aself101 / mcp-secure-server

No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 1343,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "JavaScript": 516732,
        "TypeScript": 1032520
      },
      "pushed_at": "2026-07-18T04:09:27Z",
      "created_at": "2025-10-10T18:39:39Z",
      "owner_type": "User",
      "updated_at": "2026-07-18T04:09:31Z",
      "description": "A universal security-by-default framework for Model Context Protocol (MCP) servers that provides multi-layered defense against traditional attacks.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript",
        "JavaScript"
      ]
    },
    "owner": {
      "blog": "www.alexself.dev",
      "name": "Alexander Self",
      "type": "User",
      "login": "aself101",
      "company": "Hawaiian Macadamia Nut Services",
      "location": "Hilo, HI",
      "followers": 5,
      "avatar_url": "https://avatars.githubusercontent.com/u/7062416?v=4",
      "created_at": "2014-03-25T19:22:26Z",
      "is_verified": null,
      "public_repos": 28,
      "account_age_days": 4502
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.8.0",
          "kind": "minor",
          "published_at": "2026-01-07T02:09:33Z"
        },
        {
          "tag": "v1.7.0",
          "kind": "minor",
          "published_at": "2026-01-07T01:37:08Z"
        },
        {
          "tag": "v1.6.0",
          "kind": "minor",
          "published_at": "2026-01-07T01:08:30Z"
        },
        {
          "tag": "v1.5.0",
          "kind": "minor",
          "published_at": "2026-01-06T19:57:32Z"
        },
        {
          "tag": "v1.4.0",
          "kind": "minor",
          "published_at": "2026-01-06T19:51:30Z"
        },
        {
          "tag": "v1.3.0",
          "kind": "minor",
          "published_at": "2026-01-06T19:22:38Z"
        },
        {
          "tag": "v1.2.0",
          "kind": "minor",
          "published_at": "2026-01-06T18:47:52Z"
        },
        {
          "tag": "v1.1.0",
          "kind": "minor",
          "published_at": "2026-01-02T20:27:00Z"
        },
        {
          "tag": "v1.0.1",
          "kind": "patch",
          "published_at": "2025-12-20T20:10:42Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2025-12-20T20:07:44Z"
        },
        {
          "tag": "v0.9.2",
          "kind": "patch",
          "published_at": "2025-12-20T19:59:41Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2025-12-20T19:55:12Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2025-12-20T19:51:29Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "506e35b34b37a3c4f4e6f0a2244bc9bcabc10d1a",
          "body": "…llAccess, cap provenance + release-gate remediation\n\nConsolidates the 0.0.19-security work (unreleased) into one commit spanning\nthree sources: the heidegger-analyst cap-provenance fix (run #9), the two\npolicy failures observed on positional-sweep run #19, and the release-gate\nremediation (run #5).\n[…]\non pattern.\n\nTests: 1191 passing (+ securityLevel guard, registerToolPolicy guard,\nunion enum error, maxParamBytes, shellAccess FP regressions).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(0.0.19-security): configurable maxParamBytes, contextualized she…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-07-18T04:09:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6090701e8148d75ac9388c48af0cdb5ce57eceac",
          "body": "… (0.0.18-security)\n\nFixes the startup crash when launched with a non-writable cwd (e.g. MCP hosts\nthat spawn servers with cwd=\"/\"): SecurityLogger resolves its directory from\nlogDir option -> LOG_DIR env -> <cwd>/logs and degrades to no-op logging\ninstead of throwing. Degradation is observable (std\n[…]\nlity valve. Validated against both consumers (ops-uluops-mcp\n899/899, uluops-registry-mcp 337/337) via Verdaccio before promotion.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Merge: configurable logDir + non-fatal observable logging degradation…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-06-22T03:10:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "080f992e6dba29070a99dbac2747e7aa012dc903",
          "body": "…ardening (ship-gate remediation)\n\nFollow-up to the configurable-logDir fix, driven by the ship pipeline's\nanxiety-reader (58 -> 86), security-analyst (CWE-778), code-auditor, and\nrelease-readiness gates. The logger no longer crashes on an unwritable dir;\nthis makes that degradation OBSERVABLE rathe\n[…]\nre, existing-non-directory, healthy-state, and observability assertions\non the degradation path). Full suite 1173/1173, tsc clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(security-logger): observable degradation + configurable logDir h…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-06-22T02:54:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "273d1f91b7fa12230784d88f192f0cf18f86f277",
          "body": "… unwritable dir\n\nSecurityLogger hardcoded its log directory to cwd-relative 'logs' in five\nplaces and ignored all configuration. When launched with a non-writable\nworking directory (e.g. an MCP host such as Claude Desktop, which spawns\nservers with cwd=\"/\"), the constructor's mkdirSync('logs') thre\n[…]\n68, typecheck clean. Verified end-to-end from cwd=\"/\":\nno LOG_DIR degrades without crashing; LOG_DIR set writes to that directory.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security-logger): resolve log dir from option/env, never crash on…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-06-22T01:57:50Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3bb01491ac313b4b92b388d9fffdea2cf844e6ef",
          "body": "…o Layer 1 (0.0.17-security)\n\nStructureValidationLayer has accepted maxStringLength since inception, but\ncreateValidationPipeline() hardcoded LIMITS.STRING_LENGTH_MAX when\nconstructing the layer — unlike maxMessageSize and maxParamCount on the\nadjacent lines. Every consumer was pinned to the 5,000-c\n[…]\ns\n- README: option documented in Layer 1 config, type-safe config, full\n  reference, and a new String Parameter Too Long troubleshooting section\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(pipeline-factory): thread maxStringLength from server options int…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-06-12T23:06:00Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2cff548321f2c9791bed2b851970f40023758973",
          "body": "…6-security)\n\nThe command.executionWrappers patterns used unanchored leading tokens —\n/system\\s*\\(/ (System Call) and /exec\\s*\\(/ (Exec Call). With no left word\nboundary, any word ending in those letters followed by \"(\" matched:\n\"filesystem (\", \"subsystem(\", \"ecosystem(\" all tripped System Call (CRI\n[…]\n(\"), rejects suffix substrings\n(filesystem (, subsystem(, codeexec(). Regression coverage in\ntest/unit/layers/patterns.test.js. 1158 tests pass.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(pattern-detection): anchor System Call / Exec Call regexes (0.0.1…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-06-11T23:41:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ccfcad6eb8ea4a5fa1bd901372ad51cc52dd2641",
          "body": "… false positives (v0.0.15)\n\n`\\b<cmd>\\s*` matched every identifier beginning with the command word because\n`\\s*` is satisfied by zero whitespace. `topPerformers`, `topology`,\n`whoamiHandler` and friends were rejected as COMMAND_INJECTION. Switched both\npatterns to bidirectional `\\b<cmd>\\b` — real sh\n[…]\njecting `get_ecosystem_overview({\nfields: [\"topPerformers\"] })` from Codex before reaching the registry's\nsubscription-tier check.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(layer2): tighten top/whoami regexes to avoid identifier substring…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-06-08T02:11:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ec57e84ae70dc86ea810d79dcbd5abc46b6bbc13",
          "body": "…(v0.0.14)\n\nTwo bugs fixed:\n\n1. Coarse-grained config gating: shouldCheckConfig() used any-match —\n   if any sub-category was ALWAYS_CHECK, all sub-categories ran. This\n   caused command.systemInfo (EXECUTION_ONLY, matches \"top\", \"env\",\n   \"whoami\") to fire at STORAGE level because sibling command.s\n[…]\nential calls. Added lastIndex = 0 reset\n   before every .test() call.\n\n15 new tests covering both fixes. 1134 total tests passing.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(layer2): per-subcategory level filtering + regex lastIndex reset …",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-29T02:36:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "be58977320e3544b257e57d5469f476f2105b512",
          "body": "Digit-heavy UUIDs (e.g. 45207057-6941-4142-...) false-positive as\ncredit card numbers because the first 16 digits match the 4x4-digit\npattern. Strip UUID-format strings before running sensitive data\npattern checks in both Layer 2 data-semantics and response validators.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(layer2): strip UUIDs before credit card pattern matching",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-15T20:15:31Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4fdac79ea9c9656252d685b9616640cf586b7ea3",
