Öffentliches RegisterMittel
Software-GesundheitsberichtSchema 0.27.0 · Metriken 1.13.0 · 2026-07-27 15:55 UTC
vinkius-labs / mcpfusion
MCP Fusion - The TypeScript framework for secure MCP servers.
vinkius-labs/mcpfusion erreicht einen Gesundheitsindex von 65 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Vitality (86/100) ab, am schwächsten bei Security (41/100). Zuletzt heute aktualisiert. Ein einzelner Mitwirkender trägt den Großteil der jüngsten Arbeit.
65
gesamt / 100Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
65
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Eigentümerschaft
VinkiusOrganisation
15 Follower65 öffentliche Reposseit Juli 2025
Dieses Repository wird von einer Organisation getragen — geteilte, rechenschaftspflichtige Trägerschaft, die jeden einzelnen Maintainer überdauern kann.
Paket-Ökosysteme
Metriken nach Kategorie
Vitalität
Lebt das Projekt — wird Code geschrieben und werden Releases ausgeliefert?
86
Wie die Bewertung erfolgt
| 36/36 | Push-Aktualität — letzter Push vor 0 Tagen |
| 13.2/36 | Commit-Rhythmus — 19/52 Wochen mit Commits |
| 18/18 | Commit-Volumen — 342 Commits im letzten Jahr |
| 10/10 | OpenSSF Scorecard: Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
Verwendete Eingangsdaten
| commits_last_year | 342 |
| human_commit_share | 1 |
| days_since_last_push | 0 |
| active_weeks_last_year | 19 |
Release-Disziplin
100Exzellent
Wie die Bewertung erfolgt
| 27/27 | Liefert Releases aus — 100 Releases veröffentlicht |
| 36/36 | Release-Aktualität — letztes Release vor 0 Tagen |
| 27/27 | Release-Rhythmus — ein Release etwa alle 7,6 Tage |
| 0/10 | OpenSSF Scorecard: Signed-Releases — keine Daten |
Verwendete Eingangsdaten
| releases_count | 100 |
| latest_release_tag | v4.4.1 |
| releases_from_tags | nein |
| days_since_latest_release | 0 |
| mean_days_between_releases | 7,6 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Community & Verbreitung
Hat das Projekt Nutzer, Downloads, Aufmerksamkeit und ein einladendes Umfeld für Beitragende?
70
Popularität & Verbreitung
52Mittel
Wie die Bewertung erfolgt
| 39.1/60 | Stars — 257 Stars |
| 11.2/25 | Forks — 23 Forks |
| 1.7/15 | Watcher — 3 Watcher |
Verwendete Eingangsdaten
| forks | 23 |
| stars | 257 |
| watchers | 3 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community-Gesundheit
92Exzellent
Wie die Bewertung erfolgt
| 22.5/22.5 | README |
| 22.5/22.5 | Lizenz — anerkannte Lizenz (Apache-2.0) |
| 18/18 | CONTRIBUTING-Leitfaden |
| 13.5/13.5 | Verhaltenskodex |
| 0/7.2 | Issue-Vorlage |
| 6.3/6.3 | PR-Vorlage |
Verwendete Eingangsdaten
| has_readme | ja |
| has_license | ja |
| has_contributing | ja |
| has_issue_template | nein |
| has_code_of_conduct | ja |
| has_pull_request_template | ja |
Wie die Bewertung erfolgt
| 54.6/80 | Downloads pro Monat — 12.407 Downloads/Monat über npm |
| 0/20 | Abhängige in der Registry — von diesem Ökosystem nicht ausgewiesen |
Verwendete Eingangsdaten
| packages | @mcpfusion/a2a, @mcpfusion/aws, @mcpfusion/jwt, @mcpfusion/n8n, @mcpfusion/core, @mcpfusion/yaml, @mcpfusion/oauth, @mcpfusion/swarm |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 12.407 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Abhängige in der Registry. Die verbleibenden Gewichte wurden renormalisiert.
Nachhaltigkeit & Governance
Überdauert das Projekt die Menschen, die es tragen — Bus-Faktor, Reaktionsfähigkeit, Trägerschaft und Paketpflege?
41
Maintainer-Resilienz (Bus-Faktor)
16Kritisch
Wie die Bewertung erfolgt
| 9/54 | Bus-Faktor — 1 Beitragende decken die Hälfte aller Commits ab |
| 0/22.5 | Commit-Verteilung — wichtigste beitragende Person verfasste 100 % der Commits |
| 1.4/13.5 | Breite der Beitragenden — 1 Beitragende |
| 6/10 | OpenSSF Scorecard: Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
Verwendete Eingangsdaten
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Reaktionsfähigkeit bei Issues & PRs
11Kritisch
Wie die Bewertung erfolgt
| 6.7/46.8 | Issue-Lösungsquote — 14 % der Issues geschlossen |
| 0/38.3 | PR-Annahme — keine entschiedenen Pull Requests oder keine Daten |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Verwendete Eingangsdaten
| merged_prs | 0 |
| open_issues | 6 |
| closed_issues | 1 |
| issue_closed_ratio | 0,143 |
| closed_unmerged_prs | 0 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): PR-Annahme. Die verbleibenden Gewichte wurden renormalisiert.
Eigentümerschaft & Trägerschaft
54Mittel
Wie die Bewertung erfolgt
| 30/30 | Organisatorische Trägerschaft — im Besitz einer Organisation |
| 0/20 | Verifizierte Domain |
| 8.7/25 | Reichweite des Inhabers — 15 Follower von vinkius-labs |
| 15/25 | Kontohistorie — 65 öffentliche Repos, Kontoalter ca. 1 Jahre |
Verwendete Eingangsdaten
| followers | 15 |
| owner_type | Organization |
| is_verified | — |
| owner_login | vinkius-labs |
| public_repos | 65 |
| account_age_days | 366 |
Paketpflege
100Exzellent
Wie die Bewertung erfolgt
| 25/25 | Veröffentlicht & auflösbar — 8 Paket(e) auf npm |
| 35/35 | Veröffentlichungsaktualität — letzte Veröffentlichung vor 0 Tagen |
| 20/20 | Versionshistorie — 12 veröffentlichte Versionen |
| 20/20 | Nicht veraltet — aktiv, nicht veraltet oder zurückgezogen |
Verwendete Eingangsdaten
| packages | @mcpfusion/a2a, @mcpfusion/aws, @mcpfusion/jwt, @mcpfusion/n8n, @mcpfusion/core, @mcpfusion/yaml, @mcpfusion/oauth, @mcpfusion/swarm |
| ecosystems | npm |
| any_deprecated | nein |
| min_days_since_publish | 0 |
Engineering-Qualität
Sind grundlegende Engineering- und Dokumentationspraktiken vorhanden?
84
Wie die Bewertung erfolgt
| 24/24 | CI-Workflows — 5 Workflow(s) |
| 24/24 | Tests vorhanden |
| 16/16 | Linter-Konfiguration — eslint.config.js |
| 0/9.6 | Pre-Commit-Hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — keine Daten |
Verwendete Eingangsdaten
| has_ci | ja |
| has_tests | ja |
| has_editorconfig | nein |
| has_linter_config | ja |
| has_precommit_config | nein |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: CI-Tests. Die verbleibenden Gewichte wurden renormalisiert.
Dokumentation
90Exzellent
Wie die Bewertung erfolgt
| 30/30 | README |
| 25/25 | Dokumentationsverzeichnis |
| 15/15 | Dokumentations-/Homepage-Site — https://vinkius.com/open-source |
| 10/10 | Repository-Beschreibung |
| 10/10 | Topics — 7 Topics |
| 0/10 | Wiki |
Verwendete Eingangsdaten
| topics | mcp, mcp-framework, mcp-server, model-context-protocol, chatgpt, claude, mcp-tools |
| has_wiki | nein |
| homepage | https://vinkius.com/open-source |
| has_readme | ja |
| has_docs_dir | ja |
| has_description | ja |
Sicherheit
Sind die sichtbaren Sicherheits- und Lieferkettenpraktiken belastbar, ohne ungeklärte Exposition gegenüber Hochrisikojurisdiktionen?
41
Sicherheitslage
41Gefährdet
Wie die Bewertung erfolgt
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — keine Daten |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 1.5/2.5 | Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Lizenz — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — keine Daten |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 64 existing vulnerabilities detected |
Verwendete Eingangsdaten
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 4,1 |
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): ci_tests, signed_releases. Die verbleibenden Gewichte wurden renormalisiert.
