XTraceAI/memory-sdk-ts erreicht einen Gesundheitsindex von 47 von 100 und liegt damit im Bereich Gefährdet. Am stärksten schneidet es bei Vitality (70/100) ab, am schwächsten bei Security (17/100). Zuletzt vor 5 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
47
gesamt / 100
Gefährdet
Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
47
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Dieses Repository wird von einer Organisation getragen — geteilte, rechenschaftspflichtige Trägerschaft, die jeden einzelnen Maintainer überdauern kann.
Liefert Releases aus — 6 Versions-Tags (keine GitHub-Releases)
36/36
Release-Aktualität — letztes Release vor 5 Tagen
27/27
Release-Rhythmus — ein Release etwa alle 10,2 Tage
0/10
OpenSSF Scorecard: Signed-Releases — keine Daten
Verwendete Eingangsdaten
releases_count
6
latest_release_tag
v0.5.0
releases_from_tags
ja
days_since_latest_release
5
mean_days_between_releases
10,2
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): dangerous_workflow, packaging, pinned_dependencies, signed_releases, token_permissions. Die verbleibenden Gewichte wurden renormalisiert.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
Belegte Agentenpraxis — 22 der letzten 60 Commits von Agenten verfasst oder ihnen zugeschrieben
0/8
Automatisierte Wartung — keine automatisierten Abhängigkeits-Updates beobachtet
0/10
OpenSSF Scorecard: Pinned-Dependencies — keine Daten
Verwendete Eingangsdaten
has_nix
nein
has_tests
ja
lockfiles
package-lock.json
has_dockerfile
nein
typed_language
ja
bootstrap_files
—
has_devcontainer
nein
has_linter_config
nein
typecheck_configs
tsconfig.json
agent_commit_share
0,367
toolchain_manifests
—
dependency_bot_commit_share
0
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Pinned-Dependencies. Die verbleibenden Gewichte wurden renormalisiert.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
deps.dev does not index npm:@xtraceai/memory@0.5.0; advisories assessed against the repository dependency graph instead
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 34 ⇿
0Sterne
34Forks
2Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 0Minor 1Patch 1
OpenSSF Scorecard 1.6 / 10
1.6Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).Scorecard v5.5.0 · 2026-07-23 06:40 UTC
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 2582,
"has_wiki": true,
"homepage": null,
"languages": {
"TypeScript": 249347
},
"pushed_at": "2026-07-17T21:38:28Z",
"created_at": "2026-05-16T01:26:20Z",
"owner_type": "Organization",
"updated_at": "2026-07-22T06:47:50Z",
"description": "TypeScript SDK for the xtrace memory API",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": null,
"name": null,
"type": "Organization",
"login": "XTraceAI",
"company": null,
"location": null,
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/170989492?v=4",
"created_at": "2024-05-28T00:32:34Z",
"is_verified": null,
"public_repos": 6,
"account_age_days": 786
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-07-17T21:37:44Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-07-10T00:37:21Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-24T02:31:29Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-06-01T21:25:34Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-05-31T18:54:30Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-05-27T23:05:22Z"
}
],
"recent_commits": [
{
"oid": "cda5165a021374ae716662d555b53667e6325820",
"body": null,
"is_bot": false,
"headline": "release: v0.5.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-17T21:37:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82f1c2e3da2001f73ff7061f0f6b3e5e0dc13823",
"body": "feat(ai-sdk): withDirectiveRecall — procedural-memory recall around tools",
"is_bot": false,
"headline": "Merge pull request #15 from XTraceAI/fm-feat/ai-sdk-directive-middleware",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T18:43:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4927a7dbf1ad76b1a6c187a92b94be541679f0e2",
"body": "[medium] the reservation cleanup only ran on the success paths; a throwing\noriginalExecute propagated correctly but skipped release(), leaking its\nreserved directive ids into the shared fired set forever — silent loss on\nany later successful call. Wrap the tool call: on throw, settle the\nin-flight r\n[…]\nded), release all, re-throw.\nNew test asserts the error propagates AND the directive resurfaces next call.\n\n65 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): release reserved ids when a tool throws (review)",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:26:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d34e3890d27ea9bcd7c9fb370dd755c8a0aa3346",
"body": "…review)\n\n[low] fired is shared across wrapped tools, and the check (!fired.has) and\nact (add) spanned the tool-execution await — two parallel tool calls (the\nAI SDK runs tools concurrently) could both select the same directive and\ndouble-deliver. Move to optimistic reservation: recall reserves ids \n[…]\niver() no longer owns fired. New concurrency test asserts\nexactly-once delivery across two parallel calls.\n\n64 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): close the fired-once race across concurrent tool calls (…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:20:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e74f2a0203a8d7825db3455184207e13bebc2c91",