          "body": "…rorSanitizer\n\nAdded enableDetailedErrors to SecureMcpServerOptions interface.\nSecureMcpServer constructor now passes the option to ErrorSanitizer\ninstead of always using the production shared instance.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: plumb enableDetailedErrors through SecureMcpServerOptions to Er…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-15T20:11:27Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d833a87fb48ef738568f2066628ffaa08bbf6e90",
          "body": "…type-specific messages\n\nThe error sanitizer previously randomized between 3 generic messages when\nenableDetailedErrors was false, making errors completely undiagnosable.\nNow uses the same deterministic messageMap regardless of mode.\n\nWhen enableDetailedErrors is true, the redacted reason is appended to\nthe top-level error.message so diagnostics are visible without digging\ninto the data envelope.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(sanitizer): replace randomized error messages with deterministic …",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-15T20:08:56Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f147391554ac3543b289788f9d6b06829b5a3a9c",
          "body": "README and CHANGELOG updated to document that -32602 input validation\nerrors now preserve Zod details instead of being sanitized.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump to 0.0.10-security, update docs for -32602 pass-through",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-08T22:35:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "532224554c6baa97b02aa1128f1f9a7bff10200d",
          "body": "… errors\n\nTool input validation errors (-32602) describe the caller's input\nmistakes (field paths, expected types), not internal state. Previously\nthe outgoing sanitizer stripped these details and replaced them with\nrandomized generic messages, making errors undiagnosable. Non-(-32602)\nZod errors are still sanitized to prevent internal implementation leaks.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(sanitizer): preserve -32602 Zod validation details for tool input…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-08T22:31:02Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3f6fd83d152ed0ea514b60053331d9ff8f7510a1",
          "body": "- Bump version to 0.0.8-security for npm publish\n- Update README Error Handling section with new reason/layer fields,\n  error codes table, and outgoing sanitization docs\n- Update CHANGELOG with 0.0.8-security and 0.0.7-security entries\n- Update test count badges (842 -> 1116)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump to 0.0.8-security with error diagnostic docs",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-05T06:45:48Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0ad173e90af211e9ded79101e224e4e57fb35ef0",
          "body": "ErrorSanitizer.createSanitizedErrorResponse now includes the redacted\nvalidation reason and violation type in the JSON-RPC error data field,\ngiving MCP clients actionable diagnostics instead of randomly-selected\ngeneric messages. sanitizeOutgoingError also includes reason and layer\nfor Zod-intercept\n[…]\nre still\nredacted via the existing redact() pipeline. Only the reason string\n(which describes the validation failure) is surfaced.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(sanitizer): include reason and layer in sanitized error responses",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-04-05T06:42:28Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cc73dce52b3fc150c9413d3219b90b1032828565",
          "body": "🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: bump version to 0.0.7-security for npm publish",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-28T17:57:31Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4c99da71468c29bb285a3f0d3ad644ef8b4abe7d",
          "body": "Changed relative ./SECURITY.md links to absolute GitHub URLs so they\nwork correctly on npm package page (relative links 404 on npm).\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): update SECURITY.md links to absolute GitHub URLs",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-28T17:44:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7e4ea5c4db4bd93d70e9879280b0a17d3d55f5ec",
          "body": null,
          "is_bot": false,
          "headline": "Removed .mcp.json in cookbook",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-23T01:56:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb13c32d8d35c402fb49f63c554cb217e44f1fd9",
          "body": null,
          "is_bot": false,
          "headline": "chore: bump version to 0.0.6-security for npm publish",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-22T18:35:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "acd35f1b2c584980598f5c5d56abe773f90919cb",
          "body": "- Remove GitHub Actions CI/CD workflows\n- Remove semantic-release configuration and dependencies (475 packages)\n- Update version to 0.0.5-security\n- Consolidate CHANGELOG with proper 0.0.x-security versioning\n- Fix hono security vulnerability\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: remove semantic-release and switch to manual publishing",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-22T18:33:28Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "654057ef9f62751bdfcc12b2b8210a8d3d12177a",
          "body": "- hash-utils.ts: hashObject, getMessageCacheKey\n- structural-analysis.ts: calculateNestingLevel, countParameters\n- text-decoding.ts: normalizeWhitespace, decodeSingleUrlEncoding\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add JSDoc to internal utility functions",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-12T03:03:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "77a065625109faab164683a62547ec2e76f291eb",
          "body": "- Extract type definitions to layer5-contextual-types.ts (361→314 lines)\n- Add AUDIT-OK comments to silent catch blocks in security-logger.ts\n- Document fire-and-forget flush pattern design decision\n- Rewrite layer2-content tests to use behavioral verification\n- Add HTTP server tests for 404 handling and HTTPS exports\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(quality): resolve validation issues from ship pipeline",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-12T02:30:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "205ab1b4ffff3c58b960f1c7bd4384f837299fb5",
          "body": "- layer3-behavior.ts: Use inherited getMessageSize() method which wraps\n  JSON.stringify in try/catch\n- mcp-secure-server.ts: Add try/catch wrapper for _trackRequest messageSize\n  calculation\n\nBoth locations previously used raw JSON.stringify(message).length which could\nthrow on circular references.\n[…]\n: Add 'require' as readonly global\n- http-server.ts: Simplify dynamic require comment\n\nResolves code-auditor critical issues from ship run #13.\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): protect JSON.stringify from circular reference errors",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-12T02:18:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "865c3cf3e510ffc87c42255958c2e2800553d96e",
          "body": "- Add explicit `unknown` type annotation to catch block in layer2-content\n- Add sampleSize > 0 guard before truthy comparison in layer3-behavior\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(types): add explicit type annotations and safe number checks",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-12T01:26:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8ca52ec6554306a48769388568ecc6193db4bc25",
          "body": "- Simplify ConstructorParameters<typeof ContextualValidationLayer>[0]\n  to ContextualLayerOptions in pipeline-factory.ts\n- Add JSDoc comments to type guard re-exports (isSeverity, isViolationType,\n  isError, getErrorMessage) in src/index.ts for better discoverability\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(types): simplify type assertions and add JSDoc documentation",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-12T00:36:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3f55fd476ded0738c100f53654910d7e3cbd7fc2",
          "body": "…ocumentation\n\n- Add runtime type guards before Record<> assertions in layer4-semantics,\n  layer1-structure, and error-sanitizer to prevent unsafe type coercion\n- Add SDK transport timeout with withTimeout() wrapper and configurable\n  connectTimeoutMs option (default: 10000ms) in HttpTransportManage\n[…]\nld, getToolsByLevel, isValidSecurityLevel, defaultToolPolicies)\n- Update tests to use getLayerByClassName() mock instead of direct index access\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): improve code quality with type guards, timeouts, and d…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-12T00:21:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5329e6a360cb0e81268d55ab15dd350fd16b4042",