AI Readiness
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
62
AI-Agentenkontext & Leitlinien
55Mittel
Wie die Bewertung erfolgt
| 0/45 | Agentenanweisungen — keine CLAUDE.md / AGENTS.md / Editor-Regeln |
| 15/15 | Maschinenlesbare Doku (llms.txt) — llms.txt vorhanden |
| 40/40 | Lesbare Commit-Historie — 84 von 100 menschlichen Commits benennen ihre Absicht (strukturierter Betreff oder erläuternder Text) |
Verwendete Eingangsdaten
| has_llms_txt | ja |
| legible_history_share | 0,84 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Wie die Bewertung erfolgt
| 0/18 | Bootstrap mit einem Befehl |
| 22/22 | Automatisierte Tests |
| 11/11 | Lint-/Format-Konfiguration — eslint.config.js |
| 11/11 | Statische Typprüfung — packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json |
| 10/10 | Reproduzierbare Umgebung — lockfile |
| 0/10 | Belegte Agentenpraxis — keine von Agenten verfassten Commits unter den letzten 100 |
| 0/8 | Automatisierte Wartung — keine automatisierten Abhängigkeits-Updates beobachtet |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Verwendete Eingangsdaten
| has_nix | nein |
| has_tests | ja |
| lockfiles | package-lock.json |
| has_dockerfile | nein |
| typed_language | ja |
| bootstrap_files | — |
| has_devcontainer | nein |
| has_linter_config | ja |
| typecheck_configs | packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
AI-Code-Lesbarkeit für Modelle
99Exzellent
Wie die Bewertung erfolgt
| 45/45 | Typprüfbarer Code — TypeScript (statisch typisiert) |
| 54.2/55 | Handhabbare Dateigrößen — 10/659 Quelldateien über 60 KB |
Verwendete Eingangsdaten
| primary_language | TypeScript |
| largest_source_bytes | 380.375 |
| source_files_sampled | 659 |
| oversized_source_files | 10 |
Wie die Bewertung erfolgt
| 0/40 | API-Schema (OpenAPI/GraphQL/proto) |
| 20/20 | MCP-Server |
| 40/40 | Lauffähige Beispiele — cookbook |
Verwendete Eingangsdaten
| example_dirs | cookbook |
| has_mcp_signal | ja |
| api_schema_files | — |
Eckdaten
257GitHub-Sterne
1Mitwirkende
342Commits, letzte 12 Monate
0Tage seit letztem Push
100Releases
1Bus-Faktor
6offene Issues
npmPaket-Ökosysteme
Warnungen zur Datenerhebung
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
- deps.dev does not index npm:@mcpfusion/a2a@4.4.1; advisories assessed against the repository dependency graph instead
Weitere Details
Stern- und Fork-Verlauf 0 ★ / 23 ⇿
0Sterne
23Forks
97Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 1Minor 20Patch 76
OpenSSF Scorecard 4.1 / 10
4.1Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| k. A. | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 6 | Contributors | project has 2 contributing companies or organizations -- score normalized to 6 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 10 | Security-Policy | security policy file detected |
| k. A. | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 64 existing vulnerabilities detected |
Direkte Abhängigkeiten 21
| Registry | Paket | Versionsvorgabe | Manifest |
|---|---|---|---|
| npm | @mcpfusion/core | ^4.4.1 | packages/a2a/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/api-key/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/aws/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/cloudflare/package.json |
| npm | @toon-format/toon | ^2.1.0 | packages/core/package.json |
| npm | zod-to-json-schema | ^3.25.1 | packages/core/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/inspector/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/jwt/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/n8n/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/oauth/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/openapi/package.json |
| npm | yaml | ^2.7.0 | packages/openapi/package.json |
| npm | @prisma/generator-helper | ^6.0.0 | packages/prisma-gen/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/prisma-gen/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/skills/package.json |
| npm | minisearch | ^7.1.1 | packages/skills/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/swarm/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/testing/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/vercel/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/yaml/package.json |
| npm | yaml | ^2.7.0 | packages/yaml/package.json |
Alle Abhängigkeiten nicht erhoben
Der aufgelöste Abhängigkeitssatz konnte für diesen Bericht nicht erhoben werden: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [
"mcp",
"mcp-framework",
"mcp-server",
"model-context-protocol",
"chatgpt",
"claude",
"mcp-tools"
],
"is_fork": false,
"size_kb": 10267,
"has_wiki": false,
"homepage": "https://vinkius.com/open-source",
"languages": {
"Shell": 366,
"JavaScript": 27033,
"TypeScript": 6265456
},
"pushed_at": "2026-07-27T00:12:45Z",
"created_at": "2026-02-12T07:39:46Z",
"owner_type": "Organization",
"updated_at": "2026-07-27T00:12:47Z",
"description": "MCP Fusion - The TypeScript framework for secure MCP servers.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "https://vinkius.com/open-source",
"name": "Vinkius",
"type": "Organization",
"login": "vinkius-labs",
"company": null,
"location": null,
"followers": 15,
"avatar_url": "https://avatars.githubusercontent.com/u/222905672?v=4",
"created_at": "2025-07-26T01:10:37Z",
"is_verified": null,
"public_repos": 65,
"account_age_days": 366
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v4.4.1",
"kind": "patch",
"published_at": "2026-07-27T00:13:18Z"
},
{
"tag": "v4.4.0",
"kind": "minor",
"published_at": "2026-07-24T05:58:48Z"
},
{
"tag": "v4.3.2",
"kind": "patch",
"published_at": "2026-07-19T03:57:09Z"
},
{
"tag": "v4.3.0",
"kind": "minor",
"published_at": "2026-06-18T17:57:55Z"
},
{
"tag": "v4.2.0",
"kind": "minor",
"published_at": "2026-05-27T06:23:08Z"
},
{
"tag": "v4.1.0",
"kind": "minor",
"published_at": "2026-05-26T20:28:55Z"
},
{
"tag": "v4.0.4",
"kind": "patch",
"published_at": "2026-05-26T17:10:30Z"
},
{
"tag": "v4.0.3",
"kind": "patch",
"published_at": "2026-05-26T16:51:41Z"
},
{
"tag": "v4.0.1",
"kind": "patch",
"published_at": "2026-05-20T07:57:25Z"
},
{
"tag": "v4.0.0",
"kind": "major",
"published_at": "2026-05-20T00:37:08Z"
},
{
"tag": "v3.19.6",
"kind": "patch",
"published_at": "2026-05-11T23:15:05Z"
},
{
"tag": "v3.19.5",
"kind": "patch",
"published_at": "2026-05-07T01:53:07Z"
},
{
"tag": "v3.19.4",
"kind": "patch",
"published_at": "2026-05-07T01:30:55Z"
},
{
"tag": "v3.19.3",
"kind": "patch",
"published_at": "2026-05-01T20:40:43Z"
},
{
"tag": "v3.19.2",
"kind": "patch",
"published_at": "2026-05-01T20:30:24Z"
},
{
"tag": "v3.19.1",
"kind": "patch",
"published_at": "2026-05-01T18:24:38Z"
},
{
"tag": "v3.19.0",
"kind": "minor",
"published_at": "2026-05-01T09:55:55Z"
},
{
"tag": "v3.18.0",
"kind": "minor",
"published_at": "2026-05-01T08:59:47Z"
},
{
"tag": "v3.17.3",
"kind": "patch",
"published_at": "2026-04-30T10:46:52Z"
},
{
"tag": "v3.17.2",
"kind": "patch",
"published_at": "2026-04-23T08:03:02Z"
},
{
"tag": "v3.17.1",
"kind": "patch",
"published_at": "2026-04-21T05:19:18Z"
},
{
"tag": "v3.17.0",
"kind": "minor",
"published_at": "2026-04-21T04:18:22Z"
},
{
"tag": "v3.16.0",
"kind": "minor",
"published_at": "2026-04-21T00:54:46Z"
},
{
"tag": "v3.15.3",
"kind": "patch",
"published_at": "2026-04-20T15:27:06Z"
},
{
"tag": "v3.15.2",
"kind": "patch",
"published_at": "2026-04-11T19:02:54Z"
},
{
"tag": "v3.15.1",
"kind": "patch",
"published_at": "2026-04-10T05:33:57Z"
},
{
"tag": "v3.15.0",
"kind": "minor",
"published_at": "2026-04-07T06:24:30Z"
},
{
"tag": "v3.14.8",
"kind": "patch",
"published_at": "2026-03-31T23:21:14Z"
},
{
"tag": "v3.14.5",
"kind": "patch",
"published_at": "2026-03-31T13:59:42Z"
},
{
"tag": "v3.14.4",
"kind": "patch",
"published_at": "2026-03-31T05:04:47Z"
},
{
"tag": "v3.14.0",
"kind": "minor",
"published_at": "2026-03-29T17:01:55Z"
},
{
"tag": "v3.13.1",
"kind": "patch",
"published_at": "2026-03-28T21:54:07Z"
},
{
"tag": "v3.13.0",
"kind": "minor",
"published_at": "2026-03-28T07:05:29Z"
},
{
"tag": "v3.12.8",
"kind": "patch",
"published_at": "2026-03-28T06:09:32Z"
},
{
"tag": "v3.12.7",
"kind": "patch",
"published_at": "2026-03-28T04:28:10Z"
},
{
"tag": "v3.12.6",
"kind": "patch",
"published_at": "2026-03-28T03:28:11Z"
},
{
"tag": "v3.12.5",
"kind": "patch",
"published_at": "2026-03-28T03:11:24Z"
},
{
"tag": "v3.12.4",
"kind": "patch",
"published_at": "2026-03-28T02:58:58Z"
},
{
"tag": "v3.12.3",
"kind": "patch",
"published_at": "2026-03-28T02:45:57Z"
},
{
"tag": "v3.12.2",
"kind": "patch",
"published_at": "2026-03-28T02:33:52Z"
},
{
"tag": "v3.12.1",
"kind": "patch",
"published_at": "2026-03-28T02:15:04Z"
},
{
"tag": "v3.12.0",
"kind": "minor",
"published_at": "2026-03-28T01:55:29Z"
},
{
"tag": "v3.11.1",
"kind": "patch",
"published_at": "2026-03-28T00:57:30Z"
},
{
"tag": "v3.11.0",
"kind": "minor",
"published_at": "2026-03-27T22:42:59Z"
},
{
"tag": "v3.10.0",
"kind": "minor",
"published_at": "2026-03-27T17:05:55Z"
},
{
"tag": "v3.9.0",
"kind": "minor",
"published_at": "2026-03-27T02:05:44Z"
},
{
"tag": "v3.8.3",
"kind": "patch",
"published_at": "2026-03-26T13:49:40Z"
},
{
"tag": "v3.8.2",
"kind": "patch",
"published_at": "2026-03-26T05:58:23Z"
},
{
"tag": "v3.8.1",
"kind": "patch",
"published_at": "2026-03-25T22:34:13Z"
},
{
"tag": "v3.8.0",
"kind": "minor",
"published_at": "2026-03-22T13:57:56Z"
},
{
"tag": "v3.7.13",
"kind": "patch",
