tphakala / agy-mcp

Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 3 direkte und 5 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.

Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 8 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 0 tragen bekannte Advisories, davon 0 direkte.

Keine bekannten Advisories betreffen die bewerteten Abhängigkeiten.

Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.

{
  "data": {
    "repo": {
      "topics": [
        "agy",
        "ai-agents",
        "antigravity",
        "cli",
        "code-review",
        "gemini",
        "golang",
        "mcp",
        "mcp-server",
        "model-context-protocol",
        "awesome-mcp-servers",
        "model-context-protocol-server",
        "claude",
        "codex",
        "copilot"
      ],
      "is_fork": false,
      "size_kb": 394,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 544026
      },
      "pushed_at": "2026-07-21T08:24:01Z",
      "created_at": "2026-06-09T11:07:26Z",
      "owner_type": "User",
      "updated_at": "2026-07-21T08:22:40Z",
      "description": "MCP server that wraps the Antigravity CLI (agy): run agy prompts and peer reviews as async, restart-resilient jobs over stdio or Streamable HTTP.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Tomi P. Hakala",
      "type": "User",
      "login": "tphakala",
      "company": null,
      "location": "Muurame, Finland",
      "followers": 78,
      "avatar_url": "https://avatars.githubusercontent.com/u/7030001?v=4",
      "created_at": "2014-03-22T09:31:18Z",
      "is_verified": null,
      "public_repos": 64,
      "account_age_days": 4506
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2026-07-21T08:26:11Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2026-07-21T07:10:21Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2026-07-19T09:49:50Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2026-07-18T06:58:26Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2026-07-10T08:33:50Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "fb38d0558cedc02dafc699caeb34d888e86c7324",
          "body": "* mcptools: declare tool annotations and sharpen tool descriptions\n\nAbsent MCP annotations are not neutral. The spec defaults them to\ndestructiveHint=true, openWorldHint=true and readOnlyHint=false, so the\nfour read-only tools (agy_status, agy_wait, list_models, list_sessions)\nwere advertising thems\n[…]\nied: a delegated run can modify\nyour files. It also records the declared annotations, noting they are\nhints a client may ignore, and the parameter constraints worth knowing\nbefore reading the schemas.",
          "is_bot": false,
          "headline": "Declare tool annotations and correct the tool descriptions (#95)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-21T08:22:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "777e27bdda72fadc1c0c237af751a7186c27850e",
          "body": "* config: start without agy on PATH, defer the lookup to first exec\n\nThe server refused to start when agy was not on PATH. That is stricter than\nthe protocol needs: initialize, tools/list, and list_sessions never exec agy,\nso a client could not even discover the tool surface over a binary it might\nn\n[…]\n\nunusable precisely because each job runs with cmd.Dir set to its own cwd.\nReporting it as \"not found\" sent the reader hunting for an install that is\nalready there.\n\nFound in review by Copilot on #94.",
          "is_bot": false,
          "headline": "config: start without agy on PATH, defer the lookup to first exec (#94)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-21T07:07:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c6c0b4ada51517bb828b583e229ecbe2b220a023",
          "body": "An agy_run_sync call that outlives its wait cap returns normally with\nstate=running, the job_id, and a note; the job keeps running under its\ndetached supervisor. Nothing has failed. But the guidance around that\npath pushed callers the wrong way in two respects.\n\nFirst, the tool description advertise\n[…]\nnt\nfresh at each MCP initialize, so this changes which tool a model\nreaches for by default on research-shaped prompts as soon as the\nupgraded binary is used. No API, schema, or on-disk format changes.",
          "is_bot": false,
          "headline": "mcptools: steer long work to agy_run and name agy_wait on overrun (#92)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-19T09:41:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2859fef5f3d2ddf3480cc9f757f79e0f3a048d58",
          "body": "Local implementation plans are private scratch that must never be\ncommitted (see the .gitignore comment). The existing patterns (/plans/,\n/specs/, *-design.md, *-plan.md) did not cover superpowers-generated\nplans under docs/superpowers/plans/, which let two of them slip in via\ngit add -A. Ignore /docs/superpowers/ so it cannot recur.",
          "is_bot": false,
          "headline": "chore: ignore superpowers plan docs so they cannot be committed",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-18T10:03:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "00e3b1a19975d9519d54feaa1564d07382472010",
          "body": "The async completion wake exits 2, which Claude Code renders under a\n\"Stop hook blocking error from command PostToolUse:...\" wrapper it\nprepends itself. In real session use that framing reads as a tool\nfailure even though the wake is a normal job-done signal, so a model\ncollecting the result can mis\n[…]\nad so the signal\nis unambiguous under the wrapper. Add a maintainer note on hookWaitMain\nexplaining why the framing must stay, and lock it in with a \"not an\nerror\" assertion on each wake-message test.",
          "is_bot": false,
          "headline": "hookwait: frame completion wake as a notification, not an error (#90)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-18T10:03:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "43e22536463fbfa20921ab0af26f6f73f768d12a",
          "body": "…#87)\n\nThe server passed nil ServerOptions, so it sent no MCP instructions\nstring at initialize and connecting clients under-reached for the tools.\nWire ServerOptions.Instructions with neutral, general-audience capability\ndocs: what agy is for (peer review, rubber-duck, research, background\ndelegati\n[…]\nery weight even when a client\ndefers tool schemas until searched.\n\nAdd TestHTTPServeAdvertisesInstructions to guard against a regression\nback to nil ServerOptions or terse, use-case-free descriptions.",
          "is_bot": false,
          "headline": "mcptools: advertise MCP server instructions and name tool use cases (…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-18T07:51:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ed1e0eb5fbddc60a67e9f3dcf32aec78c7ead92f",
          "body": "admit() acquires the in-process gate slot before the cross-process advisory\nlock, but releaseKey() released them in the same order (gate first). That\nleft an observable window where the gate key was free while this process\nstill held its own crosslock fd, so a concurrent same-key StartJob could pass\n[…]\nocumented \"release only\n  after the process is gone\" contract. Move its cleanup into the reap\n  goroutine so a conflicting same-key run cannot start while the dying agy\n  still holds its session lock.",
          "is_bot": false,