"body": "…reactive priority (review)\n\nThree more review findings on the directive middleware:\n\n- [high] a directive recalled at an undeliverable moment (array/number\n result, no observer) was still added to the fired set — silently lost,\n and blocked from a later injectable call, contradicting the 'keeps i\n[…]\now take budget priority.\n\n3 new tests (undeliverable keeps its chance, Date not spread, reactive\npriority); 63 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): correct fired-once accounting, non-plain-object safety, …",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:13:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1cd99de00d1c5cdc4a3db8f59a2d62e6671f0d7e",
"body": "…e exact tag (review follow-up)\n\nThe tag-specific neutralize regex missed whitespace/attribute variants\n(</team-directives >, <team-directives foo=x>) that a fuzzy model parser\nwould still honor as a block close. Escape the whole angle-bracket class in\ndirective text instead — provably complete, and the model reads </>\nas literal characters. Test now asserts the whitespace + attribute variants\nare defanged too.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): escape all angle brackets in directive text, not just th…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:06:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "72f8de70d95b377ba1a29d95777f14d8f76c5662",
"body": "…er, redaction, reactive FP\n\nFour MemHub-review findings on the directive middleware:\n\n- [medium] prompt-injection sink: directive text is teammate-authored\n (untrusted) and was appended verbatim inside a <team-directives> block a\n malicious directive could break out of. Neutralize <team-directive\n[…]\n can supply a precise check.\n\n4 new tests (breakout defang, no-clobber, redaction, isFailure suppression);\n60 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): harden withDirectiveRecall per review — injection, clobb…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:00:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0db99173f7cda53a1ce1bf449e3c2a3e43592ea0",
"body": "…ools\n\nWrap any AI SDK tools object so every tool call fires the symbol tripwire:\npre-tool recall runs CONCURRENTLY with execute (never delays the tool), a\nreactive second recall fires when a string result looks like a failure\n(the error text names the true cause — identifiers the args never showed)\n[…]\ntility\nreplay. 7 tests: wire contract, dedup, object/array injection shapes,\nreactive pass, fail-open (error + timeout), no-execute passthrough.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(ai-sdk): withDirectiveRecall — procedural-memory recall around t…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T01:55:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "32421bf9337893e316968d31d837ac9922e76d37",
"body": "feat(directives): memories.trigger() + agentic/namespace ingest",
"is_bot": false,
"headline": "Merge pull request #14 from XTraceAI/fm-feat/directive-trigger-surface",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T23:29:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "caf400ebd2416f0caa502483a8a999560c4ec21b",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: satisfy noUncheckedIndexedAccess in trigger tests",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T01:46:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "016f878a1aca1d31e59bb3fa3a44dba80577e279",
"body": "… procedural-memory surface\n\n- Vendor the fixed staging OpenAPI spec (DirectiveDetails was a dangling\n $ref that hard-failed openapi-typescript — fixed server-side in\n VecDB-Backend #153) and regenerate src/generated/types.ts: first regen\n since the directive/agentic surface shipped.\n- types: les\n[…]\nall recall,\n body passed through verbatim (server defaults stay in charge).\n- tests: trigger wire contract + directive-row typing (49 passing).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(directives): memories.trigger() + agentic/namespace ingest — the…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T01:46:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ea935918c247783daa680f010eda41778607398",
"body": null,
"is_bot": false,
"headline": "0.4.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-10T00:37:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9576b0e5b0ddc1f61c3b831bb31367b59a2bf31c",
"body": "feat: support prompt-less (catch-all) groups",
"is_bot": false,
"headline": "Merge pull request #13 from XTraceAI/claude/jolly-williamson-a11418",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-10T00:35:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dae1cece3cc0476c97e0a6d4d64cb52677c5b913",
"body": "examples/groups-smoke.ts (npm run smoke:groups) walks the whole\ncatch-all surface against a live API: prompted create regression,\nprompt-less create -> prompt null, empty-string 422s on create and\nPATCH, null round-trip through get/list, PATCH converting a catch-all\nto prompted, ingest tagging a sha\n[…]\nonal memory stays untagged (classifier-dependent, so\nsoft-fail), and archived ids echoing in ignored_group_ids. Cleans up\neverything it creates.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: add staging smoke script for catch-all groups",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-08T01:58:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "80f0429296ef2e66a3e8f76c0c8a67dd896a1e24",
