || report == nil) {
+		return jsonToolResult(map[string]interface{}{
+			"operation":   "get_scan_report",
+			"server_name": serverName,
+			"scan_status": neverScannedHint,
+			"next_steps":  fmt.Sprintf("Use operation='scan_server' name='%s' to run the offline baseline scan.", serverName),
+		}, "scan report")
+	}
+
+	response := map[string]interface{}{
+		"operation":   "get_scan_report",
+		"server_name": serverName,
+		"scan_status": scanStatusLineFrom(summary, serverName),
+	}
+	if summary != nil {
+		response["verdict"] = summary.Status
+		response["risk_score"] = summary.RiskScore
+		if summary.FindingCounts != nil {
+			response["finding_counts"] = summary.FindingCounts
+		}
+		if summary.LastScanAt != nil {
+			response["last_scan_at"] = summary.LastScanAt.UTC().Format(time.RFC3339)
+		}
+		response["scanners_run"] = summary.ScannersRun
+		response["scanners_failed"] = summary.ScannersFailed
+		response["scanners_total"] = summary.ScannersTotal
+		if summary.DeepScan != nil {
+			response["deep_scan"] = summary.DeepScan
+		}
+	}
+
+	if reportErr == nil && report != nil {
+		response["job_id"] = report.JobID
+		if summary == nil {
+			response["verdict"] = report.Verdict
+			response["risk_score"] = report.RiskScore
+		}
+		response["findings_total"] = len(report.Findings)
+		findings := make([]map[string]interface{}, 0, scanReportMaxFindings)
+		for i, f := range report.Findings {
+			if i >= scanReportMaxFindings {
+				response["findings_truncated"] = len(report.Findings) - scanReportMaxFindings
+				break
+			}
+			finding := map[string]interface{}{
+				"rule_id":      f.RuleID,
+				"title":        f.Title,
+				"severity":     f.Severity,
+				"threat_level": f.ThreatLevel,
+				"threat_type":  f.ThreatType,
+				"scanner":      f.Scanner,
+			}
+			if f.Location != "" {
+				finding["location"] = f.Location
+			}
+			if f.Description != "" {
+				finding["description"] = f.Description
+			}
+			findings = append(findings, finding)
+		}
+		response["findings"] = findings
+	}
+
+	return jsonToolResult(response, "scan report")
+}
+
+// scanStatusLineFrom renders the one-line scan status carried by every
+// quarantine_security listing/inspection response.
+func scanStatusLineFrom(summary *scanner.ScanSummary, serverName string) string {
+	if summary == nil {
+		return neverScannedHint
+	}
+	if summary.Status == "scanning" {
+		return fmt.Sprintf("scan running for '%s' — re-run get_scan_report shortly", serverName)
+	}
+	line := fmt.Sprintf("last scan verdict: %s (risk %d)", summary.Status, summary.RiskScore)
+	if summary.LastScanAt != nil {
+		line += fmt.Sprintf(", scanned %s", summary.LastScanAt.UTC().Format(time.RFC3339))
+	}
+	return line
+}
+
+// scanStatusLine resolves the one-line scan status for a server, tolerating a
+// process with no scanner at all.
+func (p *MCPProxyServer) scanStatusLine(ctx context.Context, serverName string) string {
+	svc := p.securityScanner()
+	if svc == nil {
+		return "scan status unavailable — this process runs no security scanner"
+	}
+	return scanStatusLineFrom(svc.GetScanSummary(ctx, serverName), serverName)
+}
+
+// scanStatusLines resolves scan status for a batch of servers (list_quarantined).
+func (p *MCPProxyServer) scanStatusLines(ctx context.Context, serverNames []string) map[string]string {
+	lines := make(map[string]string, len(serverNames))
+	for _, name := range serverNames {
+		if name == "" {
+			continue
+		}
+		lines[name] = p.scanStatusLine(ctx, name)
+	}
+	return lines
+}
+
+// jsonToolResult marshals a response map into an MCP text result.
+func jsonToolResult(payload map[string]interface{}, what string) (*mcp.CallToolResult, error) {
+	jsonBytes, err := json.Marshal(payload)
+	if err != nil {
+		return mcp.NewToolResultError(fmt.Sprintf("Failed to serialize %s: %v", what, err)), nil
+	}
+	return mcp.NewToolResultText(string(jsonBytes)), nil
+}
diff --git a/internal/server/mcp_quarantine_scan_test.go b/internal/server/mcp_quarantine_scan_test.go
new file mode 100644
index 000000000..35829305a
--- /dev/null
+++ b/internal/server/mcp_quarantine_scan_test.go
@@ -0,0 +1,301 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/security/scanner"
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/storage"
+)
+
+// quarantine_security is the security surface agents actually reach for, and it
+// had no way to run or read a TPA scan. These tests cover the two operations
+// that close that gap (scan_server / get_scan_report) plus the one-line scan
+// status every listing/inspection response now carries.
+
+// scanTestProxy builds a proxy wired to a real runtime plus a fake scanner
+// service, and returns both so a test can pin scan fixtures.
+func scanTestProxy(t *testing.T, servers ...*config.ServerConfig) (*MCPProxyServer, *fakeSecurityScanner) {
+	t.Helper()
+	proxy, rt := createTestProxyWithRuntime(t, servers)
+	// list_quarantined reads the persisted upstream list, mirroring production
+	// where an added server is always saved to BBolt.
+	for _, sc := range servers {
+		require.NoError(t, rt.StorageManager().SaveUpstreamServer(sc))
+	}
+	fake := newFakeSecurityScanner()
+	proxy.mainServer.securityScanner = fake
+	return proxy, fake
+}
+
+func decodeToolJSON(t *testing.T, result *mcp.CallToolResult) map[string]interface{} {
+	t.Helper()
+	require.NotNil(t, result)
+	require.NotEmpty(t, result.Content)
+	text, ok := result.Content[0].(mcp.TextContent)
+	require.True(t, ok, "expected text content")
+	var payload map[string]interface{}
+	require.NoError(t, json.Unmarshal([]byte(text.Text), &payload), "response must be JSON: %s", text.Text)
+	return payload
+}
+
+func settledSummary(status string, risk int) *scanner.ScanSummary {
+	at := time.Date(2026, 8, 20, 10, 0, 0, 0, time.UTC)
+	return &scanner.ScanSummary{
+		LastScanAt:    &at,
+		RiskScore:     risk,
+		Status:        status,
+		FindingCounts: &scanner.FindingCounts{Dangerous: 1, Total: 1},
+		ScannersRun:   1,
+		ScannersTotal: 1,
+	}
+}
+
+// TestQuarantineSecurity_ScanServer_ReturnsVerdictWhenScanSettles is the happy
+// path: the operation starts a scan and, because the baseline scan finishes
+// in-process, answers with the verdict rather than only a job id.
+func TestQuarantineSecurity_ScanServer_ReturnsVerdictWhenScanSettles(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true, Quarantined: true})
+	fake.onStartScan = func(serverName string) {
+		fake.setScanResult(serverName,
+			&scanner.ScanJob{ID: "job-1", ServerName: serverName, Status: scanner.ScanJobStatusCompleted},
+			settledSummary("dangerous", 80))
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError, "scan_server must succeed")
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, []string{"github"}, fake.startedScans(), "the scan is actually triggered")
+	assert.Equal(t, "completed", payload["status"])
+	assert.Equal(t, "dangerous", payload["verdict"])
+	assert.Equal(t, float64(80), payload["risk_score"])
+	assert.Equal(t, "job-1", payload["job_id"])
+	assert.Contains(t, payload["next_steps"], "get_scan_report")
+}
+
+// TestQuarantineSecurity_ScanServer_AsyncWhenScanStillRunning covers the other
+// branch: a scan that has not settled must report "scan started" with a job id,
+// never a fabricated verdict.
+func TestQuarantineSecurity_ScanServer_AsyncWhenScanStillRunning(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-2", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		nil)
+
+	// Keep the test fast: the wait loop honours context cancellation.
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	result, err := proxy.handleQuarantineSecurity(ctx, quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "scan started", payload["status"])
+	assert.Equal(t, "job-2", payload["job_id"])
+	assert.NotContains(t, payload, "verdict", "an unfinished scan has no verdict to report")
+}
+
+// TestQuarantineSecurity_ScanServer_RequiresName pins the argument contract.
+func TestQuarantineSecurity_ScanServer_RequiresName(t *testing.T) {
+	proxy, _ := scanTestProxy(t)
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+	}))
+	require.NoError(t, err)
+	require.True(t, result.IsError)
+	assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "'name'")
+}
+
+// TestQuarantineSecurity_ScanServer_ReportsStartFailure — a scan that cannot
+// start (disconnected server, no tool definitions) says so.
+func TestQuarantineSecurity_ScanServer_ReportsStartFailure(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.startScanErr = errors.New("server is disconnected")
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.True(t, result.IsError)
+	assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "server is disconnected")
+}
+
+// TestQuarantineSecurity_GetScanReport_ReturnsVerdictAndFindings covers the
+// read side, including the finding projection.
+func TestQuarantineSecurity_GetScanReport_ReturnsVerdictAndFindings(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-3", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		settledSummary("warnings", 30))
+	fake.reports["github"] = &scanner.AggregatedReport{
+		JobID:      "job-3",
+		ServerName: "github",
+		Verdict:    "warnings",
+		RiskScore:  30,
+		Findings: []scanner.ScanFinding{{
+			RuleID:      "TPA-2026-0001",
+			Title:       "Hidden instructions in tool description",
+			Severity:    scanner.SeverityHigh,
+			ThreatLevel: "warning",
+			ThreatType:  "tool_poisoning",
+			Scanner:     "tpa-descriptions",
+			Location:    "tools.json",
+		}},
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "warnings", payload["verdict"])
+	assert.Equal(t, "job-3", payload["job_id"])
+	assert.Equal(t, float64(1), payload["findings_total"])
+	findings, ok := payload["findings"].([]interface{})
+	require.True(t, ok)
+	require.Len(t, findings, 1)
+	assert.Equal(t, "TPA-2026-0001", findings[0].(map[string]interface{})["rule_id"])
+	assert.Contains(t, payload["scan_status"], "warnings")
+}
+
+// TestQuarantineSecurity_GetScanReport_NeverScanned is the honest empty state:
+// no report is NOT a clean verdict.
+func TestQuarantineSecurity_GetScanReport_NeverScanned(t *testing.T) {
+	proxy, _ := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, neverScannedHint, payload["scan_status"])
+	assert.NotContains(t, payload, "verdict")
+	assert.Contains(t, payload["next_steps"], "scan_server")
+}
+
+// TestQuarantineSecurity_ListQuarantined_CarriesScanStatus — the listing an
+// agent starts from must say whether each held server was ever scanned.
+func TestQuarantineSecurity_ListQuarantined_CarriesScanStatus(t *testing.T) {
+	proxy, fake := scanTestProxy(t,
+		&config.ServerConfig{Name: "scanned", Enabled: true, Quarantined: true},
+		&config.ServerConfig{Name: "unscanned", Enabled: true, Quarantined: true},
+	)
+	fake.setScanResult("scanned",
+		&scanner.ScanJob{ID: "job-4", ServerName: "scanned", Status: scanner.ScanJobStatusCompleted},
+		settledSummary("clean", 0))
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "list_quarantined",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	statuses, ok := payload["scan_status"].(map[string]interface{})
+	require.True(t, ok, "list_quarantined must carry per-server scan status")
+	assert.Contains(t, statuses["scanned"], "clean")
+	assert.Equal(t, neverScannedHint, statuses["unscanned"])
+	assert.Contains(t, payload["scan_hint"], "scan_server")
+}
+
+// TestQuarantineSecurity_InspectTools_CarriesScanStatus — same for the
+// tool-approval inspection, in both the populated and the empty state.
+func TestQuarantineSecurity_InspectTools_CarriesScanStatus(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true, Quarantined: true})
+	require.NoError(t, proxy.storage.SaveToolApproval(&storage.ToolApprovalRecord{
+		ServerName:         "github",
+		ToolName:           "create_issue",
+		Status:             storage.ToolApprovalStatusPending,
+		CurrentHash:        "h1",
+		CurrentDescription: "Creates a GitHub issue",
+		CurrentSchema:      `{"type":"object"}`,
+	}))
+
+	inspect := func() *mcp.CallToolResult {
+		result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+			"operation": "inspect_tools",
+			"name":      "github",
+		}))
+		require.NoError(t, err)
+		require.False(t, result.IsError)
+		return result
+	}
+
+	payload := decodeToolJSON(t, inspect())
+	assert.Equal(t, neverScannedHint, payload["scan_status"])
+
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-5", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		settledSummary("dangerous", 90))
+	payload = decodeToolJSON(t, inspect())
+	assert.Contains(t, payload["scan_status"], "dangerous")
+}
+
+// TestQuarantineSecurity_InspectTools_EmptyStateCarriesScanStatus covers the
+// no-records early return, which is plain text rather than JSON.
+func TestQuarantineSecurity_InspectTools_EmptyStateCarriesScanStatus(t *testing.T) {
+	proxy, _ := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "inspect_tools",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+	assert.Contains(t, result.Content[0].(mcp.TextContent).Text, neverScannedHint)
+}
+
+// TestQuarantineSecurity_ScanOps_WithoutScannerService — a proxy with no
+// scanner (stdio-only mode) must explain that, not crash.
+func TestQuarantineSecurity_ScanOps_WithoutScannerService(t *testing.T) {
+	proxy, _ := createTestProxyWithRuntime(t, []*config.ServerConfig{{Name: "github", Enabled: true}})
+
+	for _, op := range []string{"scan_server", "get_scan_report"} {
+		result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+			"operation": op,
+			"name":      "github",
+		}))
+		require.NoError(t, err)
+		require.True(t, result.IsError, "%s must report the missing scanner", op)
+		assert.Contains(t, result.Content[0].(mcp.TextContent).Text, "unavailable")
+	}
+}
+
+// TestQuarantineSecurity_QuarantineServerOperationName — the enum advertises
+// "quarantine_server"; the dispatch used to accept only the old "quarantine"
+// spelling, so the advertised name returned "Unknown quarantine operation".
+func TestQuarantineSecurity_QuarantineServerOperationName(t *testing.T) {
+	proxy, _ := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "quarantine_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	assert.NotContains(t, result.Content[0].(mcp.TextContent).Text, "Unknown quarantine operation")
+}
diff --git a/internal/server/scan_admission_test.go b/internal/server/scan_admission_test.go
index 40f902151..c90818322 100644
--- a/internal/server/scan_admission_test.go
+++ b/internal/server/scan_admission_test.go
@@ -27,6 +27,17 @@ type fakeSecurityScanner struct {
 	hasBaseline map[string]bool
 	approveErr  error
 