"published_at": "2026-03-21T10:01:41Z"
},
{
"tag": "v3.7.12",
"kind": "patch",
"published_at": "2026-03-20T18:24:06Z"
},
{
"tag": "v3.7.11",
"kind": "patch",
"published_at": "2026-03-20T13:51:55Z"
},
{
"tag": "v3.7.10",
"kind": "patch",
"published_at": "2026-03-20T10:36:34Z"
},
{
"tag": "v3.7.9",
"kind": "patch",
"published_at": "2026-03-19T17:20:56Z"
},
{
"tag": "v3.7.8",
"kind": "patch",
"published_at": "2026-03-19T14:23:24Z"
},
{
"tag": "v3.7.7",
"kind": "patch",
"published_at": "2026-03-19T10:30:13Z"
},
{
"tag": "v3.7.6",
"kind": "patch",
"published_at": "2026-03-19T10:16:20Z"
},
{
"tag": "v3.7.5",
"kind": "patch",
"published_at": "2026-03-19T09:52:39Z"
},
{
"tag": "v3.7.4",
"kind": "patch",
"published_at": "2026-03-19T01:17:23Z"
},
{
"tag": "v3.7.3",
"kind": "patch",
"published_at": "2026-03-19T01:02:16Z"
},
{
"tag": "v3.7.2",
"kind": "patch",
"published_at": "2026-03-19T00:51:17Z"
},
{
"tag": "v3.7.1",
"kind": "patch",
"published_at": "2026-03-19T00:47:32Z"
},
{
"tag": "v3.7.0",
"kind": "minor",
"published_at": "2026-03-19T00:16:39Z"
},
{
"tag": "v3.6.10",
"kind": "patch",
"published_at": "2026-03-18T22:35:29Z"
},
{
"tag": "v3.6.9",
"kind": "patch",
"published_at": "2026-03-18T22:13:15Z"
},
{
"tag": "v3.6.8",
"kind": "patch",
"published_at": "2026-03-18T21:17:45Z"
},
{
"tag": "v3.6.7",
"kind": "patch",
"published_at": "2026-03-18T20:21:18Z"
},
{
"tag": "v3.6.6",
"kind": "patch",
"published_at": "2026-03-17T18:40:24Z"
},
{
"tag": "v3.6.5",
"kind": "patch",
"published_at": "2026-03-17T10:43:49Z"
},
{
"tag": "v3.6.4",
"kind": "patch",
"published_at": "2026-03-17T10:18:20Z"
},
{
"tag": "v3.6.3",
"kind": "patch",
"published_at": "2026-03-17T09:41:18Z"
},
{
"tag": "v3.6.2",
"kind": "patch",
"published_at": "2026-03-17T09:11:26Z"
},
{
"tag": "v3.6.0",
"kind": "minor",
"published_at": "2026-03-16T01:12:28Z"
},
{
"tag": "v3.5.0",
"kind": "minor",
"published_at": "2026-03-14T00:53:12Z"
},
{
"tag": "v3.3.4",
"kind": "patch",
"published_at": "2026-03-13T08:57:11Z"
},
{
"tag": "v3.3.3",
"kind": "patch",
"published_at": "2026-03-12T18:18:17Z"
},
{
"tag": "v3.3.2",
"kind": "patch",
"published_at": "2026-03-12T17:31:03Z"
},
{
"tag": "v3.3.1",
"kind": "patch",
"published_at": "2026-03-12T16:52:47Z"
},
{
"tag": "v3.3.0",
"kind": "minor",
"published_at": "2026-03-12T16:19:05Z"
},
{
"tag": "v3.2.3",
"kind": "patch",
"published_at": "2026-03-11T07:52:28Z"
},
{
"tag": "v3.2.2",
"kind": "patch",
"published_at": "2026-03-11T06:44:35Z"
},
{
"tag": "v3.2.1",
"kind": "patch",
"published_at": "2026-03-09T11:29:37Z"
},
{
"tag": "v3.2.0",
"kind": "minor",
"published_at": "2026-03-09T10:11:41Z"
},
{
"tag": "v3.1.31",
"kind": "patch",
"published_at": "2026-03-06T06:03:03Z"
},
{
"tag": "v3.1.30",
"kind": "patch",
"published_at": "2026-03-06T05:42:53Z"
},
{
"tag": "v3.1.29",
"kind": "patch",
"published_at": "2026-03-06T05:28:29Z"
},
{
"tag": "v3.1.28",
"kind": "patch",
"published_at": "2026-03-06T04:57:50Z"
},
{
"tag": "v3.1.27",
"kind": "patch",
"published_at": "2026-03-06T04:41:50Z"
},
{
"tag": "v3.1.26",
"kind": "patch",
"published_at": "2026-03-06T04:06:00Z"
},
{
"tag": "v3.1.25",
"kind": "patch",
"published_at": "2026-03-06T03:52:26Z"
},
{
"tag": "v3.1.24",
"kind": "patch",
"published_at": "2026-03-06T02:49:04Z"
},
{
"tag": "v3.1.23",
"kind": "patch",
"published_at": "2026-03-06T02:35:36Z"
},
{
"tag": "v3.1.22",
"kind": "patch",
"published_at": "2026-03-06T02:09:18Z"
},
{
"tag": "v3.1.21",
"kind": "patch",
"published_at": "2026-03-06T01:43:59Z"
},
{
"tag": "v3.1.20",
"kind": "patch",
"published_at": "2026-03-06T01:20:21Z"
},
{
"tag": "v3.1.19",
"kind": "patch",
"published_at": "2026-03-06T01:02:18Z"
},
{
"tag": "v3.1.18",
"kind": "patch",
"published_at": "2026-03-05T23:37:26Z"
},
{
"tag": "v3.1.17",
"kind": "patch",
"published_at": "2026-03-05T23:17:13Z"
},
{
"tag": "v3.1.16",
"kind": "patch",
"published_at": "2026-03-05T22:55:26Z"
}
],
"recent_commits": [
{
"oid": "5616a2de3b8bbb6181c202362fb8cab4f57c7ba3",
"body": "…n tools (4.4.1)\n\nThe auto-generated Workflow block (DescriptionGenerator) and the TOON action-metadata table (ToonDescriptionGenerator) are now emitted only for grouped tools or flat tools with 2+ actions. A flat single-action tool (e.g. defineTool with a single 'default' action) no longer carries a redundant per-action block. Destructive/readOnly/idempotent hints (annotations) and required params (inputSchema) are unaffected. Bumps monorepo to 4.4.1 and cross-deps to ^4.4.1.",
"is_bot": false,
"headline": "fix(core): omit Workflow section and TOON table for flat single-actio…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-07-27T00:10:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cd4c867161e4b39e9072008fae7599b716b267b",
"body": "… for MCP 2026-07-28 (4.4.0)",
"is_bot": false,
"headline": "feat(core): return-based elicitation (requireInput) + deprecate ask()…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-07-24T05:22:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c20c5e5fc486ac23e05ed94f441513263b7971e",
"body": null,
"is_bot": false,
"headline": "fix(core): inherit builder description for actions without their own",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-07-19T03:55:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2990dddf03976d599ea28f61a2adecc48847a899",
"body": null,
"is_bot": false,
"headline": "bump",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-06-25T00:45:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d61a5929463bbc790176393998ddbdbb0777fec7",
"body": null,
"is_bot": false,
"headline": "fix: remove auto-gitignore on .MCPFusionrc (v4.3.1)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-06-25T00:18:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb10fe95ca0486775f50c4ee67ad072be5c5a410",
"body": "…e compatibility (4.3.0)",
"is_bot": false,
"headline": "fix(core): architecture audit — type safety, security hardening & edg…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-06-18T17:55:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16dd88d0a45197fd15ed924da4a981fb9ef28499",
"body": "…e (4.2.0)",
"is_bot": false,
"headline": "feat(core): marketplace SEO metadata - structured product intelligenc…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-27T06:22:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c9e7a836c4932239d1d0ddbcc850681057fc380",
"body": "… context window optimization",
"is_bot": false,
"headline": "feat(core): FSM Progressive Disclosure — compactDescription() API for…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T20:25:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea64432129e7fcc9c654ed9e3304cb1f193c53ac",
"body": "…er scanner compatibility (v4.0.4)",
"is_bot": false,
"headline": "fix(edge): sanitizer replaces process.env in string literals for serv…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T17:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "081929b056b263764fcc82b5ef89e7d8c9bc90ac",
"body": null,
"is_bot": false,
"headline": "docs: fix duplicate SEO key and dead SKILL.md links in VitePress build",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T16:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88eb63dc5b49fe22f688a99b464093513a6efdac",
"body": "…yntaxError — v4.0.3\n\nThe process.env regex in sanitizeBundleForEdge() was corrupting string literals in minified bundles, causing SyntaxError: missing ) after argument list at V8 Isolate compile time. Replaced with a context-aware callback that detects string boundaries via double-quote counting, skipping replacement inside string literals.\n\nAffects: deploy.ts (CLI), sanitizer.ts (runtime)\n\nAll monorepo packages bumped to 4.0.3.",
"is_bot": false,
"headline": "fix(core): context-aware process.env sanitizer prevents isolated-vm S…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T16:47:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0325ae1fd093e908b47442b75f8511de7527d5a2",
"body": null,
"is_bot": false,
"headline": "release: v4.0.1 - stabilize core pipeline and bump workspace packages",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-20T07:55:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c45a918d6cb7dcc8b7ccf909dbb7ae7bda0560ec",
"body": "The Vurb-to-mcpfusion rename accidentally corrupted /tmp/ to /tm./ in the Unix socket path (same pattern as the Vercel scaffold bug). This caused EACCES on all 6 inspector e2e tests in CI.\n\nFixed: TelemetryBus.ts (source), 5 test files in packages/inspector/tests/",
"is_bot": false,
"headline": "fix: socket path /tm./ → /tmp/ in TelemetryBus and inspector tests",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-20T00:30:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e052a4a9e863533de9e90211a8c525b2d81a08c",
"body": "Full rebrand from Vurb to MCP Fusion. All source code, documentation, CLI, workflows, and npm packages now use the @mcpfusion scope. Security-first TypeScript framework for MCP servers powering 4,000+ connectors on Vinkius.\n\n- Version bump: 3.19.6 → 4.0.0 (root + 16 packages)\n\n- Internal cross-deps:\n[…]\ncore ^3.19.6 → ^4.0.0\n\n- Git remote: vinkius-labs/mcpfusion\n\n- CHANGELOG: 4.0.0 entry with governance stack and ecosystem table\n\n- Fix: Vercel scaffold path src/mc./mcpfusion.ts → src/mcp/mcpfusion.ts",
"is_bot": false,
"headline": "4.0.0 — Welcome to MCP Fusion",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-20T00:21:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "18a5dfc0aef88c0b0354bc8bb1cb7329dbcf104b",
