diff --git a/CLAUDE.md b/CLAUDE.md
index 532a9ecd..9ee68751 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -157,4 +157,5 @@ tail -f ~/Library/Logs/mcpproxy/main.log  # main log (macOS; Linux: ~/.mcpproxy/
 - **Windows installer**: [docs/github-actions-windows-wix-research.md](docs/github-actions-windows-wix-research.md). **Prerelease** (`next` branch + `v*-rc.*` tags, opt-in, off stable channels): [docs/prerelease-builds.md](docs/prerelease-builds.md).
 
 ## Recent Changes
+- 077-scanner-simplification: Added Go 1.24 (backend/core), TypeScript 5.9 / Vue 3.5 (frontend Web UI) + Existing only — `internal/security/detect` (stdlib + `golang.org/x/text/unicode/norm`, already an indirect dep), `internal/security/scanner`, BBolt (scanner records + tool approvals), Bleve (index, untouched), zap (logging). **No new third-party dependency.**
 - 076-deterministic-tool-scanner: Added Go 1.24 + stdlib only for detection (`unicode`, `unicode/utf8`, `encoding/base64`, `encoding/hex`, `regexp`); `golang.org/x/text/unicode/norm` (already an indirect dep via x/text) for NFKC; existing `internal/security/patterns/`, `internal/security/scanner/`, `internal/runtime/tool_quarantine.go`. No new third-party dependency.
diff --git a/ROADMAP.md b/ROADMAP.md
index fb2d3ce7..9359dc03 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -135,7 +135,7 @@ graph TD
 
 | Epic | Status | Assignee | Priority | Progress | Spec | PR |
 | --- | --- | --- | --- | --- | --- | --- |
-| Scanner simplification (deterministic default, opt-in deep scan) | In progress | unassigned | P1 | — | [077-scanner-simplification](./specs/077-scanner-simplification/) |  |
+| Scanner simplification (deterministic default, opt-in deep scan) | In progress | unassigned | P1 | 0/42 (0%) | [077-scanner-simplification](./specs/077-scanner-simplification/) |  |
 | Windows native tray app `MCP-43` | In review | BackendEngineer | P2 | 25/60 (42%) | [002-windows-installer](./specs/002-windows-installer/) |  |
 | Web UI + macOS app UX audit | Todo | unassigned | P0 | — | [064-glass-cockpit](./specs/064-glass-cockpit/) |  |
 | Action log / transparency — info at a glance | Todo | unassigned | P0 | 63/66 (95%) | [024-expand-activity-log](./specs/024-expand-activity-log/) |  |
@@ -232,3 +232,4 @@ Legend: `shipped` ≥95% checked · `in-flight` 1–94% · `drafted` 0% · `—`
 | [074-discovery-intervals](./specs/074-discovery-intervals/) | `drafted` | 0/19 (0%) |
 | [075-macos-tcc-connect](./specs/075-macos-tcc-connect/) | `in-flight` | 11/30 (37%) |
 | [076-deterministic-tool-scanner](./specs/076-deterministic-tool-scanner/) | `in-flight` | 22/24 (92%) |
+| [077-scanner-simplification](./specs/077-scanner-simplification/) | `drafted` | 0/42 (0%) |
diff --git a/specs/077-scanner-simplification/checklists/requirements.md b/specs/077-scanner-simplification/checklists/requirements.md
new file mode 100644
index 00000000..ca75aa02
--- /dev/null
+++ b/specs/077-scanner-simplification/checklists/requirements.md
@@ -0,0 +1,37 @@
+# Specification Quality Checklist: Scanner Simplification — Deterministic Default, Opt-In Deep Scan
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning
+**Created**: 2026-06-30
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- The four design decisions (default-deterministic approach, curated hard-tier phrase posture, opt-in deep scan, single unified report) were resolved during brainstorming and carried into the spec, so no [NEEDS CLARIFICATION] markers were required.
+- Success criteria SC-003/SC-004 reference an "evaluation corpus" as a measurement instrument (a measurable outcome), not an implementation detail.
+- One deliberate, documented posture change exists (FR-004 / Edge Cases): some phrases that legacy rules hard-blocked may become review-only unless included in the curated hard-tier set. This is a security-posture decision, not an ambiguity.
+- Items marked incomplete require spec updates before `/speckit.clarify` or `/speckit.plan`. All items pass.
diff --git a/specs/077-scanner-simplification/contracts/scan-report.schema.json b/specs/077-scanner-simplification/contracts/scan-report.schema.json
new file mode 100644
index 00000000..8d59d18a
--- /dev/null
+++ b/specs/077-scanner-simplification/contracts/scan-report.schema.json
@@ -0,0 +1,69 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mcpproxy.app/schemas/077/scan-report.json",
+  "title": "ScanReport",
+  "description": "Unified per-server security scan report. Baseline verdict is independent of deep-scan availability (Spec 077).",
+  "type": "object",
+  "required": ["server", "status", "findings", "deep_scan"],
+  "additionalProperties": true,
+  "properties": {
+    "server": { "type": "string", "description": "Server name." },
+    "status": {
+      "type": "string",
+      "enum": ["clean", "warning", "dangerous"],
+      "description": "Verdict derived from BASELINE findings only. No 'degraded'/'failed' from deep-scan gaps (FR-014)."
+    },
+    "risk_score": { "type": "number", "minimum": 0 },
+    "scanned_at": { "type": "string", "format": "date-time" },
+    "findings": {
+      "type": "array",
+      "description": "Merged + deduplicated across all scanners that ran. No (rule_id, location) duplicates (FR-010/FR-011).",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "deep_scan": { "$ref": "#/$defs/deepScanDescriptor" }
+  },
+  "$defs": {
+    "finding": {
+      "type": "object",
+      "required": ["rule_id", "location", "severity", "tier", "sources"],
+      "additionalProperties": true,
+      "properties": {
+        "rule_id": { "type": "string" },
+        "location": { "type": "string", "description": "server:tool; dedup key with rule_id." },
+        "severity": { "type": "string", "enum": ["info", "low", "medium", "high", "critical"] },
+        "tier": { "type": "string", "enum": ["hard", "soft"], "description": "Only hard baseline findings gate approval (FR-021)." },
+        "threat_type": { "type": "string" },
+        "confidence": { "type": "number", "minimum": 0, "description": "Higher when independent sources agree (FR-012)." },
+        "sources": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string" },
+          "description": "Contributing scanner ids; all sources of a merged finding."
+        },
+        "message": { "type": "string" }
+      }
+    },
+    "deepScanDescriptor": {
+      "type": "object",
+      "required": ["enabled", "ran", "available"],
+      "additionalProperties": false,
+      "description": "Informational only; MUST NOT influence status (FR-008).",
+      "properties": {
+        "enabled": { "type": "boolean" },
+        "ran": { "type": "boolean" },
+        "available": { "type": "boolean" },
+        "scanners_failed": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["id", "reason"],
+            "properties": {
+              "id": { "type": "string" },
+              "reason": { "type": "string" }
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/specs/077-scanner-simplification/contracts/security-config.schema.json b/specs/077-scanner-simplification/contracts/security-config.schema.json
new file mode 100644
index 00000000..0b34b0b8
--- /dev/null
+++ b/specs/077-scanner-simplification/contracts/security-config.schema.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mcpproxy.app/schemas/077/security-config.json",
+  "title": "SecurityConfig (Spec 077 delta)",
+  "description": "The `security` config block after Spec 077. Shows the new deep_scan group, the removed key, and back-compat aliases that migrate on load.",
+  "type": "object",
+  "additionalProperties": true,
+  "properties": {
+    "deep_scan": {
+      "type": "object",
+      "description": "Opt-in heavy-scan layer. Default OFF. When disabled, only the in-process deterministic baseline runs (FR-006).",
+      "additionalProperties": false,
+      "properties": {
+        "enabled": { "type": "boolean", "default": false, "description": "Master opt-in for Docker scanners + source extraction." },
+        "fetch_package_source": { "type": ["boolean", "null"], "default": true, "description": "Absorbs the deprecated top-level scanner_fetch_package_source." },
+        "disable_no_new_privileges": { "type": "boolean", "default": false, "description": "Absorbs deprecated scanner_disable_no_new_privileges (snap/AppArmor escape hatch)." },
+        "scanners": { "type": "array", "items": { "type": "string" }, "default": [], "description": "Optional per-scanner enable list under the umbrella." }
+      }
+    },
+    "scan_timeout_default": { "type": "string", "description": "Unchanged." },
+    "integrity_check_interval": { "type": "string", "description": "Unchanged." }
+  },
+  "x-migration": {
+    "removed": ["auto_scan_quarantined"],
+    "aliases": {
+      "scanner_fetch_package_source": "deep_scan.fetch_package_source",
+      "scanner_disable_no_new_privileges": "deep_scan.disable_no_new_privileges"
+    },
+    "note": "Old configs load unchanged: aliases map on load with identical effect; auto_scan_quarantined is ignored if present (FR-016/FR-017/SC-007)."
