> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Scoring Integration

> Enriched event payloads, session tracking, and 4-layer score decomposition from the cloud API

<Warning>
  **Superseded by Intent-Scoped Security (2026-07-18).** This page describes a per-action cloud scoring path (local score → GNN → LLM enrichment) that is no longer the product direction: Quint does not score each action against the conversation, the GNN will not be built as described, and no enforcement decision is made by a model. It also shows tool-argument content (`data_fields_accessed`, extracted field values, cloud-side `reasoning`) leaving the machine — the current invariant is that the **cloud never sees conversation content**, only intent frames (text hash-only by default).
</Warning>

# Cloud Scoring Integration

The proxy performs **local risk scoring** first (pattern matching, keyword detection, behavior tracking), then optionally enriches the score via the **cloud scoring API** which provides graph-based analysis, GNN inference, compliance matching, and LLM-assisted reasoning.

## Scoring Flow

```mermaid theme={null}
flowchart LR
    TC["`Tool Call`"] --> LS["`Local Score`"]
    LS --> RC{"`Remote API configured?`"}
    RC -->|No| Final["`Final Score = Local`"]
    RC -->|Yes| API["`POST /events`"]
    API --> Merge["`Merge Scores`"]
    Merge --> Final2["`Final Score = max(local, remote)`"]
    LS --> |"Depth/burst penalties"| Merge
```

<Note>
  Remote scoring never downgrades the local score. The final score is always `max(local, remote)`. This ensures local safety checks are never bypassed by the cloud API.
</Note>

## Configuration

```json theme={null}
{
  "risk_api": {
    "url": "https://api.quintai.dev",
    "api_key": "sk-acme-...",
    "customer_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "enabled": true,
    "timeout_ms": 15000
  }
}
```

Remote scoring is **non-blocking** — if the cloud API times out or errors, the proxy falls back to the local score with zero impact on the tool call.

## Enriched Event Payload

The proxy sends the full `AgentEventCreate` schema to the cloud API:

```json theme={null}
{
  "event_id": "uuid",
  "customer_id": "a1b2c3d4-...",
  "action": "mcp:github:list_repos.list",
  "timestamp": "2025-03-05T10:30:00Z",
  "agent": {
    "agent_id": "anthropic:bold-amber-falcon",
    "agent_type": "claude",
    "framework": "claude-code",
    "model": "claude-sonnet-4-20250514"
  },
  "session": {
    "session_id": "sess-uuid",
    "user_id": "user-123"
  },
  "target": {
    "resource_type": "repository",
    "resource_id": "org/repo",
    "sensitivity_level": 2
  },
  "mcp_context": {
    "server_name": "github",
    "transport": "stdio",
    "is_verified": true,
    "tool_name": "list_repos"
  },
  "parameters": {"org": "acme-corp"},
  "preceding_actions": [
    "mcp:filesystem:read_file.read",
    "mcp:github:search_repos.search"
  ],
  "data_fields_accessed": [
    {"field": "email", "classification": "pii"},
    {"field": "repo_name", "classification": "internal"}
  ],
  "metadata": {
    "local_score": 25,
    "local_level": "low"
  }
}
```

### Automatic Field Extraction

The proxy automatically extracts and classifies data fields from tool call arguments:

| Classification  | Matched Patterns                                          |
| --------------- | --------------------------------------------------------- |
| `pii_sensitive` | ssn, passport, tax\_id, national\_id, drivers\_license    |
| `pii`           | email, phone, name, address, date\_of\_birth, ip\_address |
| `financial`     | credit\_card, cvv, bank\_account, iban, swift             |
| `health`        | medical, diagnosis, prescription, patient, hipaa          |
| `auth`          | password, api\_key, secret, token, private\_key           |
| `legal`         | contract, nda, legal\_hold, subpoena, litigation          |

Sensitivity levels: 0 (public) → 1 (internal) → 2 (PII) → 3 (sensitive PII/financial/health) → 4 (auth credentials).

### Target Resource Inference

The proxy infers `target.resource_type` from the MCP server name:

| Server Names                          | Resource Type   |
| ------------------------------------- | --------------- |
| postgres, mysql, sqlite, mongo, redis | `database`      |
| filesystem, fs, file                  | `file`          |
| github, gitlab, bitbucket             | `repository`    |
| slack, discord, teams                 | `channel`       |
| vault, secrets                        | `secret_store`  |
| aws, gcp, azure                       | `cloud_service` |
| s3                                    | `object_store`  |
| fetch, http                           | `external_api`  |

## Session Tracker

The proxy tracks the **last 20 actions per session** in a 30-minute sliding window, providing behavioral context to the cloud API.

```
Session key: agent's subject ID (or "default")
Max actions: 20
Window: 30 minutes
```

The session tracker also provides local behavioral signals:

| Signal               | Threshold         | Description                                                   |
| -------------------- | ----------------- | ------------------------------------------------------------- |
| Delegation burst     | 5+ actions in 10s | Rapid-fire tool calls suggest automated sub-agent spawning    |
| Action rate          | actions/second    | High rates may indicate automated scanning                    |
| Temporal correlation | 0.0-0.50          | Timing similarity between two sessions suggests shared origin |

## Action Classification

Tool calls are classified into canonical `domain:scope:verb` format:

| MCP Method       | Action Format                | Example                      |
| ---------------- | ---------------------------- | ---------------------------- |
| `tools/call`     | `mcp:{server}:{tool}.{verb}` | `mcp:github:list_repos.list` |
| `resources/read` | `mcp:{server}:resource.read` | `mcp:postgres:resource.read` |
| `prompts/get`    | `mcp:{server}:prompt.get`    | `mcp:slack:prompt.get`       |

Verbs are inferred from tool name prefixes:

| Prefix                              | Verb      |
| ----------------------------------- | --------- |
| `list`                              | `list`    |
| `get`, `read`, `fetch`, `query`     | `read`    |
| `search`, `find`                    | `search`  |
| `create`, `add`, `insert`           | `create`  |
| `update`, `edit`, `modify`, `patch` | `update`  |
| `delete`, `remove`, `destroy`       | `delete`  |
| `send`, `post`, `publish`           | `send`    |
| `execute`, `run`, `exec`            | `execute` |

In forward proxy (HTTP) mode: `http:{domain}:{method}.{path_slug}`.

## Score Response

The cloud API returns a 4-layer score decomposition:

```json theme={null}
{
  "event_id": "uuid",
  "score": 72,
  "risk_level": "high",
  "violations": ["PII access without justification"],
  "reasoning": "Agent accessed SSN field in customer database...",
  "scoring_source": "graph+gnn+llm",
  "compliance_refs": ["SOC2-CC6.1", "GDPR-Art.32"],
  "mitigations": ["Require approval for PII access", "Enable field-level encryption"],
  "behavioral_flags": ["escalation_pattern", "new_resource_access"],
  "score_decomposition": {
    "intrinsic": 45,
    "gnn": 68,
    "policy": 72,
    "temporal": 55
  },
  "gnn_score": 0.68,
  "confidence": 0.92
}
```

All enrichment fields (compliance refs, behavioral flags, score decomposition, GNN score, confidence) are persisted to the [audit log](/concepts/deployment-modes#data-privacy) for dashboard display.

## Depth & Burst Penalties

The local scoring engine applies additional penalties for nested agents and burst behavior:

| Condition                            | Penalty                | Cap |
| ------------------------------------ | ---------------------- | --- |
| Agent depth > 0                      | `depth * 5`            | 25  |
| Delegation burst (5+ actions in 10s) | `10 + (count - 5) * 2` | —   |