+	// Scan-surface fixtures (quarantine_security scan_server /
+	// get_scan_report). jobs/reports are keyed by server name; startScanErr
+	// and reportErr let a test drive the failure branches.
+	jobs         map[string]*scanner.ScanJob
+	reports      map[string]*scanner.AggregatedReport
+	startScanErr error
+	reportErr    error
+	// onStartScan runs inside StartScan, so a test can make the scan "settle"
+	// (publish a completed job + summary) exactly when it is triggered.
+	onStartScan func(serverName string)
+
 	approveCalls   []string
 	startScanCalls []string
 }
@@ -35,9 +46,20 @@ func newFakeSecurityScanner() *fakeSecurityScanner {
 	return &fakeSecurityScanner{
 		summaries:   map[string]*scanner.ScanSummary{},
 		hasBaseline: map[string]bool{},
+		jobs:        map[string]*scanner.ScanJob{},
+		reports:     map[string]*scanner.AggregatedReport{},
 	}
 }
 
+// setScanResult publishes a settled scan for a server: the job the status poll
+// sees and the summary the verdict is read from.
+func (f *fakeSecurityScanner) setScanResult(serverName string, job *scanner.ScanJob, summary *scanner.ScanSummary) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.jobs[serverName] = job
+	f.summaries[serverName] = summary
+}
+
 func (f *fakeSecurityScanner) GetScanSummary(_ context.Context, serverName string) *scanner.ScanSummary {
 	f.mu.Lock()
 	defer f.mu.Unlock()
@@ -56,9 +78,44 @@ func (f *fakeSecurityScanner) ApproveServer(_ context.Context, serverName string
 
 func (f *fakeSecurityScanner) StartScan(_ context.Context, serverName string, _ bool, _ []string, _ string) (*scanner.ScanJob, error) {
 	f.mu.Lock()
-	defer f.mu.Unlock()
 	f.startScanCalls = append(f.startScanCalls, serverName)
-	return nil, nil
+	err := f.startScanErr
+	hook := f.onStartScan
+	f.mu.Unlock()
+
+	// The hook may publish the settled job, so read it back afterwards.
+	if hook != nil {
+		hook(serverName)
+	}
+	if err != nil {
+		return nil, err
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.jobs[serverName], nil
+}
+
+func (f *fakeSecurityScanner) GetScanStatus(_ context.Context, serverName string) (*scanner.ScanJob, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	job, ok := f.jobs[serverName]
+	if !ok {
+		return nil, errors.New("no scan job")
+	}
+	return job, nil
+}
+
+func (f *fakeSecurityScanner) GetScanReport(_ context.Context, serverName string) (*scanner.AggregatedReport, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.reportErr != nil {
+		return nil, f.reportErr
+	}
+	report, ok := f.reports[serverName]
+	if !ok {
+		return nil, errors.New("no scan found")
+	}
+	return report, nil
 }
 
 func (f *fakeSecurityScanner) HasApprovalBaseline(serverName string) bool {
diff --git a/internal/server/server.go b/internal/server/server.go
index 9057fc855..0a6d2b210 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -62,12 +62,27 @@ type securityScannerService interface {
 	GetScanSummary(ctx context.Context, serverName string) *scanner.ScanSummary
 	ApproveServer(ctx context.Context, serverName string, force bool, approvedBy string) error
 	StartScan(ctx context.Context, serverName string, dryRun bool, scannerIDs []string, sourceDir string) (*scanner.ScanJob, error)
+	// GetScanStatus / GetScanReport back the quarantine_security scan
+	// operations (scan_server / get_scan_report): an agent that just triggered
+	// a scan needs the job's terminal state and the verdict that came out of it.
+	GetScanStatus(ctx context.Context, serverName string) (*scanner.ScanJob, error)
+	GetScanReport(ctx context.Context, serverName string) (*scanner.AggregatedReport, error)
 	HasApprovalBaseline(serverName string) bool
 	ApplySecurityConfig(sec *config.SecurityConfig)
 	SetIsolationMode(mode string)
 	DeepScanEnabled() bool
 }
 