"body": "VecDB-Backend now allows creating a group without a prompt\n(GroupCreateRequest.required == [\"name\"] in the regenerated OpenAPI\nspec). A prompt-less group is a catch-all: the ingest classifier tags\nit on every extracted memory it judges shareable, with no per-group\nmatching. Personal memories are nev\n[…]\n can never\n be removed via update\n- Add a create-without-prompt test asserting the request body omits\n the key and the null prompt round-trips\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: support prompt-less (catch-all) groups",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-08T00:50:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "52e831fb4cb11c61d6c33c6283ddc4aaf2aaaf0d",
"body": "feat: webhooks support (client.webhooks + signature verification)",
"is_bot": false,
"headline": "Merge pull request #10 from XTraceAI/feat/webhooks",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:31:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d490de2ba8e31c51e96a7422b7af9b581def0975",
"body": "Codex review (#10): the test sign() helper used the gated\nglobalThis.crypto, so on stock Node 18 the suite ReferenceErrors before\nany assertion. Use node:crypto.webcrypto in the signer so tests cover\nthe advertised node >=18 range (and so the global-absent test can null\nglobalThis.crypto without breaking signing).",
"is_bot": false,
"headline": "test: sign webhook fixtures with node:crypto (Node 18 compat)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:23:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfc3d942d88cef0f6b5829b1610d4965a20fd0b6",
"body": "Codex review (#10): verifyWebhookSignature read globalThis.crypto.subtle,\nwhich on Node 18.x is gated behind --experimental-global-webcrypto — so\nit threw before verifying on stock Node 18 even though the package\nadvertises node >=18.\n\nResolve SubtleCrypto across runtimes: prefer globalThis.crypto.s\n[…]\nzily import node:crypto.webcrypto\n(always present on Node). The import is dynamic + guarded so non-Node\nbundles never pull in node:crypto. Adds a test simulating Node 18\n(globalThis.crypto undefined).",
"is_bot": false,
"headline": "fix: webhook signature verification works on Node 18",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:01:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "caa8de236b05a2f9d38d10580a5a596e38c6b4a2",
"body": "Codex review (#10): at-most-once is misleading given retries — a lost\n2xx after the handler ran triggers a duplicate. State deliveries may be\ndropped or duplicated; dedupe on job_id.",
"is_bot": false,
"headline": "docs: correct webhook delivery semantics in README",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T01:51:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12cbadbfed95485e62b864fc5426345298745bc6",
"body": "Add first-class support for ingestion-completion webhooks:\n\n- client.webhooks.set() / get() / delete() for the per-org /v1/webhooks\n config (set() takes { rotateSecret } to mint a fresh signing secret).\n- verifyWebhookSignature() / parseWebhookEvent() — HMAC-SHA256 over the\n raw body via Web Crypt\n[…]\n,\n WebhookMemoryRef.\n- README \"Webhooks\" section + raw-body verification example.\n\nMinor bump → 0.3.0. 45 tests pass; typecheck + build clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: webhooks support (client.webhooks + signature verification)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T01:37:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0737c6ecd0a88f47d6d54ba4eef5da3df214d76a",
"body": null,
"is_bot": false,
"headline": "change from docs.mem to docs",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-05T16:51:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fa0d3d0f51026ceb411ef192f558d1d4fb7bf4f",
"body": null,
"is_bot": false,
"headline": "release: v0.2.1",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:25:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9cb76798dbedc38f7d04e165942cc1cbe9a42d9e",
"body": "feat(sdk): generalize recall() to union arbitrary scope pools",
"is_bot": false,
"headline": "Merge pull request #8 from XTraceAI/tc/recall-pools",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:15:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "005dcf8ac2b980f6398616d717d801d1c300c31d",
"body": "Addresses Codex P2 on #8: a JS caller (no compiler) passing a bare string, e.g.\npools: [{ group_ids: \"grp_x\" }], slipped past validation because strings have\n.length, then forwarded a non-array group_ids to /v1/memories/search. recall()\nnow rejects any non-array group_ids with a clear error. TS callers are already\nprotected by the string[] type; this guards the untyped path.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): reject a non-array group_ids in a recall pool",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:05:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "685896b713d588ce7e7250c707f3ca568e0a7d39",
