<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>MCTS Security Report</title>
  {{ chart_script | safe }}
  <style>{{ styles | safe }}</style>
</head>
<body>
  <div class="app">
    <aside class="sidebar">
      <div class="brand card-interactive" data-card-action="goto:overview" tabindex="0" role="button" aria-label="Back to report overview">
        <div class="brand-logo">
          <img src="{{ logo_src }}" alt="MCTS logo" width="44" height="44">
        </div>
        <div class="brand-text">
          <h1>MCTS</h1>
          <p>Security Report</p>
        </div>
      </div>

      <nav class="nav" aria-label="Report sections">
        <button type="button" class="nav-item active" data-section="overview">
          <span class="nav-label">Start Here</span>
        </button>
        <button type="button" class="nav-item" data-section="findings">
          <span class="nav-label">Issues to Fix</span>
          <span class="nav-badge" id="nav-badge-findings" hidden></span>
        </button>
        <button type="button" class="nav-item" data-section="analyzers">
          <span class="nav-label">All Checks</span>
          <span class="nav-badge nav-badge--ok" id="nav-badge-analyzers" hidden></span>
        </button>
        <button type="button" class="nav-item" data-section="recommendations">
          <span class="nav-label">How to Fix</span>
          <span class="nav-badge" id="nav-badge-recs" hidden></span>
        </button>
        <button type="button" class="nav-item" data-section="attack-chains">
          <span class="nav-label">Attack Paths</span>
        </button>
        <button type="button" class="nav-item" data-section="techniques">
          <span class="nav-label">MCTS-T Map</span>
        </button>
        <button type="button" class="nav-item" data-section="capabilities">
          <span class="nav-label">Capabilities</span>
        </button>
        <button type="button" class="nav-item" data-section="owasp">
          <span class="nav-label">OWASP Map</span>
        </button>
        <button type="button" class="nav-item" data-section="appendix">
          <span class="nav-label">Raw Data</span>
        </button>
      </nav>

      <div class="scan-card">
        <h3>Scan Information</h3>
        <dl class="scan-meta">
          <dt>Target</dt><dd id="meta-target">—</dd>
          <dt>Scan Scope</dt><dd id="meta-scope">—</dd>
          <dt>Scan Date</dt><dd id="meta-date">—</dd>
          <dt>Scan Time</dt><dd id="meta-time">—</dd>
          <dt>Tools Discovered</dt><dd id="meta-tools">—</dd>
          <dt>Analyzers Run</dt><dd id="meta-analyzers">—</dd>
        </dl>
      </div>

      <div class="sidebar-footer">
        <button type="button" class="btn-download" id="download-json-side">
          Download JSON Report
        </button>
      </div>
    </aside>

    <main class="main">
      <header class="header">
        <span class="badge-version">v{{ app_version }}</span>
        <div class="export-wrap">
          <button type="button" class="btn-export" id="export-toggle" aria-haspopup="true" aria-expanded="false">
            Export
          </button>
          <div class="export-menu" id="export-menu" role="menu">
            <button type="button" role="menuitem" id="export-pdf">PDF (Print)</button>
            <button type="button" role="menuitem" id="export-json">JSON</button>
            <button type="button" role="menuitem" id="export-html">HTML</button>
          </div>
        </div>
      </header>

      <!-- Overview -->
      <section id="overview" class="page-section active">
        <div id="tool-discovery-banner" class="tool-discovery-banner" role="status" hidden></div>
        <div id="scan-notes-banner" class="scan-notes-banner" role="status" hidden></div>

        <header class="overview-hero" id="overview-hero">
          <div class="hero-text">
            <p class="hero-eyebrow" id="hero-eyebrow">Scan complete</p>
            <h2 class="hero-title" id="hero-title">Your security snapshot</h2>
            <p class="hero-lead" id="metrics-headline"></p>
          </div>
          <div class="hero-stats" id="hero-stats" aria-label="Key scan statistics"></div>
        </header>

        <nav class="quick-jump-bar" id="quick-jump" aria-label="Jump to report sections"></nav>

