Öffentliches RegisterMittel
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.13.0 · 2026-07-30 20:05 UTC
YawLabs / postgres-mcp
Read-only-by-default MCP server for PostgreSQL. Query, introspect schemas, explain plans, health checks.
YawLabs/postgres-mcp erreicht einen Gesundheitsindex von 55 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Vitality (74/100) ab, am schwächsten bei Community & Adoption (42/100). Zuletzt vor 8 Tagen aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
55
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
55
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
Yaw LabsOrganisation
9 Follower27 öffentliche Reposseit Feb. 2026
Dieses Repository wird von einer Organisation getragen — geteilte, rechenschaftspflichtige Trägerschaft, die jeden einzelnen Maintainer überdauern kann.
Paket-Ökosysteme
| Registry | Paket | Version | Downloads / Monat | Versionen | Zuletzt veröffentlicht | Tags |
|---|---|---|---|---|---|---|
| npm | @yawlabs/postgres-mcp | 0.7.0 | 6.298 | 32 | vor 8 Tagen | postgrespostgresqldatabasemcpmodel-context-protocolaiagentclaudeclaude-codecursorllmsqlschemaexplain |
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
74
Entwicklungsaktivität
63Mittel
Wie die Bewertung erfolgt
| 28.8/36 | Push-Aktualität — letzter Push vor 8 Tagen |
| 6.2/36 | Commit-Rhythmus — 9/52 Wochen mit Commits |
| 18/18 | Commit-Volumen — 125 Commits im letzten Jahr |
| 10/10 | OpenSSF Scorecard: Maintained — 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 |
Verwendete Eingangsdaten
| commits_last_year | 125 |
| human_commit_share | 0,95 |
| days_since_last_push | 8 |
| active_weeks_last_year | 9 |
Release-Disziplin
90Exzellent
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 33 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 8 Tagen |
| 27/27 | Release-Rhythmus — ein Release etwa alle 7,4 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Verwendete Eingangsdaten
| releases_count | 33 |
| latest_release_tag | v0.7.0 |
| releases_from_tags | nein |
| days_since_latest_release | 8 |
| mean_days_between_releases | 7,4 |
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
42
Popularität & Verbreitung
5Kritisch
Wie die Bewertung erfolgt
| 4.9/60 | Stars — 3 Stars |
| 0/25 | Forks — 1 Forks |
| 0/15 | Watcher — 0 Watcher |
Verwendete Eingangsdaten
| forks | 1 |
| stars | 3 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
70Gut
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 22.5/22.5 | Lizenz — anerkannte Lizenz (MIT) |
| 18/18 | CONTRIBUTING-Leitfaden |
| 0/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 0/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | ja |
| has_issue_template | nein |
| has_code_of_conduct | nein |
| has_pull_request_template | nein |
Wie die Bewertung erfolgt
| 50.7/80 | Downloads pro Monat — 6.298 Downloads/Monat über npm |
| 0/20 | Abhängige in der Registry — von diesem Ökosystem nicht ausgewiesen |
Verwendete Eingangsdaten
| packages | @yawlabs/postgres-mcp |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 6.298 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Abhängige in der Registry. Die verbleibenden Gewichte wurden renormalisiert.
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
55
Maintainer-Resilienz (Bus-Faktor)
18Kritisch
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0.6/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 98 % der Commits |
| 2.7/13.5 | Breite der Beitragenden — 2 Beitragende |
| 6/10 | OpenSSF Scorecard: Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 2 |
| top_contributor_share | 0,975 |
Wie die Bewertung erfolgt
| 41.6/46.8 | Issue-Lösungsquote — 89 % der Issues geschlossen |
| 26.3/38.3 | PR-Annahme — 11/16 entschiedene PRs gemergt |
| 1.5/15 | OpenSSF Scorecard: Code-Review — Found 4/27 approved changesets -- score normalized to 1 |
Verwendete Eingangsdaten
| merged_prs | 11 |
| open_issues | 1 |
| closed_issues | 8 |
| issue_closed_ratio | 0,889 |
| closed_unmerged_prs | 5 |
Eigentümerschaft & Trägerschaft
49Gefährdet
Wie die Bewertung erfolgt
| 30/30 | Organisatorische Trägerschaft — im Besitz einer Organisation |
| 0/20 | Verifizierte Domain |
| 7.2/25 | Reichweite des Inhabers — 9 Follower von YawLabs |
| 11.5/25 | Kontohistorie — 27 öffentliche Repos, Kontoalter ca. 0 Jahre |
Verwendete Eingangsdaten
| followers | 9 |
| owner_type | Organization |
| is_verified | — |
| owner_login | YawLabs |
| public_repos | 27 |
| account_age_days | 169 |
Paketpflege
100Exzellent
Wie die Bewertung erfolgt
| 25/25 | Veröffentlicht & auflösbar — 1 Paket(e) auf npm |
| 35/35 | Veröffentlichungsaktualität — letzte Veröffentlichung vor 8 Tagen |
| 20/20 | Versionshistorie — 32 veröffentlichte Versionen |
| 20/20 | Nicht veraltet — aktiv, nicht veraltet oder zurückgezogen |
Verwendete Eingangsdaten
| packages | @yawlabs/postgres-mcp |
| ecosystems | npm |
| any_deprecated | nein |
| min_days_since_publish | 8 |
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
54
Engineering-Praktiken
40Gefährdet
Wie die Bewertung erfolgt
| 0/24 | CI-Workflows |
| 24/24 | Tests vorhanden |
| 16/16 | Linter-Konfiguration — biome.json |
| 0/9.6 | Pre-Commit-Hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 8 merged PRs checked by a CI test -- score normalized to 0 |
Verwendete Eingangsdaten
| has_ci | nein |
| has_tests | ja |
| has_editorconfig | nein |
| has_linter_config | ja |
| has_precommit_config | nein |
Dokumentation
75Gut
Wie die Bewertung erfolgt
| 30/30 | README |
| 25/25 | Dokumentationsverzeichnis |
| 0/15 | Dokumentations-/Homepage-Site |
| 10/10 | Repository-Beschreibung |
| 0/10 | Topics |
| 10/10 | Wiki |
Verwendete Eingangsdaten
| topics | — |
| has_wiki | ja |
| homepage | — |
| has_readme | ja |
| has_docs_dir | ja |
| has_description | ja |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
45
Sicherheitslage
45Gefährdet
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 2.2/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 0/2.5 | CI-Tests — 0 out of 8 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0.8/7.5 | Code-Review — Found 4/27 approved changesets -- score normalized to 1 |
| 1.5/2.5 | Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
| 0/10 | Dangerous-Workflow — keine Daten |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Lizenz — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — keine Daten |
| 2.5/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 5 |
| 0.5/5 | SAST — SAST tool is not run on all commits -- score normalized to 1 |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — keine Daten |
| 0/7.5 | Vulnerabilities — 17 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 15 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 3 |
| scorecard_aggregate | 4,5 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): dangerous_workflow, packaging, token_permissions. Die verbleibenden Gewichte wurden renormalisiert.