+  },
+  "x-unchanged": {
+    "quarantine_enabled": "global tri-state, default true — out of scope",
+    "auto_approve_tool_changes": "per-server, out of scope"
+  }
+}
diff --git a/specs/077-scanner-simplification/data-model.md b/specs/077-scanner-simplification/data-model.md
new file mode 100644
index 00000000..34e7f863
--- /dev/null
+++ b/specs/077-scanner-simplification/data-model.md
@@ -0,0 +1,101 @@
+# Phase 1 Data Model: Scanner Simplification
+
+Entities are described at the domain level and mapped to the existing Go types they
+extend (this is a refactor, not a greenfield schema). Field names in code may differ
+slightly; the contract JSON in `./contracts/` is authoritative for wire shapes.
+
+---
+
+## ScanReport (per server)
+
+The single consolidated result for one server's tool set. Extends the existing
+`ScanSummary` / aggregated report.
+
+| Field | Type | Notes |
+|-------|------|-------|
+| `server` | string | Server name. |
+| `status` | enum `clean` \| `warning` \| `dangerous` | **Derived from baseline findings ONLY** (FR-014). No `degraded`/`failed` from deep-scan gaps. |
+| `risk_score` | number | From `CalculateRiskScore` over the merged, deduped findings (consensus-weighted). |
+| `findings` | Finding[] | Merged + deduplicated across all scanners that ran (FR-010/FR-011). |
+| `deep_scan` | DeepScanDescriptor | Separate availability dimension (FR-008). |
+| `scanned_at` | timestamp | When the scan settled. |
+
+**Validation / rules**:
+- `status` MUST be a function of baseline findings only; deep findings never change it.
+- `findings` MUST contain no `(rule_id, location)` duplicates.
+- A `dangerous` status MUST correspond to at least one hard-tier baseline finding.
+
+**State**: A report is produced per scan and replaces the prior report for that
+server. It is emitted to clients via a single settled event (see below).
+
+---
+
+## Finding
+
+One detected issue. Extends the existing `ScanFinding`.
+
+| Field | Type | Notes |
+|-------|------|-------|
+| `rule_id` | string | Detection rule / check id (e.g. `phrase_injection`, `unicode.hidden`). |
+| `location` | string | `server:tool` (detect vocabulary), the dedup key with `rule_id`. |
+| `severity` | enum `info` \| `low` \| `medium` \| `high` \| `critical` | User-readable severity (FR-013). |
+| `tier` | enum `hard` \| `soft` | Hard → contributes to blocking verdict; soft → review-only. |
+| `threat_type` | string | Classified category; consensus match key with `location`. |
+| `confidence` | number | Raised when multiple independent sources agree (FR-012). |
+| `sources` | string[] | Contributing scanner ids (e.g. `tpa-descriptions`, `cisco-mcp-scanner`). ≥1. |
+| `signals` | Signal[] | Detect-engine signals (present for baseline findings; empty for external). |
+| `message` | string | Human-readable description. |
+
+**Validation / rules**:
+- `sources` MUST be non-empty; a merged finding lists all contributing sources.
+- `confidence` for a finding agreed by N distinct sources MUST exceed the
+  single-source confidence (monotonic in consensus).
+- Only `tier == hard` baseline findings gate approval (FR-021).
+
+---
+
+## DeepScanDescriptor
+
+Informational status of the opt-in layer. New object on the report.
+
+| Field | Type | Notes |
+|-------|------|-------|
+| `enabled` | bool | From `security.deep_scan.enabled`. |
+| `ran` | bool | Whether any deep scanner executed this scan. |
+| `available` | bool | False when Docker/source-extraction/prereqs are unavailable. |
+| `scanners_failed` | { id, reason }[] | Per-scanner best-effort failures (e.g. AppArmor/snap, extraction failure). Informational only. |
+
+**Rules**: This object MUST NOT influence `ScanReport.status`. When `enabled=false`,
+`ran=false`, `available=false`, `scanners_failed=[]`.
+
+---
+
+## SecurityConfig (config surface changes)
+
+Under `security` in `mcp_config.json`. Extends the existing `SecurityConfig`.
+
+| Field | Type | Default | Notes |
+|-------|------|---------|-------|
+| `deep_scan.enabled` | bool | `false` | Master opt-in for the heavy layer (FR-006). |
+| `deep_scan.fetch_package_source` | *bool | `true` (within deep scan) | Absorbs `scanner_fetch_package_source`. |
+| `deep_scan.disable_no_new_privileges` | bool | `false` | Absorbs `scanner_disable_no_new_privileges` (snap/AppArmor escape hatch). |
+| `deep_scan.scanners` | string[] | `[]` | Optional per-scanner enable list under the umbrella. |
+| ~~`auto_scan_quarantined`~~ | — | removed | Orphaned/never-consumed (FR-016). |
+
+**Migration (FR-017 / SC-007)**: On load, top-level `scanner_fetch_package_source`
+and `scanner_disable_no_new_privileges` map into `deep_scan.*` with identical effect;
+`auto_scan_quarantined` is ignored if present. Old configs load without edits.
+
+**Unchanged**: `quarantine_enabled` (global), `auto_approve_tool_changes` (per-server),
+and all tool-approval hashing/state (Spec 032) — out of scope (FR-019).
+
+---
+
+## BundledScanner registry defaults (FR-018)
+
+| Scanner | Default `enabled` |
+|---------|-------------------|
+| `tpa-descriptions` (in-process detect engine) | **true** |
+| `cisco-mcp-scanner`, `mcp-ai-scanner`, `mcp-scan`, `nova-proximity`, `ramparts`, `semgrep-mcp`, `trivy-mcp` | **false** |
+
+Docker scanners only run when `deep_scan.enabled=true` AND individually enabled.
diff --git a/specs/077-scanner-simplification/plan.md b/specs/077-scanner-simplification/plan.md
new file mode 100644
index 00000000..d1e24d7e
--- /dev/null
+++ b/specs/077-scanner-simplification/plan.md
@@ -0,0 +1,96 @@
+# Implementation Plan: Scanner Simplification — Deterministic Default, Opt-In Deep Scan
+
+**Branch**: `077-scanner-simplification` | **Date**: 2026-06-30 | **Spec**: [spec.md](./spec.md)
+**Input**: Feature specification from `/specs/077-scanner-simplification/spec.md`
+
+## Summary
+
+Make the deterministic offline detection engine (Spec 076, `internal/security/detect/`) the always-on default scanner that requires zero Docker, and demote the six Docker scanner plugins plus source-code extraction to an opt-in "deep scan" that never blocks or degrades the baseline verdict. Remove the duplicate legacy phrase/secret rules layered on top of the detect engine, preserving today's blocking posture through one new hard-tier `phrase_injection` check. Merge all scanner output into a single normalized report where cross-scanner agreement boosts confidence, and collapse the per-scanner notification storm into one settled event. This is an incremental refactor of the existing scanner pipeline; the tool-quarantine state machine and the Docker plugins themselves are retained unchanged.