        <div class="priority-grid" id="priority-grid">
          <div class="priority-col priority-col--issues">
            <div class="card issues-summary-card card-interactive" data-card-action="goto:findings" aria-label="View all issues">
              <span class="card-cta">View all issues →</span>
              <h3 class="card-heading">Issues found</h3>
              <p class="issues-summary-intro">Security problems MCTS flagged — fix Critical and High first.</p>
              <div class="issues-total-wrap">
                <span class="issues-total" id="issues-total">0</span>
                <span class="issues-total-label">total issues</span>
              </div>
              <table class="issues-table" aria-label="Issues by severity">
                <thead>
                  <tr><th>Severity</th><th>Count</th><th>What it means</th></tr>
                </thead>
                <tbody id="issues-table-body"></tbody>
                <tfoot>
                  <tr><td><strong>Total</strong></td><td id="issues-table-total"><strong>0</strong></td><td></td></tr>
                </tfoot>
              </table>
              <div class="tools-stat" id="tools-stat"></div>
            </div>
          </div>

          <div class="priority-col priority-col--risk">
            <div class="card score-card card-interactive" id="score-card" data-card-action="scroll:score-breakdown-section" aria-label="View area sub-scores"{% if hide_legacy_score_card %} hidden{% endif %}>
              <span class="card-cta">View sub-scores →</span>
              <div class="score-title-row">
                <h3 id="score-card-title">Security Score</h3>
                <div class="score-info-wrap">
                  <button type="button" class="score-info" id="score-info" aria-describedby="score-tooltip">ⓘ</button>
                  <div class="score-tooltip" id="score-tooltip" role="tooltip"></div>
                </div>
              </div>
              <p class="score-scale-hint"><strong>0–100 points</strong> · higher is better · not a percentage</p>
              <div class="gauge-wrap">
                <canvas id="gauge-chart" aria-label="Security score gauge"></canvas>
                <div class="gauge-center">
                  <div class="gauge-score"><span id="gauge-score-value">0</span><span class="gauge-denom"> / 100</span></div>
                  <p class="gauge-grade">Grade <span id="security-grade" class="grade-badge">—</span></p>
                </div>
              </div>
              <div class="risk-pill critical" id="risk-pill">—</div>
              <p class="score-brief" id="score-brief">—</p>
              <p class="score-detail" id="score-detail"></p>
            </div>

            <div class="v2-risk-panel" id="v2-score-section"{% if not hide_legacy_score_card %} hidden{% endif %}>
              <div class="card v2-score-card" id="v2-primary-card">
                <h3 class="card-heading">Overall risk level</h3>
                <p class="card-microcopy">Multi-factor score — higher number means more danger</p>
                <div class="v2-absolute-risk" id="v2-absolute-risk">—</div>
                <div class="risk-pill critical" id="v2-risk-pill">—</div>
                <p class="score-brief" id="v2-risk-range">—</p>
                <dl class="v2-meta-dl">
                  <dt><span class="term-label">Benchmark score</span><span class="term-hint">Compared to other MCP servers (0–100, higher is better)</span></dt>
                  <dd id="v2-security-score">—</dd>
                  <dt><span class="term-label">Confidence</span><span class="term-hint">How sure MCTS is about this risk estimate</span></dt>
                  <dd id="v2-confidence">—</dd>
                  <dt><span class="term-label">Risk percentile</span><span class="term-hint">Where you rank vs the benchmark corpus</span></dt>
                  <dd id="v2-percentile">—</dd>
                </dl>
              </div>
              <div class="card v2-dimension-card">
                <h3 class="card-heading">What drives the risk?</h3>
                <p class="score-scale-hint">Each spoke shows which risk factor weighs most on <em>this</em> scan. 100 = dominant factor.</p>
                <div class="chart-box v2-radar-box">
                  <canvas id="v2-dimension-radar" aria-label="Risk factor dimension radar"></canvas>
                </div>
              </div>
            </div>
          </div>
        </div>