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
68
AI-Agentenkontext & Leitlinien
39Gefährdet
Wie die Bewertung erfolgt
| 0/45 | Agentenanweisungen — keine CLAUDE.md / AGENTS.md / Editor-Regeln |
| 0/15 | Maschinenlesbare Doku (llms.txt) |
| 38.7/40 | Lesbare Commit-Historie — 69 von 95 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | nein |
| legible_history_share | 0,726 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Wie die Bewertung erfolgt
| 0/18 | Bootstrap mit einem Befehl |
| 22/22 | Automatisierte Tests |
| 11/11 | Lint-/Format-Konfiguration — biome.json |
| 11/11 | Statische Typprüfung — tsconfig.json |
| 10/10 | Reproduzierbare Umgebung — lockfile |
| 10/10 | Belegte Agentenpraxis — 66 der letzten 100 Commits von Agenten verfasst oder ihnen zugeschrieben |
| 8/8 | Automatisierte Wartung — 5 der letzten 100 Commits sind automatisierte Abhängigkeits-Updates |
| 5/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 5 |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | ja |
| lockfiles | package-lock.json |
| has_dockerfile | nein |
| typed_language | ja |
| bootstrap_files | — |
| has_devcontainer | nein |
| has_linter_config | ja |
| typecheck_configs | tsconfig.json |
| agent_commit_share | 0,66 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0,05 |
AI-Code-Lesbarkeit für Modelle
100Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — TypeScript (statisch typisiert) |
| 55/55 | Handhabbare Dateigrößen — 0/26 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | TypeScript |
| largest_source_bytes | 53.014 |
| source_files_sampled | 26 |
| oversized_source_files | 0 |
Eckdaten
3GitHub-Sterne
2Mitwirkende
125Commits, letzte 12 Monate
8Tage seit letztem Push
33Releases
1Bus-Faktor
1offene Issues
npmPaket-Ökosysteme
Warnungen zur Datenerhebung
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Weitere Details
OpenSSF Scorecard 4.5 / 10
4.5Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 3 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 0 | CI-Tests | 0 out of 8 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 1 | Code-Review | Found 4/27 approved changesets -- score normalized to 1 |
| 6 | Contributors | project has 2 contributing companies or organizations -- score normalized to 6 |
| k. A. | Dangerous-Workflow | no workflows found |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 |
| k. A. | Packaging | packaging workflow not detected |
| 5 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 5 |
| 1 | SAST | SAST tool is not run on all commits -- score normalized to 1 |
| 10 | Security-Policy | security policy file detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| k. A. | Token-Permissions | No tokens found |
| 0 | Vulnerabilities | 17 existing vulnerabilities detected |
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 522,
"has_wiki": true,
"homepage": null,
"languages": {
"Shell": 34127,
"JavaScript": 24624,
"TypeScript": 288352
},
"pushed_at": "2026-07-21T23:51:11Z",
"created_at": "2026-04-21T16:39:36Z",
"owner_type": "Organization",
"updated_at": "2026-07-21T23:51:15Z",
"description": "Read-only-by-default MCP server for PostgreSQL. Query, introspect schemas, explain plans, health checks.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "https://yaw.sh",
"name": "Yaw Labs",
"type": "Organization",
"login": "YawLabs",
"company": null,
"location": null,
"followers": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/260788729?v=4",
"created_at": "2026-02-11T00:00:33Z",
"is_verified": null,
"public_repos": 27,
"account_age_days": 169
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-07-21T23:51:30Z"
},
{
"tag": "v0.6.21",
"kind": "patch",
"published_at": "2026-06-11T18:12:45Z"
},
{
"tag": "v0.6.20",
"kind": "patch",
"published_at": "2026-06-04T13:17:57Z"
},
{
"tag": "v0.6.19",
"kind": "patch",
"published_at": "2026-06-03T02:38:40Z"
},
{
"tag": "v0.6.18",
"kind": "patch",
"published_at": "2026-05-28T21:33:17Z"
},
{
"tag": "v0.6.17",
"kind": "patch",
"published_at": "2026-05-19T12:48:35Z"
},
{
"tag": "v0.6.16",
"kind": "patch",
"published_at": "2026-05-18T14:31:46Z"
},
{
"tag": "v0.6.15",
"kind": "patch",
"published_at": "2026-05-16T17:10:36Z"
},
{
"tag": "v0.6.14",
"kind": "patch",
"published_at": "2026-05-16T17:03:17Z"
},
{
"tag": "v0.6.13",
"kind": "patch",
"published_at": "2026-05-16T16:50:51Z"
},
{
"tag": "v0.6.12",
"kind": "patch",
"published_at": "2026-05-16T16:11:20Z"
},
{
"tag": "v0.6.11",
"kind": "patch",
"published_at": "2026-05-16T15:45:24Z"
},
{
"tag": "v0.6.10",
"kind": "patch",
"published_at": "2026-05-16T15:39:28Z"
},
{
"tag": "v0.6.6",
"kind": "patch",
"published_at": "2026-05-16T15:09:04Z"
},
{
"tag": "v0.6.5",
"kind": "patch",
"published_at": "2026-05-16T06:31:42Z"
},
{
"tag": "v0.6.4",
"kind": "patch",
"published_at": "2026-05-15T18:17:35Z"
},
{
"tag": "v0.6.3",
"kind": "patch",
"published_at": "2026-05-15T17:21:43Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2026-05-15T17:03:04Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2026-05-15T16:43:06Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-05-15T04:02:49Z"
},
{
"tag": "v0.5.4",
"kind": "patch",
"published_at": "2026-05-14T04:17:00Z"
},
{
"tag": "v0.5.3",
"kind": "patch",
"published_at": "2026-05-14T02:55:01Z"
},
{
"tag": "v0.5.2",
"kind": "patch",
"published_at": "2026-05-14T02:37:26Z"
},
{
"tag": "v0.5.1",
"kind": "patch",
"published_at": "2026-05-05T17:17:37Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-05-05T05:24:25Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2026-05-05T04:46:19Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-04-25T21:14:18Z"
},
{
"tag": "v0.3.3",
"kind": "patch",
"published_at": "2026-04-24T21:43:26Z"
},
{
"tag": "v0.3.2",
"kind": "patch",
"published_at": "2026-04-24T17:30:40Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2026-04-22T13:42:21Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-04-22T12:51:50Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-04-21T17:26:16Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-04-21T16:40:20Z"
}
],
"recent_commits": [
{
"oid": "b2d8fbc30ac5cc0c2f184cd25faf3eacbe5c6988",
"body": null,
"is_bot": false,
"headline": "v0.7.0",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T23:51:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f5f22e0cef3172f810c652f8ed65c464f04cd5e",
"body": "The stacked PRs (#16/#19) and the conflict resolution between them left\nformat and import-order violations. No CI to catch these anymore.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "style: apply biome formatting after the 0.6.21 feature merges",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T22:43:09Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7196975bc3fee9eb7a0a3d0f29b9e6082d2aaf65",
"body": "* fix: add foreign-table coverage to pg_advisor and pg_describe_table\n\nCloses #10.\n\npg_advisor.tables_without_primary_key filtered relkind IN ('r','p') and\nsilently missed foreign tables (relkind='f'). A foreign table without a\ndefined PK is the same design-drift signal as a heap table -- the PK is\n\n[…]\nf\n pgstattuple extension state\"\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>\nCo-authored-by: Jeff Yaw <jeff@yaw.sh>",
"is_bot": false,
"headline": "feat(pg_table_bloat): add approx and exact methods via pgstattuple (#19)",
"author_name": "Michael",
"author_login": "HighviewOne",
"committed_at": "2026-07-21T22:37:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e45f403248dee9a6144a7319bf75a059804562cf",
"body": "…tat_statements >= 1.10 (#16)\n\n* test: gate pg_current_wal_lsn REVOKE behind POSTGRES_MCP_DESTRUCTIVE_TESTS=1\n\nThe _warnings-path test for pg_replication_status forces a permission error\nby revoking PUBLIC EXECUTE on pg_catalog.pg_current_wal_lsn(). A hard\nprocess kill between REVOKE and GRANT leave\n[…]\nged (>= 1.10 is still\n the right cutoff for the feature being present)\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(pg_top_queries): add io_read_time_ms / io_write_time_ms for pg_s…",
"author_name": "Michael",
"author_login": "HighviewOne",
"committed_at": "2026-07-21T22:32:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "52fccf0d425da492127089b71fe722df87d405df",
"body": "…number (#17)\n\n* fix(pg_list_tables): cast reltuples to float8 so estimated_rows is a number\n\npg_class.reltuples is float4. Casting it to ::bigint gives an int8 result\n(OID 20), which node-pg parses as a string by default -- so estimated_rows\nwas returning \"42\" (a JSON string) instead of 42 (a JSON \n[…]\n- Integration test updated to accept number|null and assert integrality\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(pg_list_tables): cast reltuples to float8 so estimated_rows is a …",
"author_name": "Michael",
"author_login": "HighviewOne",
"committed_at": "2026-07-21T22:30:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2cbab57296cd45f6be674b8cc67cfada77a4c9d7",
"body": "release.sh:\n- handle git ls-remote failure in the tag-drift guard explicitly instead\n of dying on the ERR trap with git's real error suppressed\n- non-interactive runs now require RELEASE_YES=1 or a piped 'y' instead\n of proceeding unconditionally; a piped decline aborts again\n- correct the SKIP_LI\n[…]\n loop and the comment's\n unbacked schema/handler-drift claim\n\nchangelog:\n- backfill [0.6.17]-[0.6.19] sections for published versions with none\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: address 10 confirmed findings from review of f7b7cb3..a736200 (#21)",
