Reports

Runtime and endpoint scans return an agent report with the scan result. Prompt scans have their own report shape, retrieved through the reports namespace.

Agent reportsCopy Anchor Link

const { report } = await zeroleaks.runtimeScans.run(target);
// or: const { report } = await zeroleaks.endpointScans.get(scanId);

console.log(report.overallScore); // 0-100, higher is safer
console.log(report.overallVulnerability); // "critical" | "high" | "medium" | "low" | "secure"
console.log(report.components);
console.log(report.recommendations);

ZeroLeaks scrubs a report before storing it. In findings, conversationLog, recommendations, and boundaryAssurance, credential-shaped strings are replaced with a marker such as [redacted provider_api_key], and your planted canary with [planted canary]. Runtime toolTrace entries get the same credential scrub.

promptSecurity contains secrets-in-context and injection findings. Tool hijacking, indirect injection, authority and protocol exploits, and boundary violations appear in toolSafety. Each finding (AgentFinding) includes the technique, severity, evidence, attack prompt, and agent response. Secrets-in-context findings add leakClass and evidenceStrength. An evidenceStrength of deterministic_effect or observed_tool_call means ZeroLeaks observed the effect or tool call. The indicator and semantic values describe evidence based on the response text.

Boundary assuranceCopy Anchor Link

report.boundaryAssurance explains what the scan tested and why:

• invariants: the rules derived from the target profile. Each has an id, title, dimension (such as authorization, data access, or tool use), protectedAsset, the allowed and forbidden behavior, an approvalRequirement, the relevant tools, and a severity.
• verificationCases: each boundary probe with its turns, the expected safe behavior, whether it violated the invariant, the evidence, and evidenceStrength, confidence, and judgeVotes where available.
• initialProbes, mutatedProbes, multiAgentProbes, artifactProbes, violations, promotedProbes: counts for the boundary track. Promotion into the reusable probe library stays inside your account.
• attackQuality: success rate, deterministic evidence rate, queries to first success, longest campaign, novelty, and coverage with the attack surfaces requested, exercised, and unsupported (with a reason). limitations lists anything that reduced coverage.
• longHorizonCampaigns: multi-turn campaigns against a single invariant, with turnsUsed, budget, and a status of in_progress, crossed, or exhausted. campaignStates holds the full state of each one, transcript included.
• strategy: the phase plan (reconnaissance, escalation, persistence) that ordered the probe groups, with per-phase budgets and when a stalled conversation is reset.
• fingerprint: the defenses observed during the scan: refusal style, output-filter signals, whether tool gating held, refusal rate, and sample size. The next scan of the same target in your account starts from this fingerprint. priorFingerprint is the one this scan started from, when there was one.
• secretsInContext: probes run, leaks by class, what reconnaissance observed, and whether a planted canary was configured. See secrets in context.

Older reports may lack some fields. The types mark those fields optional; check that they exist before reading them. @zeroleaks/sdk 0.3.0 or later types all of boundaryAssurance as BoundaryAssurance, with SecretsInContextSummary, DefenseFingerprint, and CampaignState for its parts.

RemediationCopy Anchor Link

Recommendations and findings describe what to change. A scan does not apply a fix or rerun exploits against the fixed agent. Scan again after you change the agent, and the same attacks run against the new version.

Prompt scan reportsCopy Anchor Link

const report = await zeroleaks.reports.getByScan(scanId);
const byId = await zeroleaks.reports.get(reportId);
const page = await zeroleaks.reports.list({ limit: 20 });

reports only covers prompt scans (the retired hosted prompt-scan flow). A prompt scan report can include:

• Leakage and injection scores
• Severity-ranked findings
• Attack-family statistics
• Tool logs and exposed canaries
• Kill-chain detections
• Remediation guidance
• Knowledge and corpus version metadata
• A truncation notice when verbose evidence exceeds storage limits
• Runtime tool-call and tool-result traces
• Target provider, model, tool schemas, and adapter metadata

Treat report evidence as sensitive security data. Avoid logging complete reports or exposing them to unauthenticated clients.