"body": "… hygiene — v3.19.6\n\n- Session close O(n) → O(1) via WeakMap reverse-lookup\n- Hot-path URL constructor replaced with string-based pathname extraction\n- Reaper-integrated rate limiter pruning (zero extra Set allocation)\n- Single Date.now() capture in telemetry emit for timestamp coherence\n- Finalizat\n[…]\n leak detector for SandboxEngine\n- 24 auto-fixable ESLint problems resolved across 7 files\n- 22 new regression tests (331 files, 6,827 tests passing)\n- All @vurb/* cross-dependencies bumped to ^3.19.6",
"is_bot": false,
"headline": "perf(core): HTTP transport optimizations, telemetry coherence, ESLint…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T23:13:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1b349491f62e006f5d624073723ea0a22b736ad1",
"body": null,
"is_bot": false,
"headline": "fix: add User-Agent to bypass Cloudflare 1010 on Discord webhook",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T01:43:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e223490101c8804baf2c714995ab351cf2914c3",
"body": null,
"is_bot": false,
"headline": "fix: export STAT so Python can read it in Discord notify workflow",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:51:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52dca786e7f038615251cd89d71848e4a423cbd8",
"body": null,
"is_bot": false,
"headline": "fix: correct Discord notification env interpolation in heredoc",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:43:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "174a5f7d663daedf1a41b3822c2bb9b9d9650150",
"body": null,
"is_bot": false,
"headline": "ci: richer Discord commit notifications with file stats and avatar",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:40:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "85fcbb909c3e4abe6bf2be4fb3b3f6ac2641e6d2",
"body": null,
"is_bot": false,
"headline": "ci: add Discord notifications for commits and releases",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:37:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07f4eb83e5fc606907904deefc61b8903bf399df",
"body": "- Add Discord CTA above badges for immediate visibility\n- Add Discord to navigation links row\n- Remove standalone Community section (redundant)",
"is_bot": false,
"headline": "docs: consolidate Discord link into header and nav bar",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:26:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f67971c334118a3138b06714fb0240494a967b7",
"body": null,
"is_bot": false,
"headline": "docs: add prominent Discord CTA at top of README",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:23:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df070f935e06d4415617b8aead70ce26b19c741e",
"body": null,
"is_bot": false,
"headline": "docs: add Discord community section",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:21:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17b3a50ab74f2ea48464f059e6cd039ffc5d7e15",
"body": null,
"is_bot": false,
"headline": "chore(release): v3.19.5",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-07T01:51:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8a5d814264cdb38bedb2837af2bc2f0a6c136b2",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-07T01:41:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bb038e2e0bd6151cab2622bd6bb71da52770b5d",
"body": null,
"is_bot": false,
"headline": "chore(release): v3.19.4",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-07T01:27:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "db8ce9378579724b18ac36fdead19a2bc906953d",
"body": "…e table",
"is_bot": false,
"headline": "docs: add withJson and withOptionalJson to FluentToolBuilder referenc…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-02T19:58:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d2f91939582089b77ca97de5de87f543c0df3f7",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T22:39:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50f3779022160d5a6b89df8d425e63adcbae4e88",
"body": "…— v3.19.3",
"is_bot": false,
"headline": "fix(core): externalize isolated-vm from introspection esbuild builds …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T20:38:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02d0129b43c56d69d1fe6cc030d5a01b5b86e663",
"body": "…o tmpdir — v3.19.2",
"is_bot": false,
"headline": "fix(core): autoDiscover fails during introspection — bundle written t…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T20:28:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ef052ec550868068b0c5460eec2b7babf316a02",
"body": "- fix: SSE parser multi-line data concatenation (silent data loss)\n- fix: streaming path missing tool existence check before executeStream\n- fix: streaming path skipped message.kind validation\n- fix: non-text artifact content silently dropped as empty TextPart\n- refactor: extract shared message-util\n[…]\n.0+ types)\n- fix: pagination cursor NaN guard in TaskManager.listTasks\n- fix: UUID fallback entropy improved for collision resistance\n- test: 35 regression tests in bug-regressions.test.ts (245 total)",
"is_bot": false,
"headline": "fix(a2a): remediate 8 bugs from protocol audit — v3.19.1",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T18:21:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a17c25d7a54f2e0c046b294a7725464c9b269cc0",
"body": null,
"is_bot": false,
"headline": "feat(@vurb/a2a): A2A Protocol Bridge with SSE streaming — v3.19.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T09:53:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "27140b34b2940fc6ffd7a7cea4e8124f05646b8b",
"body": "Standard /.well-known/mcp/server-card.json endpoint for AI agent auto-discovery.\n\n- compileServerCard() pure-function compiler with duck-typed interfaces\n\n- startServer({ serverCard }) integration with zero per-request overhead\n\n- ServerCardConfig, ServerCardPayload, ServerCardToolEntry types\n\n- 55 tests (adversarial, scale, idempotency, JSON compliance)\n\n- llms.txt updated with feature docs and API reference\n\n- All @vurb/* packages bumped to 3.18.0",
"is_bot": false,
"headline": "feat: MCP Server Card auto-discovery (SEP-1649) — v3.18.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T08:57:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eeadea5f87972d33a21207c81a2268a8adbf3b3",
"body": "…es TypeError crash in V8 isolates\n\nedge-stub.ts did not export AsyncLocalStorage, but ask.ts executes\nnew AsyncLocalStorage() at module load time. The Proxy fallback\nreturned an arrow function (not constructable), causing:\n TypeError: Va.AsyncLocalStorage is not a constructor\n\nAdded AsyncLocalStorage class (synchronous stack-based store) to\nedge-stub.ts alongside EventEmitter, Readable, Writable, Server.\n\nBump: 3.17.2 -> 3.17.3 (all 16 packages)",
"is_bot": false,
"headline": "fix(edge-stub): add AsyncLocalStorage as Tier 1 structural stub — fix…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-30T10:45:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6eea45f8868cef71cc7f04ad1795ed743805c795",
"body": "…tion errors, response transform key collisions — v3.17.2",
"is_bot": false,
"headline": "feat(yaml): loadFromParsedSpec export, connection timeouts, interpola…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-23T08:01:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0269c7ba887fc3a4c465b58b0ce19a879c771d4",
"body": "…, add @vurb/core/cli export — v3.17.1",
"is_bot": false,
"headline": "fix(yaml): crypto.randomUUID → node:crypto import, export MCP helpers…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-21T05:18:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d76d1d213194924a0e85def4860baad514b43b0c",
"body": null,
"is_bot": false,
"headline": "feat: @vurb/yaml declarative MCP server engine + CLI plugin (3.17.0)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-21T04:18:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e97730cf6acffeb48768776b18445042accb10a4",
"body": "…#3.16.0)\n\n- ask() callable namespace with typed field factories (string, number, boolean, enum)\n\n- AskResponse with fail-fast .data getter and boolean guards\n\n- .interactive() on FluentToolBuilder and FluentRouter\n\n- Zero-overhead AsyncLocalStorage transport binding in ServerAttachment\n\n- Multi-step wizard support and URL redirect mode\n\n- 72 new tests, full documentation, llms.txt updated\n\n- All packages bumped to 3.16.0",
"is_bot": false,
"headline": "feat: MCP Elicitation — human-in-the-loop DSL for agentic workflows (…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-21T00:51:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8855887647f534f23badfac1f242d765813ae75",
"body": null,
"is_bot": false,
"headline": "fix: correct package name @vurb/openapi-gen",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:46:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf66e8202da374c414afc36373d85403c67cf439",
"body": null,
"is_bot": false,
"headline": "fix: cron expression requires 5 fields (add day-of-week)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:37:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc7cf250711a8d3864a9934ed9d6d8170e0bf103",
"body": null,
"is_bot": false,
"headline": "release: v3.15.3",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:24:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8738df880cc939887150bab4b666bef32497dce",
