Registro públicoEn riesgo
Informe de salud del softwareesquema 0.27.0 · métricas 1.13.0 · 2026-07-30 21:49 UTC
mindsdb / cowork-server
FastAPI backend for MindsHub Cowork. Manages projects, conversations, files, scheduling, memory, and agent orchestration with a SQLite-backed data layer.
mindsdb/cowork-server tiene un índice de salud de 32 sobre 100, lo que lo sitúa en la banda En riesgo. Su puntuación más alta es Sustainability & Governance (85/100) y la más baja, Security (35/100). Se actualizó por última vez hoy. 3 personas concentran la mayor parte del trabajo reciente.
32
global / 100Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
32
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
La Política de Jurisdicciones de Alto Riesgo aplica un multiplicador del 50% a la salud global ponderada y le da un límite «En riesgo» de 49.
Titularidad
MindsDB IncOrganización
1416 seguidores57 repositorios públicosdesde ago 2017
Este repositorio está respaldado por una organización: una custodia compartida y responsable que puede sobrevivir a cualquier mantenedor individual.
Ecosistemas de paquetes
| Registro | Paquete | Versión | Descargas / mes | Versiones | Última publicación |
|---|---|---|---|---|---|
| PyPI | cowork-server | 0.26.7.27.3 | 4576 | 51 | hace 3 días |
Métricas por categoría
Vitalidad
¿Está vivo el proyecto: se escribe código y se publican versiones?
77
Actividad de desarrollo
62Moderado
Cómo se puntúa
| 36/36 | Recencia de push — último push hace 0 días |
| 7.6/36 | Cadencia de commits — 11/52 semanas con commits |
| 18/18 | Volumen de commits — 601 commits en el último año |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Datos de entrada utilizados
| commits_last_year | 601 |
| human_commit_share | 0,99 |
| days_since_last_push | 0 |
| active_weeks_last_year | 11 |
Disciplina de publicación
100Excelente
Cómo se puntúa
| 27/27 | Publica versiones — 54 versiones publicadas |
| 36/36 | Recencia de las versiones — última versión hace 0 días |
| 27/27 | Cadencia de publicación — una versión cada ~0,3 días |
| 0/10 | OpenSSF Scorecard: Signed-Releases — sin datos |
Datos de entrada utilizados
| releases_count | 54 |
| latest_release_tag | v0.26.7.30.1rc5 |
| releases_from_tags | no |
| days_since_latest_release | 0 |
| mean_days_between_releases | 0,3 |
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: Signed-Releases. Los pesos restantes se han renormalizado.
Comunidad y Adopción
¿Tiene el proyecto usuarios, descargas, atención y unas condiciones acogedoras para quienes contribuyen?
38
Popularidad y adopción
13Crítico
Cómo se puntúa
| 7.7/60 | Estrellas — 4 estrellas |
| 5/25 | Forks — 5 forks |
| 0/15 | Observadores — 0 observadores |
Datos de entrada utilizados
| forks | 5 |
| stars | 4 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Salud de la comunidad
50Moderado
Cómo se puntúa
| 22.5/22.5 | README |
| 22.5/22.5 | Licencia — licencia reconocida (AGPL-3.0) |
| 0/18 | Guía CONTRIBUTING |
| 0/13.5 | Código de conducta |
| 0/7.2 | Plantilla de issues |
| 0/6.3 | Plantilla de PR |
Datos de entrada utilizados
| has_readme | sí |
| has_license | sí |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Adopción en el ecosistema (descargas)
61Moderado
Cómo se puntúa
| 48.8/80 | Descargas mensuales — 4576 descargas/mes en pypi |
| 0/20 | Dependientes en el registro — no lo informa este ecosistema |
Datos de entrada utilizados
| packages | cowork-server |
| dependents | — |
| ecosystems | pypi |
| total_downloads | — |
| monthly_downloads | 4576 |
Excluidos de la puntuación (sin datos o no aplicable): Dependientes en el registro. Los pesos restantes se han renormalizado.