        <div class="zone zone--actions" id="zone-actions">
          <div class="zone-header">
            <h3 class="zone-heading">What to do next</h3>
            <p class="zone-intro">Start with urgent issues, then follow the recommended fixes below.</p>
          </div>
          <div class="overview-split" id="overview-split" hidden>
            <div class="card overview-panel overview-panel--issues card-interactive" data-card-action="goto:findings" aria-label="View all issues">
              <span class="card-cta">Open issues →</span>
              <h3 class="card-heading">Fix these first</h3>
              <p class="panel-hint">Highest-severity findings from this scan.</p>
              <ul class="overview-list" id="overview-top-findings"></ul>
              <button type="button" class="panel-link" data-goto="findings">View all issues →</button>
            </div>
            <div class="card overview-panel overview-panel--passed card-interactive" data-card-action="goto:analyzers-passed" aria-label="View passed checks">
              <span class="card-cta">Open checks →</span>
              <h3 class="card-heading">What already looks good</h3>
              <p class="panel-hint">Checks that ran cleanly — click any row for details.</p>
              <ul class="overview-list overview-list--passed" id="overview-passed-list"></ul>
              <button type="button" class="panel-link" data-goto="analyzers">View all checks →</button>
            </div>
          </div>
          <div class="card exec-summary card-interactive" data-card-action="goto:recommendations" aria-label="View fix recommendations">
            <span class="card-cta">How to fix →</span>
            <h3 class="card-heading">Summary &amp; recommended actions</h3>
            <div class="exec-summary-grid">
              <div class="exec-col">
                <h4 class="exec-col-title">What this means</h4>
                <div id="exec-paragraphs" class="exec-paragraphs"></div>
              </div>
              <div class="exec-col">
                <h4 class="exec-col-title">Top fixes (P1 first)</h4>
                <div id="exec-actions" class="exec-actions"></div>
              </div>
            </div>
          </div>
        </div>

        <div class="zone zone--risk-detail" id="zone-risk-detail" hidden>
          <div class="zone-header">
            <h3 class="zone-heading">Risk breakdown</h3>
            <p class="zone-intro" id="v2-metrics-intro">Which findings and categories add the most to your overall risk score.</p>
          </div>
          <div class="v2-detail-grid">
            <div class="card v2-contributors-card" id="v2-contributors-card">
              <h3 class="card-heading">Biggest risk contributors</h3>
              <p class="card-microcopy">Findings that added the most to your absolute risk number.</p>
              <div class="v2-contributors-table-wrap">
                <table class="data-table" id="v2-contributors-table" aria-label="Top risk contributors">
                  <thead>
                    <tr>
                      <th>Finding</th>
                      <th>Tool</th>
                      <th>Risk added</th>
                      <th>Why</th>
                    </tr>
                  </thead>
                  <tbody id="v2-contributors-body"></tbody>
                </table>
              </div>
            </div>
            <div class="card v2-categories-card" id="v2-categories-card">
              <h3 class="card-heading">Category health</h3>
              <p class="card-microcopy">100 = no problems in that OWASP bucket · lower = more findings there.</p>
              <div class="v2-categories-list-wrap">
                <ul class="category-list" id="v2-category-list"></ul>
              </div>
            </div>
          </div>
        </div>

        <div class="zone zone--coverage" id="zone-coverage">
          <div class="zone-header">
            <h3 class="zone-heading">Scan coverage</h3>
            <p class="zone-intro">How many security checks ran, and how they grouped into risk areas.</p>
          </div>
          <div class="checks-section" id="checks-section" hidden>
            <div id="checks-summary-row" class="checks-summary-row"></div>
          </div>
          <div class="score-breakdown-section" id="score-breakdown-section" hidden>
            <h4 class="zone-subheading">Area scores (legacy)</h4>
            <p class="zone-subintro">Points out of 100 per security area — separate from the main risk score above.</p>
            <div id="score-breakdown-row" class="score-breakdown-row"></div>
          </div>
        </div>

        <div class="zone zone--trends" id="zone-trends">
          <div class="zone-header">
            <h3 class="zone-heading">Trends &amp; benchmarks</h3>
            <p class="zone-intro" id="trend-zone-intro">Track changes across scans and see where your score sits on the scale.</p>
          </div>
          <div class="breakdown-row" id="breakdown-row">
            <div class="card breakdown-card card-interactive" id="legacy-breakdown-card" data-card-action="scroll:breakdown-row" aria-label="Explore risk categories">
              <span class="card-cta">Explore categories →</span>
              <h3 class="card-heading">Risk by category</h3>
              <p class="card-microcopy">How each security area compares to industry benchmarks.</p>
              <div class="breakdown-inner">
                <div class="metrics-panel">
                  <ul class="category-list" id="category-list"></ul>
                </div>
                <div class="chart-box radar-box">
                  <canvas id="radar-chart" aria-label="Risk category radar"></canvas>
                </div>
              </div>
            </div>
            <div class="card breakdown-card trend-card card-interactive" id="trend-card" data-card-action="scroll:trend-card" aria-label="View score trend">
              <span class="card-cta">View trend →</span>
              <h3 class="card-heading" id="trend-card-title">Score over time</h3>
              <p class="card-microcopy" id="trend-card-hint">Run multiple scans from the same folder to compare.</p>
              <div class="chart-box trend">
                <p id="trend-note" class="trend-note" hidden></p>
                <div id="trend-chart-wrap" class="trend-chart-wrap" hidden aria-hidden="true"></div>
                <div id="trend-table-wrap" class="trend-table-wrap" hidden></div>
                <div id="trend-empty" class="trend-empty" hidden>
                  <div class="trend-empty-icon" aria-hidden="true">📈</div>
                  <h4 id="trend-empty-title">No scan history yet</h4>
                  <p id="trend-empty-text">Run <code>mcts scan</code> at least twice from the same project folder. History is stored in <code>mcts_analysis/history.json</code>.</p>
                </div>
              </div>
            </div>
          </div>
          <div class="card risk-guide-card">
            <h3 class="card-heading" id="risk-guide-title">Risk level guide</h3>
            <p class="card-microcopy" id="risk-guide-hint">Where your current score falls on the scale.</p>
            <div class="risk-guide" id="risk-guide"></div>
          </div>
        </div>