+// securityScannerSvc returns the security scanner service, or nil when the
+// process runs without one (scanner disabled, or a test harness that never
+// wired one up). Callers MUST nil-check.
+func (s *Server) securityScannerSvc() securityScannerService {
+	if s == nil {
+		return nil
+	}
+	return s.securityScanner
+}
+
 // Server wraps the MCP proxy server with all its dependencies
 type Server struct {
 	logger   *zap.Logger
diff --git a/internal/server/testdata/toolslist_goldens/code_execution_mode.json b/internal/server/testdata/toolslist_goldens/code_execution_mode.json
index b9f6af6ee..29e080fd2 100644
--- a/internal/server/testdata/toolslist_goldens/code_execution_mode.json
+++ b/internal/server/testdata/toolslist_goldens/code_execution_mode.json
@@ -48,15 +48,15 @@
       "idempotentHint": false,
       "openWorldHint": false
     },
-    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "description": "Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
     "inputSchema": {
       "properties": {
         "name": {
-          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)",
           "type": "string"
         },
         "operation": {
-          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings.",
           "enum": [
             "list_quarantined",
             "inspect_quarantined",
@@ -70,7 +70,9 @@
             "disable_tool",
             "inspect_prompts",
             "approve_prompt",
-            "approve_all_prompts"
+            "approve_all_prompts",
+            "scan_server",
+            "get_scan_report"
           ],
           "type": "string"
         },
diff --git a/internal/server/testdata/toolslist_goldens/default_server.json b/internal/server/testdata/toolslist_goldens/default_server.json
index a4f4680c8..b76af5443 100644
--- a/internal/server/testdata/toolslist_goldens/default_server.json
+++ b/internal/server/testdata/toolslist_goldens/default_server.json
@@ -188,15 +188,15 @@
       "idempotentHint": false,
       "openWorldHint": false
     },
-    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "description": "Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
     "inputSchema": {
       "properties": {
         "name": {
-          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)",
           "type": "string"
         },
         "operation": {
-          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings.",
           "enum": [
             "list_quarantined",
             "inspect_quarantined",
@@ -210,7 +210,9 @@
             "disable_tool",
             "inspect_prompts",
             "approve_prompt",
-            "approve_all_prompts"
+            "approve_all_prompts",
+            "scan_server",
+            "get_scan_report"
           ],
           "type": "string"
         },
diff --git a/internal/server/testdata/toolslist_goldens/pre099/code_execution_mode.json b/internal/server/testdata/toolslist_goldens/pre099/code_execution_mode.json
new file mode 100644
index 000000000..b9f6af6ee
--- /dev/null
+++ b/internal/server/testdata/toolslist_goldens/pre099/code_execution_mode.json
@@ -0,0 +1,304 @@
+{
+  "code_execution": {
+    "annotations": {
+      "title": "Code Execution (Disabled)",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Code execution is currently disabled. Enable it by setting \"enable_code_execution\": true in your mcpproxy config.",
+    "inputSchema": {
+      "properties": {
+        "code": {
+          "description": "JavaScript source code to execute.",
+          "type": "string"
+        },
+        "script": {
+          "description": "Name of a stored script to execute.",
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    },
+    "name": "code_execution"
+  },
+  "list_registries": {
+    "annotations": {
+      "title": "List Registries",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "📋 List all available MCP registries. Use this FIRST to discover which registries you can search with the 'search_servers' tool. Each registry contains different collections of MCP servers that can be added as upstreams.",
+    "inputSchema": {
+      "properties": {},
+      "required": [],
+      "type": "object"
+    },
+    "name": "list_registries"
+  },
+  "quarantine_security": {
+    "annotations": {
+      "title": "Quarantine Security",
+      "readOnlyHint": false,
+      "destructiveHint": true,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "inputSchema": {
+      "properties": {
+        "name": {
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "type": "string"
+        },
+        "operation": {
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "enum": [
+            "list_quarantined",
+            "inspect_quarantined",
+            "quarantine_server",
+            "inspect_tools",
+            "approve_tool",
+            "approve_all_tools",
+            "block_tool",
+            "block_all_tools",
+            "enable_tool",
+            "disable_tool",
+            "inspect_prompts",
+            "approve_prompt",
+            "approve_all_prompts"
+          ],
+          "type": "string"
+        },
+        "prompt_name": {
+          "description": "Prompt name (required for approve_prompt; spec 100)",
+          "type": "string"
+        },
+        "tool_name": {
+          "description": "Tool name (required for approve_tool and block_tool operations)",
+          "type": "string"
+        }
+      },
+      "required": [
+        "operation"
+      ],
+      "type": "object"
+    },
+    "name": "quarantine_security"
+  },
+  "retrieve_tools": {
+    "annotations": {
+      "title": "Retrieve Tools",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Search and discover available upstream tools using BM25 full-text search. Use this to find tools, then use the `code_execution` tool to call them via `call_tool(serverName, toolName, args)` in JavaScript. Do NOT use call_tool_read/write/destructive — they are not available in this mode. Use natural language to describe what you want to accomplish. Response includes a structured `session_risk` object (level, lethal_trifecta, has_open_world_tools, has_destructive_tools, has_write_tools). ANNOTATION FILTERS: read_only_only, exclude_destructive and exclude_open_world self-restrict discovery. When they withhold tools that matched your query, the response carries a 'filter_diagnostics' block with per-filter counts (split into missing upstream annotations vs. explicitly unsafe ones) and one suggestion; it is absent when nothing was withheld. Filter diagnostics describe this call's candidate window, not the whole catalog.",
+    "inputSchema": {
+      "properties": {
+        "exclude_destructive": {
+          "description": "Exclude tools with destructiveHint=true or unset (MCP default is destructive). Use to avoid destructive operations.",
+          "type": "boolean"
+        },
+        "exclude_open_world": {
+          "description": "Exclude tools with openWorldHint=true or unset (MCP default is open-world). Use to restrict to local/sandboxed tools.",
+          "type": "boolean"
+        },
+        "include_session_risk_warning": {
+          "description": "Include the prose 'warning' string in session_risk when the lethal trifecta is detected (default: false; structured fields are always returned). Server-side default can be flipped via the 'tool_response_session_risk_warning' config flag.",
+          "type": "boolean"
+        },
+        "limit": {
+          "description": "Maximum number of tools to return (default: configured tools_limit, max: 100)",
+          "type": "number"
+        },
+        "query": {
+          "description": "Natural language description of what you want to accomplish.",
+          "type": "string"
+        },
+        "read_only_only": {
+          "description": "Only return tools with readOnlyHint=true. Use to self-restrict to safe read operations.",
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "query"
+      ],
+      "type": "object"
+    },
+    "name": "retrieve_tools"
+  },
+  "search_servers": {
+    "annotations": {
+      "title": "Search Servers",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": true
+    },
+    "description": "🔍 Discover MCP servers from known registries with repository type detection. Search and filter servers from embedded registry list to find new MCP servers that can be added as upstreams. Features npm/PyPI package detection for enhanced install commands. WORKFLOW: 1) Call 'list_registries' first to see available registries, 2) Use this tool with a registry ID to search servers. Results include server URLs and repository information ready for direct use with upstream_servers add command.",
+    "inputSchema": {
+      "properties": {
+        "limit": {
+          "description": "Maximum number of results to return (default: 10, max: 50)",
+          "type": "number"
+        },
+        "registry": {
+          "description": "Registry ID or name to search (e.g., 'smithery', 'mcprun', 'pulse'). Use 'list_registries' tool first to see available registries.",
+          "type": "string"
+        },
+        "search": {
+          "description": "Search term to filter servers by name or description (case-insensitive)",
+          "type": "string"
+        },
+        "tag": {
+          "description": "Filter servers by tag/category (if supported by registry)",
+          "type": "string"
+        }
+      },
+      "required": [
+        "registry"
+      ],
+      "type": "object"
+    },
+    "name": "search_servers"
+  },
+  "set_profile": {
+    "annotations": {
+      "title": "Set Profile",
+      "readOnlyHint": true,
+      "destructiveHint": false,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Switch the active profile for THIS session. A profile scopes tool discovery (retrieve_tools) and tool calls to a named subset of upstream servers — useful to focus an agent on one task domain (e.g. 'research', 'deploy'). The selection persists for the lifetime of the current MCP session and applies to subsequent retrieve_tools / call_tool_* / code_execution calls on the base /mcp endpoint without re-indexing. Pass an empty string to clear the selection and go back to all servers. Note: an explicit /mcp/p/\u003cslug\u003e URL still overrides the session profile for that request, and a profile-pinned agent token cannot switch away from its pinned profile.",
+    "inputSchema": {
+      "properties": {
+        "profile": {
+          "description": "Profile slug to activate for this session (e.g. 'research'). Pass \"\" (empty) to clear the active profile and return to all servers.",
+          "type": "string"
+        }
+      },
+      "required": [],
+      "type": "object"
+    },
+    "name": "set_profile"
+  },
+  "upstream_servers": {
+    "annotations": {
+      "title": "Upstream Servers",
+      "readOnlyHint": false,
+      "destructiveHint": true,
+      "idempotentHint": false,
+      "openWorldHint": false
+    },
+    "description": "Manage upstream MCP servers - add, remove, update, and list servers. Includes Docker isolation configuration and connection status monitoring. SECURITY: Newly added servers are automatically quarantined to prevent Tool Poisoning Attacks (TPAs). Use 'quarantine_security' tool to review and manage quarantined servers. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.\n\nDocker Isolation: Use 'isolation_json' parameter to configure per-server Docker images, CPU/memory limits, and network isolation. Example: {\"enabled\": true, \"image\": \"node:20\", \"network_mode\": \"bridge\"}.\n\nSMART PATCHING (update/patch): Uses deep merge - only specify fields you want to change. Omitted fields are PRESERVED, not removed. Examples:\n- Enable server: {\"operation\": \"patch\", \"name\": \"my-server\", \"enabled\": true} - only enabled changes\n- Enable isolation: {\"operation\": \"patch\", \"name\": \"my-server\", \"isolation_json\": \"{\\\"enabled\\\": true}\"} - enables isolation with defaults\n- Update image: {\"operation\": \"patch\", \"name\": \"my-server\", \"isolation_json\": \"{\\\"image\\\": \\\"python:3.12\\\"}\"} - other isolation fields preserved\n- Add env var: env_json merges with existing vars\n- Replace args: args_json replaces entirely (arrays not merged)\n- Remove field: use 'null' (e.g., isolation_json: \"null\" removes isolation)",
+    "inputSchema": {
+      "properties": {
+        "args_json": {
+          "description": "Command arguments for stdio servers as a JSON array of strings (e.g., '[\"mcp-server-sqlite\", \"--db-path\", \"/path/to/db\"]'). For update/patch: REPLACES all existing args (arrays are not merged).",
+          "type": "string"
+        },
+        "command": {
+          "description": "Command to run for stdio servers (e.g., 'uvx', 'python')",
+          "type": "string"
+        },
+        "enabled": {
+          "description": "Whether server should be enabled (default: true)",
+          "type": "boolean"
+        },
+        "env_json": {
+          "description": "Environment variables for stdio servers as JSON object (e.g., '{\"API_KEY\": \"value\"}'). For update/patch: MERGES with existing vars (new keys added, existing keys updated).",
+          "type": "string"
+        },
+        "expose_prompts": {
+          "description": "Per-server prompt-aggregation override (F9): true = include this server's MCP prompts in mcpproxy's aggregated prompts/list; false = exclude them regardless of capability. Omit to leave unchanged (patch) / inherit the default (aggregate if advertised). Only meaningful when aggregate_upstream_prompts is enabled globally. Used with add/update/patch.",
+          "type": "boolean"
+        },
+        "headers_json": {
+          "description": "HTTP headers for authentication as JSON object (e.g., '{\"Authorization\": \"Bearer token\"}'). For update/patch: MERGES with existing headers (new keys added, existing keys updated).",
+          "type": "string"
+        },
+        "id": {
+          "description": "Server id within the registry - required for add_from_registry.",
+          "type": "string"
+        },
+        "init_timeout": {
+          "description": "Per-server MCP `initialize` handshake deadline as a duration string (e.g. '120s', '3m'). Raise this for upstreams that do legitimate first-run warmup (cache/index build) before responding to `initialize`, so they are not killed mid-startup. Unset → global default (30s). Bounds: 1s–30m. Used with add/update/patch.",
+          "type": "string"
+        },
+        "isolation_json": {
+          "description": "Docker isolation config as JSON object. MERGES with existing settings - only provided fields change. Use 'null' to remove isolation entirely. Example: '{\"image\": \"python:3.12\"}' updates only the image.",
+          "type": "string"
+        },
+        "lines": {
+          "description": "Number of lines to tail from server log (default: 50, max: 500) - used with tail_log operation",
+          "type": "number"
+        },
+        "name": {
+          "description": "Server name (required for add/remove/update/patch/tail_log operations; optional name override for add_from_registry)",
+          "type": "string"
+        },
+        "oauth_json": {
+          "description": "OAuth config as JSON object. MERGES with existing settings. Use 'null' to remove OAuth entirely. Fields: client_id, client_secret, scopes (array - replaces).",
+          "type": "string"
+        },
+        "operation": {
+          "description": "Operation: list, add, remove, update, patch, tail_log, add_from_registry, enable, disable, restart, refresh. 'update' and 'patch' use smart merge - only specified fields change, others preserved. 'add_from_registry' adds an upstream from a registry reference (registry+id) so you need not hand-construct command/args/url - the server re-derives the runnable config and quarantines it. 'refresh' re-discovers and re-indexes a server's tools without changing any security state - use it to make just-approved tools searchable immediately. For quarantine operations, use the 'quarantine_security' tool.",
+          "enum": [
+            "list",
+            "add",
+            "remove",
+            "update",
+            "patch",
+            "tail_log",
+            "add_from_registry",
+            "enable",
+            "disable",
+            "restart",
+            "refresh"
+          ],
+          "type": "string"
+        },
+        "protocol": {
+          "description": "Transport protocol: stdio, http, sse, streamable-http, auto (default: auto-detect)",
+          "enum": [
+            "stdio",
+            "http",
+            "sse",
+            "streamable-http",
+            "auto"
+          ],
+          "type": "string"
+        },
+        "registry": {
+          "description": "Registry id to add from (e.g. 'pulse') - required for add_from_registry. Use the 'list_registries'/'search_servers' tools to discover registries and server ids.",
+          "type": "string"
+        },
+        "trust_mode": {
+          "description": "Per-server trust tier governing new-server admission AND tool-change approval (spec 086): 'auto' = approve without scanning; 'scan' = auto-approve only when the fast offline TPA scan is green, else hold for review; 'manual' = human reviews every change. Empty → manual (secure default). Used with add/update/patch.",
+          "enum": [
+            "auto",
+            "scan",
+            "manual"
+          ],
+          "type": "string"
+        },
+        "url": {
+          "description": "Server URL for HTTP/SSE servers (e.g., 'http://localhost:3001')",
+          "type": "string"
+        }
+      },
+      "required": [
+        "operation"
+      ],
+      "type": "object"
+    },
+    "name": "upstream_servers"
+  }
+}
diff --git a/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json b/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json
index d0b2dbd4e..7eef750e7 100644
--- a/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json
+++ b/internal/server/testdata/toolslist_goldens/retrieve_tools_mode.json
@@ -213,15 +213,15 @@
       "idempotentHint": false,
       "openWorldHint": false
     },
-    "description": "Security quarantine management for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs). Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
+    "description": "Security quarantine management AND TPA scanning for MCP servers and tools. Review and manage quarantined servers and tools to prevent Tool Poisoning Attacks (TPAs), and scan a server for them: 'scan_server' runs the always-on offline baseline scan (in-process, no Docker required) and 'get_scan_report' returns the latest verdict and findings. Every listing/inspection response also carries a one-line scan status, so an unscanned server is visible as unscanned. Supports server-level quarantine and tool-level approval for individual tool description/schema changes. NOTE: Unquarantining servers is only available through manual config editing or system tray UI for security.",
     "inputSchema": {
       "properties": {
         "name": {
-          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts)",
+          "description": "Server name (required for inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, approve_prompt, approve_all_prompts, scan_server, get_scan_report)",
           "type": "string"
         },
         "operation": {
-          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved.",
+          "description": "Security operation: list_quarantined, inspect_quarantined, quarantine_server, inspect_tools, approve_tool, approve_all_tools, block_tool, block_all_tools, enable_tool, disable_tool, inspect_prompts, approve_prompt, approve_all_prompts, scan_server, get_scan_report. 'block_tool'/'block_all_tools' atomically approve AND disable a tool (acknowledge it but keep it hidden) — all-or-nothing so a tool is never left approved+enabled. The prompt operations (spec 100) manage aggregated upstream prompts held by the metadata rug-pull baseline: a prompt whose advertised metadata changed since approval is withheld from prompts/list until approved. 'scan_server' starts the offline TPA baseline scan for one server (no Docker needed) and returns the verdict once it settles, or a job id to poll; 'get_scan_report' returns that server's latest verdict, counts and findings.",
           "enum": [
             "list_quarantined",
             "inspect_quarantined",
@@ -235,7 +235,9 @@
             "disable_tool",
             "inspect_prompts",
             "approve_prompt",
-            "approve_all_prompts"
+            "approve_all_prompts",
+            "scan_server",
+            "get_scan_report"
           ],
           "type": "string"
         },
diff --git a/internal/server/toolslist_snapshot_test.go b/internal/server/toolslist_snapshot_test.go
index 151fdd88e..b9a2e2baa 100644
--- a/internal/server/toolslist_snapshot_test.go
+++ b/internal/server/toolslist_snapshot_test.go
@@ -33,15 +33,25 @@ import (
 //     DELIBERATELY, once, so the new definition — including its prose — is
 //     pinned byte-for-byte and a later edit shows up as a reviewable diff
 //     rather than drifting silently under the token budget.
-//  2. The regenerated goldens differ from the frozen pre-099 capture
-//     (testdata/toolslist_goldens/pre099/) in EXACTLY one tool entry,
-//     describe_tool, on exactly those two surfaces. Every other tool, and the
-//     whole code_execution surface, is byte-equal — which is why that surface
-//     has no pre099 copy at all: its golden was never regenerated.
+//  2. The regenerated goldens differ from the frozen pre-feature capture
+//     (testdata/toolslist_goldens/pre099/) in EXACTLY the tool entries the
+//     shipped features were allowed to move — see toolsListAllowedDelta. Every
+//     other tool on every surface is byte-equal.
 //
 // A failure in (1) with no accompanying spec is a regression, not a golden to
 // refresh. A failure in (2) means a change reached further than it claimed.
 //
+// The enumerated delta currently covers two features:
+//
+//   - describe_tool (spec 099), on the two retrieve_tools-carrying surfaces;
+//   - quarantine_security, which gained the scan_server / get_scan_report
+//     operations so TPA scanning is reachable from the surface agents already
+//     use. It carries no new PARAMETER — the two operations reuse `name` — so
+//     the delta is the operation enum plus the prose that documents it. It is
+//     registered on all three surfaces, which is why code_execution_mode now
+//     has a frozen copy too (a byte-for-byte snapshot of its previous golden,
+//     which had never moved since the spec-098 capture).
+//
 // Surfaces covered (the three routing modes that expose a static, built-in
 // tool set):
 //
@@ -57,9 +67,10 @@ import (
 const (
 	toolsListGoldenDir = "toolslist_goldens"
 