Sostenibilidad y Gobernanza
¿Sobrevivirá el proyecto a sus personas: factor bus, capacidad de respuesta, quién lo respalda y mantenimiento del paquete?
85
Cómo se puntúa
| 36/54 | Factor bus — la mitad de los commits recae en 3 contribuyente(s) |
| 17.2/22.5 | Distribución de commits — el principal contribuyente firma el 24% de los commits |
| 13.5/13.5 | Amplitud de contribuyentes — 15 contribuyentes |
| 10/10 | OpenSSF Scorecard: Contributors — project has 18 contributing companies or organizations |
Datos de entrada utilizados
| bus_factor | 3 |
| contributors_sampled | 15 |
| top_contributor_share | 0,236 |
Capacidad de respuesta a issues y PR
91Excelente
Cómo se puntúa
| 46.8/46.8 | Resolución de issues — 100% de issues cerradas |
| 31.1/38.3 | Aceptación de PR — 178/219 PR decididos fusionados |
| 13.5/15 | OpenSSF Scorecard: Code-Review — Found 12/13 approved changesets -- score normalized to 9 |
Datos de entrada utilizados
| merged_prs | 178 |
| open_issues | 0 |
| closed_issues | 1 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 41 |
Propiedad y custodia
78Bueno
Cómo se puntúa
| 30/30 | Respaldo de la propiedad — propiedad de una organización |
| 0/20 | Dominio verificado |
| 22.7/25 | Alcance del propietario — 1416 seguidores de mindsdb |
| 24.8/25 | Trayectoria — 57 repos públicos, cuenta de ~8 años |
Datos de entrada utilizados
| followers | 1416 |
| owner_type | Organization |
| is_verified | — |
| owner_login | mindsdb |
| public_repos | 57 |
| account_age_days | 3271 |
Mantenimiento de paquetes
100Excelente
Cómo se puntúa
| 25/25 | Publicado y resoluble — 1 paquete(s) en pypi |
| 35/35 | Recencia de publicación — última publicación hace 3 días |
| 20/20 | Historial de versiones — 51 versiones en el registro |
| 20/20 | No obsoleto — activo, ni obsoleto ni retirado |
Datos de entrada utilizados
| packages | cowork-server |
| ecosystems | pypi |
| any_deprecated | no |
| min_days_since_publish | 3 |
Calidad de Ingeniería
¿Existen unas prácticas mínimas de ingeniería y documentación?
77
Prácticas de ingeniería
68Moderado
Cómo se puntúa
| 24/24 | Flujos de trabajo de CI — 11 flujo(s) de trabajo |
| 24/24 | Pruebas presentes |
| 0/16 | Configuración de linter |
| 0/9.6 | Hooks de pre-commit |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard: CI-Tests — 14 out of 14 merged PRs checked by a CI test -- score normalized to 10 |
Datos de entrada utilizados
| has_ci | sí |
| has_tests | sí |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Documentación
90Excelente
Cómo se puntúa
| 30/30 | README |
| 25/25 | Directorio de documentación |
| 15/15 | Sitio de documentación / página del proyecto — https://mindshub.ai |
| 10/10 | Descripción del repositorio |
| 0/10 | Topics |
| 10/10 | Wiki |
Datos de entrada utilizados
| topics | — |
| has_wiki | sí |
| homepage | https://mindshub.ai |
| has_readme | sí |
| has_docs_dir | sí |
| has_description | sí |
Seguridad
¿Son sólidas las prácticas visibles de seguridad y de cadena de suministro, sin exposición jurisdiccional de alto riesgo sin resolver?