        <details class="read-guide card" id="report-guide">
          <summary class="read-guide-summary">
            <span class="read-guide-title">How to read this report</span>
            <span class="read-guide-toggle" aria-hidden="true"></span>
          </summary>
          <div class="read-guide-body">
            <p class="report-guide-lead" id="report-guide-lead"></p>
            <ol class="report-guide-steps" id="report-guide-steps"></ol>
            <div class="scores-legend" id="scores-legend" role="note" aria-label="How to read scores versus counts">
              <h4 class="scores-legend-title" id="scores-legend-title">Understanding the numbers</h4>
              <div class="scores-legend-grid" id="scores-legend-grid">
                <div class="scores-legend-block scores-legend-block--scores" id="legend-scores-block">
                  <strong>Security scores (0–100 points)</strong>
                  <p>Like a health rating: <strong>100 = best, 0 = worst</strong>. Not a percentage and not “% of tests passed.”</p>
                </div>
                <div class="scores-legend-block scores-legend-block--counts">
                  <strong>Counts (plain numbers)</strong>
                  <p>Issues, severity rows, checks run, and tools discovered are totals — how many items MCTS counted.</p>
                </div>
                <div class="scores-legend-block scores-legend-block--v2" id="legend-v2-block" hidden>
                  <strong>Absolute risk (v2)</strong>
                  <p>Sums risk from eight security factors on tool findings. <strong>Higher = worse</strong> — opposite direction from the 0–100 benchmark score.</p>
                </div>
              </div>
            </div>
          </div>
        </details>
      </section>

      <!-- Findings -->
      <section id="findings" class="page-section">
        <h2 class="section-title">Issues to Fix</h2>
        <p class="section-subtitle">Every security problem MCTS found, sorted by severity. Fix Critical and High items first.</p>
        <div class="card findings-card">
          <div class="table-toolbar">
            <div class="search-wrap">
              <input type="search" id="findings-search" placeholder="Search findings…" aria-label="Search findings">
            </div>
            <select class="filter-select" id="findings-filter" aria-label="Filter by severity">
              <option value="all">All severities</option>
              <option value="critical">Critical</option>
              <option value="high">High</option>
              <option value="medium">Medium</option>
              <option value="low">Low</option>
            </select>
          </div>
          <table class="data-table" id="findings-table">
            <thead>
              <tr>
                <th data-sort="severity">Severity</th>
                <th data-sort="title">Finding</th>
                <th data-sort="location">Location</th>
                <th data-sort="technique_id">Technique</th>
                <th data-sort="cwe_id">CWE</th>
                <th data-sort="category">Category</th>
                <th data-sort="owasp">OWASP</th>
                <th data-sort="tool">Affected Tool</th>
                <th>Confidence</th>
                <th>Remediation</th>
              </tr>
            </thead>
            <tbody id="findings-body"></tbody>
          </table>
        </div>
      </section>

      <!-- Techniques -->
      <section id="techniques" class="page-section">
        <h2 class="section-title">MCTS-T Technique Map</h2>
        <p class="section-subtitle" id="technique-map-lead">Regression technique coverage for this scan.</p>
        <div class="technique-toolbar" id="technique-toolbar" role="toolbar" aria-label="Filter techniques">
          <button type="button" class="technique-filter active" data-filter="all">All</button>
          <button type="button" class="technique-filter" data-filter="detected">Detected</button>
          <button type="button" class="technique-filter" data-filter="clear">Clear</button>
        </div>
        <div class="technique-grid technique-grid--full" id="technique-grid"></div>
      </section>