-	// toolsListPre099Dir holds the FROZEN pre-099 capture of the two surfaces
-	// spec 099 was allowed to move. It is never regenerated: it is the baseline
-	// the enumerated delta is measured against.
+	// toolsListPre099Dir holds the FROZEN pre-feature capture of the surfaces
+	// an enumerated delta is measured against. It is never regenerated: it is
+	// the baseline, not a mirror of the current surface. (Named for spec 099,
+	// the first feature that needed it.)
 	toolsListPre099Dir = "pre099"
 
 	// toolsListGoldenWriteEnv, when set to a directory, makes this test WRITE
@@ -166,29 +177,35 @@ func TestToolsListSnapshot_MatchesMergeBaseGoldens(t *testing.T) {
 	}
 }
 
-// toolsListPre099Surfaces maps a surface to the tool entries spec 099 was
-// allowed to change on it (FR-014). A surface absent from this map may not move
-// at all — code_execution_mode is deliberately absent.
-var toolsListPre099Surfaces = map[string][]string{
-	"default_server":      {"describe_tool"},
-	"retrieve_tools_mode": {"describe_tool"},
+// toolsListAllowedDelta maps a surface to the tool entries the shipped features
+// were allowed to change on it, measured against the frozen pre-feature
+// capture. Every surface with a frozen copy appears here; adding a name to a
+// list is a deliberate, reviewable act.
+//
+//   - describe_tool        — spec 099 (FR-014), retrieve_tools surfaces only.
+//   - quarantine_security  — scan_server / get_scan_report operations, on every
+//     surface that registers the tool (all three).
+var toolsListAllowedDelta = map[string][]string{
+	"default_server":      {"describe_tool", "quarantine_security"},
+	"retrieve_tools_mode": {"describe_tool", "quarantine_security"},
+	"code_execution_mode": {"quarantine_security"},
 }
 
-// TestToolsListSnapshot_Spec099DeltaIsExactlyDescribeTool is the FR-014 gate:
-// the goldens moved, and this is the enumeration of how far.
-func TestToolsListSnapshot_Spec099DeltaIsExactlyDescribeTool(t *testing.T) {
-	for surface, allowed := range toolsListPre099Surfaces {
+// TestToolsListSnapshot_DeltaIsEnumerated is the FR-014 gate: the goldens
+// moved, and this is the enumeration of how far.
+func TestToolsListSnapshot_DeltaIsEnumerated(t *testing.T) {
+	for surface, allowed := range toolsListAllowedDelta {
 		surface, allowed := surface, allowed
 		t.Run(surface, func(t *testing.T) {
 			before := decodeToolsListGolden(t, filepath.Join("testdata", toolsListGoldenDir, toolsListPre099Dir, surface+".json"))
 			after := decodeToolsListGolden(t, toolsListGoldenPath(surface))
 
-			// The tool SET is unchanged: 099 adds parameters to an existing
-			// built-in, it does not register or retire one.
+			// The tool SET is unchanged: these features extend existing
+			// built-ins, they do not register or retire one.
 			assert.Equal(t, sortedToolNames(before), sortedToolNames(after),
-				"surface %s: spec 099 adds no tool and removes none", surface)
+				"surface %s: no tool may be added or removed", surface)
 
-			changed := make([]string, 0, 1)
+			changed := make([]string, 0, len(allowed))
 			for name, pre := range before {
 				post, ok := after[name]
 				if !ok {
@@ -199,15 +216,19 @@ func TestToolsListSnapshot_Spec099DeltaIsExactlyDescribeTool(t *testing.T) {
 				}
 			}
 			sort.Strings(changed)
-			assert.Equal(t, allowed, changed,
-				"surface %s: spec 099 may change describe_tool and nothing else", surface)
+			sortedAllowed := append([]string(nil), allowed...)
+			sort.Strings(sortedAllowed)
+			assert.Equal(t, sortedAllowed, changed,
+				"surface %s: only the enumerated tools may change", surface)
 		})
 	}
 
-	// The one surface that had no delta to enumerate: it must still match the
-	// spec-098 merge-base bytes, so it never needed a pre099 copy.
-	assert.NotContains(t, toolsListPre099Surfaces, "code_execution_mode",
-		"code_execution mode carries no describe_tool and must not move (FR-002/FR-014)")
+	// Every surface with a golden carries a frozen baseline to measure against:
+	// a surface silently dropping out of the map would stop being gated.
+	for _, surface := range toolsListGoldenSurfaces {
+		assert.Contains(t, toolsListAllowedDelta, surface,
+			"surface %s must be covered by the enumerated-delta gate", surface)
+	}
 }
 
 func decodeToolsListGolden(t *testing.T, path string) map[string]json.RawMessage {

From 6ee4ffd25f6143607814e646243137028b17cb23 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <gordon.greatests@gmail.com>
Date: Sun, 23 Aug 2026 22:00:17 +0300
Subject: [PATCH 2/8] fix(security): never report "scanning" as a verdict;
 count baseline race-free
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two defects found in cross-model review of the scan surface.

1. awaitScanVerdict trusted the terminal job status. The scanner engine sets
   job.Status to a terminal value BEFORE its completion callback persists the
   report, and the job only leaves the engine's active map after the callback
   returns. A summary read inside that window still answers "scanning", so
   scan_server could reply status=completed + verdict=scanning — a non-verdict
   that reads like a clean-ish result. The wait now keeps polling until the
   settled job's own verdict is visible and otherwise falls back to the honest
   async answer.

2. GetOverview counted the in-process baseline by reading ScannerPlugin.Status
   from the pointers Registry.List() hands out. Those are the registry's live
   records, and UpdateStatus mutates Status on exactly them under the registry
   lock, so the count raced with any concurrent scanner install/pull. The
   predicate now resolves inside Registry.InProcessRunnableIDs(), under the
   same lock as the write — and that helper is nil-receiver safe, so a Service
   built without a registry no longer panics in the one call that had stopped
   guarding for it.

Tests: the completion window (both halves), a -race loop of GetOverview against
concurrent UpdateStatus, and the nil-registry path.
---
 .../scanner/overview_baseline_test.go         | 41 +++++++++++++
 internal/security/scanner/registry.go         | 28 +++++++++
 internal/security/scanner/service.go          | 13 ++--
 internal/server/mcp_quarantine_scan.go        | 20 +++++--
 internal/server/mcp_quarantine_scan_test.go   | 59 +++++++++++++++++++
 5 files changed, 151 insertions(+), 10 deletions(-)

diff --git a/internal/security/scanner/overview_baseline_test.go b/internal/security/scanner/overview_baseline_test.go
index b2db6637f..13e46c106 100644
--- a/internal/security/scanner/overview_baseline_test.go
+++ b/internal/security/scanner/overview_baseline_test.go
@@ -70,3 +70,44 @@ func TestGetOverview_DoesNotDoubleCountPersistedBaseline(t *testing.T) {
 	assert.Equal(t, 1, overview.ScannersEnabled, "the persisted baseline is counted exactly once")
 	assert.Equal(t, 1, overview.ScannersInstalled, "the persisted baseline is counted exactly once")
 }
+
+// TestGetOverview_ConcurrentScannerStatusUpdateIsRaceFree guards the read seam
+// the baseline count added. Registry.List() hands out the live *ScannerPlugin
+// records the registry keeps, and UpdateStatus mutates Status on exactly those
+// records under the registry lock — so counting by reading reg.Status outside
+// the lock is a data race with any concurrent install/pull. GetOverview must
+// resolve the predicate inside the registry instead. Run with -race.
+func TestGetOverview_ConcurrentScannerStatusUpdateIsRaceFree(t *testing.T) {
+	svc := newFreshInstallService(t)
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for i := 0; i < 200; i++ {
+			status := ScannerStatusInstalled
+			if i%2 == 0 {
+				status = ScannerStatusAvailable
+			}
+			_ = svc.registry.UpdateStatus(inProcessTPAScannerID, status)
+		}
+	}()
+
+	for i := 0; i < 200; i++ {
+		_, err := svc.GetOverview(context.Background())
+		require.NoError(t, err)
+	}
+	<-done
+}
+
+// TestGetOverview_ToleratesNilRegistry pins the nil-registry contract: other
+// Service methods already guard for it, and the overview must not be the one
+// call that panics on a service built without a registry.
+func TestGetOverview_ToleratesNilRegistry(t *testing.T) {
+	logger := zap.NewNop()
+	dir := t.TempDir()
+	svc := NewService(newMockStorage(), nil, NewDockerRunner(logger), dir, logger)
+
+	overview, err := svc.GetOverview(context.Background())
+	require.NoError(t, err)
+	assert.Equal(t, 0, overview.ScannersEnabled)
+}
diff --git a/internal/security/scanner/registry.go b/internal/security/scanner/registry.go
index fcde70523..4fb859b48 100644
--- a/internal/security/scanner/registry.go
+++ b/internal/security/scanner/registry.go
@@ -93,6 +93,34 @@ func (r *Registry) List() []*ScannerPlugin {
 	return result
 }
 
+// InProcessRunnableIDs returns the IDs of in-process scanners whose status
+// means the engine will actually run them (installed or configured), sorted.
+//
+// It exists so a caller can count the always-on in-process baseline without
+// reading ScannerPlugin fields outside the registry lock: List() hands out the
+// live pointers the registry keeps, and UpdateStatus mutates Status on exactly
+// those records, so an unsynchronized read of reg.Status races with any
+// concurrent install/pull. Resolving the predicate here keeps the read under
+// the same lock as the write.
+func (r *Registry) InProcessRunnableIDs() []string {
+	if r == nil {
+		return nil
+	}
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	ids := make([]string, 0, len(r.scanners))
+	for id, s := range r.scanners {
+		if s == nil || !s.InProcess {
+			continue
+		}
+		if s.Status == ScannerStatusInstalled || s.Status == ScannerStatusConfigured {
+			ids = append(ids, id)
+		}
+	}
+	sort.Strings(ids)
+	return ids
+}
+
 // Get returns a scanner by ID
 func (r *Registry) Get(id string) (*ScannerPlugin, error) {
 	r.mu.RLock()
diff --git a/internal/security/scanner/service.go b/internal/security/scanner/service.go
index b107880dc..a8722da85 100644
--- a/internal/security/scanner/service.go
+++ b/internal/security/scanner/service.go
@@ -1861,14 +1861,15 @@ func (s *Service) GetOverview(ctx context.Context) (*SecurityOverview, error) {
 			}
 		}
 	}
-	for _, reg := range s.registry.List() {
-		if seen[reg.ID] || !reg.InProcess {
+	// InProcessRunnableIDs resolves the predicate under the registry lock:
+	// List() returns the live *ScannerPlugin records that UpdateStatus mutates,
+	// so reading Status out here would race with a concurrent install/pull.
+	for _, id := range s.registry.InProcessRunnableIDs() {
+		if seen[id] {
 			continue
 		}
-		if reg.Status == ScannerStatusInstalled || reg.Status == ScannerStatusConfigured {
-			overview.ScannersInstalled++
-			overview.ScannersEnabled++
-		}
+		overview.ScannersInstalled++
+		overview.ScannersEnabled++
 	}
 