35
Postura de seguridad
28Crítico
Alerta de riesgo jurisdiccional
Exposición a una jurisdicción de alto riesgo detectada
2 perfiles de contribuidores principalesRussiaSeguridad y calificación global: límite En riesgo
Se basa en ubicaciones públicas declaradas por los propios perfiles. Esta señal de gobernanza no determina nacionalidad, ciudadanía, intención, sanciones ni la fiabilidad de una persona.
Cómo se evalúa la exposición jurisdiccionalCómo se puntúa
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — sin datos |
| 2.5/2.5 | CI-Tests — 14 out of 14 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 6.8/7.5 | Code-Review — Found 12/13 approved changesets -- score normalized to 9 |
| 2.5/2.5 | Contributors — project has 18 contributing companies or organizations |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Licencia — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0.5/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1 |
| 5/5 | SAST — SAST tool is run on all commits |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — sin datos |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 14 existing vulnerabilities detected |
Datos de entrada utilizados
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 5,5 |
| high_risk_jurisdiction_cap | 49 |
| high_risk_jurisdiction_multiplier | 50 |
| security_posture_after_multiplier | 28 |
| security_posture_before_jurisdiction | 55 |
Excluidos de la puntuación (sin datos o no aplicable): branch_protection, signed_releases. Los pesos restantes se han renormalizado. La Política de Jurisdicciones de Alto Riesgo aplica un multiplicador del 50% y da a la postura de seguridad un límite «En riesgo» de 49.
Avisos de dependencias
61Moderado
Cómo se puntúa
| 14.6/35 | Dependencias directas libres de avisos conocidos — 1 afectados: hermes-agent 0.17.0 (high 7.3) |
| 6.8/25 | Dependencias indirectas libres de avisos conocidos — 1 afectados: pillow 12.2.0 (critical 9.1) |
| 40/40 | Sin avisos pendientes — ningún aviso lleva público más de 90 días |
Datos de entrada utilizados
| source | osv |
| advisories | 30 |
| affected_packages | 2 |
| assessed_packages | 103 |
| unassessed_packages | 0 |
| affected_by_severity | critical 1, high 1 |
| direct_affected_packages | 1 |
Se cotejó el cierre de dependencias en tiempo de ejecución de pypi:cowork-server@0.26.7.27.3 —lo que arrastra la instalación del paquete publicado—: 103 paquetes. No se analiza la alcanzabilidad.
Preparación para IA
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
50
Contexto y guía para agentes
33En riesgo
Cómo se puntúa
| 0/45 | Instrucciones para agentes — sin CLAUDE.md / AGENTS.md / reglas de editor |
| 0/15 | Documentación legible por máquinas (llms.txt) |
| 32.9/40 | Historial de commits legible — 61 de 99 commits humanos declaran su intención (asunto estructurado o cuerpo explicativo) |
Datos de entrada utilizados
| has_llms_txt | no |
| legible_history_share | 0,616 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Cómo se puntúa
| 18/18 | Arranque con un solo comando — Makefile |
| 22/22 | Pruebas automatizadas |
| 0/11 | Configuración de lint / formato |
| 0/11 | Verificación estática de tipos |