"author_name": "Jeff",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T22:30:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "555e19d9e585272d4560cd58ddac1aa2d1e71a94",
"body": "Actions and Dependabot are disabled org-wide; releases run from the local\nrelease.sh. Removes the now-inert workflow files and version-update config.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(ci): remove GitHub Actions workflows and dependabot config (#24)",
"author_name": "Jeff",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T21:50:39Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "17ba0ff158e4a44dd7a4279536289fadfdf1987b",
"body": "…ith 3 updates (#23)\n\nBumps the dev-dependencies group with 3 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [esbuild](https://github.com/evanw/esbuild) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg).\n\n\nUpdat\n[…]\non-update:semver-minor\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump the dev-dependencies group across 1 directory w…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-21T20:57:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b03ca08a73029b1ddd86192ae461285948c63d2d",
"body": null,
"is_bot": false,
"headline": "add CODEOWNERS for SOC 2 compliance",
"author_name": "Jeff",
"author_login": "jeffyaw",
"committed_at": "2026-06-15T13:06:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1cbf22db0d990fe66892145243a35c3f7477594b",
"body": null,
"is_bot": false,
"headline": "chore(release): v0.6.21",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-11T18:12:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8500cd325f8bf0903ce56acae20f64c992df931e",
"body": "Adopt the @yawlabs/mcp binary pipeline (release.yml 5-platform matrix +\nbuild-binary/stage/update-manifests scripts + sea-config), all derived from\npackage.json. Bootstrap de-TLA'd so the entry bundles to CJS for Node SEA;\nbehaviour unchanged. Added postject devDep.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(release): cross-platform single-binary pipeline (scoop + homebrew)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-11T18:12:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3de2b31da1621fc1fb89acca92f6a6b103746177",
"body": "Bumps the dev-dependencies group with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `@types/node` from 25.9.1 to 25.9.2\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/Definite\n[…]\non-update:semver-patch\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump @types/node in the dev-dependencies group (#20)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-11T04:51:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "19a32175c1497ea59b7e0db079f81b2b129c65a4",
"body": "…ith 3 updates (#14)\n\nBumps the dev-dependencies group with 3 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [pg](https://github.com/brianc/no\n[…]\non-update:semver-minor\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump the dev-dependencies group across 1 directory w…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-06T16:19:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a73620039a8617450a9d2bb4c364dd35cc356f0f",
"body": null,
"is_bot": false,
"headline": "v0.6.20",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-04T13:17:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c862baae6d0100e552854d0f7cb064df4390c4a",
"body": "WIP from a prior session plus this session's address-all pass. The CHANGELOG\nentry is the authoritative change list; commit message is intentionally terse\nbecause release.sh (step 4) will create a per-version commit on top of this\nwith the version bump + tag.\n\nCHANGELOG sections:\n- Fixed: wrapToolHa\n[…]\ntSchema round-trip test\n- Docs: pg_query description re-order, getPool env-var snapshot reword\n- Infrastructure: REQUIRE_MATRIX=1 in release.sh\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: cut 0.6.20",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-04T13:11:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0a309a25cdc8f2f6b766f0f6fae87e0b486c8ef1",
"body": "Closes the full-pass digest's actionable items, mostly the file-for-later\ntier. Bundled in this commit because the working tree at session start\nalready had in-flight v0.6.20 work sitting across 18 files; a clean\nseparation would have required git add -p on every hunk.\n\nAddress-all edits:\n- src/api.\n[…]\ns from a prior session\n\nVerified: tsc --noEmit clean, 214/214 unit tests pass (128/128 in the\ntools suite where the new round-trip test lives).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: address-all pass + bundled WIP",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-04T13:00:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "af44415954af43a3890267d9bd782446137e4889",
"body": null,
"is_bot": false,
"headline": "v0.6.19",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-03T02:38:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b9d29208a653fc62e0c873b3b2f184b6e7bfc70",
"body": "…olHandler for testability\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: cover MCP result wrapper + connect-failure path; extract wrapTo…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-03T02:13:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d9cf4ccf6973d1da74454d8598e14fbffad2fa45",
"body": "…on't false-abort\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): compare tag-object shas in drift guard so resume runs d…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-03T01:34:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ee59d2352a2efb2ae32611a9a47664dc4dfcc447",
"body": "GitHub's Markdown sanitizer strips <a href> values whose scheme isn't on\nits allowlist (http/https/mailto/...), so a badge linking straight to\nyaw://install rendered the image but dropped the link -- the click did\nnothing. Point it at https://yaw.sh/mcp/install, which forwards the\nverbatim query to the yaw:// install handler the app registered.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(readme): point \"Add to Yaw MCP\" badge at the https forwarder",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-02T14:34:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6287b19d392ee7123013ea453ea3a9748027282b",
"body": "Prior wording claimed the failure happens AFTER npm publish via\nnon-fast-forward rejection. Both clauses wrong: the tag-push step\nruns BEFORE npm publish, and `git push --follow-tags` (used in 11\nof 12 release.sh files) silently SKIPS a tag that already exists\non the remote rather than rejecting it.\n[…]\nease create` then publishes a GitHub release linked to that\nstale commit while npm carries the new one. Re-stated accordingly.\n\nNo code change.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(release): fix tag-drift comment to describe the real failure mode",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T22:04:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f2af583dced176d2fdc465d57329d53fa838c2dc",
"body": "Before pushing the bump commit + tag, query origin for the same tag\nname and compare SHAs. If origin already has the tag at a different\ncommit (rewound elsewhere, parallel release race), fail with a clear\nmessage instead of letting the push silently non-fast-forward AFTER\nnpm publish has already started -- which would leave the npm release\nwithout a matching git tag.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): refuse to push if origin's tag drifted from local",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:57:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "908a1f7bafc0d1a148bd64e18cddcb74cbecc893",
"body": "Wraps `npm`/`pnpm` so any `lint*` subcommand becomes a no-op when\nSKIP_LINT=1 is set. Workaround for the MINGW64-ARM64 case where the\nnpm-run-script wrapper segfaults on exit-cleanup and biome itself\nfails silently (platform-windows.md). Apply only when the lint\nrunner is broken on the host; the next CI / clean-runner release\ncatches any lint regression.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): add SKIP_LINT=1 escape hatch for broken lint runners",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:47:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d999a344279d9291ea772d24e8b36265a26f9f94",
"body": null,
"is_bot": false,
"headline": "v0.6.18",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:33:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74d41d7d0cd0942250cfb43f779112de5690e92d",
"body": "Drift between server.json and package.json went undetected because\nprior releases predated the release.sh unconditional-sync fix.\nBringing server.json forward so the working tree matches what's\nalready on npm and on the MCP Registry.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: sync server.json version to match package.json",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:26:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4f84f2a8ddc950f80da713fe7977b98b54e84c34",