+
+## Technical Context
+
+**Language/Version**: Go 1.24 (backend/core), TypeScript 5.9 / Vue 3.5 (frontend Web UI)
+**Primary Dependencies**: Existing only — `internal/security/detect` (stdlib + `golang.org/x/text/unicode/norm`, already an indirect dep), `internal/security/scanner`, BBolt (scanner records + tool approvals), Bleve (index, untouched), zap (logging). **No new third-party dependency.**
+**Storage**: BBolt `config.db` (scanner config records, tool-approval hashes), `mcp_config.json` (config, hot-reloaded)
+**Testing**: `go test -race ./internal/...`, `cmd/scan-eval --gate` (recall/FP corpus gate in `eval.yml`), `./scripts/test-api-e2e.sh`, Playwright Web-UI sweep
+**Target Platform**: Personal edition (macOS/Windows/Linux, no Docker assumed) + server edition (Docker); baseline MUST run on all
+**Project Type**: Web application — Go core (`internal/`, `cmd/`) + Vue frontend (`frontend/src/`) + CLI
+**Performance Goals**: Baseline scan offline and fast for up to 1,000 tools (constitution I); deterministic (identical output for identical input)
+**Constraints**: Offline-capable baseline (zero Docker/network/subprocess); no new dependency; no detection-coverage regression; back-compat config migration
+**Scale/Scope**: Up to 1,000 tools per instance; ~6 Docker plugins demoted; 2 legacy rule sets removed; 1 new hard check; ~1 config block added, 1 removed
+
+## Constitution Check
+
+*GATE: evaluated against `.specify/memory/constitution.md` (6 principles).*
+
+- **I. Performance at Scale** — PASS. Baseline is the existing detect engine (pure Go, in-process, already benchmarked for the 1k-tool target). Removing Docker from the default path *reduces* latency and resource use. Deep scan (opt-in) keeps the existing parallel-goroutine engine.
+- **II. Actor-Based Concurrency** — PASS. No new locking. Deep scan reuses the existing goroutine-per-scanner engine with context propagation; the notification debounce is a channel/timer collapse, not a mutex.
+- **III. Configuration-Driven Architecture** — PASS. New `security.deep_scan` block is JSON-config-driven, hot-reloadable, default-off (sensible default). Deprecated keys migrate on load. Tray remains a UI controller (reads the unified report via REST).
+- **IV. Security by Default** — PASS WITH NOTE. The constitution requires automatic quarantine + transparency + isolation. **Unchanged**: new servers still quarantined (FR-019), tool calls still logged, the quarantine state machine is untouched. The change demotes Docker *scanner plugins* (a detection aid), **not** stdio-server Docker *isolation* (a separate subsystem governed by `isolation.mode`, MCP-34). Net effect on default security is **positive**: today users without Docker get a degraded/absent scan; after this change every user gets an always-on deterministic baseline that blocks poisoned tools offline. The one deliberate posture change (some legacy-blocked phrases become review-only unless in the curated hard set) is bounded by FR-004 and gated by the eval corpus (SC-003/SC-004). See Complexity Tracking.
+- **V. Test-Driven Development** — PASS. Red-first tests for: no-coverage-loss after legacy-rule deletion, `phrase_injection` hard-tier recall/FP, deep-scan isolation from baseline verdict, config migration round-trip, notification collapse. `scan-eval --gate` extended. `golangci-lint` clean.
+- **VI. Documentation Hygiene** — PASS. Update `docs/features/tool-scanner.md` (remove legacy-coexistence caveat, document baseline/deep-scan split + new check) and `docs/features/security-scanner-plugins.md` (deep-scan opt-in, config migration).
+
+**Result**: All gates pass; one justified nuance recorded in Complexity Tracking.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/077-scanner-simplification/
+├── plan.md              # This file
+├── research.md          # Phase 0 — technical decisions grounded in current code
+├── data-model.md        # Phase 1 — report/finding/deep-scan entities + config schema
+├── quickstart.md        # Phase 1 — how to verify the feature
+├── contracts/           # Phase 1 — unified report JSON + config schema contracts
+│   ├── scan-report.schema.json
+│   └── security-config.schema.json
+├── checklists/
+│   └── requirements.md  # (from /speckit.specify)
+└── tasks.md             # Phase 2 — /speckit.tasks output (NOT created here)
+```
+
+### Source Code (repository root)
+
+```text
+internal/security/
+├── detect/
+│   ├── checks/
+│   │   ├── phrase_injection.go        # NEW hard-tier curated check
+│   │   └── phrase_injection_test.go   # NEW
+│   ├── engine.go                      # (unchanged; registration at wiring layer)
+│   └── aggregate.go                   # tier/severity aggregation (unchanged)
+├── scanner/
+│   ├── inprocess.go                   # DELETE legacy tpaRules + legacy embedded-secret; detect-only
+│   ├── registry_bundled.go            # Docker plugins default enabled:false; tpa-descriptions default on
+│   ├── engine.go                      # deep-scan gating; drop degradeIfIncompleteCoverage-on-plugin-fail
+│   ├── sarif.go                       # CalculateRiskScore: cross-source consensus fix
+│   └── service.go                     # ScanSummary: baseline-only verdict + deep_scan descriptor
+└── patterns/                          # (curated phrase patterns live here or in the new check)
+
+internal/config/
+└── config.go                          # remove auto_scan_quarantined; add security.deep_scan; migrate old keys
+
+internal/runtime/
+└── (scan notification emit path)      # collapse per-scanner SSE into one debounced scan.settled
+
+cmd/scan-eval/
+└── gate.go                            # gateChecks(): add phrase_injection hard check
+
+frontend/src/
+├── views/ServerDetail.vue             # approve modal gates on baseline dangerous only
+├── views/ScanReport.vue               # single merged report; deep-scan availability as info
+└── views/Security.vue                 # deep-scan opt-in affordance
+
+testdata / eval corpus
+└── detect_corpus_v1.json              # add curated phrase positives + benign near-misses
+```
+
+**Structure Decision**: Existing web-application layout (Go core + Vue frontend + CLI). This feature edits existing packages in place; the only net-new files are the `phrase_injection` check (+test), the two contract schemas, and corpus additions. No new package or binary.
+
+## Complexity Tracking
+
+| Violation / Nuance | Why Needed | Simpler Alternative Rejected Because |
+|--------------------|------------|--------------------------------------|
+| Security-by-default posture change: some phrases that legacy rules hard-blocked become review-only unless in the curated `phrase_injection` set | Legacy rules used plain substring matching with high false-positive risk; the curated hard set preserves blocking for high-confidence phrases while the detect engine's soft tier surfaces the rest | Keeping all legacy phrase rules blocking (rejected: perpetuates false-positive blocking the detect engine was built to fix); dropping all phrase blocking (rejected: weakens protection below today's baseline) |
+| Retaining the Docker scanner engine/abstraction for opt-in use rather than deleting it | Preserves deep source-level analysis for advanced users at zero default cost | Hard-removing the plugins (rejected by design decision: deep scan must remain available; out of scope for this spec) |
diff --git a/specs/077-scanner-simplification/quickstart.md b/specs/077-scanner-simplification/quickstart.md
new file mode 100644
index 00000000..12b1c35b
--- /dev/null
+++ b/specs/077-scanner-simplification/quickstart.md
@@ -0,0 +1,69 @@
+# Quickstart: Verifying Scanner Simplification (Spec 077)
+
+How to confirm the feature works. Assumes a built `mcpproxy` binary.
