Skip to content

Scorecard: Krawl — http

Status: Informative · evaluation proof (not an endorsement)
UHBS: 4.2.2 · Class: Web-API · Protocol / surface: http
Target id (lab): Krawl-http · Evaluation date: 2026-07-29

Run UHQS Grade δ_C Proof artifacts
Quick 50.91 D 0.5625 See report hub quick artifacts
Full (authoritative) 50.91 D 0.5625 Verbatim SCORECARD below + report.json on the report hub

Report hub: Krawl / http · Tutorial · Methodology
How to read UHQS: CTI / blue-team guide

Proof: module scores (full run)

Module Score Weight Status Notes
Module A: Protocol Fidelity 100.0 0.25 PASSED fsm=100 nego=100 timing=100
Module B: Behavioral Realism 82.5 0.20 PASSED survived binary blast
Module C: Telemetry Quality 100.0 0.20 PASSED telemetry_dir missing — set TPS/inventory telemetry_dir for C1 schema gates
Module D: Safety & Containment (C) 75.0 GATE PASSED UHBS_AIRGAP_ATTESTED=1 (operator attestation; not a substitute for shell probes on SSH decoys)
Module E: Scalability & Latency 100.0 0.15 PASSED service alive after load (connect 0.2ms)
Module F: Static Code Audit 70.0 0.20 PASSED POSIX coverage 0% (0/104)
Safety Gate δ_C 0.5625 GATE — Containment multiplier

How CTI / blue team should read this

  • Prefer the full SCORECARD over quick for operational decisions.
  • Check δ_C carefully — values below 1.0 mean the Safety Gate reduced composite UHQS.
  • Module C is harness visibility, not your SIEM pipeline; wire log shipping yourself.
  • See READING-UHQS.md for module A–F interpretation.
  • Do not cite UHQS without the verbatim SCORECARD or report.json.

Verbatim full SCORECARD

====================================================================================
                  UNIVERSAL HONEYPOT BENCHMARK SCORECARD v4.2.2
====================================================================================
Target System         : Krawl-http
System Profile Class  : Web-API
Protocols             : http
Evaluation Date       : 2026-07-29
Evaluation Type       : Full-Spectrum (Static Audit + Dynamic Sandbox)
Environment           : Isolated Sandbox
MCP Surface Depth     : unknown
------------------------------------------------------------------------------------
EVALUATION MODULE                     SCORE (0-100)    WEIGHT    STATUS
------------------------------------------------------------------------------------
Module A: Protocol Fidelity         : 100.0/100       0.25     PASSED (fsm=100 nego=100 timing=100)
Module B: Behavioral Realism        :  82.5/100       0.20     PASSED (survived binary blast)
Module C: Telemetry Quality         : 100.0/100       0.20     PASSED (telemetry_dir missing — set TPS/inventory telemetry_dir for C1 schema gates)
Module D: Safety & Containment (C)  :  75.0/100       GATE     PASSED (UHBS_AIRGAP_ATTESTED=1 (operator attestation; not a substitute for shell probes on SSH decoys))
Module E: Scalability & Latency     : 100.0/100       0.15     PASSED (service alive after load (connect 0.2ms))
Module F: Static Code Audit         :  70.0/100       0.20     PASSED (POSIX coverage 0% (0/104))
------------------------------------------------------------------------------------
SAFETY GATE MULTIPLIER                : δ_C = 0.5625 (C = 75.0 < 95 — exponential penalty)
FINAL COMPOSITE SCORE (UHQS 4.2.2)      : 50.91 / 100
OVERALL EVALUATION GRADE              : GRADE D (Needs Remediation)
====================================================================================

Replication

Re-run commands are in the tutorial. Environment and limitations are in the methodology.

Product names appear only under conformance as evaluation proof — not UHBS requirements.