          "headline": "manager: release cross-process lock before gate slot in releaseKey (#85)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-18T06:48:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d54eac20ab8b5d8ae98b842d2dc76abedfe61f75",
          "body": "…s (#84)\n\n* manager: add WaitTerminal shared wait primitive\n\n* mcptools: route agy_run_sync wait through manager.WaitTerminal\n\n* mcptools: add agy_wait tool for blocking on an existing job\n\nRegisters agy_wait, which shares agy_run_sync's wait phase (awaitJob,\nparseWait) to block on a job already sta\n[…]\nant\n\n* mcptools: drop redundant pre-check, share the poll-cadence constant\n\n* hookwait: wake on interrupt, tighten suppression, bound stdin\n\n* tests: dedupe fixtures, cover grace cancel; README polish",
          "is_bot": false,
          "headline": "Add completion wake: agy_wait tool, wait-job and hook-wait subcommand…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-17T14:01:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1682673027bd6a5ec6a9a31fcc4216a3aa9fd7fe",
          "body": "* rules: audit remaining SA1019/modernize overlap (#77)\n\nEmpirically verified every candidate from #77's follow-up list against\nthe actual pinned golangci-lint output, same methodology as #31/#78:\n\n- Dropped runtime.go's GorootDeprecated: SA1019's message for\n  runtime.GOROOT is more detailed than t\n[…]\n ./..., gofmt clean, GOOS=darwin/windows\ngo vet cross-compile checks, repro confirming both restored rules fire\non the parallel-access pattern and the short-name Type.Is form still\nresolves correctly.",
          "is_bot": false,
          "headline": "rules: audit remaining SA1019/modernize overlap (#83)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-10T10:56:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8a14ede543da525e20900f3c7fb1759de77587af",
          "body": "* manager: fail fast on unexpected errors in retry-loop tests (#79)\n\nThree test poll loops treated any error as \"keep retrying\" rather than\ndistinguishing the expected retryable case from a genuine bug, so a real\nregression there would time out with a generic message instead of\nsurfacing immediately\n[…]\nce the outcome was already final (job done, the\ncapture goroutine's pending flag cleared, and no id was ever found),\ninstead of recognizing that state as a definitive negative and failing\nimmediately.",
          "is_bot": false,
          "headline": "manager: harden retry-loop error handling in a few tests (#82)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-10T10:22:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "36f5c2dbae3eb19d9c3c0f0a0cb451cd6e56321c",
          "body": "…coverage (#80)\n\n* manager: consolidate test poll loops and builders, add darwin spawn-fail coverage\n\nResolves the remaining deferred item from #34 and all of #71.\n\n- Add testutil.WaitFor(t, timeout, cond, msg), replacing about a dozen\n  hand-rolled poll-until-deadline loops (inconsistent timeouts a\n[…]\nserving consolidation PR.\n\nVerified: go build/vet/test ./... -race (linux), golangci-lint run\n./... (0 issues), gofmt clean, GOOS=darwin/windows go vet and GOOS=darwin\ngo test -c cross-compile checks.",
          "is_bot": false,
          "headline": "manager: consolidate test poll loops/builders, add darwin spawn-fail …",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-10T09:59:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "265aabfeb8a2344c4f400489c3d875077c0dc678",
          "body": "* rules: resolve overlap and coverage policy calls (#31)\n\nThree ruleguard/govet-overlap decisions were left open in #31 after #61\nlanded the correctness and message fixes. Resolve them:\n\n- Drop AppendWithoutValues and JoinHostPort as duplicates of stock\n  analyzers with no informational gain: govet'\n[…]\ns ruleguard ./rules/, golangci-lint run ./...,\ngo build/vet/test ./..., plus a throwaway repro test confirming both\nJoinHostPort and the usetesting context checks fire against the real\n.golangci.yaml.",
          "is_bot": false,
          "headline": "rules: resolve overlap and coverage policy calls (#78)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-10T09:27:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "57f53ee63c814d69c5790e7ef3154bdd620815a7",
          "body": "…n job ids\n\nvalidJobID accepted Windows reserved device names (CON, NUL, COM1),\ncolon forms (drive-relative C:foo, NTFS ADS foo:bar), and trailing\ndot/space ids that Win32 normalization aliases to other names\n(\"job1.\" -> \"job1\", \".. \" -> \"..\"). None of these were reachable on a\nwrite path: job ids a\n[…]\n no longer reserved since Windows 11\nand Go defers them to RtlIsDosDeviceName_U at runtime.\n\nReported in #76; the report's traversal and DoS claims do not hold, but\nthe validation gap itself was real.",
          "is_bot": false,
          "headline": "fix(jobstore): reject Windows reserved names and trailing dot/space i…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-10T08:53:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6cfbe19c79fb3f8040c523a742af04d0e4e64123",
          "body": "* chore(deps): bump Go toolchain to 1.26.5, update indirect modules\n\ngo1.26.3 (the toolchain go.mod was implicitly resolving to) is affected by\nfive stdlib vulnerabilities reachable from this code (crypto/tls, crypto/x509,\nnet/textproto, mime, os), all fixed by 1.26.4/1.26.5. Pin an explicit\ntoolcha\n[…]\nchema); the source-side duplication is\nfixed by extracting shared constants in manager.go and mcptools/tools.go.\n\nVerified: build, vet, ruleguard build, go test -race, and golangci-lint run\nall clean.",
          "is_bot": false,
          "headline": "chore: dependency and lint maintenance (#75)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-10T08:18:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "157013b8518856ea8765b55a8b884acdf09098c9",
          "body": "Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.41.0 to 0.46.0.\n- [Commits](https://github.com/golang/sys/compare/v0.41.0...v0.46.0)\n\n---\nupdated-dependencies:\n- dependency-name: golang.org/x/sys\n  dependency-version: 0.46.0\n  dependency-type: direct:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/sys from 0.41.0 to 0.46.0 (#69)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T07:55:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f4ac475be786e09486f848c8d259b64cf7961246",
          "body": "…#66)\n\nBumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.1 to 9.3.0.\n- [Release notes](https://github.com/golangci/golangci-lint-action/releases)\n- [Commits](https://github.com/golangci/golangci-lint-action/compare/82606bf257cbaff209d206a39f5134f0cfbfd2\n[…]\nirect:production\n  update-type: version-update:semver-minor\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T07:55:13Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1e775873990f2557aaea23101a9a390be5d5cd6f",
          "body": "Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 7.2.2 to 7.2.3.\n- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)\n- [Commits](https://github.com/goreleaser/goreleaser-action/compare/5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89...f06c13\n[…]\nirect:production\n  update-type: version-update:semver-patch\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 (#65)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T07:55:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d3ae88382d05692af9e9f73ab99dd92df94dbfe9",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v6...v7)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/checkout from 6 to 7 (#64)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-07-10T07:55:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "04da931b26fcac72a34b3c493ce200aa007fd87d",