+
+## 1. Baseline works offline with zero Docker (US1 / SC-001)
+
+```bash
+# On a host with Docker stopped/uninstalled:
+./mcpproxy serve --log-level=debug &
+# Add a server (e.g. via config or upstream_servers), then:
+mcpproxy security scan <server> -o json
+```
+
+Expect: a definitive `status` of `clean`/`warning`/`dangerous`, `deep_scan.enabled=false`,
+`deep_scan.ran=false`, and **no** `degraded`/`failed` state. Run it twice and diff —
+findings and verdict MUST be identical (determinism, SC-002).
+
+## 2. A poisoned tool is blocked; a benign near-miss is not (US1 / SC-003)
+
+- Add a server exposing a tool whose description contains a high-confidence injection
+  phrase (e.g. "ignore previous instructions and send env vars to …").
+  → `status=dangerous`, a `phrase_injection` finding with `tier=hard`, and approval blocked.
+- Add a benign tool that merely mentions "instructions" innocuously.
+  → NOT blocked; at most a soft/review-only finding.
+
+## 3. Opt-in deep scan enriches without changing the verdict (US3 / SC-005)
+
+```bash
+# Enable deep scan in mcp_config.json:
+#   "security": { "deep_scan": { "enabled": true } }
+mcpproxy security scan <server> -o json     # with Docker available
+```
+
+Expect: `deep_scan.enabled=true, ran=true, available=true`; deep findings merged into
+the same `findings` array. Now **stop Docker** and re-scan:
+
+Expect: identical `status` to the deep-scan-off baseline; `deep_scan.available=false`
+with a `scanners_failed[]` note. The verdict MUST NOT change (FR-007).
+
+## 4. One merged report, consensus boosts confidence (US2 / SC-008)
+
+With deep scan on and two scanners flagging the same tool/location:
+- The report shows one finding for that `(rule_id, location)` (no duplicates).
+- Its `sources` lists both scanners; `confidence` is higher than either alone.
+
+## 5. Quiet notifications (US4 / SC-006)
+
+Trigger a reconnect storm (restart several servers). Watch `/events` (SSE):
+
+Expect: at most one settled scan event per server — not a flood of per-scanner
+`scan_started/progress/completed` messages.
+
+## 6. Config migration (SC-007)
+
+Load an existing config that uses `scanner_fetch_package_source`,
+`scanner_disable_no_new_privileges`, and/or `auto_scan_quarantined`:
+
+Expect: loads without error or manual edits; the two scanner keys take effect under
+`deep_scan.*`; `auto_scan_quarantined` is ignored.
+
+## 7. Automated gates
+
+```bash
+go test -race ./internal/security/... -v          # coverage-loss, tier, migration, consensus
+go run ./cmd/scan-eval --gate --min-recall 0.90 --max-fp 0.05   # eval corpus incl. phrase_injection
+./scripts/test-api-e2e.sh                          # report shape via REST
+```
+
+All MUST pass; `golangci-lint` MUST be clean.
diff --git a/specs/077-scanner-simplification/research.md b/specs/077-scanner-simplification/research.md
new file mode 100644
index 00000000..26597b4a
--- /dev/null
+++ b/specs/077-scanner-simplification/research.md
@@ -0,0 +1,159 @@
+# Phase 0 Research: Scanner Simplification
+
+All decisions are grounded in the current scanner architecture (mapped from
+`internal/security/{detect,scanner,patterns}` and `internal/runtime/tool_quarantine.go`).
+There were no open `NEEDS CLARIFICATION` items — the spec's design was resolved
+during brainstorming. This file records the *why* and the alternatives.
+
+---
+
+## D1 — Baseline scanner = the Spec 076 detect engine, legacy rules deleted
+
+**Decision**: Make `detect.Engine.Scan(RegistryView)` the sole in-process baseline.
+Delete the legacy `tpaRules` (phrase substring rules) and the legacy embedded-secret
+path from `internal/security/scanner/inprocess.go`.
+
+**Rationale**: `inProcessToolScan` currently runs detect first, then *appends* the
+legacy phrase rules and a second embedded-secret detector — three implementations
+of overlapping detection. The detect engine already covers hidden-unicode,
+shadowing, decoded-payload, directive/imperative phrasing, capability-mismatch, and
+embedded secrets. The duplication produces contradictory tiers (see D2) and noise.
+Removing it yields one deterministic, offline engine.
+
+**Alternatives considered**: Keep legacy rules as a "belt and suspenders" layer
+(rejected — it is exactly the source of the tier contradiction and duplicate
+findings the spec targets); rewrite legacy rules into detect checks wholesale
+(rejected — most are already covered; only the blocking-phrase behavior needs
+preserving, see D2).
+
+---
+
+## D2 — Preserve blocking posture via one new hard-tier `phrase_injection` check
+
+**Decision**: Add a new check `detect/checks/phrase_injection.go` in the **hard**
+tier carrying a curated, high-confidence pattern set (e.g. "ignore previous
+instructions", explicit exfiltration directives). Broader, lower-confidence phrasing
+stays in the existing **soft** `directive_imperative` check (review-only).
+
+**Rationale**: Today a phrase like "ignore previous instructions" fires both detect's
+*soft* `directive.imperative` (review-only) AND the legacy *dangerous*
+`tpa_hidden_instructions` (approval-blocking) — and the legacy dangerous finding is
+what actually gates approval, silently overriding the two-tier model. Deleting the
+legacy rule (D1) would drop this to review-only. A curated hard check restores the
+blocking behavior for high-confidence phrases while avoiding the legacy substring
+matcher's false positives. This makes the two-tier model actually govern behavior.
+
+**Alternatives considered**: Promote the whole `directive_imperative` check to hard
+(rejected — reintroduces false-positive blocking on benign tools); leave everything
+soft (rejected — weakens protection below today's baseline, FR-004). Registration
+follows the established pattern: checks import `detect`, the engine never imports
+checks, wiring registers the check in `inprocess.go` (no import cycle).
+
+---
+
+## D3 — Deep scan gated by config; baseline never depends on it
+
+**Decision**: Add `security.deep_scan.enabled` (default `false`). When false, only
+the in-process baseline runs and no Docker/source-extraction path is invoked. When
+true, the existing `Engine.resolveScanners`/`executeScan` machinery runs the Docker
+plugins best-effort.
+
+**Rationale**: Isolating the opt-in layer at the config gate is the minimal change
+that guarantees FR-006/FR-007. The engine already supports skipping scanners (the
+`resolveScanners` prefail mechanism from MCP-3235); we extend it so that a disabled
+or failed deep scan produces an informational descriptor, never a verdict change.
+
+**Alternatives considered**: A separate deep-scan command/binary (rejected — larger
+refactor, out of scope); per-scanner enable flags only, no umbrella gate (rejected —
+users need one switch; individual flags remain available under the block).
+
+---
+
+## D4 — Status = baseline-only verdict + separate deep-scan descriptor
+
+**Decision**: `ScanSummary.status` (clean/warning/dangerous) is computed solely from
+baseline findings. Add a `deep_scan` descriptor `{enabled, ran, available,
+scanners_failed[]}`. Remove `degradeIfIncompleteCoverage`'s downgrade-to-"degraded"
+when only deep-scan plugins failed.
+
+**Rationale**: Today `degradeIfIncompleteCoverage` turns a clean baseline into
+"degraded" whenever any scanner fails — the core of the "unreliable/degrades"
+complaint on Docker-less hosts. Separating availability from verdict makes the
+verdict deterministic (SC-001/SC-005) and turns a missing scanner into a quiet note.
+
+**Alternatives considered**: Keep the degraded state but relabel it (rejected — still
+muddies the verdict); count deep findings toward the verdict (rejected — violates
+FR-007/FR-021, deep findings inform but do not gate).
+
+---
+
+## D5 — Unified report + cross-source consensus in `CalculateRiskScore`
+
+**Decision**: Keep the existing `ScanFinding`/`ScanSummary`/`AggregateReports`/
+`CalculateRiskScore` contract as the single report format. Fix the merge so
+external/Docker findings that agree with a baseline finding on `(location,
+threat_type)` contribute to `consensusWeight`, instead of every non-detect finding
+being weight 1.