"body": "Addresses Codex P2 on #8: a dynamically-built pool like { user_id, group_ids: [] }\npassed validation (user_id is an axis) but then spread group_ids: [] into the\nsearch — an empty any-of that AND-narrows to nothing server-side, silently\nturning a personal recall into a match-nothing scoped search. re\n[…]\nains) and never forwarded; a\npool left with no real axis still throws. Unifies the empty-array and zero-axis\ncases under one rule.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): strip empty axes from recall pools before search",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:57:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "33d19fd3d8ca4147b1c696baac1ecae7bc0a9162",
"body": "Addresses Codex P2 on #8: the round-1 multi-user fix attributed any non-viewer\nrow 'everywhere', but viewerUserId is optional — so a standalone\nrenderMemoriesPrompt() on one user's personal rows (which always carry user_id)\nwith no viewer rendered every line as 'alice: ...', changing the exported\nre\n[…]\n as before. Adds a standalone test (real rows have user_id, the\nfixtures defaulted user_id:null so this regression was invisible).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): gate personal-row author attribution on a known viewer",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:49:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3539b59f17b4b23f50da2b5e8cb80fe2d783b592",
"body": "…ng them\n\nAddresses Codex P2 on #8: the pool filter silently removed any pool with no\nscope axis, so a typo'd `group_id` or an empty `group_ids: []` alongside a valid\npool would make recall() return a plausible-but-incomplete result with the\nrequested scope quietly missing. Now each pool is validate\n[…]\n conditionally must omit it\nexplicitly. ai-sdk tool already normalizes empty groups to undefined, so it\nnever trips the new guard.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): recall() rejects malformed pools instead of silently droppi…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:42:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "906f8b2452e3aa9711031477b25012891fa9fdec",
"body": "Addresses Codex P2 on #8: the anti-bleed filter was gated on pool.user_id, so a\ndeliberately-scoped pool like { user_id, app_id } still got its rows dropped when\nthey carried a non-requested group tag — violating the AND-within-pool contract\n(the axes already narrow it; the caller asked for exactly \n[…]\nly to a PLAIN { user_id } pool (no app_id/agent_id/group_ids);\nany extra axis is treated as a deliberate scope and returned as-is.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): bleed-filter only the plain personal pool, not every user pool",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:35:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "91460e50aead1afc3fd971d2a60540b22307c960",
"body": "… memories\n\nAddresses Codex P2 on #8: with pools: [{user_id}, {app_id:'product-kb'}],\nthe KB rows have no group, so they fell into the Personal / 'memories about\nthe user' section — framing a doc as the user's own fact. recall() now labels\nrows from a non-user, non-group pool with their app_id/agent\n[…]\nhose under that source label (no author attribution). User-pool rows\ntake precedence (a row also from a user pool stays Personal).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): section app/agent-pool rows under their source, not as user…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:03:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ed13ffc9331850d4254df4c38256e3b303a297ea",
"body": "- Cross-group anti-bleed filter is now USER-pool-only. It was applied to every\n pool without group_ids, so combining an app/agent pool with a group pool\n silently dropped the app pool's rows that happened to carry an unrelated group\n tag (e.g. a product-KB doc tagged grp_docs, recalled alongside \n[…]\ndocs/types all pools-only,\nno current backward-compat claim). The bots flagged the superseded first commit.\n\n+2 tests (app-pool preserved, second-user attribution) → 30 total. typecheck + build green.",
"is_bot": false,
"headline": "fix(sdk): address #8 review — recall() pool edge cases",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:48:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f56249801b7aee5bc37e4872e22b84c39456c1be",
"body": null,
"is_bot": false,
"headline": "docs(releasing): example version 0.2.1 (next release)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:40:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97b0e35f38d9629ff35a130642a8da48e1a5265a",
"body": null,
"is_bot": false,
"headline": "docs(readme): recall() example uses pools",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:35:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc49b3aa7ea6f954b13c9b31ebc3ca4c580adb76",
"body": "…elds)\n\nPer design review: the convenience form mixed semantics confusingly — it OR'd\nuser_id vs group_ids but AND-narrowed agent_id/app_id, an implicit shape that's\nhard to reason about. Make recall a single, explicit rule instead:\n\n recall({ query, pools: [{ user_id }, { group_ids }] }) // ax\n[…]\n to pools-only. 28 pass, typecheck + build green.\n\nBREAKING CHANGE: recall({ user_id, group_ids }) no longer works; pass\n`pools: [{ user_id }, { group_ids }]`. (Only affects 0.2.0, released days ago.)",
"is_bot": false,
"headline": "refactor(sdk)!: recall() is pools-only (drop the convenience union fi…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:30:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "efb0d2f96a2ec9ace5f3494d599ded4ad952c90d",