| 10/10 | Entorno reproducible — Dockerfile, lockfile |
| 10/10 | Práctica demostrada con agentes — 25 de los últimos 100 commits con autoría o crédito de agente |
| 0/8 | Mantenimiento automatizado — no se observan actualizaciones automáticas de dependencias |
| 1/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1 |
Datos de entrada utilizados
| has_nix | no |
| has_tests | sí |
| lockfiles | uv.lock |
| has_dockerfile | sí |
| typed_language | no |
| bootstrap_files | Makefile |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0,25 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Legibilidad del código para modelos
55Moderado
Cómo se puntúa
| 0/45 | Código verificable por tipos — Python sin configuración de verificación de tipos |
| 55/55 | Tamaños de archivo manejables — 0/234 archivos fuente de más de 60 KB |
Datos de entrada utilizados
| primary_language | Python |
| largest_source_bytes | 55.763 |
| source_files_sampled | 234 |
| oversized_source_files | 0 |
Datos clave
4estrellas de GitHub
15contribuidores
601commits en los últimos 12 meses
0días desde el último push
54versiones publicadas
3factor bus
0issues abiertas
PyPIecosistemas de paquetes
Advertencias de recopilación de datos
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Más detalle
Historial de estrellas y forks 0 ★ / 5 ⇿
0Estrellas
5Forks
10Versiones
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
Mayor 0Menor 0Parche 0
OpenSSF Scorecard 5.5 / 10
5.5agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| n/d | Branch-Protection | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| 10 | CI-Tests | 14 out of 14 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 9 | Code-Review | Found 12/13 approved changesets -- score normalized to 9 |
| 10 | Contributors | project has 18 contributing companies or organizations |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 1 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 1 |
| 10 | SAST | SAST tool is run on all commits |
| 0 | Security-Policy | security policy file not detected |
| n/d | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 14 existing vulnerabilities detected |
Dependencias directas 17
| Registro | Paquete | Restricción de versión | Manifiesto |
|---|---|---|---|
| PyPI | alembic | >=1.17.0 | pyproject.toml |
| PyPI | anton-agent | >=2.26.6.30.1,<3 | pyproject.toml |
| PyPI | cryptography | >=48.0.0 | pyproject.toml |
| PyPI | fastapi | >=0.136.1 | pyproject.toml |
| PyPI | hermes-agent | >=0.15.2,<0.18 | pyproject.toml |
| PyPI | httpx | >=0.27 | pyproject.toml |
| PyPI | pydantic | >=2.12.5 | pyproject.toml |
| PyPI | pydantic-settings | >=2.14.1 | pyproject.toml |
| PyPI | psycopg | >=3.2 | pyproject.toml |
| PyPI | python-multipart | >=0.0.28 | pyproject.toml |
| PyPI | sqlmodel | >=0.0.38 | pyproject.toml |
| PyPI | tzlocal | >=5.0 | pyproject.toml |
| PyPI | uvicorn | >=0.47.0 | pyproject.toml |
| PyPI | markdown | >=3.7 | pyproject.toml |
| PyPI | xhtml2pdf | >=0.2.16 | pyproject.toml |
| PyPI | python-docx | >=1.1.2 | pyproject.toml |
| PyPI | htmldocx | >=0.0.6 | pyproject.toml |
Todas las dependencias 118
Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 17 paquetes directos y 101 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.
| Registro | Paquete | Versión | Relación |
|---|---|---|---|
| PyPI | alembic | 1.18.4 | directa |
| PyPI | anton-agent | 2.26.7.6.2 | directa |
| PyPI | cryptography | 48.0.1 | directa |
| PyPI | fastapi | 0.136.3 | directa |
| PyPI | hermes-agent | 0.17.0 | directa |
| PyPI | htmldocx | 0.0.6 | directa |
| PyPI | httpx | 0.28.1 | directa |
| PyPI | markdown | 3.10.2 | directa |
| PyPI | psycopg | 3.3.4 | directa |
| PyPI | pydantic | 2.13.4 | directa |
| PyPI | pydantic-settings | 2.14.1 | directa |
| PyPI | python-docx | 1.2.0 | directa |
| PyPI | python-multipart | 0.0.32 | directa |
| PyPI | sqlmodel | 0.0.38 | directa |
| PyPI | tzlocal | 5.4.3 | directa |
| PyPI | uvicorn | 0.49.0 | directa |
| PyPI | xhtml2pdf | 0.2.17 | directa |
| PyPI | aiohappyeyeballs | 2.6.2 | indirecta |
| PyPI | aiohttp | 3.14.0 | indirecta |
| PyPI | aiosignal | 1.4.0 | indirecta |
| PyPI | annotated-doc | 0.0.4 | indirecta |
| PyPI | annotated-types | 0.7.0 | indirecta |
| PyPI | anthropic | 0.105.2 | indirecta |
| PyPI | anyio | 4.13.0 | indirecta |
| PyPI | arabic-reshaper | 3.0.1 | indirecta |
| PyPI | asn1crypto | 1.5.1 | indirecta |
| PyPI | attrs | 26.1.0 | indirecta |
| PyPI | audioop-lts | 0.2.2 | indirecta |
| PyPI | beautifulsoup4 | 4.15.0 | indirecta |
| PyPI | certifi | 2026.5.20 | indirecta |
| PyPI | cffi | 2.0.0 | indirecta |
| PyPI | charset-normalizer | 3.4.7 | indirecta |
| PyPI | click | 8.4.1 | indirecta |
| PyPI | colorama | 0.4.6 | indirecta |
| PyPI | concurrent-log-handler | 0.9.29 | indirecta |
| PyPI | coverage | 7.14.3 | indirecta |
| PyPI | croniter | 6.0.0 | indirecta |
| PyPI | cssselect2 | 0.9.0 | indirecta |
| PyPI | dill | 0.3.8 | indirecta |
| PyPI | discord-py | 2.7.1 | indirecta |
| PyPI | distro | 1.9.0 | indirecta |
| PyPI | docstring-parser | 0.18.0 | indirecta |
| PyPI | fire | 0.7.1 | indirecta |
| PyPI | frozenlist | 1.8.0 | indirecta |
| PyPI | greenlet | 3.5.1 | indirecta |
| PyPI | h11 | 0.16.0 | indirecta |
| PyPI | html5lib | 1.1 | indirecta |
| PyPI | httpcore | 1.0.9 | indirecta |
| PyPI | httptools | 0.8.0 | indirecta |
| PyPI | idna | 3.18 | indirecta |
| PyPI | iniconfig | 2.3.0 | indirecta |
| PyPI | jinja2 | 3.1.6 | indirecta |
| PyPI | jiter | 0.15.0 | indirecta |
| PyPI | lxml | 6.1.1 | indirecta |
| PyPI | mako | 1.3.12 | indirecta |
| PyPI | markdown-it-py | 4.2.0 | indirecta |
| PyPI | markupsafe | 3.0.3 | indirecta |
| PyPI | mdurl | 0.1.2 | indirecta |
| PyPI | multidict | 6.7.1 | indirecta |
| PyPI | openai | 2.24.0 | indirecta |
| PyPI | oscrypto | 1.3.0 | indirecta |
| PyPI | packaging | 26.0 | indirecta |
| PyPI | pathspec | 1.1.1 | indirecta |
| PyPI | pillow | 12.3.0 | indirecta |
| PyPI | pluggy | 1.6.0 | indirecta |
| PyPI | portalocker | 3.2.0 | indirecta |
| PyPI | prompt-toolkit | 3.0.52 | indirecta |
| PyPI | propcache | 0.5.2 | indirecta |
| PyPI | psutil | 7.2.2 | indirecta |
| PyPI | psycopg-binary | 3.3.4 | indirecta |
| PyPI | ptyprocess | 0.7.0 | indirecta |
| PyPI | pycparser | 3.0 | indirecta |
| PyPI | pydantic-core | 2.46.4 | indirecta |
| PyPI | pygments | 2.20.0 | indirecta |