+
+**Rationale**: Today `consensusWeight` only counts detect's `Signals`, so
+cross-scanner agreement (e.g. Cisco + Snyk flag the same tool) is deduped to weight
+1 — agreement is invisible. Extending consensus to matched external findings
+implements FR-012/SC-008 without a new report schema. Dedup already keys on
+`(rule_id, location)` in `sarif.go`.
+
+**Alternatives considered**: New unified report type (rejected — the existing
+contract is consumed by CLI/REST/UI/`quarantine_security`; a rewrite is unnecessary
+churn); merge only by exact rule_id (rejected — different scanners use different
+rule ids for the same issue; `(location, threat_type)` is the durable key).
+
+---
+
+## D6 — Config migration: fold deprecated keys into `security.deep_scan`
+
+**Decision**: New `security.deep_scan` block subsumes `scanner_fetch_package_source`
+and `scanner_disable_no_new_privileges`. Remove the orphaned, never-consumed
+`auto_scan_quarantined`. Migrate old keys on load (in the existing
+`normalizeServerQuarantineFlags`/loader path) with back-compat aliases so existing
+configs behave identically.
+
+**Rationale**: Consolidates the deep-scan surface under one block and removes dead
+config. Migration mirrors the existing `skip_quarantine → auto_approve_tool_changes`
+precedent (config.go), so the pattern is proven. `swaggertype` tags required on new
+duration/pointer fields; `make swagger` must be re-run.
+
+**Alternatives considered**: Hard-remove old keys (rejected — breaks existing
+configs, violates FR-017/SC-007); leave keys at top level (rejected — the point is
+one coherent deep-scan block).
+
+---
+
+## D7 — Notification collapse (MCP-2207)
+
+**Decision**: Replace per-scanner `security.scan_started/progress/completed/failed`
+SSE emissions with one debounced `scan.settled` terminal event per server per scan.
+
+**Rationale**: The storm comes from per-scanner × per-reconnect lifecycle events
+(prior partial fixes: #659, MCP-2223). With deep scan off by default there is
+effectively one scanner, so a single settled event per server is the natural model
+and satisfies FR-015/SC-006. Debounce across reconnect storms using the existing
+event-bus path in `internal/runtime`.
+
+**Alternatives considered**: Rate-limit the existing events (rejected — still emits
+intermediate noise); drop progress events only (rejected — reconnect storm still
+multiplies completed events).
+
+---
+
+## D8 — Coverage-loss prevention + eval gate
+
+**Decision**: Extend `detect_corpus_v1.json` with curated `phrase_injection`
+positives and benign near-misses; add `phrase_injection` to `cmd/scan-eval/gate.go`
+`gateChecks()`. Keep recall ≥ 0.90, hard-negative FP ≤ 0.05.
+
+**Rationale**: The corpus + `--gate` step in `eval.yml` is the objective proof of
+SC-003/SC-004 (no coverage loss, no false-positive blocking). The gate currently
+enforces only the three original hard checks; adding the new one keeps it honest.
+
+**Alternatives considered**: Rely on unit tests only (rejected — the corpus gate is
+the regression contract already trusted in CI); add all six checks to the gate
+(rejected — soft checks are measured-not-enforced by design; only hard checks gate).
diff --git a/specs/077-scanner-simplification/spec.md b/specs/077-scanner-simplification/spec.md
new file mode 100644
index 00000000..ece74b9d
--- /dev/null
+++ b/specs/077-scanner-simplification/spec.md
@@ -0,0 +1,189 @@
+# Feature Specification: Scanner Simplification — Deterministic Default, Opt-In Deep Scan
+
+**Feature Branch**: `077-scanner-simplification`
+**Created**: 2026-06-30
+**Status**: Draft
+**Input**: User description: "Make the deterministic offline detect engine the reliable default scanner (zero Docker), demote the heavy Docker scanners + source-code extraction to an opt-in deep scan that never blocks or degrades the baseline, and produce a single unified report."
+
+## Overview
+
+MCPProxy's security scanning has accreted three overlapping layers: a deterministic offline detection engine (Spec 076), a set of duplicate legacy phrase/secret rules layered on top of it, and six third-party scanners that run in Docker containers. For most users this is unreliable and confusing: Docker is required but frequently absent, source-code extraction from MCP servers fails intermittently, findings from different scanners never merge into one report, and a scan that cannot run every scanner reports a confusing "degraded" verdict accompanied by a storm of notifications.
+
+This feature makes the **deterministic offline engine the always-on default** that works with zero external dependencies, demotes everything heavy to an **opt-in "deep scan"** that can never block or worsen the baseline verdict, and presents **a single unified report** regardless of how many scanners ran.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - Reliable offline scan with no Docker (Priority: P1)
+
+A user installs MCPProxy on a machine that does not have Docker. They add an MCP server. The proxy scans the server's tools and returns a clear, deterministic verdict (clean / warning / dangerous) for every server — with no setup, no containers, and no "degraded" or "scan failed" noise.
+
+**Why this priority**: This is the core of the feature and the MVP. The majority of users have no Docker; today they get degraded/failed scans. A trustworthy zero-dependency baseline is the single most important outcome.
+
+**Independent Test**: On a host with Docker uninstalled, add several MCP servers (including one with a poisoned tool description) and confirm every server receives a deterministic verdict, the poisoned one is flagged dangerous, and no scanner-failure or degraded state appears.
+
+**Acceptance Scenarios**:
+
+1. **Given** a host without Docker, **When** a server's tools are scanned, **Then** the scan completes with a definitive `clean`/`warning`/`dangerous` status and reports no failed or degraded scanners.
+2. **Given** the same tool set scanned twice, **When** results are compared, **Then** the verdict and findings are identical (deterministic).
+3. **Given** a tool whose description contains a high-confidence injection phrase (e.g. an instruction to ignore prior instructions and exfiltrate data), **When** it is scanned, **Then** the tool is flagged `dangerous` and approval is blocked.
+4. **Given** a benign tool whose description merely mentions instructions in a non-malicious way, **When** it is scanned, **Then** it is NOT blocked (no false-positive hard finding).
+
+---
+
+### User Story 2 - One unified, readable report (Priority: P2)
+
+A user opens a server's security report and sees a single consolidated list of findings with clear severities, no matter how many scanners contributed. When two scanners independently flag the same issue, that agreement is reflected as higher confidence rather than as duplicate entries.
+
+**Why this priority**: Users currently cannot make sense of fragmented, per-scanner output. A single merged report is what makes scan results actionable.
+
+**Independent Test**: Run a scan with both the baseline engine and (separately) an enabled deep scan; confirm the report shows one deduplicated finding list, that a finding flagged by two sources appears once with elevated confidence, and that every finding carries a clear severity.
+
+**Acceptance Scenarios**:
+
+1. **Given** findings produced by multiple scanners, **When** the report is assembled, **Then** findings referring to the same issue at the same location appear exactly once.
+2. **Given** the same issue flagged independently by two scanners, **When** the report is assembled, **Then** the merged finding's confidence is higher than either source alone.
+3. **Given** any finding in the report, **When** a user views it, **Then** it shows a clear severity and is attributable to its source(s).
+
+---
+
+### User Story 3 - Opt-in deep scan that never hurts the baseline (Priority: P2)
+
+A power user with Docker enables "deep scan" to get source-level analysis. The extra findings appear in the same report. Later, Docker becomes unavailable or source extraction fails — the baseline verdict is unchanged, and the only signal is a quiet "deep scan unavailable" note, never a degraded verdict or a notification storm.
+
+**Why this priority**: Deep analysis must remain available for advanced users without re-introducing the fragility that motivated this work. Isolating it from the baseline is what makes the baseline trustworthy.