"body": "recall() previously hardcoded the union to `user_id OR group_ids`, which made\nthe union mechanism look group-specific and left other blends (e.g. personal +\na global app_id KB) as a manual two-search merge. The union is general, so\nrecall now takes an explicit `pools` list:\n\n recall({ query, pool\n[…]\netry where groups got a one-liner but app_id\nneeded concurrent manual searches.\n\nTests: +4 (explicit-pool union, validation, cross-pool bleed filter, legacy\nsugar) → 29 total. typecheck + build green.",
"is_bot": false,
"headline": "feat(sdk): generalize recall() to union arbitrary scope pools",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:14:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3eb4ff53b80174b6cf18e46862b903243623b600",
"body": "docs: add RELEASING.md (manual npm publish flow)",
"is_bot": false,
"headline": "Merge pull request #7 from XTraceAI/tc/releasing-doc",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:15:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94024e4c4f675a5b99adc30c7ce3811a17b16805",
"body": null,
"is_bot": false,
"headline": "docs(releasing): verify npm whoami is tristangc before publishing",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "124bee96927799a47c70244a9c3d28b5e14e9918",
"body": "… 0.2.0 run",
"is_bot": false,
"headline": "docs(releasing): publish before tagging; add troubleshooting from the…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:04:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5957a9dfc1d3a8e38ca0cbda1ef0d8ff92453d6",
"body": null,
"is_bot": false,
"headline": "Merge main (0.2.0 release commit)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c389cf965f9a517fa3b1db9fa9d1a3770252d0e0",
"body": null,
"is_bot": false,
"headline": "release: v0.2.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:54:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01285b22c665e822618b69f727b031b19f34a9ea",
"body": null,
"is_bot": false,
"headline": "Merge main (#6) into releasing-doc",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:30:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4ffe319ac38ca7704efa5d8dc95a5581c24e484",
"body": null,
"is_bot": false,
"headline": "docs: add RELEASING.md (manual npm publish flow)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:28:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c165eb63d2fd11b7cd1b79e45f1012c70980edac",
"body": "feat(sdk): recall() (personal + shared) + sync SDK to deployed API",
"is_bot": false,
"headline": "Merge pull request #6 from XTraceAI/tc/sdk-recall-and-sync",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T17:38:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "43f614857f5b40616c9f2619253429088d3353bd",
"body": "Two genuinely-new review findings on the prior commit (the others re-flagged\nby the bots were already fixed there):\n\n- limit=1 no longer always favors the personal scope. The round-robin took\n personal first every round, so `recall({ user_id, group_ids, limit: 1 })`\n dropped the shared scope even \n[…]\nall to untagged memories\".) This\n complements the earlier render-side fix (sections only requested groups).\n\nTests: +2 (limit-1 global-max, other-group exclusion) → 25 total. typecheck +\nbuild green.",
"is_bot": false,
"headline": "fix(sdk): recall() limit=1 fairness + drop other-group bleed (round 2)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T16:53:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "32f150d2fe051738508732d95349a08466a8823d",
"body": "Four issues flagged by Codex/Cursor on recall() + the ai-sdk tools:\n\n- save_memory now forwards the group scope. memoryTools normalizes the group\n scope once (groupIds) and BOTH search_memory (via recall) and save_memory\n (via ingest group_ids) use it, so model-saved facts can be group-tagged and\n\n[…]\nedGroupIds keeps the prior \"section every tag\" behavior (back-compat).\n\nTests: +7 (fair-merge, requested-group bucketing, multi-tag, tool save/gate) —\n23 total across 3 files. typecheck + build green.",
"is_bot": false,
"headline": "fix(sdk): address #6 review — recall group-scope correctness",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T08:15:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c83ce46a8691759c91bc7b189f3e761128d0de01",
"body": "Shared (group) lines now carry their author so a multi-traveler group is\nunambiguous: \"<user_id>: <fact>\", or \"you: <fact>\" when it's the caller's own\nrow (recall passes the caller as viewerUserId). Personal lines stay\nunattributed (always the caller). Uses m.user_id — which a cross-user group\nread \n[…]\nead (alice→\"you\", bob→\"bob-…\"). 17 tests,\ntypecheck + build green.\n\nNote: shows the raw user_id; human display names would be a phase-2 concern\n(server template / widened payload), tracked in ENG-108.",
"is_bot": false,
"headline": "feat(sdk): attribute group memories to their author in recall() prompt",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T08:02:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fdfac348c6ec1244a0c49b21d4ad76bc5e294ed7",
