{
  "kind": "agent_component_change",
  "product_version": "0.12.897",
  "wheel_sha256": "a9c3bf17b036c5f661df05ba4a02cf3afa834b44c2492f3e60fb3b66061a0a24",
  "method": "Published detector functions evaluated on authored inert events or disposable configuration files.",
  "scope": "No live agent, runtime adapter, daemon ingestion, product UI, external command or network action was exercised.",
  "cases": [
    {
      "case": "first-inventory",
      "inputs": {
        "previous": [],
        "current": [
          {
            "component_id": "example-server",
            "kind": "mcp_server",
            "name": "review-server",
            "scope": "global",
            "workspace": "",
            "source": ".claude.json",
            "readers": [
              "claude_code"
            ],
            "version": "",
            "content_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "details": {}
          }
        ],
        "baseline": true,
        "now_ms": 1800000000000
      },
      "expected_severity": null,
      "actual_severity": null,
      "findings": []
    },
    {
      "case": "added-after-baseline",
      "inputs": {
        "previous": [],
        "current": [
          {
            "component_id": "example-server",
            "kind": "mcp_server",
            "name": "review-server",
            "scope": "global",
            "workspace": "",
            "source": ".claude.json",
            "readers": [
              "claude_code"
            ],
            "version": "",
            "content_hash": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
            "details": {}
          }
        ],
        "baseline": false,
        "now_ms": 1800000000000
      },
      "expected_severity": "warning",
      "actual_severity": "warning",
      "findings": [
        {
          "kind": "agent_component_change",
          "session_id": "claude_code:example",
          "runtime": "claude_code",
          "severity": "warning",
          "title": "New MCP server for Claude Code: review-server",
          "detail": "Something this Claude Code session loads was added since ClawMetry last looked: review-server (MCP server, added). Read from .claude.json. A new or swapped MCP server, skill or plugin runs with the agent's credentials the next time it is used, and nothing in the tool stream shows the change. ClawMetry read the configuration only; it did not start or run the component. If you or your agent installed or updated it, this is expected.",
          "evidence": {
            "observed": "agent_inventory",
            "components": [
              {
                "kind": "mcp_server",
                "name": "review-server",
                "scope": "global",
                "source": ".claude.json",
                "change": "new",
                "changed_at": 1800000000000,
                "version": "",
                "content_hash": "aaaaaaaaaaaa",
                "previous_hash": "",
                "readers": [
                  "claude_code"
                ]
              }
            ],
            "count": 1
          },
          "first_bad_step": null,
          "spend_at_risk_usd": 0.0,
          "spend_basis": "unknown",
          "frameworks": {
            "mapping_version": "2026-09-27.1",
            "owasp_llm": [],
            "owasp_asi": [
              "ASI04"
            ],
            "atlas": [
              "AML.T0010.005",
              "AML.T0081"
            ],
            "mapped": true,
            "mode": "detect",
            "pre_action_control": false
          }
        }
      ]
    }
  ]
}