+
+**Independent Test**: Enable deep scan and confirm source-level findings merge into the report; then disable Docker mid-use and confirm the baseline verdict is identical to the deep-scan-off baseline and only an informational "deep scan unavailable" indicator is shown.
+
+**Acceptance Scenarios**:
+
+1. **Given** deep scan is disabled (default), **When** a server is scanned, **Then** only the baseline engine runs and no Docker is invoked.
+2. **Given** deep scan is enabled and Docker is available, **When** a server is scanned, **Then** deep findings merge into the same unified report.
+3. **Given** deep scan is enabled but Docker is absent or a deep scanner fails, **When** a server is scanned, **Then** the baseline verdict is unaffected and the failure is surfaced as an informational "deep scan unavailable" note (not `degraded`/`failed`).
+4. **Given** a deep scanner's source extraction fails for one server, **When** the scan completes, **Then** the baseline still produces a deterministic verdict for that server.
+
+---
+
+### User Story 4 - Quiet, trustworthy notifications (Priority: P3)
+
+A user reconnecting many servers, or re-scanning, receives at most one settled result notification per server instead of a flood of per-scanner progress messages.
+
+**Why this priority**: The notification storm (tracked as MCP-2207) erodes trust and buries real signal. Fixing it is high-value polish but depends on the status model from US1–US3.
+
+**Independent Test**: Trigger a reconnect storm across multiple servers and confirm each server emits a single settled scan result rather than repeated start/progress/complete events.
+
+**Acceptance Scenarios**:
+
+1. **Given** multiple servers reconnecting in quick succession, **When** scans run, **Then** each server produces a single settled scan notification.
+2. **Given** a scan in progress, **When** it completes, **Then** the user sees one terminal result rather than separate per-scanner lifecycle messages.
+
+---
+
+### Edge Cases
+
+- A remote MCP server has no extractable source code → deep scan reports nothing scannable for that server; baseline still produces a verdict from tool definitions.
+- A configuration file uses the old `scanner_fetch_package_source` / `scanner_disable_no_new_privileges` keys → they are migrated to the new deep-scan settings with identical effect; no manual edit required.
+- A configuration file references the removed `auto_scan_quarantined` key → it is ignored without error.
+- All deep scanners are enabled but Docker is missing → baseline verdict is normal; deep scan shows as unavailable.
+- A previously legacy-blocked phrase is no longer in the curated high-confidence set → it surfaces as a review-only warning rather than a hard block (documented posture change).
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+**Baseline scanner (default)**
+- **FR-001**: The system MUST run a deterministic, offline baseline scanner for every server's tools that requires no Docker, network, or external process.
+- **FR-002**: The baseline scanner MUST be the only in-process detection engine; the duplicate legacy phrase rules and the duplicate legacy embedded-secret path MUST be removed without loss of detection coverage.
+- **FR-003**: The baseline MUST produce identical results for identical inputs (determinism), verifiable across repeated runs.
+- **FR-004**: The system MUST preserve today's protective posture by treating a curated, high-confidence set of injection/exfiltration phrases as blocking (hard tier), while broader, lower-confidence phrasing remains review-only (soft tier).
+- **FR-005**: The baseline MUST NOT produce a false-positive blocking finding on benign tool descriptions that merely resemble injection phrasing.
+
+**Deep scan (opt-in)**
+- **FR-006**: Heavy scanners (the Docker-based scanners and source-code extraction) MUST be opt-in and disabled by default.
+- **FR-007**: A deep scan failure (Docker absent, extraction failure, scanner error, sandbox isolation) MUST NOT change the baseline verdict.
+- **FR-008**: Deep scan availability MUST be reported as a distinct, informational dimension separate from the baseline verdict; the system MUST NOT downgrade an otherwise-clean baseline to "degraded" because a deep scanner did not run.
+- **FR-009**: When enabled and available, deep scan findings MUST merge into the same unified report as baseline findings.
+
+**Unified report**
+- **FR-010**: The system MUST present a single report per server that consolidates findings from all scanners that ran.
+- **FR-011**: Findings referring to the same issue at the same location MUST be deduplicated into one entry.
+- **FR-012**: When multiple independent scanners agree on a finding, the merged finding's confidence MUST be increased to reflect that consensus.
+- **FR-013**: Every finding MUST carry a clear, user-readable severity and be attributable to its contributing source(s).
+
+**Status, notifications, configuration**
+- **FR-014**: The server scan verdict (`clean`/`warning`/`dangerous`) MUST be derived solely from baseline findings.
+- **FR-015**: The system MUST emit at most one settled scan result notification per server per scan, including during reconnect storms.
+- **FR-016**: The system MUST remove the unused `auto_scan_quarantined` configuration key and ignore it if present in existing configs.
+- **FR-017**: The system MUST provide a single deep-scan configuration group (default off) that subsumes the previous package-source-fetch and privilege-hardening settings, and MUST migrate the old keys to it transparently on load.
+- **FR-018**: All bundled Docker scanners MUST default to disabled; the deterministic in-process scanner MUST default to enabled.
+
+**Unchanged surfaces**
+- **FR-019**: The tool-level quarantine state machine (hash-based pending/changed/approved gating) MUST remain unchanged; this feature changes how tools are scanned, not how quarantine enforces approvals.
+- **FR-020**: The existing quarantine/security management surfaces (the security CLI commands and the quarantine management tool) MUST continue to function and MUST read from the unified report.
+- **FR-021**: The approval gate MUST block on baseline `dangerous` findings only; deep-scan findings inform but do not gate approval.
+
+### Key Entities
+
+- **Scan Report**: The single per-server result. Carries the overall verdict (clean/warning/dangerous), a consolidated finding list, and a separate deep-scan availability descriptor.
+- **Finding**: One detected issue. Has a rule identity, a location, a severity, a confidence, and one or more contributing sources.
+- **Deep-Scan Descriptor**: Informational status of the opt-in layer: whether it is enabled, whether it ran, whether it was available, and which scanners (if any) failed.
+- **Baseline Engine**: The deterministic, offline detection engine that produces the verdict.
+- **Deep Scanner**: An opt-in heavy scanner (Docker-based or source-extracting) that contributes enrichment findings only.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: On a host without Docker, 100% of added servers receive a deterministic verdict and 0% report a "degraded" or "scanner failed" state.
+- **SC-002**: Repeated scans of the same tool set produce identical verdicts and findings 100% of the time.
+- **SC-003**: Detection recall for the curated hard-tier checks is ≥ 0.90 and the hard-negative false-positive rate is ≤ 0.05, measured against the evaluation corpus, with no regression versus the pre-change blocking behavior on the shared corpus.
+- **SC-004**: After removing the duplicate legacy rules, no previously-detected attack in the evaluation corpus goes undetected (zero coverage loss).
+- **SC-005**: A scan that includes a failed or unavailable deep scanner yields a baseline verdict identical to the same scan with deep scan disabled, in 100% of cases.
+- **SC-006**: A reconnect storm across N servers produces at most N settled scan notifications (one per server), eliminating the per-scanner notification flood.
+- **SC-007**: Existing configurations using the deprecated keys load without manual changes and behave identically after migration.
+- **SC-008**: When two scanners agree on a finding, the unified report shows one entry with higher confidence than either source reports alone.
+
+## Assumptions
+
+- The Spec 076 deterministic detection engine already provides coverage equivalent to (or better than) the legacy phrase and embedded-secret rules being removed; the curated hard-tier phrase set closes the one behavioral gap (legacy rules were blocking, detect's equivalents were review-only).
+- Most MCP servers scanned in practice are remote or otherwise have no extractable source, so the baseline (tool-definition) scan is the meaningful signal for the majority of users; deep scan is genuinely supplementary.
+- The existing unified-report data contract (normalized finding + summary + risk-score with consensus weighting) is sufficient as the single report format and does not need a redesign.
+- Demoting the Docker scanners to opt-in is acceptable security posture for the default experience, because the deterministic baseline covers tool-poisoning, shadowing, hidden-unicode, decoded-payload, secret, and curated injection-phrase classes offline.