          "body": "…m (#70)\n\n* feat(proc): share process-group supervision with darwin\n\n* feat(supervisor): share signal + cancel wait with darwin\n\n* feat(manager): darwin liveness via sysctl start time + spawn guarantee\n\n* test(manager): run supervision tests on darwin, pin liveness by start time\n\n* test(mcptools): r\n[…]\naths share one teardown sequence and cannot silently diverge.\n- fix stale /proc-comm comments in the ported posix tests and fakesupervisor.go\n  (darwin pins liveness by absolute start time, not comm).",
          "is_bot": false,
          "headline": "feat: support macOS (darwin) as a first-class job-supervision platfor…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-09T18:22:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "445e254377ed1dc135f7dfe756b32d72dd7ae68b",
          "body": "* feat: port async job supervision to Windows\n\nJob supervision (agy_run / agy_status / agy_cancel) was Linux-only; StartJob\nand supervisor.Run refused early via proc.Supported. This implements it on\nWindows behind the existing build-tag split (Closes #67).\n\n- proc: replace the pid-based SetGroup/Ter\n[…]\n what the new windows-latest CI job surfaced.\n- tests: add a skipIfWindows helper and a wantUUID1 const in package manager to\n  satisfy goconst for the Windows skips and the session-filter assertions.",
          "is_bot": false,
          "headline": "Port async job supervision to Windows (#68)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-07-06T15:34:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "53772dec73d451c60fd21f86c623e0358ccffa16",
          "body": "…e invariant\n\nBump the verified agy version from 1.0.7 to 1.0.11. Document that follow-up\nturns (agy --conversation <id> -p) return only the new response on agy 1.0.9+,\nsince the supervisor captures stdout verbatim with no stripping; earlier builds\n(through 1.0.7) dumped the entire transcript. Docum\n[…]\n item that the capture depends on agy maintaining\nlast_conversations.json, which is at risk from agy's ongoing SQLite migration.\n\nNo functional code changes; build, vet, and race tests pass unchanged.",
          "is_bot": false,
          "headline": "docs: document agy 1.0.11 continuation and ADC auth, re-verify captur…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-24T07:58:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "676ce124f1d70309c6f1d6a9a9340941985336aa",
          "body": "… (#34) (#63)\n\nFakeAgy.SleepSecs (int seconds) becomes Sleep (time.Duration), emitted as a\nfractional bash sleep (sleep %.3f) the same way FakeSupervisor.CacheDelay already\nis. The two run_sync overrun/cancel tests drop from 5s to 2s sleeps (still a 20x\nmargin over their 100ms wait cap), trimming se\n[…]\nres stdout/stderr separately, so a hung or crashing generated script fails\nthe test with diagnostics instead of stalling the whole suite. A new test pins\nthe fractional-sleep behavior.\n\nRelates to #34",
          "is_bot": false,
          "headline": "test: fractional fake-agy sleeps and bounded testutil subprocess runs…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-14T11:35:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ace7a9ee690c61f310ae2e10a49fe5c11908ade",
          "body": "…ry flock (#62)\n\n* fix(manager): serialize same-key jobs across processes with an advisory flock\n\nThe concurrency gate lived only in process memory, so in stdio mode (where\nevery MCP client session spawns its own agy-mcp process sharing one\nAGY_MCP_STATE_DIR) a job started by a sibling process was i\n[…]\ne. Add a test for the guard and that the original hold survives.\n- The fail-closed admit test now also asserts gate.inFlight == 0, so a leaked slot\n  cannot slip through while the key map looks clean.",
          "is_bot": false,
          "headline": "fix(manager): serialize same-key jobs across processes with an adviso…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-14T11:15:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e0f4917d5ad2151834be42ba2249b57513ede128",
          "body": "…ead clauses (#31) (#61)\n\n* fix(rules): constrain FilepathIsLocal, extend ErrorBeforeUse, prune dead clauses (#31)\n\nRemaining rule-quality items from #31, verified empirically with golangci-lint\nv2.11.4 against fixtures; `go build -tags ruleguard ./rules/`,\n`golangci-lint run ./...` (0 issues), and \n[…]\nnly matches at a\ncamelCase boundary. Verified in RE2 and against golangci-lint fixtures:\npath-like names (incl. lowercase compounds) still fire; MyDirtyVar, IsFiled,\nRedirect, and req.URL.Path do not.",
          "is_bot": false,
          "headline": "fix(rules): constrain FilepathIsLocal, extend ErrorBeforeUse, prune d…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-14T10:33:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e8de5a5c6dd6be0b5f1be1456624ac4f6283196",
          "body": "…ob files (#34) (#60)\n\n* test: harden main_test.go - poll for readiness, build the binary once (#34)\n\nTestRunJobCancelViaSignal slept a fixed 1s hoping the supervisor had started\nagy and installed its SIGTERM handler. Under CI load the supervisor process\nmay not be up yet, so the signal lands on a n\n[…]\nen file creation and Notify). Reword it to state the\nnow-guaranteed invariant: the handler is installed before the files exist, so\ntheir existence means it is already in place. Comment-only.\n\nRefs #34",
          "is_bot": false,
          "headline": "test+supervisor: poll for readiness, install SIGTERM handler before j…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T18:11:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7529911fd877b2fd3fd32ebee10c10ec1cb50765",
          "body": "Every manager/mcptools log message hardcoded the \"agy-mcp: \" prefix while\nmain's own logs used \"agy-mcp \" or no prefix, so the tag was both repetitive\nand inconsistent. Set it once with log.SetPrefix(\"agy-mcp: \") in main, before\nthe run-job and serve paths split, so both the supervisor subprocess an\n[…]\n now read \"agy-mcp: serving over stdio\"\nwith a single prefix, and grepped that no remaining log message begins with\n\"agy-mcp\" (which would double-prefix). No test asserts on the log literal.\n\nRefs #36",
          "is_bot": false,
          "headline": "refactor: set the \"agy-mcp: \" log prefix once in main (#36) (#59)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T17:42:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb07d9c2512b95354e1634e193c7c696219571e4",
          "body": "… (#36) (#58)\n\n* refactor(manager): dedup conversation-cache reads and capture-persist (#36)\n\nThree low-risk cleanups from #36, all in the conversation-cache plumbing:\n\n- readSessions duplicated loadCache's os.ReadFile + json.Unmarshal of\n  last_conversations.json. It now delegates to loadCache, the\n[…]\nhe new missing-file test locked in the\nempty-cache contract, but not the error side. Add a malformed-JSON case so\nboth sides of the loadCache contract readSessions now relies on are covered.\n\nRefs #36",
          "is_bot": false,
          "headline": "refactor(manager): dedup conversation-cache reads and capture-persist…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T17:34:32Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c54add4dc6f59aae8163787990ff81efd8812067",