      <!-- Capabilities -->
      <section id="capabilities" class="page-section">
        <h2 class="section-title">Tool Capability Matrix</h2>
        <p class="section-subtitle" id="capability-matrix-lead">Inferred capability flags per discovered MCP tool.</p>
        <div class="capability-wrap" id="capability-matrix"></div>
      </section>

      <!-- Analyzers -->
      <section id="analyzers" class="page-section">
        <h2 class="section-title">All Security Checks</h2>
        <p class="section-subtitle">Every analyzer MCTS ran — expand any card to see what it checked, OWASP mapping, and techniques.</p>
        <p class="section-lead" id="analyzer-section-lead"></p>
        <div id="analyzer-passed-section" class="analyzer-section" hidden>
          <h3 class="subsection-title passed-title">Passed Checks</h3>
          <p class="subsection-lead">Passed = no pattern matches in this scan scope. Expand a card to see what was inspected and framework coverage.</p>
          <div class="analyzer-grid" id="analyzer-passed-grid"></div>
        </div>
        <div id="analyzer-issues-section" class="analyzer-section" hidden>
          <h3 class="subsection-title issues-title">Checks With Findings</h3>
          <div class="analyzer-grid" id="analyzer-issues-grid"></div>
        </div>
      </section>

      <!-- Attack Chains -->
      <section id="attack-chains" class="page-section">
        <h2 class="section-title">Attack Paths</h2>
        <p class="section-subtitle">How tools could be chained together for a multi-step attack (read → exfiltrate, etc.).</p>
        <div class="card card-interactive" data-card-action="goto:findings" aria-label="View findings related to attack paths">
          <span class="card-cta">View related issues →</span>
          <p style="color:var(--muted);margin:0 0 16px">Each arrow shows a possible step between tools.</p>
          <div class="graph-wrap">
            <svg id="attack-graph" role="img" aria-label="Attack chain graph"></svg>
          </div>
        </div>
      </section>

      <!-- OWASP -->
      <section id="owasp" class="page-section">
        <h2 class="section-title">OWASP Mapping</h2>
        <p class="section-subtitle">How findings map to OWASP LLM and MCP Top 10 categories.</p>

        <h3 class="owasp-subsection-title">OWASP LLM Top 10</h3>
        <p class="section-subtitle owasp-subsection-lead" id="owasp-llm-lead">
          Industry-standard categories for LLM application security.
        </p>
        <div class="owasp-grid" id="owasp-grid"></div>

        <h3 class="owasp-subsection-title">OWASP MCP Top 10</h3>
        <p class="section-subtitle owasp-subsection-lead" id="owasp-mcp-lead">
          MCP-specific risk categories — gaps mirror compliance meta-findings when analyzers did not cover a category.
        </p>
        <div class="owasp-grid" id="owasp-mcp-grid"></div>
      </section>

      <!-- Recommendations -->
      <section id="recommendations" class="page-section">
        <h2 class="section-title">How to Fix</h2>
        <p class="section-subtitle">Prioritized remediation steps — P1 is most urgent.</p>
        <div class="rec-list" id="rec-list"></div>
      </section>

      <!-- Appendix -->
      <section id="appendix" class="page-section">
        <h2 class="section-title">Raw Data</h2>
        <p class="section-subtitle">Full machine-readable scan JSON for automation and debugging.</p>
        <div class="card appendix card-interactive" data-card-action="goto:appendix" aria-label="View raw JSON data">
          <span class="card-cta">Scroll to JSON →</span>
          <h3>Raw Scan Report (JSON)</h3>
          <pre id="appendix-json"></pre>
        </div>
      </section>
    </main>
  </div>

  <div id="analyzer-modal-backdrop" class="analyzer-modal-backdrop" hidden aria-hidden="true"></div>
  <div id="analyzer-modal" class="analyzer-modal" role="dialog" aria-modal="true" aria-labelledby="analyzer-modal-title" hidden>
    <div class="analyzer-modal-dialog">
      <button type="button" class="analyzer-modal-close" id="analyzer-modal-close" aria-label="Close check details">×</button>
      <div id="analyzer-modal-content"></div>
    </div>
  </div>

  <script type="application/json" id="mcts-report-data">{{ report_json | safe }}</script>
  <script type="application/json" id="mcts-icons-data">{{ icons_json | safe }}</script>
  {{ dashboard_script | safe }}
</body>
</html>