 	// Count scan jobs
diff --git a/internal/server/mcp_quarantine_scan.go b/internal/server/mcp_quarantine_scan.go
index 63a179386..e040ef9a6 100644
--- a/internal/server/mcp_quarantine_scan.go
+++ b/internal/server/mcp_quarantine_scan.go
@@ -36,6 +36,10 @@ const (
 	// neverScannedHint is the one-line status carried by list/inspect
 	// responses for a server with no scan on record.
 	neverScannedHint = "never scanned — run scan_server first"
+
+	// scanSummaryStatusRunning is the sentinel ScanSummary.Status the scanner
+	// service reports while a Pass-1 scan is still registered as active.
+	scanSummaryStatusRunning = "scanning"
 )
 
 // securityScanner returns the scanner service backing the scan operations, or
@@ -116,9 +120,17 @@ func (p *MCPProxyServer) awaitScanVerdict(ctx context.Context, svc securityScann
 	for {
 		job, err := svc.GetScanStatus(ctx, serverName)
 		if err == nil && job != nil && scanJobSettled(job.Status) && (jobID == "" || job.ID == jobID) {
-			// The summary is derived from persisted jobs/reports, which the
-			// completion callback writes before flipping the job state.
-			return svc.GetScanSummary(ctx, serverName)
+			// The engine flips the job to a terminal status BEFORE its
+			// completion callback persists the report and BEFORE the job is
+			// dropped from the active map. A summary read inside that window
+			// still answers "scanning", which would be reported here as
+			// status=completed + verdict=scanning — a verdict that reads as a
+			// clean-ish result but is really "not known yet". Keep polling
+			// until the settled job's own verdict is visible, or time out into
+			// the async answer.
+			if summary := svc.GetScanSummary(ctx, serverName); summary != nil && summary.Status != scanSummaryStatusRunning {
+				return summary
+			}
 		}
 
 		if time.Now().After(deadline) {
@@ -227,7 +239,7 @@ func scanStatusLineFrom(summary *scanner.ScanSummary, serverName string) string
 	if summary == nil {
 		return neverScannedHint
 	}
-	if summary.Status == "scanning" {
+	if summary.Status == scanSummaryStatusRunning {
 		return fmt.Sprintf("scan running for '%s' — re-run get_scan_report shortly", serverName)
 	}
 	line := fmt.Sprintf("last scan verdict: %s (risk %d)", summary.Status, summary.RiskScore)
diff --git a/internal/server/mcp_quarantine_scan_test.go b/internal/server/mcp_quarantine_scan_test.go
index 35829305a..187ade7f1 100644
--- a/internal/server/mcp_quarantine_scan_test.go
+++ b/internal/server/mcp_quarantine_scan_test.go
@@ -112,6 +112,65 @@ func TestQuarantineSecurity_ScanServer_AsyncWhenScanStillRunning(t *testing.T) {
 	assert.NotContains(t, payload, "verdict", "an unfinished scan has no verdict to report")
 }
 
+// TestQuarantineSecurity_ScanServer_NeverReportsScanningAsAVerdict covers the
+// completion window inside the scanner engine: it flips the job to a terminal
+// status BEFORE the completion callback persists the report and before the job
+// leaves the active map, so a summary read in between still answers "scanning".
+// Reporting that pair verbatim would produce status=completed with
+// verdict=scanning — a non-verdict that reads like a result. The wait must keep
+// polling and fall back to the honest async answer.
+func TestQuarantineSecurity_ScanServer_NeverReportsScanningAsAVerdict(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-window", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		&scanner.ScanSummary{Status: "scanning"})
+
+	// Bound the wait: the loop honours context cancellation.
+	ctx, cancel := context.WithTimeout(context.Background(), 400*time.Millisecond)
+	defer cancel()
+
+	result, err := proxy.handleQuarantineSecurity(ctx, quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "scan started", payload["status"])
+	assert.NotContains(t, payload, "verdict", "'scanning' is not a verdict")
+	assert.Equal(t, "job-window", payload["job_id"])
+}
+
+// TestQuarantineSecurity_ScanServer_WaitsThroughTheCompletionWindow is the
+// other half: once the completion callback lands and the summary carries a real
+// verdict, the still-open call reports it rather than timing out into async.
+func TestQuarantineSecurity_ScanServer_WaitsThroughTheCompletionWindow(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-late", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+		&scanner.ScanSummary{Status: "scanning"})
+
+	go func() {
+		time.Sleep(300 * time.Millisecond)
+		fake.setScanResult("github",
+			&scanner.ScanJob{ID: "job-late", ServerName: "github", Status: scanner.ScanJobStatusCompleted},
+			settledSummary("clean", 0))
+	}()
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "completed", payload["status"])
+	assert.Equal(t, "clean", payload["verdict"])
+	assert.Equal(t, "job-late", payload["job_id"])
+}
+
 // TestQuarantineSecurity_ScanServer_RequiresName pins the argument contract.
 func TestQuarantineSecurity_ScanServer_RequiresName(t *testing.T) {
 	proxy, _ := scanTestProxy(t)

From d4a1cc032e7a9a87851379db44d19f722b9b0306 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <gordon.greatests@gmail.com>
Date: Sun, 23 Aug 2026 22:09:23 +0300
Subject: [PATCH 3/8] fix(security): label get_scan_report findings that came
 from a previous scan
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The summary and the aggregated report are two independent latest-by-server
reads. While a new scan is running the summary says "scanning" but the report
is still the PREVIOUS job's, so the response carried that older job's id,
findings_total and findings with nothing saying they were not the running
scan's result — an agent reading it would attribute stale findings to the scan
it just started. The response now names whose findings they are.
---
 internal/server/mcp_quarantine_scan.go      |  7 ++++
 internal/server/mcp_quarantine_scan_test.go | 36 +++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/internal/server/mcp_quarantine_scan.go b/internal/server/mcp_quarantine_scan.go
index e040ef9a6..7b9815b75 100644
--- a/internal/server/mcp_quarantine_scan.go
+++ b/internal/server/mcp_quarantine_scan.go
@@ -204,6 +204,13 @@ func (p *MCPProxyServer) handleGetScanReport(ctx context.Context, request mcp.Ca
 			response["verdict"] = report.Verdict
 			response["risk_score"] = report.RiskScore
 		}
+		// The summary and the report are two independent latest-by-server
+		// reads. While a scan is running the summary says "scanning" but the
+		// report is still the PREVIOUS job's — attaching its findings unlabelled
+		// would read as the running scan's result. Name whose findings these are.
+		if summary != nil && summary.Status == scanSummaryStatusRunning {
+			response["findings_from"] = "the previous completed scan — a new scan is still running; re-run get_scan_report for its verdict"
+		}
 		response["findings_total"] = len(report.Findings)
 		findings := make([]map[string]interface{}, 0, scanReportMaxFindings)
 		for i, f := range report.Findings {
diff --git a/internal/server/mcp_quarantine_scan_test.go b/internal/server/mcp_quarantine_scan_test.go
index 187ade7f1..358c8818d 100644
--- a/internal/server/mcp_quarantine_scan_test.go
+++ b/internal/server/mcp_quarantine_scan_test.go
@@ -239,6 +239,42 @@ func TestQuarantineSecurity_GetScanReport_ReturnsVerdictAndFindings(t *testing.T
 	assert.Contains(t, payload["scan_status"], "warnings")
 }
 
+// TestQuarantineSecurity_GetScanReport_LabelsPreviousFindingsWhileScanning:
+// the summary and the report are independent latest-by-server reads, so while a
+// new scan runs the report is still the PREVIOUS job's. Its findings must be
+// labelled as such, never presented as the running scan's result.
+func TestQuarantineSecurity_GetScanReport_LabelsPreviousFindingsWhileScanning(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-new", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		&scanner.ScanSummary{Status: "scanning"})
+	fake.reports["github"] = &scanner.AggregatedReport{
+		JobID:      "job-old",
+		ServerName: "github",
+		Verdict:    "warnings",
+		RiskScore:  30,
+		Findings: []scanner.ScanFinding{{
+			RuleID:  "TPA-2026-0001",
+			Title:   "Hidden instructions in tool description",
+			Scanner: "tpa-descriptions",
+		}},
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Contains(t, payload["scan_status"], "scan running")
+	assert.Equal(t, "job-old", payload["job_id"])
+	assert.Contains(t, payload, "findings_from",
+		"findings from an older job must say which scan they came from")
+	assert.Contains(t, payload["findings_from"], "previous")
+}
+
 // TestQuarantineSecurity_GetScanReport_NeverScanned is the honest empty state:
 // no report is NOT a clean verdict.
 func TestQuarantineSecurity_GetScanReport_NeverScanned(t *testing.T) {

From 6875b612fab048d3e041dc6fa1424fa380e7c802 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <gordon.greatests@gmail.com>
Date: Sun, 23 Aug 2026 22:19:36 +0300
Subject: [PATCH 4/8] fix(security): poll Pass 1 for the verdict; name whose
 findings a report holds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two more defects from cross-model review, both in how the new scan surface
reads the scanner service's latest-by-server state.

1. scan_server polled GetScanStatus, which answers with whatever job is ACTIVE
   for the server. With deep scan enabled a completed Pass 1 auto-starts the
   Pass-2 supply-chain audit, so the active job becomes Pass 2 — an id that
   never matches the one scan_server started. The wait then ran out its full
   budget and answered "scan started" while the baseline verdict was already
   sitting there. It now polls Pass 1 specifically, via a new
   GetScanStatusByPass on the scanner interface.

2. get_scan_report labelled every report attached to a "scanning" summary as
   the previous scan's. Per-scanner reports are persisted as each scanner
   finishes, so the report can equally be the RUNNING job's partial output —
   which the response also reported as job_id, contradicting the label. The
   label now distinguishes the two by comparing the report's job id with the
   running Pass-1 job.
---
 internal/server/mcp_quarantine_scan.go      | 35 ++++++++--
 internal/server/mcp_quarantine_scan_test.go | 72 +++++++++++++++++++++
 internal/server/scan_admission_test.go      | 43 +++++++++++-
 internal/server/server.go                   |  5 ++
 4 files changed, 149 insertions(+), 6 deletions(-)

diff --git a/internal/server/mcp_quarantine_scan.go b/internal/server/mcp_quarantine_scan.go
index 7b9815b75..163e7a552 100644
--- a/internal/server/mcp_quarantine_scan.go
+++ b/internal/server/mcp_quarantine_scan.go
@@ -118,7 +118,13 @@ func (p *MCPProxyServer) awaitScanVerdict(ctx context.Context, svc securityScann
 	defer ticker.Stop()
 
 	for {
-		job, err := svc.GetScanStatus(ctx, serverName)
+		// Pass 1 (the offline baseline) is the pass scan_server started and the
+		// only one whose verdict this call promises. GetScanStatus answers with
+		// whatever job is ACTIVE for the server, and a completed Pass 1
+		// auto-starts the Pass-2 deep audit when deep scan is on — that Pass-2
+		// job's id never matches, so polling the generic status would time out
+		// on a baseline verdict that was already sitting there.
+		job, err := svc.GetScanStatusByPass(ctx, serverName, scanner.ScanPassSecurityScan)
 		if err == nil && job != nil && scanJobSettled(job.Status) && (jobID == "" || job.ID == jobID) {
 			// The engine flips the job to a terminal status BEFORE its
 			// completion callback persists the report and BEFORE the job is
@@ -144,6 +150,18 @@ func (p *MCPProxyServer) awaitScanVerdict(ctx context.Context, svc securityScann
 	}
 }
 