          "body": "…support\n\n- Add Content-Security-Policy and Strict-Transport-Security headers\n- Create ErrorRateLimiter to prevent probing via error responses\n- Add rate limiting to 405, 415, 400, 408, 404 error responses\n- Add createSecureHttpsServer() function with TLS certificate support\n- Add getClientIp() util\n[…]\nng X-Forwarded-For and X-Real-IP\n- Add 21 new tests (3 for headers, 18 for rate limiter)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(security): add CSP/HSTS headers, error rate limiting, and HTTPS …",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-12T00:02:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f819f572cf9f99fde254f602fc6ed859000b7e44",
          "body": "Add severity level assertions to validation tests to ensure mutations\nin severity logic would be caught:\n- Rate limit violations assert HIGH severity\n- Burst activity asserts HIGH severity\n- Automated timing detection asserts MEDIUM severity\n- Path traversal asserts HIGH severity\n- SQL injection asserts CRITICAL severity\n\nThese assertions would fail if someone accidentally changed severity\nlevels in the validation layer implementations.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(mutation-resistance): add severity assertions to catch mutations",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T23:40:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "27366e158db97fac0364eba1643b7e39d8d01daa",
          "body": "- Upgrade semantic-release from 24.2.1 to 25.0.2 to fix glob command\n  injection vulnerability (GHSA-5j98-mcp5-4vw2)\n- Add comprehensive tests for HttpTransportManager covering:\n  - Constructor options and defaults\n  - Transport creation and reuse\n  - Exponential backoff retry logic\n  - Max retry duration enforcement\n  - Connection failure handling\n  - Getter properties\n\nResolves all npm audit high severity vulnerabilities (4→0)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): upgrade semantic-release to v25 and add transport tests",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T22:49:01Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b08255e19280d9eb85d71b11b341a2ecf0e67473",
          "body": "- Fix ESLint unused variable warning (err → _err)\n- Add failOnError option to global rules and response validators\n- Add maxRetryDurationMs option to prevent unbounded retries\n- Add cache size limit tests to catch accidental limit removal\n- Security: npm audit fix for qs vulnerability\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): address multiple validation issues",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T22:37:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e8008106949dae20a395cef099dd85cbc18654a7",
          "body": "…th tests\n\nAdded 4 tests for untested response validation scenarios:\n- registerTool blocks responses when Layer 5 validation fails\n- registerTool returns original response when validator throws\n- registerTool passes callback directly when not a function\n- tool() delegates directly when no handler function in arguments\n\nResolves: Response validation error path untested (critical)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(response-validation): add missing registerTool and tool error pa…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T22:14:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "701296bcab0f5aef284887e56d1b6fde82493722",
          "body": "Fixes ReDoS vulnerability (GHSA-8r9q-7v3j-jr4g) in SDK dependency.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): upgrade @modelcontextprotocol/sdk to 1.25.2",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T06:47:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "99c2293134de4fc6f8cfc604feb8012ae2599712",
          "body": "Add security headers to all HTTP responses to address CWE-693:\n- X-Content-Type-Options: nosniff (prevent MIME sniffing)\n- X-Frame-Options: DENY (prevent clickjacking)\n- Cache-Control: no-store (prevent caching sensitive data)\n- X-XSS-Protection: 0 (disable legacy XSS filter)\n\nIntroduces writeSecureResponse helper for consistent header application\nacross all 7 response paths.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): add security headers to HTTP transport responses",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T05:25:04Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "de0456dd5fe87ae8024c20a989016c5bb9e936e0",
          "body": "Add test coverage for URL-encoded null byte (%00) attacks that can\nbe used to truncate file paths and bypass extension checks.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(security): add null byte path traversal detection tests",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T05:05:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "469a44edbae556fdd63fd9c5c9ff926708aa1275",
          "body": "- Handle unawaited promises in SIGINT/SIGTERM handlers with .catch()\n- Add logError() method to SecurityLogger for error-level logging\n- Log actual error messages in HTTP transport catch blocks instead of\n  silently returning 500\n- Errors are now logged before returning generic error responses\n\nFixes issues: silent error swallowing, unawaited promise in callback\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): improve error handling and add logError method",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-11T03:27:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "be82065ab2b17d50c978f0a19d228d5dbe00321e",
          "body": "- Extract types to http-server-types.ts (49 lines)\n- Extract body parsing to http-body-parser.ts (70 lines)\n- Create HttpTransportManager with exponential backoff (118 lines)\n- Reduce main http-server.ts from 397 to 222 lines\n\nAdds automatic reconnection with configurable backoff:\n- Base delay: 100ms, doubles on each retry\n- Max delay: 5s, max attempts: 5\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(http): split http-server.ts into focused modules",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T19:28:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f305a9256641cc709b5739185d974ef56fc6bde0",
          "body": "- Add index signature to JsonRpcMessage for Record compatibility\n- Add isRecordParams type guard for proper params validation\n- Remove 6 unnecessary double assertions in transport-validator.ts\n- Document intentional SDK bridging assertions in secure-transport.ts\n\nResolves validation issue: Eight double type assertions for SDK compatibility\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(types): remove double type assertions in transport layer",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T19:00:39Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "20408558a6c0eec61349c5ac65c5dcbcc3c6058a",
          "body": "Added documentation for new Layer 3 behavior configuration options:\n- burstWindowMs: configurable burst detection window duration\n- suspiciousMessageSize: threshold for flagging large messages\n- automationDetection: timing-based automation detection settings\n  - enabled, sampleSize, maxVariance, min\n[…]\nrity Presets table: added Burst and Automation Detection columns\n- Troubleshooting: new entries for burst, automation, and large message errors\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): document configurable burst detection options",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T07:33:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "932ff4f43d3bd2688a22f7c69516dd200d4d62ea",
          "body": "Add new configuration options for Layer 3 behavior validation:\n- burstWindowMs: configurable burst detection window (default: 10s)\n- suspiciousMessageSize: configurable message size threshold (default: 20KB)\n- automationDetection: configurable automation detection settings\n  - enabled, sampleSize, m\n[…]\n development\n- paranoid: stricter settings (5s window, 10KB threshold, faster detection)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(security): add configurable burst detection options",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T07:27:58Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d2eae46bfc753d0dacd51fb6de04959c6e703ee5",
          "body": "- Fix globToRegExp regex replacements that matched empty strings incorrectly\n- Add ? to escape character class for proper question mark handling\n- Handle leading **/ pattern to support root-level matching\n- Add 17 new tests for canonicalize module (isFieldPathRelaxed,\n  canonicalizeWithRelaxedFields, size guard)\n- Add 29 new tests for glob-utils module (globToRegExp, cache eviction)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): correct globToRegExp regex patterns and add test coverage",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T05:28:53Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b0fe40465f97afbcb40406ed5ce56d80fd8f3eb5",
          "body": "- Added optional resolvedPreset parameter to createValidationPipeline\n- Pass already-resolved preset from SecureMcpServer to pipeline factory\n- Maintains backward compatibility for standalone factory usage\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "perf(security): eliminate duplicate resolvePreset call in constructor",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T04:33:36Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "238267c51f1c7256c1b5851ba8ea7c320b75fd01",