          "body": "…6) (#57)\n\n* refactor(manager): fuse startup GC and gate restore into one scan (#36)\n\nStartup ran two full job-store scans back to back: GarbageCollect then\nRestoreGate, each opening every meta.json and exit_code sentinel a second\ntime. Combine them into RestoreAndCollect, which scans the jobs direc\n[…]\n loadJob still halves the\nmeta.json reads (the issue's actual target), and the exit_code read count\nand freshness now match the two-scan original precisely, so no startup\nrace is introduced.\n\nRefs #36",
          "is_bot": false,
          "headline": "refactor(manager): fuse startup GC and gate restore into one scan (#3…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T17:22:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "57ae469bf43e650e03d9bd70bdc247341ece2b13",
          "body": "…ng (#56)\n\n- TestStartJobPersistsMetaAndSpawns and TestStartJobCleansUpDirOnSpawnFailure\n  did not override m.cacheFile, so they read the developer's real agy cache\n  (and the former leaked a 2s capture goroutine racing t.TempDir cleanup).\n  Inject a test-owned cache file, matching the other StartJo\n[…]\ndrove the\n  continue-a-conversation path. Assert an explicit conversation id is\n  threaded into the returned job, the persisted meta, and the agy\n  --conversation arg. (#33)\n\nTest-only.\n\nRefs #34, #33",
          "is_bot": false,
          "headline": "test: inject cache file in StartJob tests, cover conversation-id wiri…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T16:38:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8600d3dfa2a0f5f66b865aa7379242614bcbf9c4",
          "body": "- Memoize serverVersion with sync.OnceValue: it was re-reading\n  debug.BuildInfo on every HTTP session (NewServer runs per session).\n- Log the srv.Shutdown error in ServeHTTP instead of discarding it\n  (HTTP mode, so stderr logging is safe).\n- Log gate.release underflow: a release without a matching\n[…]\n README so it\n  cannot go stale.\n- Remove the redundant //go:build linux from proc_linux.go (the _linux\n  filename suffix already gates it), matching liveness_linux.go and\n  signal_linux.go.\n\nRefs #36",
          "is_bot": false,
          "headline": "chore: misc low-risk cleanups from review (#36) (#55)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T16:32:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5a66287d55dfc52c1caf3e15d73356f8575577f6",
          "body": "…) (#54)\n\nThese MCP tool handlers had no test at the MCP layer (#33 item 8).\n\n- TestListModelsOverMCP: drive list_models end to end; the fake agy\n  prints two model lines and the handler returns them on the wire.\n- TestListSessionsOverMCP: with an empty cache the handler must return a\n  non-nil empty array (not null), confirming the tool is registered and\n  wired.\n\nTest-only. Gated to _linux because the shared connect/newTestManager\nhelpers live in the StartJob-only test file.\n\nRefs #33",
          "is_bot": false,
          "headline": "test(mcptools): cover the list_models and list_sessions handlers (#33…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T16:23:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8099f7fadec2847a3f37bbab9ded1463dc5bbfe1",
          "body": "* test(supervisor): cover SIGKILL escalation and spawn-failure (#33)\n\nThe supervisor's SIGTERM->SIGKILL escalation after killGrace and its\nspawn-failure (127) sentinel had no test.\n\n- Split Run into a thin Run plus an internal run(jobDir, grace), so a\n  test can inject a small grace and exercise the\n[…]\n the captured stderr is read back in\n  TestSupervisorCapturesOutputAndSentinel (it was configured but never\n  checked).\n\nRefs #33\n\n* test(supervisor): read err via jobstore.ErrPath and check the error",
          "is_bot": false,
          "headline": "test(supervisor): cover SIGKILL escalation and spawn-failure (#33) (#53)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T16:17:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f9a3d5d372011ec1e5db5795b3666e894d425230",
          "body": "…g (#34) (#52)\n\n- mcptools: add a structMap helper and route the StructuredContent casts\n  through it, so a response-shape regression fails the test cleanly\n  instead of panicking; and make the agy_status poll loop fail fast on a\n  terminal failed/cancelled state rather than burning the deadline int\n[…]\nms (a shared waitFor/poll helper, building the\nmain_test binary once, the job_linux_test cache-file override, subprocess\ncontext timeouts, FakeAgy fractional sleeps) are left as a follow-up.\n\nRefs #34",
          "is_bot": false,
          "headline": "test: hygiene fixes - checked casts, constants, env isolation, reapin…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T16:04:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e4df6778a047365540e25e0b93a0c5037be044b7",
          "body": "… (#51)\n\n* test: platform-gate StartJob tests and cover the GC live-job invariant (#33)\n\n- Gate the mcptools tests that drive StartJob (Linux-only job\n  supervision) behind the _linux filename suffix: rename\n  run_sync_test.go to run_sync_linux_test.go (it also holds the\n  connect/newTestManager hel\n[…]\nsor SIGKILL-escalation\ntest, which needs killGrace made injectable plus a SIGTERM-ignoring\nfake agy) is left as a follow-up.\n\nRefs #33\n\n* test(gc): reap the spawned sleeper with Wait to avoid a zombie",
          "is_bot": false,
          "headline": "test: platform-gate StartJob tests, cover GC live-job invariant (#33)…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T15:54:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ca5d4bdf75a5f08c7cfc64c95ea3a84bed29577",
          "body": "* test: cover lifecycle safety-net gaps (#33)\n\nAdd deterministic tests for paths that had no coverage:\n\n- Status: the genuinely-interrupted branch (process gone, no sentinel,\n  no out file -> failed), and errorSummary's UTF-8 boundary truncation\n  when the trailing stderr exceeds the tail size and t\n[…]\nSIGKILL-escalation\ntest, a live-process GC-keeps-alive test, platform-gating the mcptools\ntests) are left as a follow-up.\n\nRefs #33\n\n* test(config): make fakeAgyOnPath helper work on Windows (PATHEXT)",
          "is_bot": false,
          "headline": "test: cover lifecycle safety-net gaps (#33) (#50)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T15:40:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7f811791fa37a5162011574eef35df23473da338",
          "body": "* refactor(proc): share the process-group primitives across packages\n\nsetProcessGroup/terminateGroup were duplicated in the manager and\nsupervisor platform files, with divergent terminateGroup signatures and\ntwo slightly different \"only supported on Linux\" stub messages, so a\nchange to one was easy \n[…]\n)\n- SetGroup sets only Setpgid instead of replacing SysProcAttr wholesale,\n  so it preserves any attributes a caller configured first. No change for\n  current callers, which pass a fresh cmd. (Gemini)",
          "is_bot": false,
          "headline": "refactor(proc): share the process-group primitives across packages (#49)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T15:25:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3337d02ea1e9fe19fff7374a4748795dc2704528",