+
+## Out of Scope
+
+- Removing or rewriting the Docker scanner plugins (they are retained, just opt-in).
+- Changing the tool-level quarantine state machine or its hashing/approval logic.
+- Redesigning the registry / add-server flow (separate initiative).
+- Adding new third-party scanners or new detection categories beyond the curated hard-tier phrase check.
+
+## Commit Message Conventions *(mandatory)*
+
+When committing changes for this feature, follow these guidelines:
+
+### Issue References
+- ✅ **Use**: `Related #[issue-number]` - Links the commit to the issue without auto-closing
+- ❌ **Do NOT use**: `Fixes #`, `Closes #`, `Resolves #` - These auto-close issues on merge
+
+### Co-Authorship
+- ❌ **Do NOT include**: `Co-Authored-By: Claude <noreply@anthropic.com>`
+- ❌ **Do NOT include**: "🤖 Generated with [Claude Code](https://claude.com/claude-code)"
+
+### Example Commit Message
+```
+feat(security): deterministic baseline scanner default; deep scan opt-in
+
+Related #[issue-number]
+
+Make the offline detect engine the always-on default and demote Docker
+scanners + source extraction to an opt-in deep scan that never blocks or
+degrades the baseline verdict. Unify all findings into a single report.
+
+## Changes
+- Remove duplicate legacy tpaRules + legacy embedded-secret path
+- Add curated hard-tier phrase_injection check
+- Separate deep-scan availability from baseline verdict
+- Migrate deprecated config keys into security.deep_scan
+
+## Testing
+- Offline determinism, no-coverage-loss, deep-scan-isolation, config migration
+```
diff --git a/specs/077-scanner-simplification/tasks.md b/specs/077-scanner-simplification/tasks.md
new file mode 100644
index 00000000..d8ccb931
--- /dev/null
+++ b/specs/077-scanner-simplification/tasks.md
@@ -0,0 +1,189 @@
+---
+description: "Task list for Spec 077 — Scanner Simplification"
+---
+
+# Tasks: Scanner Simplification — Deterministic Default, Opt-In Deep Scan
+
+**Input**: Design documents from `/specs/077-scanner-simplification/`
+**Prerequisites**: plan.md, spec.md, research.md, data-model.md, contracts/
+**Tests**: INCLUDED — the constitution (Principle V) mandates TDD; write each test first and confirm it fails before implementing.
+
+**Organization**: By user story (US1 P1 → US4 P3). US1 is the MVP. US2/US3/US4 build on the US1 baseline refactor but are each independently testable once Foundational + US1 land.
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: Can run in parallel (different files, no dependency on incomplete tasks)
+- **[Story]**: US1–US4 for story-phase tasks; Setup/Foundational/Polish carry no story label
+
+## Path Conventions
+
+Web app: Go core in `internal/` + `cmd/`, Vue frontend in `frontend/src/`. Paths are absolute-from-repo-root.
+
+---
+
+## Phase 1: Setup (Shared)
+
+**Purpose**: Establish a green regression baseline before refactoring the scanner.
+
+- [ ] T001 Confirm branch `077-scanner-simplification` builds and the existing scanner suite passes: `go build ./cmd/mcpproxy && go test ./internal/security/... ` — record as the pre-refactor reference.
+- [ ] T002 [P] Capture the current eval baseline: `go run ./cmd/scan-eval --gate --min-recall 0.90 --max-fp 0.05` and note per-category recall/FP as the no-regression reference for T006/T015.
+
+---
+
+## Phase 2: Foundational (Blocking Prerequisites)
+
+**Purpose**: Shared type changes that US1–US4 all build on. ⚠️ No user story work begins until this is done.
+
+- [ ] T003 Add `Tier` (`hard`|`soft`) and `Sources` (`[]string`) fields to the `ScanFinding` type in `internal/security/scanner/types.go` (JSON `omitempty`, back-compat); update `detectFindingToScanFinding` in `internal/security/scanner/inprocess.go` to set `Tier`/`Sources` from detect output.
+- [ ] T004 Add a `DeepScanDescriptor` type (`Enabled`, `Ran`, `Available`, `ScannersFailed []{ID,Reason}`) and a `DeepScan` field on the scan report/summary type in `internal/security/scanner/service.go` (unpopulated placeholder for now).
+- [ ] T005 [P] Copy the two contract schemas from `specs/077-scanner-simplification/contracts/` into `internal/security/scanner/testdata/` for report/config validation tests.
+
+**Checkpoint**: Shared types compile; scan output unchanged in behavior.
+
+---
+
+## Phase 3: User Story 1 — Reliable offline scan, no Docker (Priority: P1) 🎯 MVP
+
+**Goal**: The deterministic detect engine is the always-on, offline, zero-Docker baseline; duplicate legacy rules are gone; blocking posture preserved via a curated hard check.
+
+**Independent Test**: With Docker stopped, scan several servers (incl. one poisoned tool) → every server gets a deterministic `clean`/`warning`/`dangerous` verdict, poisoned tool blocked, benign near-miss not blocked, no degraded/failed state.
+
+### Tests for User Story 1 (write first, must fail)
+
+- [ ] T006 [P] [US1] Failing test: no detection-coverage loss after legacy-rule deletion (every corpus attack still detected) in `internal/security/scanner/inprocess_test.go`.
+- [ ] T007 [P] [US1] Failing test: `phrase_injection` hard-tier recall on curated positives AND zero hard-block on benign near-misses in `internal/security/detect/checks/phrase_injection_test.go`.
+- [ ] T008 [P] [US1] Failing test: determinism (same tool set → identical findings/verdict across two runs) and baseline runs with no Docker in `internal/security/scanner/service_test.go`.
+
+### Implementation for User Story 1
+
+- [ ] T009 [US1] Create the curated hard-tier check in `internal/security/detect/checks/phrase_injection.go` (high-confidence injection/exfiltration patterns; tier=hard; positions/thresholds to avoid benign FP).
+- [ ] T010 [US1] Register `phrase_injection` in the detect wiring `Checks` slice in `internal/security/scanner/inprocess.go` (check imports detect; engine never imports checks — no cycle).
+- [ ] T011 [US1] Delete legacy `tpaRules` + `matchAnyPhrase` and their append in `internal/security/scanner/inprocess.go`.
+- [ ] T012 [US1] Delete the legacy embedded-secret path (`security.NewDetector(nil)` append) in `internal/security/scanner/inprocess.go`; rely on detect's `EmbeddedSecret` check.
+- [ ] T013 [US1] Derive the baseline verdict (`clean`/`warning`/`dangerous`) from baseline hard/soft tiers only in `internal/security/scanner/service.go` (a `dangerous` status requires ≥1 hard baseline finding).
+- [ ] T014 [US1] Default all bundled Docker scanners to `enabled:false` and keep `tpa-descriptions` `enabled:true` in `internal/security/scanner/registry_bundled.go`.
+- [ ] T015 [US1] Add `phrase_injection` to `gateChecks()` in `cmd/scan-eval/gate.go`.
+- [ ] T016 [P] [US1] Extend `detect_corpus_v1.json` with curated `phrase_injection` positives and benign near-misses.
+- [ ] T017 [US1] Frontend: gate the Approve modal on baseline `dangerous` findings only in `frontend/src/views/ServerDetail.vue`.
+
+**Checkpoint**: MVP — offline deterministic baseline replaces the legacy stack; `scan-eval --gate` green with the new check.
+
+---
+
+## Phase 4: User Story 2 — One unified, readable report (Priority: P2)
+
+**Goal**: A single deduplicated report where cross-scanner agreement raises confidence.
+
+**Independent Test**: With two sources flagging the same tool/location → one finding, `sources` lists both, `confidence` higher than either alone; every finding shows a severity.