          "body": "- Added getSharedInstance() static method to ErrorSanitizer for lazy singleton\n- Updated ValidationLayer base class to use shared instance\n- Updated ValidationPipeline to use shared instance\n- Updated SecureMcpServer to use shared instance\n- Reduces 7+ ErrorSanitizer instances to 1, saving memory allocation\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(security): implement ErrorSanitizer singleton pattern",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T04:11:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e307fea8e41a38660c7d1eab88151dd902f7eece",
          "body": "…xamples\n\n- Added 7 helper functions to Available Exports: getToolPoliciesConfig,\n  matchesPattern, resolvePolicy, SECURITY_PRESETS, resolvePreset,\n  getDefaultPreset, isValidPreset\n- Added new \"Programmatic Preset Access\" section with usage examples\n- Updated exports table with descriptions for all new functions\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): add missing helper function exports and preset access e…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T04:01:54Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "99b293b41ffd6374c37f15b14a844d50cc41d4aa",
          "body": "…ass-through\n\nPerformance improvements:\n- Add fast-path in ValidationPipeline to skip normalization for passing requests\n- Cache JSON.stringify result in layer3-behavior (50% reduction in serialization)\n\nArchitecture:\n- Extract createValidationPipeline to utils/pipeline-factory.ts (384 → 74 lines)\n-\n[…]\nies()\n\nTesting:\n- Add 5 mutation-catching tests for passed/allowed precedence edge cases\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(security): optimize validation pipeline and add capability p…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-10T03:53:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "906f93efcaa230e1fdd21349d4393a12ba46f6bd",
          "body": "…orts\n\n- Add eslint-plugin-unused-imports for detecting dead imports with auto-fix\n- Re-export individual attack patterns for better tree-shaking support\n- Add NodeJS to eslint globals for type references\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(tooling): add unused-imports eslint plugin and tree-shaking exp…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T20:30:52Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f93360f638687f5a8e563a7f37087cbbb82e98ac",
          "body": "Replace .catch(() => {}) fire-and-forget pattern with void operator\nfor cleaner, more consistent async handling in SecurityLogger.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "style(logger): standardize async patterns with void operator",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T19:45:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0cde80da69bba94017ed79c1424a33512f1f90d6",
          "body": "- Add 4 tests for hourly + minute rate limit boundary interaction\n- Add 5 tests for multiple credential pattern collisions in redaction\n- Add 5 tests for connection drop during validation scenarios\n\nTest count: 986 → 1000 (14 new tests)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(security): add comprehensive edge case coverage",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T18:29:46Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "77e028ff63122e671b6b9f240241bdc4b47e91bf",
          "body": "…ble assertions\n\n- SecureTransport now implements SDK Transport interface directly\n- Import Transport, JSONRPCMessage, TransportSendOptions from SDK\n- Add type conversion helpers (asJsonRpcMessage, asMcpMessage)\n- Create SecureServerHttpInterface for HTTP integration without casts\n- Remove all doubl\n[…]\napping\n- Double assertion for error responses\n- Double assertion for server capabilities\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(transport): implement SDK Transport interface, eliminate dou…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T18:03:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7f6381e0c9a2d2d07115d2626c141688fdefc18f",
          "body": "- Create transport-validator.ts with createTransportValidator factory (108 lines)\n- Main file reduced from 471 to 433 lines (8% reduction)\n- Clean separation of transport validation logic\n- Remove unused imports (ValidationResult, PipelineContext, normalizeRequest)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(transport): extract transport validator to dedicated module",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T17:29:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "99d792bdd4eda2e904eeff920f53ccf25bfb5847",
          "body": "- Create semantic-policies-types.ts with all interface definitions (106 lines)\n- Create semantic-resource-validation.ts with resource/path validation (195 lines)\n- Main file reduced from 435 to 233 lines (46% reduction)\n- Re-exports maintain backward compatibility\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(semantics): split semantic-policies into focused modules",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T17:26:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a832c53d15caaff0357f862372c51901945cbfd5",
          "body": "- Create security-logger-types.ts with all interface definitions (80 lines)\n- Create log-formatters.ts with formatting utilities (201 lines)\n- Extract duplicate flush logic into flushStreamsSync() and fsyncLogFiles()\n- Main file reduced from 491 to 372 lines (24% reduction)\n- Re-exports maintain backward compatibility\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(security): extract types and formatters from security-logger",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T17:25:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "93b5451a0ad31acfe5088d9017a0a735996d0145",
          "body": "…bleshooting\n\n- Document MCP SDK passthrough vs enhanced methods in README\n- Add 8 troubleshooting entries for common validation false positives\n- Document advanced tool policy helpers (getToolsByLevel, isRelaxedField, etc.)\n- Add comprehensive JSDoc with export categorization in src/index.ts\n- Organize exports into Core, Advanced, Tool Policy, and Preset sections\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: enhance README and index.ts with export categorization and trou…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T07:14:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "111818ed8c9bff7f49f80a8a73520d4ea88dda19",
          "body": "- Create shared test/helpers/message-builders.js with createToolCallMessage,\n  createResourceReadMessage, and createJsonRpcMessage utilities\n- Update 5 test files to use shared utilities, removing local duplicates\n- Add 4 new tests for tool callback exception propagation\n- Add documented createNestedEncoding helper for URL encoding tests\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test: consolidate test utilities and add callback exception coverage",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T07:09:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "882de4bc60479331e60a8a7928e7d04c082bae58",
          "body": "- Extract glob utilities to glob-utils.ts from semantic-policies.ts\n- Extract builtin validators to builtin-validators.ts from layer5-contextual.ts\n- Extract policy validation to tool-policy-validation.ts from tool-policies-config.ts\n- Replace unsafe Function() constructor with safe math parser in t\n[…]\nnfig.ts: 482 → 316 lines\n- semantic-policies.ts: 484 → 435 lines\n\nAll 949 tests passing.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: extract modules for file size compliance",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T06:55:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4d55d79af7f5bf4c7555cc981346b6613c18321d",
          "body": "- Add SecurityLogger interface for custom logger injection\n- Replace console.error/warn/info with process.stderr/stdout fallback\n- Add mixed attack vector detection tests (file://+SQL, path traversal+XSS)\n- Add pathological nested encoding tests (20+ levels)\n- Extract magic timing constants to named TIMING object in behavior tests\n- Update error-sanitizer tests to use mock logger\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): replace console.* with logger injection in ErrorSanitizer",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-09T06:40:41Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f4985a2206d87ab604af323e02f0e7313f2e69d9",
          "body": "…de issues\n\n- Move test-server to cookbook/minimal-server for consistency with other examples\n- Move test-data to cookbook/test-data\n- Update all references in docs, config files, and test setup\n- Fix unused catch variable warnings in tool-policies-config.ts\n- Replace console.warn with proper ToolPolicyError for circular inheritance\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor: move test-server and test-data to cookbook, fix critical co…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-08T18:58:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "04c53955c06690c5bd0ad8b70c793301163bb399",