"body": "…able format)\n\nExtract the prompt format into a JSON-serializable PromptTemplate\n(DEFAULT_PROMPT_TEMPLATE) that drives renderMemoriesPrompt: header,\npersonal/unknown-group labels, per-type tags, and category/date toggles.\nDefault output is unchanged.\n\nSets up phase 2: a future API endpoint can retur\n[…]\n, full\nartifact bodies, or char-budgeting without also widening the search payload.\n\nExports PromptTemplate + DEFAULT_PROMPT_TEMPLATE. 16 tests (added a\ncustom-template case); typecheck + build green.",
"is_bot": false,
"headline": "refactor(sdk): make recall() prompt template-driven (phase 1 of swapp…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:46:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "070cbfd23a74f336f17d331aa3b31c173e417c8c",
"body": "…tags)\n\nFacts still render as plain statements; artifacts and episodes now get a\ntype tag and their title — \"[document] <title>: <text>\" and\n\"[conversation] <title>: <text>\" — so the agent can tell a stored document\nor a past conversation from a stated fact. Uses only m.type / m.details\nalready on e\n[…]\nparity\nwould need a backend assemble-over-merged-set endpoint, which adds a\nsequential round-trip after the fan-out — declined here to keep recall fast.\n\nTest added; 15 total, typecheck + build green.",
"is_bot": false,
"headline": "feat(sdk): light type-awareness in recall() render (artifact/episode …",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:40:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e4db7ced321adae7747553f96ea6fae50ebdf771",
"body": "Memory rows carry only opaque group_ids, so the prompt couldn't name the\ngroup. recall() now resolves group id → name from the registry (one\nGET /v1/groups, fired in parallel with the searches — ~free latency,\nbest-effort: a lookup failure falls back to id labels rather than failing\nthe call). rende\n[…]\nacts under its own name.\n\nTests: name-resolution + per-group sectioning + id fallback (14 total).\nValidated live on staging — shared section headed by the group name,\nopaque id absent from the prompt.",
"is_bot": false,
"headline": "feat(sdk): recall() labels shared sections by group NAME",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:29:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7da2318468fa82712acab75342634779b041eb01",
"body": "…egories + date\n\nrenderMemoriesPrompt now groups the merged memories into \"Personal\" and\n\"Shared (group)\" sections (by each row's group_ids — tagged = shared,\nuntagged = personal), falling back to a flat list when only one kind is\npresent. Each bullet carries the memory's categories (`[...]`) and re\n[…]\nhile staying fully deterministic and client-side (no LLM, no backend\ncall). Still overridable via `recall(..., { render })`.\n\nAdded a grouping test; updated the flat-list test for the new line format.",
"is_bot": false,
"headline": "feat(sdk): richer recall() prompt — split personal vs shared, add cat…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:15:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7da7a9c443ec8a66a356678a29ff8a8d9872a86",
"body": "…yed API\n\n## recall() — personal + shared (group) read in one call\n\nSearch scoping is AND-everything (\"scope by what you pass\"), so a combined\n\"my own preferences AND the trip's shared facts\" read can't be one request\n(`{user_id, group_ids}` intersects). `client.memories.recall()` rebuilds that\nunio\n[…]\negenerated via `npm run gen:types`) is still\nstale; left out of scope — it's a reference artifact, not part of the public surface.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add recall() (personal + shared) and sync SDK to the deplo…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:00:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fd9978d4ef5e4f4bb0381c78a7b0b2d409898077",
"body": "update readme",
"is_bot": false,
"headline": "Merge pull request #5 from XTraceAI/chore/update-readme",
"author_name": "Liwen O.",
"author_login": "liwenXtrace",
"committed_at": "2026-05-28T20:22:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d4aeac0be566bcf843196856223fdaf2a25e373",
"body": null,
"is_bot": false,
"headline": "update readme",
"author_name": "Sebastian Gonzalez",
"author_login": "sgonz-xtrace",
"committed_at": "2026-05-28T19:58:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9eb8ebb70ec58aabf0d0813bcb3fc62d1a53039",
"body": "Flip the SDK-side default in memories.ingest() so the artifact\nextraction stage runs unless callers explicitly pass\n`extract_artifacts: false`. The server still treats an absent key\nas off, so the SDK now sends the resolved value on every request.\n\nThe ai-sdk wrappers (auto-ingest middleware in prov\n[…]\n message pairs and\none-line facts rarely benefit from the artifact stage and it is the\nmost expensive extraction step.\n\nBumps version to 0.1.1.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: default extract_artifacts to true for direct ingest",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-27T23:05:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ed0a44319a8a323c3e3ee5f8007793ef482b36b",
"body": "Two patterns ship under @xtraceai/memory/ai-sdk:\n\n- createXtraceMemory(): wraps any LanguageModel so it auto-searches\n memory before each call and auto-ingests the turn after. Mem0's\n provider pattern — set it and forget it.\n\n- memoryTools(): exposes search_memory and save_memory as tools the\n LL\n[…]\ns where the model decides\n when to read / write memory.\n\nai and zod are optional peer dependencies; users who only import\nthe core SDK don't pull them in. Bumps version to 0.1.0 (new public\nsurface).",