"body": "…ellite packages\n\nFixes installation failures when installing adapter packages standalone (e.g. @vurb/inspector). Core is now auto-installed as a transitive dependency.",
"is_bot": false,
"headline": "fix: move @vurb/core from peerDependencies to dependencies in all sat…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:21:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cad2a643ce07b693385207327b470d4a44aa0c63",
"body": null,
"is_bot": false,
"headline": "ci: add ecosystem health smoke tests and scheduled CI",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:16:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "123a7c19601f8b1a9e2735e9d39802c48347e217",
"body": null,
"is_bot": false,
"headline": "chore: release v3.15.2",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-11T19:00:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f2182578da0b12336e68513ff1cb76c85a83045",
"body": "…ache invalidation [3.15.1]\n\n- PostProcessor.isToolResponse() migrated from shape-based to TOOL_RESPONSE_BRAND symbol detection\n- ResponseBuilder.build() now stamps TOOL_RESPONSE_BRAND (was missing, causing MVA layer corruption)\n- GroupedToolBuilder.invalidateCache() replaces duck-type private field\n[…]\nreateAuthTool ok()/fail() aligned with brand-based detection\n- Updated tests to use success()/error() helpers instead of manual ToolResponse construction\n- Bumped all 15 packages from 3.15.0 to 3.15.1",
"is_bot": false,
"headline": "fix(core): unified brand-based ToolResponse detection, encapsulated c…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-10T05:32:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9f864bb814bf02d6949bc8096ea5e67368324758",
"body": null,
"is_bot": false,
"headline": "feat(core): add withJson/withOptionalJson to FluentToolBuilder — v3.15.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-07T06:20:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25ad34f91c0ed67518066c15ecec4f75940aa19e",
"body": null,
"is_bot": false,
"headline": "optionalCredential",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-05T03:11:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "87b0d7cc20067fe4508c341c401dc1c1bc420d10",
"body": "zodToJsonSchema (v3.x) silently returns empty schemas for Zod 4 types,\ncausing all MCP tool parameters to disappear from inputSchema.\n\nAdded ZodCompat.ts layer that detects Zod version at runtime:\n- Zod 4: uses native z.toJSONSchema()\n- Zod 3: delegates to zod-to-json-schema (backward compatible)\n\nMigrated SchemaGenerator, ExpositionCompiler, and JsonSerializer.\nAdded 13 regression tests in ZodCompat.test.ts.",
"is_bot": false,
"headline": "fix(core): Zod 4 JSON Schema compatibility — v3.14.8",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-31T23:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "214b1b02f9a765500f5c78adabad5a89e1e5191e",
"body": "- __vinkius_edge_dispatch now returns JSON string instead of raw object\n\n- Eliminates DataCloneError when handlers return Promise/Function/Symbol\n\n- JSON.stringify inside isolate, JSON.parse on host side\n\n- Patch bump all packages 3.14.4 → 3.14.5",
"is_bot": false,
"headline": "fix: edge dispatch structured clone boundary protection (v3.14.5)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-31T13:53:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8feabaa9f1446b4f837f5c003a6b5ede54f99a6",
"body": "…ubs (v3.14.4)",
"is_bot": false,
"headline": "fix(edge): V8 isolate boot failures — __proto__ sanitizer, os/path st…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-31T05:02:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31bbc1de9e94d39d4d01a8ad8fb9222f34d203b5",
"body": null,
"is_bot": false,
"headline": "chore(release): v3.14.1",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-29T23:06:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de655847fc30829ae0e43b121b23e67e0a6a156c",
"body": "- Add 'oauth2' to CredentialType union\n- Add OAuthConfig interface (provider, grant_type, authorize_url, token_url, scopes, client_id_field, client_secret_field, user_info_url, extra_params)\n- Add oauth? field to CredentialDef\n- Bump all packages to 3.14.0",
"is_bot": false,
"headline": "feat(core): OAuth 2.0 BYOA credential type — v3.14.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-29T16:54:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3a3c1f4443ff81488b7f1d53d306281b92aa853",
"body": "…13.1)",
"is_bot": false,
"headline": "fix(core): inject credential_schema into deploy manifest payload (v3.…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T21:51:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9bfd1078776c673ff1dde0f886df2a1778ebb5aa",
"body": null,
"is_bot": false,
"headline": "v3.13.0 - Marketplace Prompt Examples",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T07:03:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4e46668df897da27176571d646c4f44627b345f",
"body": "…_event fix",
"is_bot": false,
"headline": "v3.12.8 — contract-driven HTTP method classification, Calendly cancel…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T06:08:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "075c49f9a367fe7418ec4d7f34b58198a4e11268",
"body": null,
"is_bot": false,
"headline": "v3.12.7 — graceful changelog file reference fallback",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T04:26:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f4da067ddfecc2313bfeeca0682ca4b2145da538",
"body": null,
"is_bot": false,
"headline": "v3.12.6 - Resilient esbuild Discovery (4-Strategy Resolution)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T03:26:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5a136f45b06c6323991baa1c3d90ee1a5f90618",
"body": null,
"is_bot": false,
"headline": "v3.12.5 - esbuild Auto-install ESM Resolution Cache Bypass",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T03:09:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f735e53226048a80b680eca852b880e09ef3a10",
"body": null,
"is_bot": false,
"headline": "v3.12.4 - esbuild Auto-install Uses Project Root",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T02:57:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b7d25e7b7455a964aa78107010297996c80a52b",
"body": null,
"is_bot": false,
"headline": "v3.12.3 - Introspection Pipeline Auto-installs esbuild",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T02:43:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca23870569f9f14de1bd0e1717f70e74523b6c9e",
"body": null,
"is_bot": false,
"headline": "v3.12.1 - Edge Deploy Bundle Sanitizer Fix",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T02:11:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abf1b40b65619a84c0484cc61358964cfecda604",
"body": "- vurb version: CLI version + installed @vurb/* packages table\n- vurb update: detect outdated packages + auto npm install\n- vurb doctor: 8-check diagnostic suite (node, config, token, entrypoint, esbuild, lockfile)\n- vurb validate: live server smoke test with tool analysis + lockfile drift detection\n- Shared modules: npm-registry.ts, introspect.ts\n- 119 new tests across 5 test files (639 total CLI tests passing)\n- Bump all packages 3.11.1 → 3.12.0",
"is_bot": false,
"headline": "feat(cli): add version, update, doctor, validate commands (v3.12.0)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T01:49:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc5076c5b1319b1d475b481dd58a4fef45e49583",
"body": null,
"is_bot": false,
"headline": "v3.11.1 — bundle size limit 500KB→1.5MB, MCP SDK dedup",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T00:55:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "21a11c78f07e523e0752efd6e586b6bc740631d5",
"body": "…lity",
"is_bot": false,
"headline": "feat: v3.11.0 — SaaS integration identity, deploy warnings, compatibi…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T22:40:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f15ed529694149406d70d500997a0e914cbb38dd",
"body": "…Passport, i18n, Publisher Type",
"is_bot": false,
"headline": "v3.10.0 — Marketplace Behavioral Transparency, Trust Score, Security …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T17:00:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba2e929abb0dc9cc143bfeb3af3047763a79e777",
"body": null,
"is_bot": false,
"headline": "docs: add credentials BYOC section to llms.txt and skills.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T01:52:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a254cc6040c731f15cfdfb5bb34ce5a69fa4b80d",
"body": null,
"is_bot": false,
"headline": "docs: add credentials BYOC documentation and v3.9.0 changelog",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T01:32:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b1c959d0c20878659f07b962b9ad485a84a850a",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 3.9.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T01:25:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a98ab9054a632eca99f689102dd54ef81c99044e",
"body": "…r fix",
"is_bot": false,
"headline": "chore: bump to v3.8.3 — introspection action expansion + deploy banne…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T13:47:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc1b7e933e9ff6a555fd4d44dec2d3bc48a1d82e",
"body": "…r fix",
"is_bot": false,