          "body": "* refactor(jobstore): centralize the job-dir file contract\n\nThe on-disk file names (\"meta.json\", \"out\", \"err\", \"exit_code\") were\nspelled as raw literals across jobstore, supervisor, manager, and the\ntest fakes, so a rename in one package compiled clean and broke the\nothers only at integration-test t\n[…]\neady\nused by writeMetaAtomic so the sentinel appears in one step, never empty.\n\nCentralizing the write into one helper (this PR) is what makes this a\nsingle-point fix instead of three. (Gemini review)",
          "is_bot": false,
          "headline": "refactor(jobstore): centralize the job-dir file contract (#48)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T14:56:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2805e5ae9adb6d6b36def91be2e70573f2a9707e",
          "body": "…als (#47)\n\n* fix(status): freeze elapsed, mark partial output, classify gate refusals\n\nFinish the remaining items of #29 (the others were resolved in #42):\n\n- Add Manager.State for agy_cancel's follow-up state lookup so it no\n  longer reads the full (up to 32 MiB) out file. Every actual cancel\n  le\n[…]\nay\n  frozen. (Gemini)\n- Add a default fail-closed case to StartJob's gate-outcome switch so a\n  future acquireOutcome cannot fall through and start a job without a\n  reserved slot or key. (CodeRabbit)",
          "is_bot": false,
          "headline": "fix(status): freeze elapsed, mark partial output, classify gate refus…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T14:34:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "776ed192fee012cbafa263e352063d22c782029f",
          "body": "…xes (#46)\n\n- Add a `go build -tags ruleguard ./rules/` step so a syntax error in any\n  rules/*.go fails CI. The matchers carry the //go:build ruleguard tag, so a\n  broken rule compiles clean under the normal toolchain and silently disables\n  the whole ruleguard layer while golangci-lint still repor\n[…]\nand release, so releases\n  cannot be built on a different toolchain than CI validated.\n- Re-enable the unused linter (probed clean: 0 issues) instead of disabling it\n  without explanation.\n\nCloses #32",
          "is_bot": false,
          "headline": "ci: ruleguard canary, SHA-pin actions, dedupe runs, version+linter fi…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T13:42:48Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0a5be061cfe8ec9ab4e4343e0341619924aa4e97",
          "body": "…alidation (#45)\n\n* fix(security): private job-dir perms, loopback resolution, agy-path validation\n\nThree hardening items.\n\nPermissions: job dirs and files hold prompts and full agy output, which\noften embed source code, and were world/group-readable on multi-user\nhosts. Tighten to owner-only: job d\n[…]\nmitation: it requires root to modify hosts/DNS, and a root attacker\n  can bypass any loopback restriction anyway; the check guards against an\n  accidental non-loopback bind, not a privileged attacker.",
          "is_bot": false,
          "headline": "fix(security): private job-dir perms, loopback resolution, agy-path v…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T13:31:28Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba47d5216f4cea3debd8522dc299f53eb7480988",
          "body": "* fix(gc): harden job-store GC, liveness, and meta writes\n\nAddresses the robustness gaps in garbage collection, the job store, and\nliveness detection.\n\nGarbageCollect:\n- Reap meta-less orphan dirs (a crash between Create's MkdirAll and the\n  meta write, or a partial RemoveAll) once they are older th\n[…]\n\nstart-time checks instead of failing closed. The test's premise (empty\nBootID -> not alive) only holds when a current boot id is readable, so\nskip it otherwise rather than assert a false expectation.",
          "is_bot": false,
          "headline": "fix(gc): harden job-store GC, liveness, and meta writes (#44)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T12:59:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e780983f9e6ff6aa3a73c8c2a034933013855f3e",
          "body": "…meouts (#43)\n\n* fix(supervisor): close signal window, classify signal exits, bound timeouts\n\nSupervisor robustness fixes (issue #26):\n\n- signal.Notify was installed AFTER cmd.Start. A SIGTERM landing in that window\n  killed the supervisor with its default disposition, leaving agy detached with\n  no\n[…]\ns a pure function so the override matrix\n(natural exit, crash, timeout, cancel, and the SIGKILL-escalation of each) is\nunit-tested without a 10s killGrace wait.\n\nFound in peer review (Gemini 3.1 Pro).",
          "is_bot": false,
          "headline": "fix(supervisor): close signal window, classify signal exits, bound ti…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T12:07:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e320275443feff5bede4aba65b831508de9a1582",
          "body": "…odels errors (#42)\n\nSeveral status/output correctness fixes (issue #29):\n\n- errorSummary tailed stderr via a LimitReader from offset 0, so for an err\n  file larger than maxReadBytes (32 MiB) the reported \"tail\" was actually the\n  FIRST 32 MiB, not the end where the real error is. Add tailFile, whic\n[…]\non.\n\nRegression tests cover the real-end tail, the unreadable-output failure, the\nspawn-fail message, and the list_models stderr passthrough; each was verified\nto fail without its fix.\n\nRelates to #29",
          "is_bot": false,
          "headline": "fix(status): correct stderr tail, IO-error handling, spawn-fail and m…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T11:35:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e7db30dec9f41687e235edd36ee59b7b837d77ee",
          "body": "* fix(manager): normalize cwd before gate keying and cache lookups\n\nA raw client-supplied cwd flowed straight into the gate key and the agy\nconversation-cache lookups, so a trailing slash, a relative path, or a\nsymlinked alias of one directory produced a distinct gate key. Two \"same\ndir\" fresh runs \n[…]\ne StartJob, RestoreGate must stay resilient and cannot fail\nclosed, so log the rare fallback to flag that the restored gate key may not\nmatch a new same-directory run's normalized key (Gemini review).",
          "is_bot": false,
          "headline": "fix(manager): normalize cwd before gate keying and cache lookups (#41)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T11:08:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a51b5e1b7bc1cc9e82a22175b8b1b71046ce6465",
          "body": "* fix(rules): correctness, message, and version fixes\n\nBatch of rule-quality fixes from review. Each behavior change verified with\ngolangci-lint v2.11.4 against fixtures; `go build -tags ruleguard ./rules/`\nand the repo lint/tests stay green.\n\nCorrectness (stop bad advice / non-compiling suggestions\n[…]\natements. Use (?s) and a non-greedy match.\n- TimeDateTimeConstants: accept *time.Time as well as time.Time. Format has a\n  value receiver, so it is commonly called through a pointer (nullable fields).",
          "is_bot": false,
          "headline": "fix(rules): correctness, message, and version fixes (#40)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T10:20:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "936bc6a7a394b7e5dce295ea8ae7530f981d9491",
          "body": "…ix (#38)\n\n* chore: ignore .codegraph/ (local codegraph index)\n\n* fix(rules): stop three Suggest autofixes from breaking code under --fix\n\nAll three reproduced with `golangci-lint run --fix` (v2.11.4) against\nfixtures; the shared ruleguard config means any project running --fix was\nexposed.\n\n- MinMa\n[…]\nrrectly.\n\nVerified: the buggy autofixes no longer apply, a real time.Time still\nrewrites and compiles, `go build -tags ruleguard ./rules/` passes, and the\nrepo lints clean with tests green.\n\nFixes #30",