"body": "release.sh's `read -p \"Continue?\"` aborted under `set -euo\npipefail` when stdin wasn't a tty, requiring an `echo y |`\nworkaround for headless invocations. Gate the read with\n`[ -t 0 ]`; non-interactive callers now proceed without\nconfirmation (with an info line so they know).\n\nSurfaced during the fetch-mcp v0.3.3 release flow.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): tty-gate the confirmation prompt",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:19:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "8649082d335e4ef4516c389bce51ead934c5b6af",
"body": "…ump else\n\nThe server.json jq-sync lived inside the `else` branch of \"is\npackage.json already at target version?\". On a resume run (e.g.\nbump commit made by hand on a prior session, like this one's\nv0.14.3 -> 0.14.3 bump in beaf1cd), the script hits the \"skip\"\nbranch and never touches server.json --\n[…]\ntion; the inner check makes\nit a no-op when server.json is already in sync.\n\nObserved on the v0.14.3 mcp-compliance release flow earlier today.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): sync server.json unconditionally, not only inside the b…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:01:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c15d3cd092efe55369c05e27e0275af27742038",
"body": "When MCP_REGISTRY_TOKEN is unset, source it from `gh auth token`\ninstead of failing outright. The gh CLI's session token (after\n`gh auth login`) carries admin:org scope, which covers the\nread:org claim mcp-publisher needs for the io.github.YawLabs/*\nnamespace. Removes the env-var prereq for anyone with a working\ngh CLI session, while still respecting an explicit override.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): fall back to gh auth token for MCP Registry",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T20:34:44Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f7b7cb3445106b9b23cde55dff9659f9ce9b4953",
"body": "Move the post-release MCP Registry publish (server.json sync,\nmcp-publisher install, login, publish) into release.sh as a\nnew Step 6 between GitHub release and Verify. Auth switches\nfrom github-oidc (Actions-only) to a PAT via 'login github\n-token $MCP_REGISTRY_TOKEN' so it runs locally.\n\nAlso exten\n[…]\nfrom this machine:\n * active npm session (npm login --auth-type=web)\n * MCP_REGISTRY_TOKEN env var = GitHub PAT with read:org\n for YawLabs\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: fold MCP Registry publish into release.sh, drop release.yml",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T20:25:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "39e98680341f62c4d4f9ada79c2969c4269e2935",
"body": "Comment in step 2 said the matrix was \"gated by integration.yml\nworkflow\"; integration.yml was removed in aef0d18, so the matrix\nno longer runs in CI under any path. Refresh the comment to say\nso explicitly -- behavior unchanged (CI still skips, local WSL\nstill runs), but readers won't go looking for a workflow that\nisn't there.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(release): integration matrix is now a local-only pre-tag gate",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T20:04:31Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f0785f19317a953040a852fac50e1b97b26de35a",
"body": "Companion to the prior chore(ci) commit -- release.yml had a\njobs.ci (or jobs.integration) block that `uses:`d the now-deleted\nci.yml/integration.yml, with release.needs gating on it. Without\nthis fix the next tag push would fail at the `uses:` reference.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): drop needs: ref to removed reusable workflow",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T19:40:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "aef0d182ca95f068b0ea6da225466f22a48a8077",
"body": "Reduce GitHub Actions to only the release flow (publish to npm,\nMCP Registry, and GitHub Releases). Removes ci.yml, deprecate.yml,\nand any integration/bench/docker/nightly siblings.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(ci): drop non-release workflows",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T19:31:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "387220549f5504d033e89873a35e17e8fabdb359",
"body": "Replaces the cloud-account install badge with a yaw://install?... deep\nlink that fires Yaw Terminal's local protocol handler. The handler\nshows a confirmation dialog with the verbatim command + args + env\nkeys + source before appending the server to ~/.yaw-mcp/config.json.\nAccompanying \"One click adds this to your mcp.hosting account\"\nsentence updated to match the new local-install flow.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(readme): swap mcp.hosting badge -> Add to Yaw MCP yaw:// deep link",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T19:10:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "35a8fc803b3d7e887be8c8616ed9daf6494017e4",
"body": "The @latest tag makes npx re-resolve against the npm registry on every\nspawn, so each MCP session uses the newest published version instead of\nwhatever happens to be in the npx metadata cache. Matches what the\nmcp.hosting dashboard catalog already writes for new installs.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(readme): pin npx spawn to @latest for auto-update",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-24T17:05:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "fe5d49942a077d807dd6da7050be770028eeb2f1",
"body": "Followups to the previous CI-handoff rollout. All landed in the same\nstep-5 block:\n\n1. Tightened detection grep from \"npm publish|NODE_AUTH_TOKEN|release.sh\"\n to \"npm publish|NODE_AUTH_TOKEN\". The release.sh alternation was too\n broad -- any workflow that merely RUNS the script (lint, dry-run)\n \n[…]\nlater\n failures (smoke test, MCP Registry publish, attestation upload).\n\nRolled out to the same 12 repos that received the CI-handoff change.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): address six issues from review of the CI-handoff step",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T13:46:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "efdf9633f985eff770ce6ce5028a61c79e1ed601",
"body": "The local release.sh step 5 was attempting to npm-publish from the\nworkstation in parallel with the same operation in CI -- release.yml\nruns `bash release.sh` itself with CI=true and\nNODE_AUTH_TOKEN=secrets.NPM_TOKEN on every v* tag push. So when a dev\nruns release.sh locally:\n\n 1. Steps 1-4 (lint/\n[…]\nh-type=web`.\n\nEliminates the entire class of \"workstation publish failed because\nnpmrc is stale\" failures. Originated on YawLabs/aws-mcp@1.2.0.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): hand off to CI instead of racing it at step 5",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T13:13:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4413ceb21dd4675a3af67b2c3681fc279f55725f",
"body": null,
"is_bot": false,
"headline": "v0.6.17",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T12:47:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f74d5837a33f3e47855ff3652630980e121ae082",
"body": "./release.sh 0.1.0 \"feat: add foo\" now commits tracked changes\n(git add -u, never sweeps untracked) and pushes BEFORE running\nthe existing 8-step release flow. Untouched if the 2nd arg is\nomitted -- the manual two-step is still the default and CI mode\nignores the arg entirely.\n\nPre-commit runs lint:\n[…]\nase.sh step 1. The integration\nmatrix still runs in step 2 -- the matrix gates the tag, not the\nfeature commit, so we don't double-pay it here.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(release): accept optional pre-release commit message as 2nd arg",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T12:41:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4514e3c9bff6dea09f71c4ccaf9974e898ce3e31",
"body": "release.sh now runs scripts/post-publish-smoke.sh as step 8 so the\npublished tarball is exercised end-to-end (npm install + bin invoke)\nbefore the release is declared done -- the prior step-7 `npm view`\nprobe only checked registry metadata, which can lag a working install\non CDN edges. Status glyphs\n[…]\nut (vs flooring)\n\nscripts/wsl-test-matrix.sh: capture full output to a temp log so a\nfailing test name survives summary noise on the FAIL path.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: wire post-publish smoke into release + coverage tests",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T12:31:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "646f2051508b9fe9e9c2e1c554f431c9a01f09ac",
"body": "Reusable post-release smoke: installs @yawlabs/postgres-mcp@<version>\nfrom the registry into an isolated tmp dir, invokes the bin, asserts\nthe reported version matches. Uses `cd \"${TMP:?...}\"` so an empty\nmktemp result aborts before `npm init -y` can run in cwd -- the\nexact failure mode that scrambled this repo's package.json mid-\nsession when ad-hoc bash smoke checks fell through.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: add post-publish smoke script with ${TMP:?} guard",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:48:19Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b68a03e47568a77466f089d85e0c2d1b8eb2d419",
"body": "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: changelog entry for v0.6.16",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:40:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6e9017d75696a5d44742c594cd88af8b9dbb4c13",