"is_bot": false,
"headline": "feat(ai-sdk): add Vercel AI SDK integration at /ai-sdk subpath",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-22T21:29:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "94b0f91704f3690a4753c4aa19a256295d04b54d",
"body": null,
"is_bot": false,
"headline": "chore: drop mem0 from package keywords",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-22T01:27:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65ece6d0f47cb575d2c942781078749b299abca5",
"body": null,
"is_bot": false,
"headline": "docs: point at app.xtrace.ai for credentials + docs link",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-21T21:07:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "98639fa66f23b5f8e32c7b16036ba96c13915618",
"body": "- Default baseUrl now points to https://api.production.xtrace.ai\n (was api.xtrace.ai, which returns 404)\n- Re-apply scope rename @xtrace → @xtraceai that was lost in reset\n- Bump to 0.0.2",
"is_bot": false,
"headline": "fix: correct production base URL to api.production.xtrace.ai",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-20T23:56:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d866fe6a0b7fc167ad2215cb15021b95ba4ea10",
"body": "Tests will land in a follow-up PR. The --passWithNoTests flag\nkeeps prepublishOnly from blocking the squat release.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: bump to 0.0.1 + allow empty test suite for publish",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:28:12Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "428c38aa06236463a9fb7983f2e7f05b7e931290",
"body": "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: use canonical XTraceAI casing in repo URLs",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:26:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b7fb885a1ce1ace44f91c56fc9f56ccfd83759b9",
"body": "Hand-written SDK targeting the v0.1 xtrace memory API. Covers\ningest (async + sync via wait=true), job polling with exponential\nbackoff, list (cursor-paginated async iterator), get, update,\ndelete, search, and the retrieve sugar for context_prompt.\n\nTypes match the live staging /openapi.json (regene\n[…]\neLimited, Unprocessable, etc.) keyed on the API's stable\nerror.code strings.\n\nEnd-to-end smoke test against staging passes (examples/smoke.ts).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: initial @xtrace/memory TypeScript SDK",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:23:30Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 6,
"commits_last_year": 60,
"latest_release_at": "2026-07-17T21:37:44Z",
"latest_release_tag": "v0.5.0",
"releases_from_tags": true,
"days_since_last_push": 5,
"active_weeks_last_year": 8,
"days_since_latest_release": 5,
"mean_days_between_releases": 10.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@xtraceai/memory",
"exists": true,
"license": "MIT",
"keywords": [
"xtrace",
"memory",
"sdk",
"ai",
"agent",
"ai-sdk",
"vercel-ai-sdk"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@xtraceai/memory",
"is_deprecated": false,
"latest_version": "0.5.0",
"repository_url": "https://github.com/XTraceAI/memory-sdk-ts",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 5024,
"first_published_at": "2026-05-16T01:42:32.983000Z",
"latest_published_at": "2026-07-17T21:38:18.141000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 34,
"stars": 274,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2026-05-28",
"count": 19
},
{
"date": "2026-05-29",
"count": 1
},
{
"date": "2026-05-30",
"count": 1
},
{
"date": "2026-05-31",
"count": 2
},
{
"date": "2026-06-02",
"count": 1
},
{
"date": "2026-06-04",
"count": 2
},
{
"date": "2026-06-05",
"count": 3
},
{
"date": "2026-06-06",
"count": 4
},
{
"date": "2026-06-12",
"count": 1
}
],
"complete": true,
"collected": 34,
"total_forks": 34
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 23316,
"source_files_sampled": 22,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 10,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 4
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "tristan-xtrace",
"commits": 48,
"avatar_url": "https://avatars.githubusercontent.com/u/276746865?v=4"
},
{
"type": "User",
"login": "felix-xtrace",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/170989441?v=4"
},
{
"type": "User",
"login": "liwenXtrace",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/170989218?v=4"
},
{
"type": "User",
"login": "sgonz-xtrace",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/223328257?v=4"
}
],
"contributors_sampled": 4,
"top_contributor_share": 0.8
},
"quality_signals": {
"has_ci": false,
"has_tests": true,
"ci_workflows": [],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/9 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": null,
"reason": "no dependencies found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 1,
"reason": "9 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "cda5165a021374ae716662d555b53667e6325820",
"ran_at": "2026-07-23T06:40:23Z",
"aggregate_score": 1.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-17T21:37:56Z",
"oldest_open_prs": [
{