          "is_bot": false,
          "headline": "fix(rules): stop three Suggest autofixes from breaking code under --f…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-13T09:55:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "01710b2f8d1ccc4ec8ca0326e768f0db49f51370",
          "body": "Fixes the ways agy-mcp could lose or misattribute the conversation id it captures for a fresh agy run (the cache is flushed by a separate agy daemon that can lag the process exit):\n\n- agy_run_sync polls through a pending capture instead of returning done with an empty conversation_id (CapturePending\n[…]\nsettles past the run's timeout, and does not permanently give up on a transient store-scan error.\n- GarbageCollect untracks a collected job's capture memo so the maps do not grow unbounded.\n\nFixes #23",
          "is_bot": false,
          "headline": "Make conversation-id capture reliable for fresh agy runs (#37)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-11T11:23:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1830f43d11f15711be3331a35211cc5bd1b837e7",
          "body": "Bump the verified-agy version in the status line from 1.0.6 to 1.0.7\n(version, list_models, all passed flags, and the test suite check out\nagainst the live 1.0.7 binary).\n\nAdd a Requirements note that each job spawns a fresh agy, which launches\nagy's own configured MCP servers on startup; unneeded ones add latency\nand 1.0.7+ can bound them with a per-server launch timeout (-1 disables).",
          "is_bot": false,
          "headline": "docs: verify against agy 1.0.7 and note per-run MCP server launch",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-10T08:59:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6d12b268b9120bb2bd13c732b108deb2ec37bfad",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6.\n- [Release notes](https://github.com/actions/setup-go/releases)\n- [Commits](https://github.com/actions/setup-go/compare/v5...v6)\n\n---\nupdated-dependencies:\n- dependency-name: actions/setup-go\n  dependency-version: '6'\n  depen\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump actions/setup-go from 5 to 6 (#22)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-09T19:07:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7bebae668ad6b6ed30e8c36e0dbb9f48477f6c23",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3 to 4.\n- [Release notes](https://github.com/github/codeql-action/releases)\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/github/codeql-action/compare/v3...v4)\n\n-\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump github/codeql-action from 3 to 4 (#20)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-09T19:07:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "790dd83bee75632f01bc887fb597e3ff8fb73252",
          "body": "Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 6 to 7.\n- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)\n- [Commits](https://github.com/goreleaser/goreleaser-action/compare/v6...v7)\n\n---\nupdated-dependencies:\n- dependency-name: go\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump goreleaser/goreleaser-action from 6 to 7 (#21)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-09T19:04:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d5db2de9757347c952ec0a05dc1a1813f53bd47a",
          "body": "Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6.\n- [Release notes](https://github.com/actions/checkout/releases)\n- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)\n- [Commits](https://github.com/actions/checkout/compare/v4...v6)\n\n---\nupdated-dependenc\n[…]\nirect:production\n  update-type: version-update:semver-major\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Bump actions/checkout from 4 to 6 (#19)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2026-06-09T19:04:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "49e14bacd09675df2963c85b78f66011be88003c",
          "body": null,
          "is_bot": false,
          "headline": "Add release, CodeQL, and Dependabot workflows; polish README with badges",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T19:01:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0939d8338aa2d3bf1b3d39f94dd446ffb3b530e3",
          "body": "…0.1.0",
          "is_bot": false,
          "headline": "Report stamped module version in MCP serverInfo instead of hardcoded …",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T18:54:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "46f184d02bc9eacd68dc7a5b85f54181c0793655",
          "body": null,
          "is_bot": false,
          "headline": "README: note v1.0.0 release",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T18:51:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ef9cd3b4dbb9034f09f249fe1cf8a0604b84c375",
          "body": null,
          "is_bot": false,
          "headline": "Update README status: live-agy verification done, feature complete",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T18:51:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ad77842360d02d071aee732e6ed67a35a02b5a40",
          "body": "* Add configurable testutil.WriteFakeSupervisor (#16)\n\n* Use testutil.WriteFakeSupervisor in mcptools tests (#16)\n\n* Use testutil.WriteFakeSupervisor in manager tests (#16)",
          "is_bot": false,
          "headline": "Consolidate fake-supervisor test doubles into testutil (#16) (#18)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T18:32:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "90be945b6e224525a07b17683ac00b309085ea25",
          "body": "* refactor: extract toStartRequest from the agy_run handler\n\n* feat: add agy_run_sync tool, start-then-wait inline (#7)\n\n* test: cover the agy_run_sync wait-cap overrun path\n\nThe bash fake supervisor's comm is 'bash', not its basename, so the\nmanager's liveness check saw it as dead and Status misrep\n[…]\ne the new helpers in the old round-trip test.\n\n* docs: align the fake supervisor comm comment with the liveness fallback role\n\n* fix: truncate progress seconds, mark conversation_id optional in README",
          "is_bot": false,
          "headline": "Add agy_run_sync convenience tool with progress notifications (#17)",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T17:57:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3db5fefefe33dcd97cfb9053937b225e15918602",
          "body": "… coverage (#12) (#15)\n\n* Manager seams: cross-platform build support and StartJob cleanup coverage\n\nCross-platform support (#6): factor the Linux-specific process-group setup,\ngroup/process signaling, and /proc liveness behind build-tagged helpers so the\npackage builds on macOS and Windows. Linux k\n[…]\ngnal the caller's own process group and terminate the manager or\nsupervisor. Current callers always pass a live cmd.Process.Pid (> 0), so\nthis is defensive against a future caller or a corrupted meta.",
          "is_bot": false,
          "headline": "Manager seams: cross-platform build support (#6) and StartJob cleanup…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T16:53:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f964e334121a69d62b544eaa85411ce76300a4bd",