"body": null,
"is_bot": false,
"headline": "v0.6.16",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:30:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8721268ae0466ab24807ae64d015e7895c32277",
"body": "The inline try/catch in the _warnings test left the cluster's\npg_current_wal_lsn() ungrantable to PUBLIC if cleanup itself raised\n(e.g. shutdown() throwing). Moving the REVOKE/GRANT into a nested\ndescribe's before/after means node:test guarantees the GRANT runs\nwhenever the matching REVOKE ran -- assertion failure, body throw,\nor future second `it()` in the block.\n\nVerified against PG17 and PG18 via the WSL integration matrix.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: scope pg_replication_status REVOKE/GRANT to before/after hooks",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:28:17Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bd5a89536a5a488bb66dc35919c3a60dc7a80e2f",
"body": null,
"is_bot": false,
"headline": "v0.6.15",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:09:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "605303572b0ad24ce6f594bc87e14e9096db4a2a",
"body": "runUserQueryBounded opens SAVEPOINT __pgmcp_sp around the user SQL and\nRELEASEs it at the end. A setup/teardown hook that opens a savepoint\nwith the same name would be unwound by the inner RELEASE here. Today\nno hook collides (only HypoPG uses hooks and it doesn't open\nsavepoints), but the name was undocumented as reserved.\n\nContract note for future hook authors; no behavior change.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: reserve __pgmcp_sp savepoint name on RunHooks (#8)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:09:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "67eef8f8b2ed1dc83d9a6cc7c26ddabc6e3ec57e",
"body": null,
"is_bot": false,
"headline": "v0.6.14",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:01:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f539a714f9af4b06fa6331faaeecee36b07368ab",
"body": "paramValue was unbounded recursive via z.lazy(). A pathologically nested\nrequest body could surface a `Maximum call stack size exceeded`\nRangeError instead of a clear validation error. In practice JSON.parse\ncaps recursion well below Node's stack limit, but defense in depth: a\nclear \"exceeds maximum\n[…]\nnesting, mixed array/object nesting,\nand the per-element semantic (one over-cap entry rejects the whole\narray even when surrounded by scalars).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: cap paramValue nesting depth at 32 levels (#7)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:01:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "75afb6ca939f79b8c988be1a79ad3738ff41cd41",
"body": null,
"is_bot": false,
"headline": "v0.6.13",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:49:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "324dd632f79f11ed3fcd4bcc30ea414c6cc4e432",
"body": "pg_cancel_backend / pg_terminate_backend return false for both\n\"no such PID\" and \"permission denied\", but postgres emits a NOTICE\ndistinguishing them. The handler now attaches a 'notice' listener to\nthe underlying client during the signal call and folds any captured\nNOTICE into the `note` field when\n[…]\nll (which bypasses\nrunInternal because it needs the per-client notice listener) reports\nerrors with the same shape as the rest of the codebase.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: capture pg NOTICE in pg_kill to disambiguate signaled=false (#6)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:49:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ff5a88ea07284423c85dd70ea35100c5311cbb6",
"body": null,
"is_bot": false,
"headline": "v0.6.12",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:09:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "044d3c7cd79068cc87595e7107ec771cf608f754",
"body": "Row-level contention (SELECT FOR UPDATE + UPDATE) is the common case in\napp workloads. The waiter queues on a `transactionid` lock with\npg_locks.relation = NULL because the wait is on the holder's xid, not on\na relation. The previous CASE returned `relation: null` here and gave\nthe agent no hint as \n[…]\ng\nACCESS EXCLUSIVE test renamed to \"table-lock contention\" to clarify it\ncovers the bl.relation IS NOT NULL branch. Both pass on PG17 and PG18.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: resolve relation for transactionid waits in pg_inspect_locks (#5)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:09:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bac0d3b8e7d8348291ed09a1d5b8df25e0c73754",
"body": null,
"is_bot": false,
"headline": "v0.6.11",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:43:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b708335588eaef6ea73acabed71b30693e13cd7",
"body": "inspect_locks test:\n- Replace the 500ms hardcoded sleep with a 5s polling loop on\n pg_blocking_pids(). Beats both flakes on slow CI hosts (waiter not\n yet queued at 500ms) and wasted time on fast ones.\n- Move await on waiterPromise into the finally block so an assertion\n failure mid-test still dr\n[…]\nuser-facing changelog.\n- Rewrite [0.6.10] to describe the six shipped coverage tests directly\n rather than narrating the journey to get there.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: tighten inspect_locks test, consolidate changelog",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:42:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "152acd9d8d64651f604da01b0af69a7008bba006",
"body": null,
"is_bot": false,
"headline": "v0.6.10",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:38:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "14d666828b3bcf9281959ac3b88248e5c6d57475",
"body": "The test failed in CI three times running (v0.6.7, 0.6.8, 0.6.9) for\ndifferent reasons each time, while passing locally. Root cause turned\nout to be that pg_stat_statements on PG17/18 fingerprints\n`SELECT 1 AS x_a` and `SELECT 2 AS x_b` to the same query id -- column\naliases are stripped from the ju\n[…]\nage additions are unaffected.\n\nReplaced the test with a note documenting the attempts so future\ncontributors don't redo the same investigation.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: remove the pg_top_queries orderBy=calls ordering test",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:38:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "abb480cbbbcb38705ecbe35a6984179e78905a98",
"body": null,
"is_bot": false,
"headline": "v0.6.9",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:33:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65d7d94c56a2231dab052754212285d660d35be5",
"body": "The previous attempt routed marker queries through pgQuery.handler,\nwhich wraps user SQL in DECLARE ... CURSOR FOR ... The cursor wrap\nmade the test depend on pg_stat_statements.track_utility=on so the\nDECLARE itself would be tracked -- CI postgres images don't guarantee\nthis default, so the marker \n[…]\ness of track_utility. Also adds a diagnostic dump on\nfailure so any future divergence between local and CI is visible from\nthe assertion error.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: stage pg_top_queries markers via runInternal, not pgQuery",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:33:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "127a20ddb2ef16a8abcc67a567adfba3fbe27a03",
"body": null,
"is_bot": false,
"headline": "v0.6.8",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:28:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "803f8b0f9911b99eceba7f4a1d142036a17cac41",
"body": "The numeric-ordering test for pg_top_queries staged a 12-call query and\na 2-call query then asserted ranking. CI starts with a fresh\npg_stat_statements that accumulates 100+ distinct normalized queries\nfrom fixture setup and earlier integration tests, which pushed the\n2-call marker out of the handle\n[…]\nible.\n\nReset pg_stat_statements before staging the markers. If reset isn't\navailable (no superuser / no extension), skip the assertion cleanly.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: reset pg_stat_statements before the calls-ordering assertion",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:28:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5836cf23ae85fdec7d898da29519b0868573d2ba",
"body": null,
"is_bot": false,
"headline": "v0.6.7",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:24:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a566b86517a132db179a5d470bc328d5f66276ea",
"body": "Adds seven integration tests for branches the existing suite exercised\non only one side, plus one structural regression guard.\n\n- pg_inspect_locks: real ACCESS EXCLUSIVE contention with two side\n clients. Covers the LATERAL unnest of pg_blocking_pids() and the\n per-(blocked, blocker) row shape the\n[…]\nchemas and excludes pg_*/information_schema.\n- pg_describe_table on a materialized view: kind='materialized_view'\n branch of the relkind CASE.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: close gaps from the coverage audit",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:23:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d819cfa1d0d8bfe82dcf8f996e54b12c2bcebd01",