"number": 9,
"created_at": "2026-06-15T05:39:10Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-15T18:43:23Z",
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/XTraceAI/memory-sdk-ts",
"host": "github.com",
"name": "memory-sdk-ts",
"owner": "XTraceAI"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 47,
"inputs": {
"security": 17,
"vitality": 70,
"community": 54,
"governance": 51,
"engineering": 34
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 70,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"commits_last_year": 60,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 8
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "8/52 weeks with commits",
"points": 5.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 8
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "60 commits in the last year",
"points": 16,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 60
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 6,
"latest_release_tag": "v0.5.0",
"releases_from_tags": true,
"days_since_latest_release": 5,
"mean_days_between_releases": 10.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "6 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 6
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~10.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 10.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 54,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"forks": 34,
"stars": 274,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "274 stars",
"points": 39.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 274
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "34 forks",
"points": 12.7,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 34
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 62,
"inputs": {
"packages": [
"@xtraceai/memory"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 5024
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "5,024 downloads/month across npm",
"points": 49.3,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 5024,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 51,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 4,
"top_contributor_share": 0.8
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 80% of commits",
"points": 4.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 80
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "4 contributors",
"points": 5.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 4
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 51,
"inputs": {
"merged_prs": 10,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 4
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "10/14 decided PRs merged",
"points": 27.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 10,
"decided": 14
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"followers": 3,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "XTraceAI",
"public_repos": 6,
"account_age_days": 786
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of XTraceAI",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "XTraceAI"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "6 public repos, account ~2 yr old",
"points": 10.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 6
}
},
{
"code": "account_age_years",
"params": {
"years": 2
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@xtraceai/memory"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "9 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 9
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 34,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "critical",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_ci": false,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 17,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dangerous_workflow",
"packaging",
"pinned_dependencies",
"signed_releases",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 17,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 13,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 5,
"scorecard_aggregate": 1.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "9 existing vulnerabilities detected",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 57,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.933,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "56 of 60 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 56,
"sampled": 60
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_pinned_dependencies"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.367,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "22 of the last 60 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 22,
"sampled": 60
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 23316,
"source_files_sampled": 22,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/22 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 22,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@xtraceai/memory@0.5.0; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-23T06:40:37.908397Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/x/XTraceAI/memory-sdk-ts.svg",
"full_name": "XTraceAI/memory-sdk-ts",
"license_state": "standard",
"license_spdx": "MIT"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit XTraceAI/memory-sdk-ts teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