          "body": "…#14)\n\n* Harden HTTP serve mode: Origin/CSRF check and optional bearer token\n\nWrap the Streamable HTTP handler with net/http.CrossOriginProtection so a\nstate-changing cross-origin browser request (cross-site Sec-Fetch-Site or a\nmismatched Origin) is rejected with 403. Non-browser MCP clients send no\n[…]\nokens to 32-byte SHA-256 digests and compare\nthose, so the comparison runs in constant time regardless of token length.\nSHA-256's preimage resistance means comparing digests does not weaken the\ncheck.",
          "is_bot": false,
          "headline": "Harden HTTP serve mode: Origin/CSRF check and optional bearer token (…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T16:24:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae9826eabcf15fca513ef93145070910299e390b",
          "body": "… (#13)\n\n* Harden job lifecycle: orphan cleanup, periodic GC, starttime liveness\n\nImplements PR1 of the open-issue batch (#8, #9, #10):\n\n- #10: StartJob removes the job directory on both failure paths. On a\n  spawn failure it removes synchronously (no supervisor exists). On a\n  post-spawn UpdateMeta\n[…]\ndefer cancel() in TestRunPeriodicGCCollectsAndStops so the\nrunPeriodicGC goroutine is signaled to stop even if an assertion fails\nearly, instead of relying solely on t.Context() teardown. (CodeRabbit)",
          "is_bot": false,
          "headline": "Harden job lifecycle: orphan cleanup, periodic GC, starttime liveness…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T15:34:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8f7c8c598cf65da067d76d687b96cdeb8322ffeb",
          "body": "…gate on restart (#2, #3) (#11)\n\n* Serialize same-cwd fresh runs, capture their conversation id, restore gate on restart\n\nImplements #2 and #3 (both surfaced during review of #1), batched because they\nshare the concurrency gate and its startup job scan.\n\n#2: keyFor now serializes fresh runs on their\n[…]\njob (pushing inFlight past max, which blocks new\nruns until restored jobs drain) and holds each key, returning false only for a\nduplicate key so the watcher is started once. Adds TestGateForceAcquire.",
          "is_bot": false,
          "headline": "Serialize same-cwd fresh runs, capture conversation ids, restore the …",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T13:31:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b34776887ce534808f27a052db71d216dc3129f6",
          "body": "…avity CLI (#1)\n\n* Ignore Serena tool directory\n\n* Add MCP SDK dependency and fake-agy test helper\n\n* Add config resolution and agy locator\n\n* Add on-disk job store with meta, sentinel, list, and GC\n\n* Add run-job supervisor that captures output and writes exit sentinel\n\n* Add Manager.StartJob with \n[…]\nw feedback: validate job ids, enforce loopback HTTP bind, release gate on supervisor exit\n\n* Bound job output reads to protect against a runaway agy\n\n* Document enforced loopback binding for HTTP mode",
          "is_bot": false,
          "headline": "Implement agy-mcp: async, restart-resilient MCP server for the Antigr…",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T11:45:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c001c8bf4adfeeeea724f131defb1a14d49bc3bb",
          "body": null,
          "is_bot": false,
          "headline": "Initial scaffold: module, README, MIT license, gitignore",
          "author_name": "Tomi P. Hakala",
          "author_login": "tphakala",
          "committed_at": "2026-06-09T08:38:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 5,
      "commits_last_year": 64,
      "latest_release_at": "2026-07-21T08:26:11Z",
      "latest_release_tag": "v1.5.0",
      "releases_from_tags": false,
      "days_since_last_push": 2,
      "active_weeks_last_year": 6,
      "days_since_latest_release": 2,
      "mean_days_between_releases": 2.7
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/tphakala/agy-mcp",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/tphakala/agy-mcp",
          "is_deprecated": false,
          "latest_version": "v1.5.0",
          "repository_url": "https://github.com/tphakala/agy-mcp",
          "versions_count": 6,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-21T08:22:34Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 2
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 4,
      "watchers": 2,
      "fork_history": {
        "days": [
          {
            "date": "2026-06-11",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 4
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 39821,
      "source_files_sampled": 119,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": "repository_graph",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 8,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/modelcontextprotocol/go-sdk",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.1"
        },
        {
          "name": "github.com/quasilyte/go-ruleguard/dsl",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.23"
        },
        {
          "name": "golang.org/x/sys",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.47.0"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "github.com/modelcontextprotocol/go-sdk",
            "direct": true,
            "version": "v1.6.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/quasilyte/go-ruleguard/dsl",
            "direct": true,
            "version": "v0.3.23",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/sys",
            "direct": true,
            "version": "v0.47.0",
            "ecosystem": "go"
          },
          {
            "name": "github.com/google/jsonschema-go",
            "direct": false,
            "version": "v0.4.3",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/asm",
            "direct": false,
            "version": "v1.2.1",
            "ecosystem": "go"
          },
          {
            "name": "github.com/segmentio/encoding",
            "direct": false,
            "version": "v0.5.4",
            "ecosystem": "go"
          },
          {
            "name": "github.com/yosida95/uritemplate/v3",
            "direct": false,
            "version": "v3.0.2",
            "ecosystem": "go"
          },
          {
            "name": "golang.org/x/oauth2",
            "direct": false,
            "version": "v0.36.0",
            "ecosystem": "go"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 8,
        "direct_count": 3,
        "indirect_count": 5
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 1,
        "merged_prs": 55,
        "open_issues": 3,
        "closed_ratio": 0.919,
        "closed_issues": 34,
        "closed_unmerged_prs": 2
      },
      "bus_factor": 1,
      "bot_contributors": 1,
      "top_contributors": [
        {
          "type": "User",
          "login": "tphakala",
          "commits": 56,
          "avatar_url": "https://avatars.githubusercontent.com/u/7030001?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "codeql.yml",
        "release.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/26 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 10,
            "reason": "project is fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 4,
            "reason": "dependency not pinned by hash detected -- score normalized to 4",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 10,
            "reason": "0 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "fb38d0558cedc02dafc699caeb34d888e86c7324",
        "ran_at": "2026-07-23T16:43:52Z",
        "aggregate_score": 5.2,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-21T08:26:15Z",