"body": null,
"is_bot": false,
"headline": "v0.6.6",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:07:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7ad3c2615bacd281c98d64bb497c0186ac086d4",
"body": "… shape\n\npg_table_privileges is backed by information_schema.table_privileges,\nwhich postgres filters by what the calling role can see -- least-\nprivileged roles may miss grants on unrelated third-party roles. Call\nout the caveat and recommend pg_read_all_data / superuser for a\ncomplete picture.\n\npg\n[…]\ng_pids(), so a session waiting\non N blockers appears on N rows. Document the shape and suggest\ngrouping by blocked_pid for a per-session count.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: clarify pg_table_privileges visibility and pg_inspect_locks row…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:02:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0ad274c94b79466c6236c0c5743be3c2a6f00834",
"body": null,
"is_bot": false,
"headline": "v0.6.5",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T06:30:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0712feb384f9ce4f8dcd2d7735f00f517d2bc27d",
"body": "…rule\n\n- pg_explain returns an explicit error if EXPLAIN comes back with zero rows\n rather than a misleading `{plan: \"\"}` / `{plan: undefined}` payload.\n- pg_kill description: pg_signal_backend does not cover superuser-owned\n backends; only a superuser can signal another superuser's session.",
"is_bot": false,
"headline": "fix: tighten pg_explain zero-row response, clarify pg_kill superuser …",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T06:30:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e62543b086fb0e4cb3a9a7c7dca5b17608470dfb",
"body": "Add server.json + mcpName + four release.yml steps. OIDC auth.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: publish to the Official MCP Registry via OIDC (v0.6.4)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T18:15:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b01fa284382a3bbc8f1f111f38944f02c12676d7",
"body": "release.sh only bumps package.json; CHANGELOG headings move by hand.\n0.6.3 was the deferred pg_replication_status _warnings test.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: backfill CHANGELOG [0.6.3] heading",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:22:53Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3d5b15e809912cb83ad0211c9395494660ee84da",
"body": null,
"is_bot": false,
"headline": "v0.6.3",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:20:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ee9504da2aa55b31fb00915c82168ed2c13aeea4",
"body": "The success-case shape was pinned in 0.6.1; the populated-_warnings path\nwas deferred because a plain LOGIN role doesn't actually trigger\npermission-denied on a standalone cluster (pg_current_wal_lsn is\nPUBLIC-callable, slot views just return empty for non-pg_monitor).\n\nThis test REVOKEs EXECUTE on \n[…]\nhe rest of the suite. The success-\ncase shape assertion in each of their existing tests already protects\nthe construction code from regression.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: close the deferred pg_replication_status _warnings populated path",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:19:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9d3cc56e370d3ae6e6eeab5abfea7363f1acde27",
"body": "release.sh only bumps package.json -- the CHANGELOG headings have to be\nmoved by hand. Closes the [Unreleased] block for 0.6.1 (the fix bundle)\nand adds an Infrastructure entry for 0.6.2 (test coverage only, no\nbehavior change).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: backfill CHANGELOG [0.6.1] and [0.6.2] headings",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:07:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4cddc0324d5849beaa386cc7bae9bbd809bf66cc",
"body": null,
"is_bot": false,
"headline": "v0.6.2",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:01:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdf14cdc349649af1dbfad50939bbef2e8539e04",
"body": "Adds integration coverage for pg_kill (signaled=false on PID 1, and both\ncancel/terminate against an out-of-band pg.Client backend), the previously\nzero-positive-coverage pg_advisor checks (public_tables_without_rls,\nsequence_exhaustion with the post-0.5.2 numeric-precision formula),\npg_unused_index\n[…]\nr_full sequence at 80%, and two\ncluster-scoped roles (mcp_test_group, mcp_test_member); teardown drops\nthe roles in order so reruns stay green.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: close coverage gaps surfaced by the coverage audit",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:00:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fbdd36ebafda9fc96e292a589b9c06c4463403a9",
"body": null,
"is_bot": false,
"headline": "v0.6.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T16:41:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4bacab0d169ef25136d018bc4bdf06f0f4b84ec3",
"body": "- identSchema enforces postgres's 63-byte NAMEDATALEN limit (not JS\n char length) and is shared from params.ts across schemas/stats/admin/\n explain; explain.ts also byte-checks per-piece in validateHypoIndex\n so direct-handler callers bypassing Zod get the same protection.\n- pg_advisor.tables_wit\n[…]\nt silently fall through to pg's default.\n- pg_top_queries extension presence + version probes consolidated into\n a single round-trip (3 -> 2).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: tighten ident validation, advisor coverage, partial-failure shape",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T16:40:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9d2ad5ec728817171ced16081dc853190099358c",
"body": null,
"is_bot": false,
"headline": "v0.6.0",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T04:00:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93700395e1d6ad5d80e0129e934a4a4ba4427b32",
"body": "`pg_readonly` always runs inside `BEGIN READ ONLY` regardless of\n`ALLOW_WRITES`, so hosts that gate tools individually (Claude Code\npermissions, mcp.hosting) have a stable always-safe target to auto-allow.\n`pg_query` keeps its existing behavior.\n\nREADME reframes the access story around the role in `\n[…]\ncipes), and positions\n`ALLOW_WRITES` as defense-in-depth. The postgres role enforces server-side;\nthe env var is the belt to the role's braces.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add pg_readonly tool, lead with role-based access control",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T03:57:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1f1d4c4b73891632dc4bcafac3a38ac385456f08",
"body": "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add \"Add to mcp.hosting\" install button",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T19:37:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ef5fbffdb69697f9858f5c9c3b3a310f2da09e28",
"body": null,
"is_bot": false,
"headline": "v0.5.4",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T04:15:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abb558b415044720f0fea5411590dd77017c87db",
"body": "Mechanical sweep -- every U+2014 em-dash across source, docs, CHANGELOG,\nREADME, workflows, and release.sh replaced with a single ASCII hyphen.\nNo logic changes; lint clean, tests 139/139 green.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "style: replace all em-dashes with hyphens",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T04:00:46Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "dc859e4ad101c2e317f438263835bb7bfa76ea2a",
"body": "…hest\n\nThe prior verify step sampled the highest non-current version and\nchecked if its deprecated string matched $MESSAGE. That's correct only\nwhen the deprecate range covers the highest version. A narrow range like\n'0.5.x' wouldn't touch the highest version (0.6.0) at all, so the\nsampler would tim\n[…]\nmatch means\nthe deprecate landed. As a side benefit, the per-version state dump now\nreuses the same doc instead of issuing N+1 follow-up calls.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix deprecate.yml verify sampler — check any-version-matches, not hig…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T03:09:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2edfbac026620e32792b0a174e8f2606df66a6a9",
"body": "Self-contained writeup framing the structural fix (extended query protocol)\nagainst the Datadog-documented stacked-query injection in the archived\n@modelcontextprotocol/server-postgres. Includes migration diff and a\nshort tour of what else changes if you swap. Draft; not yet published.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add blog post draft on the deprecated postgres-mcp SQLi",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T03:02:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a5fa8b188f2f7173ff3d20bdb5e5709b13c33f0a",
"body": "Mirrors release.yml -- workflow_dispatch input, NODE_AUTH_TOKEN from\norg NPM_TOKEN, no local WebAuthn session. Inputs pass via env vars;\nshares the release-npm concurrency group with release.yml. Verify\nstep retries the public-registry view to outlast CDN propagation\nlag (~10-30s typical) so the run log accurately reflects state.\n\nTrigger:\n gh workflow run deprecate.yml \\\n -f versionRange='<X.Y.Z' \\\n -f message='outdated -- install latest'",