"headline": "chore: bump to v3.8.2 — introspection action expansion + deploy banne…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T13:37:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02afda1e3cd55f8fb34ea5219a311092a99a031d",
"body": null,
"is_bot": false,
"headline": "fix: restore res.json() try/catch in deploy — bug #81 regression",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T06:37:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ccbb8c3dfcd864b844d03eca686063219e2e614d",
"body": "- Rewrote README headers for all 14 packages with MCP-first keywords\n- Added MCP-compatible and Vurb.ts badges to all sub-packages\n- Bumped patch version: 3.8.1 -> 3.8.2",
"is_bot": false,
"headline": "chore: bump all packages to v3.8.2 — MCP-first SEO for npmjs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T05:54:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cdbf912af9fa27ccfac136f700383aa6d6125f1c",
"body": "…tiveHandoff connecting bypass",
"is_bot": false,
"headline": "fix: patch 3.8.1 — resources/list stale handler, signal shadow, hasAc…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-25T21:55:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b67ef2da072e8d9ff0c1fcca8e19a58cdda5dbeb",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-22T21:53:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53eec75d248f505647cdd20a4dfff50e7bdee043",
"body": "- New package @vurb/swarm: SwarmGateway B2BUA, UpstreamMcpClient,\n NamespaceRewriter, ReturnTripInjector (anti-IPI sanitiser)\n- FHP: zero-trust HMAC-SHA256 delegation tokens, Claim-Check pattern,\n W3C traceparent distributed tracing, session lifecycle management\n- core: EXPIRED_DELEGATION_TOKEN on\n[…]\n: test script added, tests now run in CI\n- All 14 packages bumped to 3.8.0\n- README.md + packages/core/README.md: Swarm/FHP sections added\n- CHANGELOG.md: [3.8.0] entry with Added/Fixed/Security/Tests",
"is_bot": false,
"headline": "release: v3.8.0 — Federated Handoff Protocol (@vurb/swarm)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-22T13:48:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b17be65ea982c83d677a269f689877303af95f71",
"body": "- StateMachineGate.transition() race with XState subscriber: added\n await Promise.resolve() after actor.send() so the subscribe()\n callback updates _currentState before it is read (Bug #1)\n\n- SandboxEngine abort handler context undefined race: introduced\n ctxRef mutable wrapper so onAbort always \n[…]\nh registry.size (Map.size, O(1)); added readonly size\n to RegistryDelegate interface to remove the unsafe cast (Bug #4)\n\nTests: 7 FSM transition-race, 5 SandboxAbortContextRef, 13 BuildPipeline brand",
"is_bot": false,
"headline": "fix: resolve 4 core bugs and add 25 regression tests (v3.7.13)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-21T09:39:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7f33efe74511038863c10b6431eeed105dc3d6b2",
"body": "…#129) - v3.7.12",
"is_bot": false,
"headline": "fix: autoDiscover name-based dedup blocks router action merging (Bug …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-20T18:22:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a286513f13ec7004c1d7e6a86339c4786c08877",
"body": "New implementation modules, 68 edge-case tests (ConcurrencyGuard, MutationSerializer, EgressGuard, PolicyEngine, ProxyHandler, defineModel), CHANGELOG update, version bump 3.7.10->3.7.11 across all packages.",
"is_bot": false,
"headline": "chore(release): v3.7.11",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-20T13:44:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1e8544011ccc382358cc2e24151edb4adb84c20",
"body": "refactor(defineModel): extract fieldTypeToZod + labelFor helpers\n- Eliminated ~50 lines of duplicated switch/case between compileField\n and compileFieldForInput; both now delegate to a shared base compiler\n\nrefactor(FluentToolBuilder): introduce withDesc() schema helper\n- Replaced repeated ternary \n[…]\nype-safe buildTruncationSuffix() function\n- Replaced implicit {limit} placeholder string with a typed function\n that takes formattedLimit as a required argument\n\nchore: bump all 13 packages to 3.7.10",
"is_bot": false,
"headline": "chore(release): v3.7.10",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-20T10:36:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c558b66089ac857815ebe8577302c227201c4e51",
"body": "Update README and many docs to strengthen AI-facing prompt text: replace existing \"Open in Claude/ChatGPT\" links and copy-prompt content with explicit, mandatory instructions to use the Vurb.ts framework and follow the MVA patterns (createPresenter, f.query/f.mutation/f.action, .redactPII(), .return\n[…]\nndlers) and updates the example prompt block to reflect the enforcement language. Multiple documentation pages and the core README were updated to ensure consistent prompt enforcement across the site.",
"is_bot": false,
"headline": "Add mandatory Vurb.ts enforcement to docs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T23:26:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9bfd9399bc9d5564b5105f593e179d373f3e49aa",
"body": "Normalize the 'Open in Claude/ChatGPT' links and copy-button prompt text across the README and docs by removing a trailing period from the llms.txt URL and standardizing the query string encoding. This prevents the '.' from being included in the fetched architecture URL and ensures prompts are passed correctly to external AI tools. Files updated include README.md, many docs/*.md, and packages/core/README.md.",
"is_bot": false,
"headline": "Fix AI 'Open' links and prompt query strings",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T18:14:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2eb040c412e9b93de097ef61c295837bd3a393e",
"body": "Introduce Prompt Deep Linking and llms.txt integration across the site. README: update tagline, add llms.txt badge/link, safety callouts, a Raw SDK vs Vurb.ts comparison, architect checklists, many example \"Tell your AI agent\" snippets, and a new \"How Prompt Deep Linking Works\" section explaining Op\n[…]\n) so agents receive the llms.txt super-prompt before visible instructions. Overall: enhance developer UX for AI-driven code generation and enforce correct MVA patterns via machine-readable spec links.",
"is_bot": false,
"headline": "Add prompt deep-linking action bars and docs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T17:30:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5a790c5f02201d71194828c33d300f3e9b84b195",
"body": "…n token set (v3.7.9)",
"is_bot": false,
"headline": "fix(cli): preserve remote URL on --server-id, auto-resolve serverId o…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T17:03:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "497d26d6e06bda9c28b8181b8e45fae442b2a6cc",
"body": "- #1 Rate limiting per session (token bucket, 600 req/min default)\n- #2 Session ID format validation (UUID v4)\n- #3 JSON.parse safety with HTTP 400\n- #4 Max concurrent sessions (1000 default, HTTP 503)\n- #5 HMAC secret strength validation (warn dev, throw prod)\n- #6 CORS configuration with preflight support\n- #7 Auth failure telemetry (onAuthFailure callback)\n- #8 Prototype pollution guard on edge setState\n- #9 SandboxGuard security model documentation\n\n50 new tests, 0 regressions.",
"is_bot": false,
"headline": "security: hardening audit items #1-#9 + bump v3.7.8",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T13:50:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16071719933e2f4ff8e4027ac9f9f6a32471067d",
"body": "…orkers.\n\n\"One command. Your MCP server is live on Vinkius Edge, Vercel Functions, or Cloudflare Workers.\"",
"is_bot": false,
"headline": "MCP server is live on Vinkius Edge, Vercel Functions, or Cloudflare W…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:58:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efaa8619e401d5ab7e6c4dd6531c806d561d0a02",
"body": "Supported targets (Vinkius Edge, Vercel Functions, Cloudflare Workers)",
"is_bot": false,
"headline": "Highlight deployment targets in READMEs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:34:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a7fc331b6bd187fb60fd4c1cfc1fb0eac24e52f5",
"body": "Update README.md and packages/core/README.md to mention opening the scaffold in Cursor, Claude Code, or GitHub Copilot and show a sample prompt. Reword the agent sentence from \"Your AI agent...\" to \"The agent...\" for clarity, and add a new \"Scaffold Options\" section with the `vurb create my-server` example in both files.",
"is_bot": false,
"headline": "Mention Copilot and add scaffold options",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:31:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "217e678708a26423f35704f28b7e0066112d8af3",
"body": null,
"is_bot": false,
"headline": "fix: TS2352 build error in action expansion (v3.7.7)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:27:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb55a86d33576a9bdd1738a955b16cf2a7611b76",
"body": "…f lockfile (v3.7.7)",
"is_bot": false,
"headline": "fix: TS2352 build error in action expansion — use contracts instead o…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:23:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4a4cd21c7bdc280de2bb3ad4f4642d5d9bea517",
"body": "…ut (v3.7.6)",
"is_bot": false,