+// runningScanJobID returns the id of the server's current Pass-1 job while it
+// is still running, or "" when there is none (or it cannot be resolved). It is
+// how get_scan_report tells a partial report of the running scan apart from the
+// previous scan's finished one.
+func (p *MCPProxyServer) runningScanJobID(ctx context.Context, svc securityScannerService, serverName string) string {
+	job, err := svc.GetScanStatusByPass(ctx, serverName, scanner.ScanPassSecurityScan)
+	if err != nil || job == nil || scanJobSettled(job.Status) {
+		return ""
+	}
+	return job.ID
+}
+
 func scanJobSettled(status string) bool {
 	switch status {
 	case scanner.ScanJobStatusCompleted, scanner.ScanJobStatusFailed, scanner.ScanJobStatusCancelled:
@@ -205,11 +223,18 @@ func (p *MCPProxyServer) handleGetScanReport(ctx context.Context, request mcp.Ca
 			response["risk_score"] = report.RiskScore
 		}
 		// The summary and the report are two independent latest-by-server
-		// reads. While a scan is running the summary says "scanning" but the
-		// report is still the PREVIOUS job's — attaching its findings unlabelled
-		// would read as the running scan's result. Name whose findings these are.
+		// reads, so while a scan is running these findings are NOT a settled
+		// verdict — and they may come from either job: per-scanner reports are
+		// persisted as each scanner finishes, so the report can be the running
+		// job's partial output, or still the previous job's. Attaching them
+		// unlabelled would read as the running scan's finished result, so name
+		// which of the two they actually are.
 		if summary != nil && summary.Status == scanSummaryStatusRunning {
-			response["findings_from"] = "the previous completed scan — a new scan is still running; re-run get_scan_report for its verdict"
+			if runningID := p.runningScanJobID(ctx, svc, serverName); runningID != "" && runningID == report.JobID {
+				response["findings_from"] = "the scan currently running — partial results, re-run get_scan_report for the final verdict"
+			} else {
+				response["findings_from"] = "the previous completed scan — a new scan is still running; re-run get_scan_report for its verdict"
+			}
 		}
 		response["findings_total"] = len(report.Findings)
 		findings := make([]map[string]interface{}, 0, scanReportMaxFindings)
diff --git a/internal/server/mcp_quarantine_scan_test.go b/internal/server/mcp_quarantine_scan_test.go
index 358c8818d..6c8d1d0b1 100644
--- a/internal/server/mcp_quarantine_scan_test.go
+++ b/internal/server/mcp_quarantine_scan_test.go
@@ -171,6 +171,78 @@ func TestQuarantineSecurity_ScanServer_WaitsThroughTheCompletionWindow(t *testin
 	assert.Equal(t, "job-late", payload["job_id"])
 }
 
+// TestQuarantineSecurity_ScanServer_Pass2DoesNotMaskTheBaselineVerdict: with
+// deep scan enabled, a completed Pass 1 auto-starts the Pass-2 supply-chain
+// audit, which becomes the server's ACTIVE job. Polling the generic scan status
+// would then see a job whose id never matches the one scan_server started and
+// time out into "scan started" — hiding a baseline verdict that was already
+// available. The wait polls Pass 1 specifically.
+func TestQuarantineSecurity_ScanServer_Pass2DoesNotMaskTheBaselineVerdict(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	// The ACTIVE job for this server is the Pass-2 audit; Pass 1 is the job
+	// scan_server started and the one whose verdict it promised.
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-pass2", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		settledSummary("clean", 0))
+	fake.setPassJob("github", scanner.ScanPassSecurityScan,
+		&scanner.ScanJob{ID: "job-pass1", ServerName: "github", Status: scanner.ScanJobStatusRunning})
+
+	go func() {
+		time.Sleep(300 * time.Millisecond)
+		fake.setPassJob("github", scanner.ScanPassSecurityScan,
+			&scanner.ScanJob{ID: "job-pass1", ServerName: "github", Status: scanner.ScanJobStatusCompleted})
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	result, err := proxy.handleQuarantineSecurity(ctx, quarantineRequest(map[string]interface{}{
+		"operation": "scan_server",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "completed", payload["status"],
+		"the Pass-2 audit running in the background must not hide the settled baseline")
+	assert.Equal(t, "clean", payload["verdict"])
+	assert.Equal(t, "job-pass1", payload["job_id"], "scan_server reports the Pass-1 job it started")
+}
+
+// TestQuarantineSecurity_GetScanReport_LabelsPartialFindingsOfTheRunningScan is
+// the other half of the findings-provenance label: per-scanner reports are
+// persisted as each scanner finishes, so a running scan's own partial output
+// can be what GetScanReport returns. Calling that "the previous scan" is just as
+// wrong as leaving it unlabelled.
+func TestQuarantineSecurity_GetScanReport_LabelsPartialFindingsOfTheRunningScan(t *testing.T) {
+	proxy, fake := scanTestProxy(t, &config.ServerConfig{Name: "github", Enabled: true})
+	fake.setScanResult("github",
+		&scanner.ScanJob{ID: "job-live", ServerName: "github", Status: scanner.ScanJobStatusRunning},
+		&scanner.ScanSummary{Status: "scanning"})
+	fake.reports["github"] = &scanner.AggregatedReport{
+		JobID:      "job-live",
+		ServerName: "github",
+		Findings: []scanner.ScanFinding{{
+			RuleID:  "TPA-2026-0001",
+			Scanner: "tpa-descriptions",
+		}},
+	}
+
+	result, err := proxy.handleQuarantineSecurity(context.Background(), quarantineRequest(map[string]interface{}{
+		"operation": "get_scan_report",
+		"name":      "github",
+	}))
+	require.NoError(t, err)
+	require.False(t, result.IsError)
+
+	payload := decodeToolJSON(t, result)
+	assert.Equal(t, "job-live", payload["job_id"])
+	assert.Contains(t, payload["findings_from"], "currently running",
+		"a running job's own partial findings must not be labelled as a previous scan's")
+	assert.NotContains(t, payload["findings_from"], "previous")
+}
+
 // TestQuarantineSecurity_ScanServer_RequiresName pins the argument contract.
 func TestQuarantineSecurity_ScanServer_RequiresName(t *testing.T) {
 	proxy, _ := scanTestProxy(t)
diff --git a/internal/server/scan_admission_test.go b/internal/server/scan_admission_test.go
index c90818322..215678c13 100644
--- a/internal/server/scan_admission_test.go
+++ b/internal/server/scan_admission_test.go
@@ -30,7 +30,11 @@ type fakeSecurityScanner struct {
 	// Scan-surface fixtures (quarantine_security scan_server /
 	// get_scan_report). jobs/reports are keyed by server name; startScanErr
 	// and reportErr let a test drive the failure branches.
-	jobs         map[string]*scanner.ScanJob
+	jobs map[string]*scanner.ScanJob
+	// passJobs pins a job for one specific (server, pass) pair, so a test can
+	// make the ACTIVE job differ from the Pass-1 job — the shape produced when
+	// a completed Pass 1 auto-starts the Pass-2 deep audit.
+	passJobs     map[passKey]*scanner.ScanJob
 	reports      map[string]*scanner.AggregatedReport
 	startScanErr error
 	reportErr    error
@@ -47,10 +51,25 @@ func newFakeSecurityScanner() *fakeSecurityScanner {
 		summaries:   map[string]*scanner.ScanSummary{},
 		hasBaseline: map[string]bool{},
 		jobs:        map[string]*scanner.ScanJob{},
+		passJobs:    map[passKey]*scanner.ScanJob{},
 		reports:     map[string]*scanner.AggregatedReport{},
 	}
 }
 
+// passKey addresses one (server, scan pass) pair in the fake.
+type passKey struct {
+	server string
+	pass   int
+}
+
+// setPassJob pins the job a per-pass lookup resolves to, independently of the
+// job the generic status lookup returns.
+func (f *fakeSecurityScanner) setPassJob(serverName string, pass int, job *scanner.ScanJob) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.passJobs[passKey{server: serverName, pass: pass}] = job
+}
+
 // setScanResult publishes a settled scan for a server: the job the status poll
 // sees and the summary the verdict is read from.
 func (f *fakeSecurityScanner) setScanResult(serverName string, job *scanner.ScanJob, summary *scanner.ScanSummary) {
@@ -92,6 +111,11 @@ func (f *fakeSecurityScanner) StartScan(_ context.Context, serverName string, _
 	}
 	f.mu.Lock()
 	defer f.mu.Unlock()
+	// StartScan starts Pass 1 and hands back THAT job, so prefer a pinned
+	// Pass-1 job when a test has made the passes differ.
+	if job, ok := f.passJobs[passKey{server: serverName, pass: scanner.ScanPassSecurityScan}]; ok && job != nil {
+		return job, nil
+	}
 	return f.jobs[serverName], nil
 }
 
@@ -105,6 +129,23 @@ func (f *fakeSecurityScanner) GetScanStatus(_ context.Context, serverName string
 	return job, nil
 }
 
+// GetScanStatusByPass mirrors the service: a per-pass lookup. The fake keys one
+// job per server, so pass 1 resolves to it and any other pass falls through to
+// the same job — enough to exercise the "poll Pass 1, not whatever is active"
+// contract, with passJobs available when a test needs the two to differ.
+func (f *fakeSecurityScanner) GetScanStatusByPass(_ context.Context, serverName string, pass int) (*scanner.ScanJob, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if job, ok := f.passJobs[passKey{server: serverName, pass: pass}]; ok {
+		return job, nil
+	}
+	job, ok := f.jobs[serverName]
+	if !ok {
+		return nil, errors.New("no scan job")
+	}
+	return job, nil
+}
+
 func (f *fakeSecurityScanner) GetScanReport(_ context.Context, serverName string) (*scanner.AggregatedReport, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
diff --git a/internal/server/server.go b/internal/server/server.go
index 0a6d2b210..db6011017 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -66,6 +66,11 @@ type securityScannerService interface {
 	// operations (scan_server / get_scan_report): an agent that just triggered
 	// a scan needs the job's terminal state and the verdict that came out of it.
 	GetScanStatus(ctx context.Context, serverName string) (*scanner.ScanJob, error)
+	// GetScanStatusByPass resolves ONE pass's job. scan_server must poll Pass 1
+	// specifically: GetScanStatus answers with whatever job is active for the
+	// server, and a completed Pass 1 auto-starts the Pass-2 deep audit, which
+	// would otherwise mask the baseline verdict the caller is waiting for.
+	GetScanStatusByPass(ctx context.Context, serverName string, pass int) (*scanner.ScanJob, error)
 	GetScanReport(ctx context.Context, serverName string) (*scanner.AggregatedReport, error)
 	HasApprovalBaseline(serverName string) bool
 	ApplySecurityConfig(sec *config.SecurityConfig)

From c294bf019c8e14733e4f1f8bd8c4dcc4719b6c96 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <a.dumbris@gmail.com>
Date: Mon, 24 Aug 2026 06:42:54 +0300
Subject: [PATCH 5/8] fix(security): don't publish a pre-scan summary; free
 temp dir on scan reject
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two defects on the paths quarantine_security's new scan_server /
get_scan_report now expose to agents.

Lost cache invalidation. GetScanSummary reads BBolt with no lock held and
stores the result afterwards, while the scan callbacks invalidate. A reader
that sampled the pre-scan state could land its store on top of a starting
scan's invalidation, leaving a stale "clean" summary cached for a server
being scanned right now — and scan_server waits for the job to settle and
then reports that summary verbatim. Each server now carries an invalidation
generation: the reader samples it on the cache miss and cacheScanSummary
drops the write if it moved.