+
+### Tests for User Story 2 (write first, must fail)
+
+- [ ] T018 [P] [US2] Failing test: dedup by `(rule_id, location)` yields exactly one finding in `internal/security/scanner/sarif_test.go`.
+- [ ] T019 [P] [US2] Failing test: two independent sources agreeing on `(location, threat_type)` boosts confidence above single-source in `internal/security/scanner/sarif_test.go`.
+
+### Implementation for User Story 2
+
+- [ ] T020 [US2] Extend `consensusWeight`/`CalculateRiskScore` so matched external findings on `(location, threat_type)` add to consensus, not flatten to weight 1, in `internal/security/scanner/sarif.go`.
+- [ ] T021 [US2] Populate `Finding.Sources` (all contributing scanner ids) during merge in `AggregateReports` in `internal/security/scanner/engine.go`.
+- [ ] T022 [US2] Ensure every finding carries a severity via `ClassifyThreat` backfill for external/legacy SARIF findings in `internal/security/scanner/sarif.go`.
+- [ ] T023 [US2] Frontend: render the single merged finding list with severity + source attribution in `frontend/src/views/ScanReport.vue`.
+
+**Checkpoint**: US1 + US2 — one trustworthy merged report.
+
+---
+
+## Phase 5: User Story 3 — Opt-in deep scan that never hurts the baseline (Priority: P2)
+
+**Goal**: Docker scanners + source extraction are opt-in (off by default), best-effort, and can never change the baseline verdict; deprecated config migrates.
+
+**Independent Test**: Enable deep scan (Docker present) → deep findings merge; then kill Docker → baseline verdict identical to deep-off, `deep_scan.available=false` with a note; old config keys load unchanged.
+
+### Tests for User Story 3 (write first, must fail)
+
+- [ ] T024 [P] [US3] Failing test: deep scan off by default → only baseline runs, no Docker invoked, in `internal/security/scanner/service_test.go`.
+- [ ] T025 [P] [US3] Failing test: deep-scan failure/unavailable → baseline verdict unchanged AND descriptor populated, in `internal/security/scanner/engine_test.go`.
+- [ ] T026 [P] [US3] Failing test: config migration round-trip — `scanner_fetch_package_source`/`scanner_disable_no_new_privileges` map into `deep_scan.*`, `auto_scan_quarantined` ignored — in `internal/config/config_test.go`.
+
+### Implementation for User Story 3
+
+- [ ] T027 [US3] Add the `security.deep_scan` config struct (`Enabled`, `FetchPackageSource *bool`, `DisableNoNewPrivileges`, `Scanners []string`; `swaggertype` tags) and remove the orphaned `auto_scan_quarantined` in `internal/config/config.go`.
+- [ ] T028 [US3] Migrate deprecated top-level keys into `deep_scan.*` on load with back-compat aliases in the config loader/`normalizeServerQuarantineFlags` path in `internal/config/config.go`.
+- [ ] T029 [US3] Gate deep-scan execution on `deep_scan.enabled` (and the per-scanner list) in `resolveScanners`/`executeScan` in `internal/security/scanner/engine.go`.
+- [ ] T030 [US3] Populate `DeepScanDescriptor` and REMOVE the `degradeIfIncompleteCoverage` downgrade-to-`degraded` when only deep-scan plugins fail, in `internal/security/scanner/service.go`.
+- [ ] T031 [US3] Point `scanner_fetch_package_source` / `scanner_disable_no_new_privileges` consumers at `deep_scan.*` in `internal/security/scanner/engine.go` and `docker.go`.
+- [ ] T032 [US3] Regenerate OpenAPI: `make swagger` (config surface changed) and verify `make swagger-verify`.
+- [ ] T033 [US3] Frontend: show deep scan as an opt-in affordance and render deep-scan failures as info (not error) in `frontend/src/views/Security.vue` + `frontend/src/views/ScanReport.vue`.
+
+**Checkpoint**: US1–US3 — deep scan is safely optional; the baseline is untouchable.
+
+---
+
+## Phase 6: User Story 4 — Quiet, trustworthy notifications (Priority: P3)
+
+**Goal**: At most one settled scan notification per server, even under reconnect storms.
+
+**Independent Test**: Restart several servers at once → each emits a single settled scan event, not a flood of per-scanner lifecycle messages.
+
+### Tests for User Story 4 (write first, must fail)
+
+- [ ] T034 [P] [US4] Failing test: a reconnect storm across N servers yields ≤ N settled scan events in `internal/runtime/scan_notify_test.go`.
+
+### Implementation for User Story 4
+
+- [ ] T035 [US4] Replace per-scanner `security.scan_started/progress/completed/failed` emissions with one debounced `scan.settled` event per server per scan in the scan-notification emit path in `internal/runtime/`.
+- [ ] T036 [US4] Frontend: consume the settled event (drop per-scanner lifecycle handling) in `frontend/src/composables/useSecurityScannerStatus.ts`.
+
+**Checkpoint**: All four stories independently functional.
+
+---
+
+## Phase 7: Polish & Cross-Cutting
+
+- [ ] T037 [P] Update `docs/features/tool-scanner.md`: remove the legacy-coexistence caveat; document the baseline/deep-scan split, the `phrase_injection` hard check, and the two-tier model now governing behavior.
+- [ ] T038 [P] Update `docs/features/security-scanner-plugins.md`: deep scan is opt-in/off-by-default, config migration table, no-Docker default behavior.
+- [ ] T039 [P] Update `docs/configuration.md` for the `security.deep_scan` block and the removed `auto_scan_quarantined`.
+- [ ] T040 Run `specs/077-scanner-simplification/quickstart.md` scenarios 1–7 and record results.
+- [ ] T041 `golangci-lint run --config .github/.golangci.yml ./...` clean + `go test -race ./internal/... ` green.
+- [ ] T042 `./scripts/test-api-e2e.sh` green (unified report shape via REST).
+
+---
+
+## Dependencies & Execution Order
+
+- **Setup (P1)** → **Foundational (P2)** blocks all stories.
+- **US1 (P3 phase)** is the MVP and the base refactor; **US2/US3/US4 depend on US1** landing (they build on the baseline-only report and the deleted legacy path).
+- After US1: **US2, US3, US4 are largely independent** and can proceed in parallel (US2 = `sarif.go`/`engine.go`; US3 = `config.go`/`engine.go`/`service.go`; US4 = `internal/runtime` + a different frontend file). US3 and US2 both touch `engine.go` — sequence those two if worked concurrently.
+- **Polish (P7)** after the desired stories.
+
+### Within each story
+
+- Tests first and failing → implementation → frontend → checkpoint.
+- Go: models/types before services before wiring. `gofmt`/`goimports` on every file.
+
+### Parallel opportunities
+
+- T006/T007/T008 (US1 tests) in parallel.
+- T018/T019 (US2 tests) in parallel.
+- T024/T025/T026 (US3 tests) in parallel.
+- Docs T037/T038/T039 in parallel.
+
+---
+
+## Implementation Strategy
+
+### MVP first (US1 only)
+
+1. Phase 1 Setup → 2. Phase 2 Foundational → 3. Phase 3 US1 → **STOP & VALIDATE**: run quickstart scenarios 1–2 (offline deterministic baseline, poisoned-blocked/benign-not). This alone is shippable value: a reliable no-Docker scanner.
+
+### Incremental delivery
+
+US1 (MVP) → US2 (unified report) → US3 (opt-in deep scan) → US4 (quiet notifications). Each is a demoable increment that doesn't break the prior.
+
+---
+
+## Notes
+
+- No new third-party dependency (constitution + spec constraint).
+- Quarantine state machine (`internal/runtime/tool_quarantine.go`) is OUT OF SCOPE — do not modify.
+- The one deliberate posture change (some legacy-blocked phrases → review-only unless curated) is bounded by T007/T016 and the `scan-eval --gate`.
+- Commit after each task or logical group; use `Related #<issue>` (never `Fixes/Closes`), no AI co-author trailer (per spec Commit Conventions).