"headline": "fix: expand grouped tool actions in introspection + clean deploy outp…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:14:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9286bd9018f974ff78112a3968a43b50dd551127",
"body": null,
"is_bot": false,
"headline": "fix: node-compatible introspection build (v3.7.5)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T09:10:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4415d1863055d5f238679dfd0324ed303aeed7ed",
"body": null,
"is_bot": false,
"headline": "fix: IIFE introspection via vm.runInThisContext (v3.7.4)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T01:14:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffc3b425eec7cfd0cc4e57fb7822a00ca7f6dfeb",
"body": "…introspection (v3.7.3)",
"is_bot": false,
"headline": "fix: align test assertions with namespace merge, vm.runInThisContext …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T01:14:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd6057cb3735ea2a52e6c43d5dce2f3d6e2a54a5",
"body": null,
"is_bot": false,
"headline": "fix: align test assertions with namespace merge (v3.7.3)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T01:01:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ef03fb1c0c4849ec42d6928e37434356a565fbc",
"body": null,
"is_bot": false,
"headline": "fix: namespace merge + bundle introspection (v3.7.2)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T00:50:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25b95d325f95d9e6e257b4b073c81abf54293d3b",
"body": null,
"is_bot": false,
"headline": "fix: ToolRegistry namespace merge, bundle-based introspection (v3.7.1)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T00:43:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b51e2e16a823fe245d05a0bda9ac6ca21c5b1d67",
"body": "… (v3.7.0)",
"is_bot": false,
"headline": "feat: deploy manifest — real introspection, tool sync, premium output…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T00:14:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "811c3a43a642fb1d0304624999d9631eb0f2c218",
"body": null,
"is_bot": false,
"headline": "fix(deploy): bundle sanitizer for edge static analysis — v3.6.10",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-18T22:27:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e82edb91346987a5cb944987b4cc164c61c88023",
"body": "Re-release: v3.6.8 was published by CI before force-push landed.\nThis is the correct code with the esbuild plugin fix.",
"is_bot": false,
"headline": "fix(deploy): esbuild plugin with CJS Proxy — v3.6.9",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-18T21:35:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc1ab65f79fc8926578ad994dcccbce4cb56043d",
"body": "The deploy command edge-stub resolution had 3 cascading bugs:\n1. require.resolve('vurb') — package is @vurb/core\n2. require.resolve('@vurb/core') — exports map is ESM-only, CJS fails\n3. esbuild alias — prefix matching turns fs/promises into edge-stub.js/promises\n\nFix: esbuild plugin with onResolve (\n[…]\ns from edge-stub.js work normally,\n unknown names (readFile, createServer, connect, etc.) return CRASH fn\n- 19 regression tests including 2 real esbuild integration tests\n- Bump all packages to 3.6.8",
"is_bot": false,
"headline": "fix(deploy): esbuild plugin with CJS Proxy for edge-stub resolution",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-18T21:29:55Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 100,
"commits_last_year": 342,
"latest_release_at": "2026-07-27T00:13:18Z",
"latest_release_tag": "v4.4.1",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 19,
"days_since_latest_release": 0,
"mean_days_between_releases": 7.6
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 100,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "@mcpfusion/a2a",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"a2a",
"agent-to-agent",
"mcpfusion",
"agent-card",
"json-rpc",
"protocol-bridge",
"multi-agent",
"ai",
"llm",
"task-delegation"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/a2a",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 405,
"first_published_at": "2026-05-20T00:55:45.528000Z",
"latest_published_at": "2026-07-27T00:17:11.892000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/aws",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"aws",
"lambda",
"step-functions",
"mcpfusion",
"serverless",
"ai",
"llm",
"connector"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/aws",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1428,
"first_published_at": "2026-05-20T00:55:03.629000Z",
"latest_published_at": "2026-07-27T00:16:30.209000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/jwt",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"jwt",
"json-web-token",
"authentication",
"middleware",
"ai",
"llm"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/jwt",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1331,
"first_published_at": "2026-05-20T00:55:11.020000Z",
"latest_published_at": "2026-07-27T00:16:39.824000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/n8n",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"n8n",
"mcpfusion",
"workflow",
"automation",
"ai",
"llm",
"connector"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/n8n",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1463,
"first_published_at": "2026-05-20T00:55:00.236000Z",
"latest_published_at": "2026-07-27T00:16:25.607000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/core",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"model-context-protocol",
"ai",
"llm",
"tools",
"typescript",
"framework",
"middleware",
"zod",
"mva",
"model-view-agent",
"presenter",
"guardrails",
"agentic",
"structured-data",
"action-consolidation",
"dlp",
"compliance",
"pii-redaction",
"fsm",
"state-machine",
"anti-hallucination"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/core",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 12,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4344,
"first_published_at": "2026-05-20T00:54:36.916000Z",
"latest_published_at": "2026-07-27T00:16:07.308000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/yaml",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"yaml",
"declarative",
"mcp-server",
"docker-compose",
"ai",
"llm",
"model-context-protocol",
"tools",
"resources",
"prompts"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/yaml",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 570,
"first_published_at": "2026-05-20T00:55:50.358000Z",
"latest_published_at": "2026-07-27T00:17:17.427000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/oauth",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"oauth",
"device-flow",
"rfc-8628",
"authentication",
"token-manager",
"ai",
"llm"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/oauth",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1545,
"first_published_at": "2026-05-20T00:55:07.022000Z",
"latest_published_at": "2026-07-27T00:16:34.879000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/swarm",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"swarm",
"multi-agent",
"handoff",
"gateway",
"b2bua",
"federation",
"ai",
"llm",
"delegation",
"zero-trust"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/swarm",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1321,
"first_published_at": "2026-05-20T00:55:42.197000Z",
"latest_published_at": "2026-07-27T00:17:07.540000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 23,
"stars": 257,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2026-02-21",
"count": 2
},
{
"date": "2026-02-22",
"count": 8
},
{
"date": "2026-02-23",
"count": 3
},
{
"date": "2026-03-10",
"count": 1
},
{
"date": "2026-03-20",
"count": 1
},
{
"date": "2026-03-21",
"count": 1
},
{
"date": "2026-03-26",
"count": 1
},
{
"date": "2026-03-27",
"count": 1
},
{
"date": "2026-03-28",
"count": 1
},
{
"date": "2026-04-04",
"count": 1
},
{
"date": "2026-04-28",
"count": 1
},
{
"date": "2026-06-17",
"count": 1
},
{
"date": "2026-06-20",
"count": 1
}
],
"complete": true,
"collected": 23,
"total_forks": 23
},
"star_history": null,
"open_issues_and_prs": 8
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"cookbook"
],
"has_llms_txt": true,
"has_dockerfile": false,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"packages/a2a/tsconfig.json",
"packages/api-key/tsconfig.json",
"packages/aws/tsconfig.json",
"packages/cloudflare/tsconfig.json",
"packages/core/tsconfig.json",
"packages/inspector/tsconfig.json",
"packages/jwt/tsconfig.json",
"packages/n8n/tsconfig.json",
"packages/oauth/tsconfig.json",
"packages/openapi/tsconfig.json",
"packages/prisma-gen/tsconfig.json",
"packages/skills/tsconfig.json",
"packages/swarm/tsconfig.json",
"packages/testing/tsconfig.json",
"packages/vercel/tsconfig.json",
"packages/yaml/tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 380375,
"source_files_sampled": 659,
"oversized_source_files": 10,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@mcpfusion/core",
"manifest": "packages/a2a/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/api-key/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/aws/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/cloudflare/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@toon-format/toon",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^2.1.0"
},
{