Temp-dir leak. Service.StartScan exports tool definitions into an
os.MkdirTemp dir and gives the cleanup to the scan callback, but the engine
rejects a scan (already in progress, no scanners resolved) before it ever
calls that callback, so the directory survived for the life of the process.
Release it on the reject path — every engine error path returns before
OnScanStarted, so it cannot double-free. Reachable in a loop now that
scan_server is an agent-callable MCP operation.
---
 internal/security/scanner/service.go          |  77 ++++++++++---
 internal/security/scanner/service_test.go     |   5 +-
 .../scanner/start_scan_cleanup_test.go        |  62 ++++++++++
 .../scanner/summary_cache_generation_test.go  | 108 ++++++++++++++++++
 4 files changed, 232 insertions(+), 20 deletions(-)
 create mode 100644 internal/security/scanner/start_scan_cleanup_test.go
 create mode 100644 internal/security/scanner/summary_cache_generation_test.go

diff --git a/internal/security/scanner/service.go b/internal/security/scanner/service.go
index a8722da85..e62f63011 100644
--- a/internal/security/scanner/service.go
+++ b/internal/security/scanner/service.go
@@ -145,23 +145,32 @@ type Service struct {
 	// resolver. Nil ⇒ fall back to the engine-wide default.
 	isolationModeResolver func(serverName string) string
 
-	// In-memory scan summary cache — avoids expensive BBolt reads per server
-	summaryCache   map[string]*ScanSummary
-	summaryCacheMu sync.RWMutex
+	// In-memory scan summary cache — avoids expensive BBolt reads per server.
+	//
+	// summaryCacheGen is a per-server invalidation counter. GetScanSummary
+	// computes a summary from BBolt OUTSIDE the cache lock, so a scan that
+	// starts mid-computation would otherwise have its invalidation overwritten
+	// by the in-flight reader storing the pre-scan summary — leaving a stale
+	// "clean" verdict cached for a server whose scan is running. The reader
+	// samples the generation on the cache miss and refuses to store if it moved.
+	summaryCache    map[string]*ScanSummary
+	summaryCacheGen map[string]uint64
+	summaryCacheMu  sync.RWMutex
 }
 
 // NewService creates a new SecurityService
 func NewService(storage Storage, registry *Registry, docker *DockerRunner, dataDir string, logger *zap.Logger) *Service {
 	engine := NewEngine(docker, registry, dataDir, logger)
 	svc := &Service{
-		storage:        storage,
-		engine:         engine,
-		registry:       registry,
-		docker:         docker,
-		sourceResolver: NewSourceResolver(logger),
-		queue:          NewScanQueue(logger),
-		summaryCache:   make(map[string]*ScanSummary),
-		logger:         logger,
+		storage:         storage,
+		engine:          engine,
+		registry:        registry,
+		docker:          docker,
+		sourceResolver:  NewSourceResolver(logger),
+		queue:           NewScanQueue(logger),
+		summaryCache:    make(map[string]*ScanSummary),
+		summaryCacheGen: make(map[string]uint64),
+		logger:          logger,
 	}
 	var noop EventEmitter = &NoopEmitter{}
 	svc.emitter.Store(&noop)
@@ -1148,6 +1157,16 @@ func (s *Service) StartScan(ctx context.Context, serverName string, dryRun bool,
 	}
 	job, err := s.engine.StartScan(ctx, req, callback)
 	if err != nil {
+		// The engine rejected the scan before it ever called the callback, so
+		// nothing will ever run the cleanup the callback owns — release the
+		// tool-definition temp dir / extracted source here or it survives for
+		// the life of the process. Every engine error path returns before
+		// OnScanStarted, so this cannot double-free. Reachable in a loop now
+		// that scan_server is an agent-callable MCP operation: each call that
+		// lands while a scan is already in progress takes exactly this path.
+		if resolvedCleanup != nil {
+			resolvedCleanup()
+		}
 		return nil, err
 	}
 
@@ -1963,6 +1982,11 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 		s.summaryCacheMu.RUnlock()
 		return cached
 	}
+	// Sample the invalidation generation in the same critical section as the
+	// miss. Everything below reads BBolt with no lock held, so this is the
+	// token that lets cacheScanSummary tell "still current" from "a scan
+	// started while I was computing".
+	cacheGen := s.summaryCacheGen[serverName]
 	s.summaryCacheMu.RUnlock()
 
 	// Check for active scan (Pass 1 takes priority in status display)
@@ -1984,7 +2008,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 		// Only cache the explicit "no scans found" sentinel — transient
 		// I/O errors must retry on the next call.
 		if errors.Is(err, errNoScans) {
-			s.cacheScanSummary(serverName, nil)
+			s.cacheScanSummary(serverName, nil, cacheGen)
 		}
 		return nil
 	}
@@ -2010,7 +2034,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 	// Check if the primary job failed
 	if primaryJob.Status == ScanJobStatusFailed {
 		summary.Status = "failed"
-		s.cacheScanSummary(serverName, summary)
+		s.cacheScanSummary(serverName, summary, cacheGen)
 		return summary
 	}
 
@@ -2030,7 +2054,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 		}
 		if summary.ScannersRun == 0 {
 			summary.Status = "failed"
-			s.cacheScanSummary(serverName, summary)
+			s.cacheScanSummary(serverName, summary, cacheGen)
 			return summary
 		}
 	}
@@ -2073,7 +2097,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 				summary.Status = "failed"
 			}
 		}
-		s.cacheScanSummary(serverName, summary)
+		s.cacheScanSummary(serverName, summary, cacheGen)
 		return summary
 	}
 
@@ -2090,7 +2114,7 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 	summary.Status = verdict
 
 	// Cache for fast subsequent reads
-	s.cacheScanSummary(serverName, summary)
+	s.cacheScanSummary(serverName, summary, cacheGen)
 	return summary
 }
 
@@ -2224,10 +2248,14 @@ type FindingCounts struct {
 }
 
 // invalidateScanSummaryCache removes a server's cached scan summary,
-// forcing the next GetScanSummary call to recompute from storage.
+// forcing the next GetScanSummary call to recompute from storage. It also bumps
+// the server's cache generation so any GetScanSummary already mid-flight — it
+// read BBolt before this scan existed — cannot store its now-stale result on
+// top of this invalidation.
 func (s *Service) invalidateScanSummaryCache(serverName string) {
 	s.summaryCacheMu.Lock()
 	delete(s.summaryCache, serverName)
+	s.summaryCacheGen[serverName]++
 	s.summaryCacheMu.Unlock()
 }
 
@@ -2235,10 +2263,21 @@ func (s *Service) invalidateScanSummaryCache(serverName string) {
 // is stored as a sentinel meaning "we already checked, this server has no
 // scans" — used by spec 047 to avoid re-scanning the BBolt scan-job bucket on
 // every poll for untouched servers.
-func (s *Service) cacheScanSummary(serverName string, summary *ScanSummary) {
+//
+// gen is the generation sampled when the caller missed the cache. If the server
+// was invalidated since (a scan started, progressed or finished while this
+// summary was being computed) the result describes a superseded state, so it is
+// dropped rather than published: a resurrected pre-scan summary would report a
+// stale "clean" verdict for a server that is being scanned right now, and
+// quarantine_security's scan_server/get_scan_report hand that verdict straight
+// to an agent.
+func (s *Service) cacheScanSummary(serverName string, summary *ScanSummary, gen uint64) {
 	s.summaryCacheMu.Lock()
+	defer s.summaryCacheMu.Unlock()
+	if s.summaryCacheGen[serverName] != gen {
+		return
+	}
 	s.summaryCache[serverName] = summary
-	s.summaryCacheMu.Unlock()
 }
 
 // waitForConnection polls IsConnected until the server connects or the timeout expires.
diff --git a/internal/security/scanner/service_test.go b/internal/security/scanner/service_test.go
index 091704617..dc4dd3926 100644
--- a/internal/security/scanner/service_test.go
+++ b/internal/security/scanner/service_test.go
@@ -2131,7 +2131,10 @@ func TestGetScanSummary_OverwritesNilSentinelOnRealScan(t *testing.T) {
 		t.Fatalf("SaveScanJob: %v", err)
 	}
 	real := &ScanSummary{Status: "clean", LastScanAt: &now}
-	svc.cacheScanSummary("later-scanned", real)
+	svc.summaryCacheMu.RLock()
+	realGen := svc.summaryCacheGen["later-scanned"]
+	svc.summaryCacheMu.RUnlock()
+	svc.cacheScanSummary("later-scanned", real, realGen)
 
 	// Subsequent GetScanSummary returns the real summary, not the nil sentinel.
 	if got := svc.GetScanSummary(context.Background(), "later-scanned"); got == nil || got.Status != "clean" {
diff --git a/internal/security/scanner/start_scan_cleanup_test.go b/internal/security/scanner/start_scan_cleanup_test.go
new file mode 100644
index 000000000..82ba6ba7f
--- /dev/null
+++ b/internal/security/scanner/start_scan_cleanup_test.go
@@ -0,0 +1,62 @@
+package scanner
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+)
+
+// Service.StartScan exports tool definitions into an os.MkdirTemp directory and
+// hands ownership of the cleanup to the scan callback. The engine, however, can
+// reject the scan (another scan already in progress, no scanners resolved)
+// BEFORE it ever invokes that callback — so on the reject path nothing ever
+// removes the directory. It leaks for the life of the process, and
+// quarantine_security's scan_server makes that path agent-reachable in a loop.
+func TestStartScan_CleansUpTempDirWhenEngineRejectsScan(t *testing.T) {
+	// Isolate os.MkdirTemp("") so the assertion counts only this test's dirs.
+	tmpRoot := t.TempDir()
+	t.Setenv("TMPDIR", tmpRoot)
+	require.Equal(t, tmpRoot, os.TempDir(), "precondition: os.TempDir must follow TMPDIR")
+
+	dir := t.TempDir()
+	logger := zap.NewNop()
+	svc := NewService(newMockStorage(), NewRegistry(dir, logger), NewDockerRunner(logger), dir, logger)
+	svc.SetServerInfoProvider(&scanSpyProvider{info: &ServerInfo{
+		Name:     "busy-srv",
+		Protocol: "stdio",
+		Command:  "node",
+		Args:     []string{"server.js"},
+	}})
+
+	// Occupy the engine so every StartScan is rejected deterministically —
+	// exactly what a second scan_server call hits while the first still runs.
+	svc.engine.mu.Lock()
+	svc.engine.activeScans["busy-srv"] = &ScanJob{
+		ID:         "scan-busy-srv-preexisting",
+		ServerName: "busy-srv",
+		Status:     ScanJobStatusRunning,
+		ScanPass:   ScanPassSecurityScan,
+		StartedAt:  time.Now(),
+	}
+	svc.engine.mu.Unlock()
+
+	before, err := os.ReadDir(tmpRoot)
+	require.NoError(t, err)
+
+	for i := 0; i < 3; i++ {
+		job, err := svc.StartScan(context.Background(), "busy-srv", false, nil, "")
+		require.Error(t, err, "the engine must reject while a scan is in progress")
+		assert.Nil(t, job)
+	}
+
+	after, err := os.ReadDir(tmpRoot)
+	require.NoError(t, err)
+
+	assert.Len(t, after, len(before),
+		"a rejected scan must not leave its tool-definition temp dir behind")
+}
diff --git a/internal/security/scanner/summary_cache_generation_test.go b/internal/security/scanner/summary_cache_generation_test.go
new file mode 100644
index 000000000..1b12a6d53
--- /dev/null
+++ b/internal/security/scanner/summary_cache_generation_test.go
@@ -0,0 +1,108 @@
+package scanner
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// The scan-summary cache is written by GetScanSummary AFTER it has read BBolt
+// with no lock held, and invalidated by the scan callbacks. Without a
+// generation token the two interleave into a lost invalidation: a reader that
+// sampled the pre-scan state stores it on top of the invalidation a starting
+// scan just performed, and every later reader is served that stale summary from
+// cache. It matters because quarantine_security's scan_server waits for the job
+// to settle and then reports GetScanSummary's verdict verbatim to an agent — a
+// resurrected pre-scan "clean" would be handed over as the new scan's result.
+
+// TestCacheScanSummary_DropsWriteInvalidatedMidComputation is the direct
+// regression: sample a generation, invalidate (as a starting scan does), then
+// try to store. The store must be refused.
+func TestCacheScanSummary_DropsWriteInvalidatedMidComputation(t *testing.T) {
+	svc := newFreshInstallService(t)
+	const server = "victim"
+
+	// A reader misses the cache and samples the generation.
+	svc.summaryCacheMu.RLock()
+	gen := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	// While it reads BBolt, a scan starts and invalidates.
+	svc.invalidateScanSummaryCache(server)
+
+	// The in-flight reader now tries to publish its pre-scan summary.
+	stale := &ScanSummary{Status: "clean"}
+	svc.cacheScanSummary(server, stale, gen)
+
+	svc.summaryCacheMu.RLock()
+	cached, ok := svc.summaryCache[server]
+	svc.summaryCacheMu.RUnlock()
+
+	assert.False(t, ok, "a summary computed before the invalidation must not be cached")
+	assert.Nil(t, cached)
+}
+
+// TestCacheScanSummary_StoresWhenGenerationUnchanged pins the other half: the
+// guard must not break ordinary caching, or spec 047's negative caching would
+// stop working and every poll would re-scan the BBolt job bucket.
+func TestCacheScanSummary_StoresWhenGenerationUnchanged(t *testing.T) {
+	svc := newFreshInstallService(t)
+	const server = "quiet"
+
+	svc.summaryCacheMu.RLock()
+	gen := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	summary := &ScanSummary{Status: "clean"}
+	svc.cacheScanSummary(server, summary, gen)
+
+	svc.summaryCacheMu.RLock()
+	cached, ok := svc.summaryCache[server]
+	svc.summaryCacheMu.RUnlock()
+
+	require.True(t, ok, "an uncontended summary must still be cached")
+	assert.Same(t, summary, cached)
+
+	// The nil sentinel ("checked, never scanned") must cache too.
+	const empty = "untouched"
+	svc.summaryCacheMu.RLock()
+	emptyGen := svc.summaryCacheGen[empty]
+	svc.summaryCacheMu.RUnlock()
+	svc.cacheScanSummary(empty, nil, emptyGen)
+
+	svc.summaryCacheMu.RLock()
+	sentinel, sentinelOK := svc.summaryCache[empty]
+	svc.summaryCacheMu.RUnlock()
+
+	assert.True(t, sentinelOK, "the negative-cache sentinel must still be stored")
+	assert.Nil(t, sentinel)
+}
+
+// TestInvalidateScanSummaryCache_AdvancesGeneration pins that invalidation is
+// what moves the token — a second invalidation must not reuse the first's
+// generation, or two scans in a row would reopen the window.
+func TestInvalidateScanSummaryCache_AdvancesGeneration(t *testing.T) {
+	svc := newFreshInstallService(t)
+	const server = "twice"
+
+	svc.summaryCacheMu.RLock()
+	start := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	svc.invalidateScanSummaryCache(server)
+	svc.invalidateScanSummaryCache(server)
+
+	svc.summaryCacheMu.RLock()
+	end := svc.summaryCacheGen[server]
+	svc.summaryCacheMu.RUnlock()
+
+	assert.Equal(t, start+2, end, "each invalidation must advance the generation")
+
+	// A reader holding the pre-invalidation token is still refused.
+	svc.cacheScanSummary(server, &ScanSummary{Status: "clean"}, start)
+	svc.summaryCacheMu.RLock()
+	_, ok := svc.summaryCache[server]
+	svc.summaryCacheMu.RUnlock()
+	assert.False(t, ok)
+}