          "body": "- Add Security Presets section documenting basic/standard/paranoid/custom\n- Update Quick Start with preset-based initialization examples\n- Remove inline attack pattern examples that triggered npm's WAF\n- Link to SECURITY.md for complete threat model documentation\n- Add homepage and bugs fields to package.json for npm display\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add security presets to README and fix npm WAF issue",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-08T18:02:02Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0e56d1da7b030fd25f130cfdc007591cee9cb2aa",
          "body": "## [1.8.0](https://github.com/aself101/mcp-secure-server/compare/v1.7.0...v1.8.0) (2026-01-07)\n\n### Features\n\n* **server:** add capabilities option and improve test coverage ([a43fdd1](https://github.com/aself101/mcp-secure-server/commit/a43fdd17ef8b21197a2fc7c40e064f498751dab0))",
          "is_bot": false,
          "headline": "chore(release): 1.8.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-07T02:09:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a43fdd17ef8b21197a2fc7c40e064f498751dab0",
          "body": "- Add explicit ServerCapabilities option to SecureMcpServer\n- Re-export ServerCapabilities type from main index\n- Add hasExtends() type guard to reduce type casts\n- Extract validatePolicyReference() helper for DRY validation\n- Add boundary tests for rate limiting (minute window exact limits)\n- Add b\n[…]\nor burst detection (threshold ±1)\n- Add HTTP violation type to status code mapping tests\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(server): add capabilities option and improve test coverage",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-07T02:08:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2b227ee10396372ce2b3de4275760a16071e0994",
          "body": "## [1.7.0](https://github.com/aself101/mcp-secure-server/compare/v1.6.0...v1.7.0) (2026-01-07)\n\n### Features\n\n* **cookbook:** add securityLevel presets to all server examples ([d6172d2](https://github.com/aself101/mcp-secure-server/commit/d6172d2d470786a23bfc18e6c781ea841bac3bde))",
          "is_bot": false,
          "headline": "chore(release): 1.7.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-07T01:37:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d6172d2d470786a23bfc18e6c781ea841bac3bde",
          "body": "Update all 13 cookbook servers to use the new securityLevel preset option:\n- Most servers use 'standard' for balanced production security\n- http-server uses 'basic' for development examples\n- transaction-server uses 'paranoid' for financial operations\n\nThis demonstrates the simplified configuration approach introduced in v1.5.0.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cookbook): add securityLevel presets to all server examples",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-07T01:36:19Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "134e712be024e0436fe27bda42cb8bf7a7a360bf",
          "body": "## [1.6.0](https://github.com/aself101/mcp-secure-server/compare/v1.5.0...v1.6.0) (2026-01-07)\n\n### Features\n\n* **security:** add security presets and enhanced error logging ([e0719f5](https://github.com/aself101/mcp-secure-server/commit/e0719f562bdcf950bd056bda0e4ce0475ad80998))",
          "is_bot": false,
          "headline": "chore(release): 1.6.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-07T01:08:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e0719f562bdcf950bd056bda0e4ce0475ad80998",
          "body": "Implements security critique recommendations:\n\n- Add security level presets (basic/standard/paranoid) for simplified config\n- Enhance error logging with patternName, patternCategory, layerNumber\n- Add contentValidation levels (minimal/standard/full)\n- Extend ValidationResult with enhanced error meta\n[…]\n(balanced security)\n- paranoid: High-security (all 381 patterns, strict limits)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(security): add security presets and enhanced error logging",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-07T01:07:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "952eb4434401bd625d00905fbb75b1b378bd2812",
          "body": "## [1.5.0](https://github.com/aself101/mcp-secure-server/compare/v1.4.0...v1.5.0) (2026-01-06)\n\n### Features\n\n* **config:** add minimatch patterns and enhanced inheritance ([7ada48c](https://github.com/aself101/mcp-secure-server/commit/7ada48cf54a455ebf9677db093661c8505d6640d))",
          "is_bot": false,
          "headline": "chore(release): 1.5.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-06T19:57:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ada48cf54a455ebf9677db093661c8505d6640d",
          "body": "Phase 3:\n- Add minimatch dependency for full glob pattern support\n- Support brace expansion {a,b}, character classes [abc], negation [^abc]\n- Add namespaced tool pattern support (tracker:*)\n\nPhase 4:\n- Add chain inheritance (base policies can extend other base policies)\n- Add array deduplication for\n[…]\n- Support extends in pattern inline policies\n- Add validation for all extends references\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(config): add minimatch patterns and enhanced inheritance",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-06T19:56:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5fbde94c2768d415fb7eb295e9045eb47a4be13f",
          "body": "## [1.4.0](https://github.com/aself101/mcp-secure-server/compare/v1.3.0...v1.4.0) (2026-01-06)\n\n### Features\n\n* **config:** add config-driven tool policies v2 ([5b54ea7](https://github.com/aself101/mcp-secure-server/commit/5b54ea720672106ce257e5f95b17c4d5d6eb590f))",
          "is_bot": false,
          "headline": "chore(release): 1.4.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-06T19:51:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b54ea720672106ce257e5f95b17c4d5d6eb590f",
          "body": "- Add tool-policies-config.ts with Zod schema validation\n- Support config file loading (env var, cwd, ~/.config priority)\n- Add glob-style pattern matching (get_*, *_issues)\n- Add policy inheritance via extends with field merging\n- Add SecureMcpServer.create() factory for async config loading\n- Add \n[…]\ntures_list, etc.)\n- Export new API: loadToolPoliciesConfig, initializeToolPolicies, etc.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(config): add config-driven tool policies v2",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-06T19:50:44Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6c257874e31a57933ea7456b87b11af613781ed4",
          "body": "## [1.3.0](https://github.com/aself101/mcp-secure-server/compare/v1.2.0...v1.3.0) (2026-01-06)\n\n### Features\n\n* **cookbook:** add tool-policies-server example with context-aware security levels ([57c1f49](https://github.com/aself101/mcp-secure-server/commit/57c1f4994ad1dee4a798a57a32b84e3e1e1911bf))",
          "is_bot": false,
          "headline": "chore(release): 1.3.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-06T19:22:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "57c1f4994ad1dee4a798a57a32b84e3e1e1911bf",
          "body": "…ecurity levels\n\nAdds a new cookbook example demonstrating per-tool security validation:\n- DISPLAY, STORAGE, QUERY, DATA_EGRESS, EXECUTION security levels\n- Input/output validation based on tool context\n- PII detection in responses for data egress tools\n- Command injection protection for execution tools\n\nAlso exports tool policy APIs from main package for consumer use.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cookbook): add tool-policies-server example with context-aware s…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-06T19:21:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8a5e6b27607f21452a422d80e8435b66843a9ad7",
          "body": "## [1.2.0](https://github.com/aself101/mcp-secure-server/compare/v1.1.0...v1.2.0) (2026-01-06)\n\n### Features\n\n* **security:** add context-aware tool validation with security levels ([db64aaa](https://github.com/aself101/mcp-secure-server/commit/db64aaa7191e6dbdb2c4fec3ad52cac84c7d1f9f))",
          "is_bot": false,
          "headline": "chore(release): 1.2.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-06T18:47:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db64aaa7191e6dbdb2c4fec3ad52cac84c7d1f9f",
          "body": "Implements tool-aware pattern detection to reduce false positives while\nmaintaining security. Tools are classified into 4 security levels:\n- EXECUTION: Full validation (command injection, all patterns)\n- QUERY: SQL/NoSQL injection patterns added\n- STORAGE: Relaxed validation for content storage tool\n[…]\nTML tags for event handlers, SQL keywords for functions, shell commands\nfor separators).\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(security): add context-aware tool validation with security levels",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-06T18:47:01Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d06104688af6744f9611701a809fdfc1b3f5138c",