"is_bot": false,
"headline": "Add deprecate.yml: CI-driven npm deprecate via NPM_TOKEN",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T03:01:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cff22c9a20e7b877b565bee07e76c42140f3ce90",
"body": null,
"is_bot": false,
"headline": "v0.5.3",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:53:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58bb00971c4a45c304795ddacb6a76fd38794530",
"body": "In-range bumps to hono, fast-uri, express-rate-limit, ip-address. All\nfour reach us only through @modelcontextprotocol/sdk's HTTP-transport\npath, which this server doesn't use (stdio only); esbuild tree-shakes\nthem out of dist/index.js. Practical exposure was already nil; this\nclears the audit noise on future `npm install` runs.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: npm audit fix — patch transitive deps via MCP SDK",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:51:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4a655d3337106cf3c1bbbeec6491cedee3e3860b",
"body": "…ith 3 updates (#4)\n\nBumps the dev-dependencies group with 3 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [zod](https://github.com/colinhack\n[…]\non-update:semver-minor\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump the dev-dependencies group across 1 directory w…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-14T02:48:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6489ed822508859c78697cc2dae3b06d082c9705",
"body": "0.5.1 shipped without a CHANGELOG entry; 0.5.2 had no entry before tag.\nDocuments the type-name lookup fix and WSL drive translation in 0.5.1,\nand the full-pass findings + release-flow hardening + workflow smoke\ntest retry in 0.5.2.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Backfill CHANGELOG entries for 0.5.1 and 0.5.2",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:45:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "5e8b43bcbf28945e148fe4db5ac5e5639647387e",
"body": "Registry propagation has two cache layers that desynchronize across CDN\nedges: `npm view` reads metadata, `npx -y` fetches the tarball. The prior\nloop polled `npm view` for the version to appear, then did a single `npx\n-y` -- on v0.5.2 (2026-05-14) `npm view` returned 0.5.2 instantly but the\nimmediate `npx` hit a different edge and returned ETARGET. Retrying the\nwhole smoke check (6 x 10s) covers both cache layers.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Retry the npx smoke test itself, not just the npm view probe",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:40:04Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a0a64671e2121eaa365165f858c78180e0ee50b3",
"body": null,
"is_bot": false,
"headline": "v0.5.2",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:36:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c377a1a97edaf13ad0c45791c512e04958fac45",
"body": "…fault, doc/script hygiene\n\n- schemas.ts: pg_describe_table emits a warning when the kind fetch fails\n instead of silently reporting \"table\" for what may be a view.\n- admin.ts: pg_advisor sequence_exhaustion divides in numeric, not float8;\n preserves precision past 2^53 where the >= threshold chec\n[…]\nate.\n- release.sh: Verify step uses the same 5x5s retry loop as the CI smoke test\n instead of a one-shot sleep that flakes on a slow registry.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Address full-pass findings: kind warning, numeric pct_used, hypopg de…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:33:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a51491146cf0b31be3ef8f90e950d3d30403447b",
"body": "Matches the pattern Jeff converged on in electron-mcp/release.yml. The\n${{ github.workflow }} interpolation evaluates to the workflow's\n'name:' field, so a future rename ('Release' -> 'Publish' or similar)\nwould silently fragment the queue across the rename window: the old\nruns are still grouped und\n[…]\n put all release\nruns into one queue), so no observable behavior change. The fix is\nprophylactic against a future workflow rename.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Use literal 'release-npm' as concurrency group key",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-06T19:44:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8b3aae6b2c7b49f8a6b52cd8cfc563cfe01bffa9",
"body": "Two bugs in the prior 'Harden release flow' commit, plus a related\nbuild-redundancy item from the same review:\n\n* release.yml: the concurrency group was 'release-${{ github.ref }}'.\n github.ref for a tag push is 'refs/tags/vX.Y.Z' -- different per tag,\n so two tags pushed back-to-back would get se\n[…]\nl-fast value (catches tsup config\n errors at PR time, not release time). Comment in each ci.yml\n explains the per-repo decision.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix CI concurrency ref-scope bug; remove redundant build step from CI",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-06T19:32:23Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6f9a1c4532cc8de6dcf2eb5d8ba3d183f04fdf6b",
"body": "…concurrency\n\n* git tag now uses -a so 'git push --follow-tags' actually pushes it.\n Lightweight tags are silently skipped by --follow-tags (release commit\n lands but the tag never reaches origin), which would have broken every\n CI release after this point. Caught by review before any failed run.\n[…]\nyml gains a top-level 'concurrency' block so two tags pushed\n back-to-back serialize their publish jobs instead of racing on npm.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Harden release flow: annotated tags, versioned idempotency check, CI …",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-06T19:16:05Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0706fdb815b9c0c73406d033a8debca6be424adb",
"body": null,
"is_bot": false,
"headline": "v0.5.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T17:15:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e47dac0975e341e622d4fd7825fc2f92bd9d7ec",
"body": "…ive translation\n\n- api.ts: route resolveTypeNames through safeResolveTypeNames so a transient\n pg_type lookup error logs to stderr and falls back to {} instead of\n swallowing the user's successful query result.\n- release.sh: replace hardcoded /c/ -> /mnt/c/ with a sed regex so the WSL\n matrix step works from any Windows drive.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: preserve query rows on type-name lookup failure; portable WSL dr…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T17:15:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b0818de320573ec6b17e09a0a5189d3d7833feec",
"body": "BREAKING: engines.node bumped from >=18 to >=20.\n\nCI has been on [20, 22] since 0.4.1, integration + release exclusively\non Node 20+. Node 18 was effectively unsupported in practice; this\nrelease makes the declared support match. esbuild target (\"node18\" ->\n\"node20\") and release.sh prerequisite comment updated to match.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.5.0",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T05:21:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "efa4822776eb3aee0ac1b77e8b2b747021f44f28",
"body": "Node 18 reached end of life on 2025-04-30. Drop it from the CI matrix\nand bump package.json engines to >=20 so the supported-version contract\nmatches what we actually test.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: drop Node 18 from matrix, bump engines to >=20",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T05:11:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "acca36979074b8aa371e6ab26cc90b2d5e771334",
"body": "Lockfile carried 0.4.0 in the root version fields because the bump in\nthe v0.4.1 commit did not re-run npm install. No dependency changes.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: sync package-lock.json to 0.4.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T05:04:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "97638b0b2d7aa912fd45b2cd829696f3e67590c3",
"body": "Post-publish step does `npx @yawlabs/postgres-mcp@${VERSION} --version`\nfrom a temp dir and asserts the output matches the tag, so a packaging\nregression (missing shebang, bad \"files\" entry, broken esbuild output)\nfails the release run instead of reaching real users. Includes a 5x5s\nretry loop for registry propagation lag.\n\nWill apply to v0.4.2+; v0.4.1 already shipped clean per `npm view`.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: smoke-test published package after release",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T04:51:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "824d5cc7ed4ff1f9bd05afafa1e81d9109d79f11",
"body": "Bumps the dev-dependencies group with 1 update in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).\n\n\nUpdates `@biomejs/biome` from 2.4.12 to 2.4.13\n- [Release notes](https://github.com/biomejs/biome/releases)\n- [Changelog](https://github.com/biom\n[…]\non-update:semver-patch\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump @biomejs/biome (#2)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-05T04:50:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d564963948ae5da7bdbfd9911fd6a8c832862f99",