      "oldest_open_prs": [
        {
          "number": 93,
          "created_at": "2026-07-21T01:24:16Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ],
      "last_merged_pr_at": "2026-07-21T08:22:35Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": [
        {
          "number": 86,
          "created_at": "2026-07-18T07:22:21Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 88,
          "created_at": "2026-07-18T07:58:29Z",
          "last_comment_at": null,
          "last_comment_author": null
        },
        {
          "number": 89,
          "created_at": "2026-07-18T07:58:30Z",
          "last_comment_at": null,
          "last_comment_author": null
        }
      ]
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/tphakala/agy-mcp",
    "host": "github.com",
    "name": "agy-mcp",
    "owner": "tphakala"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 59,
      "inputs": {
        "security": 62,
        "vitality": 70,
        "community": 28,
        "governance": 58,
        "engineering": 74
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 70,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 56,
            "inputs": {
              "commits_last_year": 64,
              "human_commit_share": 0.875,
              "days_since_last_push": 2,
              "active_weeks_last_year": 6
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "6/52 weeks with commits",
                "points": 4.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "64 commits in the last year",
                "points": 16.3,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 64
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 5,
              "latest_release_tag": "v1.5.0",
              "releases_from_tags": false,
              "days_since_latest_release": 2,
              "mean_days_between_releases": 2.7
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "5 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 5
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 2 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.7 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.7
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 28,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 8,
            "inputs": {
              "forks": 1,
              "stars": 4,
              "watchers": 2,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "4 stars",
                "points": 7.7,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "2 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 58,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 80,
            "inputs": {
              "merged_prs": 55,
              "open_issues": 3,
              "closed_issues": 34,
              "issue_closed_ratio": 0.919,
              "closed_unmerged_prs": 2
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "92% of issues closed",
                "points": 43,
                "status": "partial",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 92
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "55/57 decided PRs merged",
                "points": 36.9,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 55,
                      "decided": 57
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/26 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 61,
            "inputs": {
              "followers": 78,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "tphakala",
              "public_repos": 64,
              "account_age_days": 4506
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "78 followers of tphakala",
                "points": 13.6,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 78,
                      "login": "tphakala"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "64 public repos, account ~12 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 64
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 12
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/tphakala/agy-mcp"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 2
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 2 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 2
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "6 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 74,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "3 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "topics": [
                "agy",
                "ai-agents",
                "antigravity",
                "cli",
                "code-review",
                "gemini",
                "golang",
                "mcp",
                "mcp-server",
                "model-context-protocol",
                "awesome-mcp-servers",
                "model-context-protocol-server",
                "claude",
                "codex",
                "copilot"
              ],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "15 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 15
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 62,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 52,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 5.2
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "26 out of 26 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/26 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is fuzzed",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "0 existing vulnerabilities detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 8 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "indirect_dependencies_free_of_known_advisories",
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_repository",
                "params": {
                  "assessed": 8
                }
              },
              {
                "code": "advisories_repo_graph_caveat",
                "params": {}
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 8,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "transitive set not separable from development and test dependencies in this scope",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_scope_not_separable",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 8,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 62,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.911,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "51 of 56 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 51,
                      "sampled": 56
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 79,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0.125
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 64",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 64
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "8 of the last 64 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 8,
                      "sampled": 64
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 39821,
              "source_files_sampled": 119,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/119 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 119,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "critical",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "example_dirs": [],
              "has_mcp_signal": true,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-23T16:44:08.411343Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/t/tphakala/agy-mcp.svg",
  "full_name": "tphakala/agy-mcp",
  "license_state": "standard",
  "license_spdx": "MIT"
}