From 7ae93f49ad25a1488a29f56e6be841d9c50fe566 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <a.dumbris@gmail.com>
Date: Mon, 24 Aug 2026 07:10:49 +0300
Subject: [PATCH 6/8] test(security): freeze the rest of quarantine_security's
 touched parameters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

assertQuarantineSecurityDelta claimed every non-`operation` schema stays
byte-equal, but it only compared `type` on `name` and only the enum on
`operation`. A later golden regeneration could therefore slip a new
`pattern`, `enum` or `default` onto `name`, or change `operation.type`, and
the frozen-golden gate would still pass — on the two parameters this feature
is allowed to touch, i.e. the widest blind spot the helper could have.

Compare both schemas minus only the keys the feature may move (`description`
on `name`; `enum` + `description` on `operation`). Verified by injecting a
`pattern` on `name` and confirming the gate now fails on every surface.
---
 internal/server/mcp_menu_surface_test.go | 30 ++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/internal/server/mcp_menu_surface_test.go b/internal/server/mcp_menu_surface_test.go
index 749fa3040..88ddd4518 100644
--- a/internal/server/mcp_menu_surface_test.go
+++ b/internal/server/mcp_menu_surface_test.go
@@ -266,6 +266,21 @@ func assertRetrieveToolsDelta(t *testing.T, surface string, preM, curM map[strin
 // from quarantine_security — the surface agents already use for held servers.
 var quarantineScanOperations = []string{"scan_server", "get_scan_report"}
 
+// schemaWithout copies a JSON-schema fragment minus the named keys, so a
+// comparison can freeze "everything except the parts this feature is allowed to
+// move". A nil fragment copies to an empty map, so a lost parameter compares
+// unequal to a present one instead of silently matching.
+func schemaWithout(schema map[string]interface{}, drop ...string) map[string]interface{} {
+	out := make(map[string]interface{}, len(schema))
+	for k, v := range schema {
+		out[k] = v
+	}
+	for _, k := range drop {
+		delete(out, k)
+	}
+	return out
+}
+
 // assertQuarantineSecurityDelta: quarantine_security may grow the two scan
 // operations and the prose that documents them, and NOTHING else. In
 // particular it takes no new parameter — both operations reuse `name` — so the
@@ -285,11 +300,15 @@ func assertQuarantineSecurityDelta(t *testing.T, surface string, preM, curM map[
 		}
 		if p == "name" {
 			// `name` is now required for the scan ops too, so its description
-			// lists them; the rest of its schema must not move.
+			// lists them; EVERY other key of its schema must be byte-equal.
+			// Comparing only `type` here would let a later regeneration slip a
+			// new `pattern`, `enum` or `default` onto the parameter unnoticed —
+			// the exact drift these frozen goldens exist to catch.
 			preName, _ := preSchema.(map[string]interface{})
 			curName, _ := curProps[p].(map[string]interface{})
 			require.NotNil(t, curName, "surface %s: quarantine_security lost its name parameter", surface)
-			assert.Equal(t, preName["type"], curName["type"], "surface %s: name stays a string", surface)
+			assert.Equal(t, schemaWithout(preName, "description"), schemaWithout(curName, "description"),
+				"surface %s: only name's description may move — every other constraint is frozen", surface)
 			for _, op := range quarantineScanOperations {
 				assert.Contains(t, curName["description"], op,
 					"surface %s: name must document that %s requires it", surface, op)
@@ -314,6 +333,13 @@ func assertQuarantineSecurityDelta(t *testing.T, surface string, preM, curM map[
 	assert.Equal(t, wantEnum, curEnum,
 		"surface %s: the operation enum grows by exactly %v", surface, quarantineScanOperations)
 
+	// …and the REST of the operation schema is frozen. Checking only the enum
+	// would let `type` change, or a new constraint appear beside it, on the one
+	// parameter this feature is allowed to touch — the widest blind spot the
+	// helper could have.
+	assert.Equal(t, schemaWithout(preOp, "enum", "description"), schemaWithout(curOp, "enum", "description"),
+		"surface %s: apart from the enum and its prose, operation's schema is frozen", surface)
+
 	// Annotations and required list unchanged.
 	assert.Equal(t, preM["annotations"], curM["annotations"],
 		"surface %s: quarantine_security annotations unchanged", surface)

From 9f427f4855fbc3752f51a3248c838dfe76991048 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <a.dumbris@gmail.com>
Date: Mon, 24 Aug 2026 07:38:09 +0300
Subject: [PATCH 7/8] test(security): make the temp-dir cleanup test
 platform-agnostic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test pinned os.TempDir() to TMPDIR, which only holds on unix — Windows
resolves TMP/TEMP, so the precondition failed the windows-amd64 build job.

Set all three variables, read os.TempDir() back instead of asserting which
one won, and count only the "mcpproxy-scan-tools-" prefix so the assertion
stays exact even when the process temp dir is shared. Re-verified it still
fails when the cleanup on the engine-reject path is removed.
---
 .../scanner/start_scan_cleanup_test.go        | 30 ++++++++++++++-----
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/internal/security/scanner/start_scan_cleanup_test.go b/internal/security/scanner/start_scan_cleanup_test.go
index 82ba6ba7f..de1cd7480 100644
--- a/internal/security/scanner/start_scan_cleanup_test.go
+++ b/internal/security/scanner/start_scan_cleanup_test.go
@@ -3,6 +3,7 @@ package scanner
 import (
 	"context"
 	"os"
+	"strings"
 	"testing"
 	"time"
 
@@ -18,10 +19,27 @@ import (
 // removes the directory. It leaks for the life of the process, and
 // quarantine_security's scan_server makes that path agent-reachable in a loop.
 func TestStartScan_CleansUpTempDirWhenEngineRejectsScan(t *testing.T) {
-	// Isolate os.MkdirTemp("") so the assertion counts only this test's dirs.
+	// Point os.MkdirTemp("") at a scratch dir. Which variable wins is
+	// platform-specific (TMPDIR on unix, TMP/TEMP on Windows), so set all three
+	// and then read back os.TempDir() rather than asserting any one of them
+	// took effect — and count only OUR prefix, so the assertion is still exact
+	// even if the process temp dir is shared.
 	tmpRoot := t.TempDir()
 	t.Setenv("TMPDIR", tmpRoot)
-	require.Equal(t, tmpRoot, os.TempDir(), "precondition: os.TempDir must follow TMPDIR")
+	t.Setenv("TMP", tmpRoot)
+	t.Setenv("TEMP", tmpRoot)
+
+	countScanTempDirs := func() int {
+		entries, err := os.ReadDir(os.TempDir())
+		require.NoError(t, err)
+		n := 0
+		for _, e := range entries {
+			if strings.HasPrefix(e.Name(), "mcpproxy-scan-tools-") {
+				n++
+			}
+		}
+		return n
+	}
 
 	dir := t.TempDir()
 	logger := zap.NewNop()
@@ -45,8 +63,7 @@ func TestStartScan_CleansUpTempDirWhenEngineRejectsScan(t *testing.T) {
 	}
 	svc.engine.mu.Unlock()
 
-	before, err := os.ReadDir(tmpRoot)
-	require.NoError(t, err)
+	before := countScanTempDirs()
 
 	for i := 0; i < 3; i++ {
 		job, err := svc.StartScan(context.Background(), "busy-srv", false, nil, "")
@@ -54,9 +71,6 @@ func TestStartScan_CleansUpTempDirWhenEngineRejectsScan(t *testing.T) {
 		assert.Nil(t, job)
 	}
 
-	after, err := os.ReadDir(tmpRoot)
-	require.NoError(t, err)
-
-	assert.Len(t, after, len(before),
+	assert.Equal(t, before, countScanTempDirs(),
 		"a rejected scan must not leave its tool-definition temp dir behind")
 }

From d35b90e997293c6e1d863727d89121d3cdc94149 Mon Sep 17 00:00:00 2001
From: Algis Dumbris <a.dumbris@gmail.com>
Date: Mon, 24 Aug 2026 13:46:38 +0300
Subject: [PATCH 8/8] test(server): close TOCTOU flake in
 TestE2E_SocketPermissions

net.Listen creates the socket file with umask-default permissions before
listener_unix.go chmods it to 0600; the readiness poll only waited for the
file to exist, so a stat landing inside that window asserted against 0755
(observed twice on the ubuntu -race CI runner). Wait for the hardened mode
before asserting.
---
 internal/server/socket_e2e_test.go | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/internal/server/socket_e2e_test.go b/internal/server/socket_e2e_test.go
index afa9714c3..b7e0928e4 100644
--- a/internal/server/socket_e2e_test.go
+++ b/internal/server/socket_e2e_test.go
@@ -403,11 +403,13 @@ func TestE2E_SocketPermissions(t *testing.T) {
 
 	socketPath := filepath.Join(tmpDir, "mcpproxy.sock")
 
-	// Wait for socket file to be created (HTTP server starts asynchronously)
+	// Wait for the socket file to be created AND hardened (HTTP server starts
+	// asynchronously, and net.Listen creates the file umask-default before the
+	// listener chmods it to 0600 — stat'ing inside that window sees 0755)
 	require.Eventually(t, func() bool {
-		_, err := os.Stat(socketPath)
-		return err == nil
-	}, 2*time.Second, 100*time.Millisecond, "Socket file should be created")
+		info, err := os.Stat(socketPath)
+		return err == nil && info.Mode().Perm() == 0600
+	}, 2*time.Second, 100*time.Millisecond, "Socket file should be created with 0600 permissions")
 
 	// Check socket file permissions
 	info, err := os.Stat(socketPath)