          "body": "- Add Layer 3 hourly rate limit enforcement tests\n- Add Layer 1 default limit boundary tests\n- Add error sanitizer exception path tests\n- Add HTTPS deployment documentation to http-server.ts\n- Add eval() safety warning comment to README\n- Clean up CHANGELOG duplicate entries\n- Bump version to 0.0.2-security\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(coverage): add critical test gaps and documentation improvements",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-02T21:22:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7ad8c09ce4702ef5b59c6a71f3447f0f12da449f",
          "body": "## [1.1.0](https://github.com/aself101/mcp-secure-server/compare/v1.0.1...v1.1.0) (2026-01-02)\n\n### Features\n\n* add configurable maxParamCount option ([e913eb0](https://github.com/aself101/mcp-secure-server/commit/e913eb0869a9de5e05724abc2a8c5adfdb8ba3de))\n* add configurable maxParamCount option ([8\n[…]\ner/commit/9cc92c4dd9f7d02b079bb3553caa6e67aaaafe98))\n* update test count badge to 842 passing ([a10c4ab](https://github.com/aself101/mcp-secure-server/commit/a10c4abcaf2e21c22700947c07751cce0d7c8c75))",
          "is_bot": false,
          "headline": "chore(release): 1.1.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2026-01-02T20:27:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a10c4abcaf2e21c22700947c07751cce0d7c8c75",
          "body": "🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: update test count badge to 842 passing",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-02T20:26:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "96933e1b25f6370515e048defbc942ca49c43916",
          "body": "…d JSON newlines\n\n- Remove overly broad CRLF patterns (\\\\r\\\\n, \\\\n, \\\\r) that blocked legitimate JSON\n- Make file:// detection context-aware, requiring sensitive paths (/etc/, .pem, etc.)\n- Make pipe detection specific to known shell commands (grep, sed, awk, etc.)\n- Fix Python pickle pattern to use escaped newline for JSON-stringified content\n\nCloses #759, #760, #761\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): prevent false positives on file://, markdown pipes, an…",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2026-01-02T20:22:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2b398fdc591c99f99da011fdaa339f60afa2952c",
          "body": "…text\n\nThe /\\bhistory\\s*/gi pattern was too broad, triggering COMMAND_INJECTION\non phrases like \"version history\" or \"release history\" in documentation.\n\nChanged to context-aware patterns that only match actual shell access:\n- history -c, history -d (history with flags)\n- !history (shell expansion)\n\n[…]\nbash_history, .zsh_history (history files)\n\nAdded 2 new false positive prevention tests.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(security): prevent false positives on \"history\" in documentation …",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-30T01:25:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e913eb0869a9de5e05724abc2a8c5adfdb8ba3de",
          "body": "- Made maxParamCount configurable in Layer 2 (defaults to Infinity)\n- Implemented context-aware sensitive file detection to reduce false positives\n- tsconfig.json and similar filenames no longer trigger PATH_TRAVERSAL\n- Sensitive file patterns now only trigger with path context (../, /etc/, etc.)\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add configurable maxParamCount option",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-30T00:44:19Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "8209f3985752a4b5589e079880e8826617cf6ba2",
          "body": "The parameter count limit was hardcoded at 20, which was too restrictive\nfor MCP servers with complex nested schemas. Now configurable via\noptions.maxParamCount with a sensible default of 100.\n\n- Add maxParamCount to SecureMcpServerOptions interface\n- Pass configured value through to StructureValida\n[…]\n from 20 to 100\n- Fix test to use explicit limit rather than relying on default\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: add configurable maxParamCount option",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-29T00:19:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9cc92c4dd9f7d02b079bb3553caa6e67aaaafe98",
          "body": "Changed from \"middleware\" to accurate description of secure MCP server\nwith 5-layer validation framework.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(package): update description to reflect current architecture",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-23T23:46:29Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ab66dba9951fdc432cf832e45aa16f8f1ee25288",
          "body": "## [1.0.1](https://github.com/aself101/mcp-secure-server/compare/v1.0.0...v1.0.1) (2025-12-20)\n\n### Reverts\n\n* restore mcp-secure-server package name ([c1ce99e](https://github.com/aself101/mcp-secure-server/commit/c1ce99ecd2cd47dd171468a87ea8da8e31706335))",
          "is_bot": false,
          "headline": "chore(release): 1.0.1 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T20:10:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1ce99ecd2cd47dd171468a87ea8da8e31706335",
          "body": "Reverting to original name while investigating npm 403 issue.\nBoth mcp-secure-server and secure-mcp-server are blocked.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "revert: restore mcp-secure-server package name",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T20:10:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b9faeb23338d30a866809af2e5166d8a295a417e",
          "body": "## [1.0.0](https://github.com/aself101/mcp-secure-server/compare/v0.9.2...v1.0.0) (2025-12-20)\n\n### ⚠ BREAKING CHANGES\n\n* Package renamed from mcp-secure-server to secure-mcp-server\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\n\n### Features\n\n* rename package to secure-mcp-server ([95892a8](https://github.com/aself101/mcp-secure-server/commit/95892a827567c82df509b517295f26102713f681))",
          "is_bot": false,
          "headline": "chore(release): 1.0.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T20:07:44Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "95892a827567c82df509b517295f26102713f681",
          "body": "npm blocks 'mcp-*' prefix packages. Renamed to secure-mcp-server\nto bypass npm spam detection while keeping clear naming.\n\nBREAKING CHANGE: Package renamed from mcp-secure-server to secure-mcp-server\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: rename package to secure-mcp-server",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T20:07:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "19cc18ebe85f8b4ef4fa0d59178591bc58b1e55b",
          "body": "## [0.9.2](https://github.com/aself101/mcp-secure-server/compare/v0.9.1...v0.9.2) (2025-12-20)\n\n### Bug Fixes\n\n* **npm:** add publishConfig with public access ([0d4db2c](https://github.com/aself101/mcp-secure-server/commit/0d4db2c26e3ea897d8b5859f13e626833ee09de8))",
          "is_bot": false,
          "headline": "chore(release): 0.9.2 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T19:59:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0d4db2c26e3ea897d8b5859f13e626833ee09de8",
          "body": "npm requires explicit access: public for new packages.\nAdding publishConfig to package.json is more reliable than\n.releaserc.json options.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(npm): add publishConfig with public access",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:59:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "58c6a4e56e7c5b931d4acc17d9ab8f38fc8b3c31",
          "body": "## [0.9.1](https://github.com/aself101/mcp-secure-server/compare/v0.9.0...v0.9.1) (2025-12-20)\n\n### Bug Fixes\n\n* **ci:** add public access flag for npm publish ([6f7ea8a](https://github.com/aself101/mcp-secure-server/commit/6f7ea8a2b08bb660b7978fa3850f0455ae206e61))",
          "is_bot": false,
          "headline": "chore(release): 0.9.1 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T19:55:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6f7ea8a2b08bb660b7978fa3850f0455ae206e61",
          "body": "New packages require explicit --access public flag.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ci): add public access flag for npm publish",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:54:44Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e8a11914cb7df8a1c3379247d9d0d080341752de",
          "body": "## [0.9.0](https://github.com/aself101/mcp-secure-server/compare/v0.8.0...v0.9.0) (2025-12-20)\n\n### Features\n\n* **cookbook:** add advanced-validation-server demonstrating Layer 5 custom validators ([9bc84b2](https://github.com/aself101/mcp-secure-server/commit/9bc84b27cbca81f864b773bdf3ff482176353ce\n[…]\na1ee0e296fa44853678))\n* **security:** remove unused semantic sessions and simplify validation ([5df62ef](https://github.com/aself101/mcp-secure-server/commit/5df62ef9fc1e9294c1898218cd648386aec5aa31))",
          "is_bot": false,
          "headline": "chore(release): 0.9.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T19:51:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6327bf1fb8f637194e792aa40885650650856ba2",