"name": "zod-to-json-schema",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^3.25.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/inspector/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/jwt/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/n8n/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/oauth/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/openapi/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "yaml",
"manifest": "packages/openapi/package.json",
"ecosystem": "npm",
"version_constraint": "^2.7.0"
},
{
"name": "@prisma/generator-helper",
"manifest": "packages/prisma-gen/package.json",
"ecosystem": "npm",
"version_constraint": "^6.0.0"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/prisma-gen/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/skills/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "minisearch",
"manifest": "packages/skills/package.json",
"ecosystem": "npm",
"version_constraint": "^7.1.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/swarm/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/testing/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/vercel/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/yaml/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "yaml",
"manifest": "packages/yaml/package.json",
"ecosystem": "npm",
"version_constraint": "^2.7.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 0,
"open_issues": 6,
"closed_ratio": 0.143,
"closed_issues": 1,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "renatomarinho",
"commits": 343,
"avatar_url": "https://avatars.githubusercontent.com/u/26571?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"discord-notify.yml",
"ecosystem-health.yml",
"gh-pages.yml",
"publish-npm.yml"
],
"has_docs_dir": true,
"linter_configs": [
"eslint.config.js"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 6,
"reason": "project has 2 contributing companies or organizations -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "64 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "5616a2de3b8bbb6181c202362fb8cab4f57c7ba3",
"ran_at": "2026-07-27T15:55:10Z",
"aggregate_score": 4.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-27T11:47:26Z",
"oldest_open_prs": [
{
"number": 10,
"created_at": "2026-04-28T12:31:46Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 12,
"created_at": "2026-06-17T18:23:20Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 1,
"created_at": "2026-02-12T18:16:47Z",
"last_comment_at": "2026-02-13T00:33:44Z",
"last_comment_author": "renatomarinho"
},
{
"number": 3,
"created_at": "2026-02-17T21:38:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 4,
"created_at": "2026-02-17T21:40:22Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 5,
"created_at": "2026-02-17T21:41:29Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 6,
"created_at": "2026-02-17T21:42:53Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 11,
"created_at": "2026-05-04T05:16:40Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/vinkius-labs/mcpfusion",
"host": "github.com",
"name": "mcpfusion",
"owner": "vinkius-labs"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"security": 41,
"vitality": 86,
"community": 70,
"governance": 41,
"engineering": 84
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 86,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"commits_last_year": 342,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 19
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "19/52 weeks with commits",
"points": 13.2,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 19
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "342 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 342
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 100,
"latest_release_tag": "v4.4.1",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 7.6
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "100 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 100
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~7.6 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 7.6
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "good",
"name": "Community & Adoption",
"value": 70,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"forks": 23,
"stars": 257,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "257 stars",
"points": 39.1,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 257
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "23 forks",
"points": 11.2,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 23
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 68,
"inputs": {
"packages": [
"@mcpfusion/a2a",
"@mcpfusion/aws",
"@mcpfusion/jwt",
"@mcpfusion/n8n",
"@mcpfusion/core",
"@mcpfusion/yaml",
"@mcpfusion/oauth",
"@mcpfusion/swarm"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 12407
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "12,407 downloads/month across npm",
"points": 54.6,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 12407,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 41,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 16,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 6,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 11,
"inputs": {
"merged_prs": 0,
"open_issues": 6,
"closed_issues": 1,
"issue_closed_ratio": 0.143,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "14% of issues closed",
"points": 6.7,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 14
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"followers": 15,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "vinkius-labs",
"public_repos": 65,
"account_age_days": 366
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "15 followers of vinkius-labs",
"points": 8.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 15,
"login": "vinkius-labs"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "65 public repos, account ~1 yr old",
"points": 15,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 65
}
},
{
"code": "account_age_years",
"params": {
"years": 1
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@mcpfusion/a2a",
"@mcpfusion/aws",
"@mcpfusion/jwt",
"@mcpfusion/n8n",
"@mcpfusion/core",
"@mcpfusion/yaml",
"@mcpfusion/oauth",
"@mcpfusion/swarm"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "8 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 8,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "12 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 12
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 84,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "5 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 5
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "eslint.config.js",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [
"mcp",
"mcp-framework",
"mcp-server",
"model-context-protocol",
"chatgpt",
"claude",
"mcp-tools"
],
"has_wiki": false,
"homepage": "https://vinkius.com/open-source",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://vinkius.com/open-source",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "7 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 7
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 41,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 41,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 4.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "64 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "moderate",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"has_llms_txt": true,
"legible_history_share": 0.84,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": "llms.txt present",
"points": 15,
"status": "met",
"details": [
{
"code": "llms_txt_present",
"params": {}
}
],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "84 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 84,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"packages/a2a/tsconfig.json",
"packages/api-key/tsconfig.json",
"packages/aws/tsconfig.json",
"packages/cloudflare/tsconfig.json",
"packages/core/tsconfig.json",
"packages/inspector/tsconfig.json",
"packages/jwt/tsconfig.json",
"packages/n8n/tsconfig.json",
"packages/oauth/tsconfig.json",
"packages/openapi/tsconfig.json",
"packages/prisma-gen/tsconfig.json",
"packages/skills/tsconfig.json",
"packages/swarm/tsconfig.json",
"packages/testing/tsconfig.json",
"packages/vercel/tsconfig.json",
"packages/yaml/tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "eslint.config.js",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 380375,
"source_files_sampled": 659,
"oversized_source_files": 10
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "10/659 source files over 60KB",
"points": 54.2,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 659,
"oversized": 10
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "moderate",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"example_dirs": [
"cookbook"
],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "cookbook",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "cookbook"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@mcpfusion/a2a@4.4.1; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-27T15:55:17.510555Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/v/vinkius-labs/mcpfusion.svg",
"full_name": "vinkius-labs/mcpfusion",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.27.0 — vollständige Methodik · Metriken-Wiki.
Wie ein einzelnes Ergebnis im Gesamtregister steht: aggregierte Statistiken — npm.