"body": "- withSharedClient: multi-query handlers share one connection (no pool starvation)\n- runUserQueryBounded distinguishes DECLARE vs FETCH/CLOSE failures (retry safety)\n- pg_top_queries orderBy \"calls\" sorts numerically (was lexical)\n- pg_describe_table not-found message escapes user names via JSON.str\n[…]\niers\n- pg_top_queries calls/rows now bigint-as-text for consistency\n- CI plumbing mirroring tailscale-mcp: ci.yml, integration.yml, release.yml\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.4.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T04:42:50Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 33,
"commits_last_year": 125,
"latest_release_at": "2026-07-21T23:51:30Z",
"latest_release_tag": "v0.7.0",
"releases_from_tags": false,
"days_since_last_push": 8,
"active_weeks_last_year": 9,
"days_since_latest_release": 8,
"mean_days_between_releases": 7.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 75,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@yawlabs/postgres-mcp",
"exists": true,
"license": "MIT",
"keywords": [
"postgres",
"postgresql",
"database",
"mcp",
"model-context-protocol",
"ai",
"agent",
"claude",
"claude-code",
"cursor",
"llm",
"sql",
"schema",
"explain"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@yawlabs/postgres-mcp",
"is_deprecated": false,
"latest_version": "0.7.0",
"repository_url": "https://github.com/YawLabs/postgres-mcp",
"versions_count": 32,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 6298,
"first_published_at": "2026-04-21T16:40:18.757000Z",
"latest_published_at": "2026-07-21T23:51:21.679000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 8
}
]
},
"popularity": {
"forks": 1,
"stars": 3,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-06-27",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 53014,
"source_files_sampled": 26,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 11,
"open_issues": 1,
"closed_ratio": 0.889,
"closed_issues": 8,
"closed_unmerged_prs": 5
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "jeffyaw",
"commits": 117,
"avatar_url": "https://avatars.githubusercontent.com/u/4382801?v=4"
},
{
"type": "User",
"login": "HighviewOne",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/6977445?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.975
},
"quality_signals": {
"has_ci": false,
"has_tests": true,
"ci_workflows": [],
"has_docs_dir": true,
"linter_configs": [
"biome.json"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 1,
"reason": "Found 4/27 approved changesets -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 6,
"reason": "project has 2 contributing companies or organizations -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 5,
"reason": "dependency not pinned by hash detected -- score normalized to 5",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 1,
"reason": "SAST tool is not run on all commits -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "17 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "b2d8fbc30ac5cc0c2f184cd25faf3eacbe5c6988",
"ran_at": "2026-07-30T20:05:29Z",
"aggregate_score": 4.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-21T23:51:12Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-21T22:37:37Z",
"ci_last_conclusion": null,
"oldest_open_issues": [
{
"number": 25,
"created_at": "2026-07-30T07:52:21Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/YawLabs/postgres-mcp",
"host": "github.com",
"name": "postgres-mcp",
"owner": "YawLabs"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"security": 45,
"vitality": 74,
"community": 42,
"governance": 55,
"engineering": 54
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 63,
"inputs": {
"commits_last_year": 125,
"human_commit_share": 0.95,
"days_since_last_push": 8,
"active_weeks_last_year": 9
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 8 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "9/52 weeks with commits",
"points": 6.2,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 9
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "125 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 125
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 33,
"latest_release_tag": "v0.7.0",
"releases_from_tags": false,
"days_since_latest_release": 8,
"mean_days_between_releases": 7.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "33 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 33
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 8 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~7.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 7.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 42,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 5,
"inputs": {
"forks": 1,
"stars": 3,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "3 stars",
"points": 4.9,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 3
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 63,
"inputs": {
"packages": [
"@yawlabs/postgres-mcp"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 6298
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "6,298 downloads/month across npm",
"points": 50.7,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 6298,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 55,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 18,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.975
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 98% of commits",
"points": 0.6,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 98
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 6,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"merged_prs": 11,
"open_issues": 1,
"closed_issues": 8,
"issue_closed_ratio": 0.889,
"closed_unmerged_prs": 5
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "89% of issues closed",
"points": 41.6,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 89
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "11/16 decided PRs merged",
"points": 26.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 11,
"decided": 16
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 4/27 approved changesets -- score normalized to 1",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"followers": 9,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "YawLabs",
"public_repos": 27,
"account_age_days": 169
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "9 followers of YawLabs",
"points": 7.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 9,
"login": "YawLabs"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "27 public repos, account ~0 yr old",
"points": 11.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 27
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@yawlabs/postgres-mcp"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 8
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 8 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 8
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "32 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 32
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 54,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_ci": false,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "biome.json",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "biome.json"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 45,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dangerous-Workflow, Packaging, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dangerous_workflow",
"packaging",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 45,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 4.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 4/27 approved changesets -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 2.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 1",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "17 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 1
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 68,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 39,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.726,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "69 of 95 human commits state their intent (structured subject or explanatory body)",
"points": 38.7,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 69,
"sampled": 95
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.66,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0.05
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "biome.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "biome.json"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "66 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 66,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "5 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 5,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 5,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 53014,
"source_files_sampled": 26,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/26 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 26,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-30T20:05:38.744975Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/y/YawLabs/postgres-mcp.svg",
"full_name": "YawLabs/postgres-mcp",
"license_state": "standard",
"license_spdx": "MIT"
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken — npm.