          "body": "- Switch to NODE_AUTH_TOKEN for npm authentication\n- Add registry-url to setup-node step\n- Revert to unscoped package name mcp-secure-server\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ci): use working release workflow with NODE_AUTH_TOKEN",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:50:55Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "83e0612234ca5cc88da68ebe2705db5e38e30618",
          "body": "## [0.9.3](https://github.com/aself101/mcp-secure-server/compare/v0.9.2...v0.9.3) (2025-12-20)\n\n### Bug Fixes\n\n* use scoped package name @okstory/mcp-secure-server ([8ecc472](https://github.com/aself101/mcp-secure-server/commit/8ecc472ed4dbe5b452c677fefe31741b2ba1214d))",
          "is_bot": false,
          "headline": "chore(release): 0.9.3 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T19:43:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8ecc472ed4dbe5b452c677fefe31741b2ba1214d",
          "body": "npm blocks unscoped 'mcp-secure-server' name. Using scoped\npackage name to bypass spam detection.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: use scoped package name @okstory/mcp-secure-server",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:42:54Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2f76b3116c41f90aa52da8ecb4fd77233cfd7460",
          "body": "## [0.9.2](https://github.com/aself101/mcp-secure-server/compare/v0.9.1...v0.9.2) (2025-12-20)\n\n### Bug Fixes\n\n* trigger npm publish retry ([3616a75](https://github.com/aself101/mcp-secure-server/commit/3616a7558642865e63d4768f3a73bd1d598ed451))",
          "is_bot": false,
          "headline": "chore(release): 0.9.2 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T19:39:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3616a7558642865e63d4768f3a73bd1d598ed451",
          "body": "🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: trigger npm publish retry",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:38:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5fbbea3e98b41b7473b69cb97f0d3fc72673da28",
          "body": "## [0.9.1](https://github.com/aself101/mcp-secure-server/compare/v0.9.0...v0.9.1) (2025-12-20)\n\n### Bug Fixes\n\n* **docs:** add npm version badge to README ([26aa8d7](https://github.com/aself101/mcp-secure-server/commit/26aa8d78ff0b1f31c32bd0c67e53d0581ce76d34))",
          "is_bot": false,
          "headline": "chore(release): 0.9.1 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T19:32:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "26aa8d78ff0b1f31c32bd0c67e53d0581ce76d34",
          "body": "🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(docs): add npm version badge to README",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:31:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "dc823bf15c8dc7b3096514d8f5359099a4b2a7c4",
          "body": "🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: trigger release",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:20:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3b9e4dd3e301b490e3078cb552cd0a524e67c843",
          "body": "## [0.9.0](https://github.com/aself101/mcp-secure-server/compare/v0.8.0...v0.9.0) (2025-12-20)\n\n### Features\n\n* **cookbook:** add advanced-validation-server demonstrating Layer 5 custom validators ([9bc84b2](https://github.com/aself101/mcp-secure-server/commit/9bc84b27cbca81f864b773bdf3ff482176353ce\n[…]\na1ee0e296fa44853678))\n* **security:** remove unused semantic sessions and simplify validation ([5df62ef](https://github.com/aself101/mcp-secure-server/commit/5df62ef9fc1e9294c1898218cd648386aec5aa31))",
          "is_bot": false,
          "headline": "chore(release): 0.9.0 [skip ci]",
          "author_name": "semantic-release-bot",
          "author_login": "semantic-release-bot",
          "committed_at": "2025-12-20T19:16:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d8af9ef367c8df0ac76cc3551e3c3a532c634573",
          "body": "Cookbook examples have their own node_modules with test files\nthat were causing import failures during CI release.\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(ci): exclude cookbook from test execution",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:16:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "c40e182c834449b0dc29a6e5b03ccb1c4a84167d",
          "body": "🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: add workflow_dispatch trigger for manual releases",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T19:13:23Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "dfcaf252304e4b7b1b6baffe472690349bc1e6f6",
          "body": "- Add GitHub Actions workflows for CI and semantic release\n- Add semantic-release configuration with conventional commits\n- Update .npmignore with comprehensive exclusions\n- Add 59 new tests improving coverage to 93.62%\n- Update README project structure to reflect current state\n\n🤖 Generated with [Claude Code](https://claude.com/claude-code)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: add semantic-release CI/CD and improve test coverage",
          "author_name": "Alexander Self",
          "author_login": "aself101",
          "committed_at": "2025-12-20T01:46:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        }
      ],
      "releases_count": 13,
      "commits_last_year": 136,
      "latest_release_at": "2026-01-07T02:09:33Z",
      "latest_release_tag": "v1.8.0",
      "releases_from_tags": true,
      "days_since_last_push": 5,
      "active_weeks_last_year": 14,
      "days_since_latest_release": 197,
      "mean_days_between_releases": 1.9
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 57,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "mcp-secure-server",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "mcp",
            "security",
            "claude",
            "ai",
            "validation",
            "protection",
            "framework",
            "middleware"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/mcp-secure-server",
          "is_deprecated": false,
          "latest_version": "0.0.19-security",
          "repository_url": "https://github.com/aself101/mcp-secure-server",
          "versions_count": 15,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 3381,
          "first_published_at": "2026-01-02T16:24:54.141000Z",
          "latest_published_at": "2026-07-18T04:11:20.838000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 2,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "cookbook",
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "cookbook/advanced-validation-server/tsconfig.json",
        "cookbook/api-wrapper-server/tsconfig.json",
        "cookbook/cli-wrapper-server/tsconfig.json",
        "cookbook/database-server/tsconfig.json",
        "cookbook/filesystem-server/tsconfig.json",
        "cookbook/http-server/tsconfig.json",
        "cookbook/image-gen-server/tsconfig.json",
        "cookbook/kenpom-server/tsconfig.json",
        "cookbook/monitoring-server/tsconfig.json",
        "cookbook/multi-endpoint-server/tsconfig.json",
        "cookbook/nba-server/tsconfig.json",
        "cookbook/tool-policies-server/tsconfig.json",
        "cookbook/transaction-server/tsconfig.json",
        "cookbook/tsconfig.json",
        "tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 34472,
      "source_files_sampled": 260,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 3875
    },
    "dependencies": {
      "manifests": [
        "cookbook/package.json",
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "cookbook/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.0.0"
        },
        {
          "name": "dotenv",
          "manifest": "cookbook/package.json",
          "ecosystem": "npm",
          "version_constraint": "^17.2.3"
        },
        {
          "name": "mcp-secure-server",
          "manifest": "cookbook/package.json",
          "ecosystem": "npm",
          "version_constraint": "file:../"
        },
        {
          "name": "zod",
          "manifest": "cookbook/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.0"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.25.2"
        },
        {
          "name": "minimatch",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^10.1.1"
        },
        {
          "name": "winston",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.10.0"
        },
        {
          "name": "zod",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.1.13"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "aself101",
          "commits": 103,
          "avatar_url": "https://avatars.githubusercontent.com/u/7062416?v=4"
        },
        {
          "type": "User",
          "login": "semantic-release-bot",
          "commits": 17,
          "avatar_url": "https://avatars.githubusercontent.com/u/32174276?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.858
    },
    "quality_signals": {
      "has_ci": false,
      "has_tests": true,
      "ci_workflows": [],
      "has_docs_dir": false,
      "linter_configs": [
        "eslint.config.js"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 6,
            "reason": "project has 2 contributing companies or organizations -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": null,
            "reason": "no workflows found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 6,
            "reason": "8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": null,
            "reason": "no dependencies found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": null,
            "reason": "No tokens found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "123 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "506e35b34b37a3c4f4e6f0a2244bc9bcabc10d1a",
        "ran_at": "2026-07-23T13:00:21Z",
        "aggregate_score": 3.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-18T04:09:28Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/aself101/mcp-secure-server",
    "host": "github.com",
    "name": "mcp-secure-server",
    "owner": "aself101"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 45,
      "inputs": {
        "security": 31,
        "vitality": 68,
        "community": 33,
        "governance": 39,
        "engineering": 50
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 68,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "commits_last_year": 136,
              "human_commit_share": 1,
              "days_since_last_push": 5,
              "active_weeks_last_year": 14
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "14/52 weeks with commits",
                "points": 9.7,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 14
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "136 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 136
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "moderate",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "releases_count": 13,
              "latest_release_tag": "v1.8.0",
              "releases_from_tags": true,
              "days_since_latest_release": 197,
              "mean_days_between_releases": 1.9
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "13 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 13
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 197 days ago",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 197
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~1.9 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 1.9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "maintained",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 5,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "last human commit 5 days ago",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_maintained",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 33,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 2,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "2 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 59,
            "inputs": {
              "packages": [
                "mcp-secure-server"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 3381
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "3,381 downloads/month across npm",
                "points": 47.1,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 3381,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 39,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 21,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.858
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 86% of commits",
                "points": 3.2,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 86
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 48,
            "inputs": {
              "followers": 5,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "aself101",
              "public_repos": 28,
              "account_age_days": 4502
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "5 followers of aself101",
                "points": 5.6,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 5,
                      "login": "aself101"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "28 public repos, account ~12 yr old",
                "points": 22.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 28
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 12
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "mcp-secure-server"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "15 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 15
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 50,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 50,
            "inputs": {
              "has_ci": false,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "eslint.config.js",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 31,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "dangerous_workflow",
                    "packaging",
                    "pinned_dependencies",
                    "signed_releases",
                    "token_permissions"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 31,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 12,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 6,
              "scorecard_aggregate": 3.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no workflows found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "No tokens found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "123 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 3
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 78,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.99,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 3875
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 99,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_pinned_dependencies"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 71,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "cookbook/advanced-validation-server/tsconfig.json",
                "cookbook/api-wrapper-server/tsconfig.json",
                "cookbook/cli-wrapper-server/tsconfig.json",
                "cookbook/database-server/tsconfig.json",
                "cookbook/filesystem-server/tsconfig.json",
                "cookbook/http-server/tsconfig.json",
                "cookbook/image-gen-server/tsconfig.json",
                "cookbook/kenpom-server/tsconfig.json",
                "cookbook/monitoring-server/tsconfig.json",
                "cookbook/multi-endpoint-server/tsconfig.json",
                "cookbook/nba-server/tsconfig.json",
                "cookbook/tool-policies-server/tsconfig.json",
                "cookbook/transaction-server/tsconfig.json",
                "cookbook/tsconfig.json",
                "tsconfig.json"
              ],
              "agent_commit_share": 0.82,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "eslint.config.js",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "cookbook/advanced-validation-server/tsconfig.json, cookbook/api-wrapper-server/tsconfig.json, cookbook/cli-wrapper-server/tsconfig.json, cookbook/database-server/tsconfig.json, cookbook/filesystem-server/tsconfig.json, cookbook/http-server/tsconfig.json, cookbook/image-gen-server/tsconfig.json, cookbook/kenpom-server/tsconfig.json, cookbook/monitoring-server/tsconfig.json, cookbook/multi-endpoint-server/tsconfig.json, cookbook/nba-server/tsconfig.json, cookbook/tool-policies-server/tsconfig.json, cookbook/transaction-server/tsconfig.json, cookbook/tsconfig.json, tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "cookbook/advanced-validation-server/tsconfig.json, cookbook/api-wrapper-server/tsconfig.json, cookbook/cli-wrapper-server/tsconfig.json, cookbook/database-server/tsconfig.json, cookbook/filesystem-server/tsconfig.json, cookbook/http-server/tsconfig.json, cookbook/image-gen-server/tsconfig.json, cookbook/kenpom-server/tsconfig.json, cookbook/monitoring-server/tsconfig.json, cookbook/multi-endpoint-server/tsconfig.json, cookbook/nba-server/tsconfig.json, cookbook/tool-policies-server/tsconfig.json, cookbook/transaction-server/tsconfig.json, cookbook/tsconfig.json, tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "82 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 82,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 34472,
              "source_files_sampled": 260,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/260 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 260,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "moderate",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "example_dirs": [
                "cookbook",
                "examples"
              ],
              "has_mcp_signal": true,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "cookbook, examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "cookbook, examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
    "deps.dev does not index npm:mcp-secure-server@0.0.19-security; advisories assessed against the repository dependency graph instead"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-23T13:00:28.772757Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/aself101/mcp-secure-server.svg",
  "full_name": "aself101/mcp-secure-server",
  "license_state": "standard",
  "license_spdx": "MIT"
}