| PyPI | pyhanko | 0.35.1 | indirecta |
| PyPI | pyhanko-certvalidator | 0.31.1 | indirecta |
| PyPI | pyjwt | 2.13.0 | indirecta |
| PyPI | pypdf | 6.14.0 | indirecta |
| PyPI | pytest | 9.0.3 | indirecta |
| PyPI | pytest-asyncio | 1.4.0 | indirecta |
| PyPI | pytest-cov | 7.1.0 | indirecta |
| PyPI | python-bidi | 0.6.10 | indirecta |
| PyPI | python-dateutil | 2.9.0.post0 | indirecta |
| PyPI | python-dotenv | 1.2.2 | indirecta |
| PyPI | pytz | 2026.2 | indirecta |
| PyPI | pywin32 | 312 | indirecta |
| PyPI | pywinpty | 2.0.15 | indirecta |
| PyPI | pyyaml | 6.0.3 | indirecta |
| PyPI | reportlab | 4.5.1 | indirecta |
| PyPI | requests | 2.33.0 | indirecta |
| PyPI | rich | 14.3.3 | indirecta |
| PyPI | ruamel-yaml | 0.18.17 | indirecta |
| PyPI | ruamel-yaml-clib | 0.2.15 | indirecta |
| PyPI | shellingham | 1.5.4 | indirecta |
| PyPI | six | 1.17.0 | indirecta |
| PyPI | slack-sdk | 3.42.0 | indirecta |
| PyPI | sniffio | 1.3.1 | indirecta |
| PyPI | socksio | 1.0.0 | indirecta |
| PyPI | soupsieve | 2.8.4 | indirecta |
| PyPI | sqlalchemy | 2.0.50 | indirecta |
| PyPI | starlette | 1.3.1 | indirecta |
| PyPI | svglib | 2.0.2 | indirecta |
| PyPI | tenacity | 9.1.4 | indirecta |
| PyPI | termcolor | 3.3.0 | indirecta |
| PyPI | tinycss2 | 1.5.1 | indirecta |
| PyPI | tqdm | 4.67.3 | indirecta |
| PyPI | typer | 0.26.7 | indirecta |
| PyPI | typing-extensions | 4.15.0 | indirecta |
| PyPI | typing-inspection | 0.4.2 | indirecta |
| PyPI | tzdata | 2025.3 | indirecta |
| PyPI | uritools | 6.1.2 | indirecta |
| PyPI | urllib3 | 2.7.0 | indirecta |
| PyPI | uvloop | 0.22.1 | indirecta |
| PyPI | watchfiles | 1.2.0 | indirecta |
| PyPI | wcwidth | 0.7.0 | indirecta |
| PyPI | webencodings | 0.5.1 | indirecta |
| PyPI | websockets | 15.0.1 | indirecta |
| PyPI | yarl | 1.24.2 | indirecta |
Avisos de dependencias 2
Instalar pypi:cowork-server@0.26.7.27.3 arrastra 103 paquetes, directos y transitivos: 2 tienen avisos conocidos, de los cuales 1 son dependencias directas.
| Paquete | Versión | Relación | Gravedad | Avisos | Corregido en |
|---|---|---|---|---|---|
| pillow | 12.2.0 | indirecta | crítica | 26 | 12.3.0 |
| hermes-agent | 0.17.0 | directa | alta | 4 | 0.18.0 |
Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 3055,
"has_wiki": true,
"homepage": "https://mindshub.ai",
"languages": {
"Mako": 704,
"Python": 1564377,
"Makefile": 818,
"Dockerfile": 1726
},
"pushed_at": "2026-07-30T21:46:27Z",
"created_at": "2026-05-13T23:54:05Z",
"owner_type": "Organization",
"updated_at": "2026-07-27T21:15:40Z",
"description": "FastAPI backend for MindsHub Cowork. Manages projects, conversations, files, scheduling, memory, and agent orchestration with a SQLite-backed data layer.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "AGPL-3.0",
"default_branch": "main",
"license_spdx_raw": "AGPL-3.0",
"primary_language": "Python",
"significant_languages": [
"Python"
]
},
"owner": {
"blog": "mindsdb.com",
"name": "MindsDB Inc",
"type": "Organization",
"login": "mindsdb",
"company": null,
"location": "Berkeley, CA",
"followers": 1416,
"avatar_url": "https://avatars.githubusercontent.com/u/31035808?v=4",
"created_at": "2017-08-15T11:14:59Z",
"is_verified": null,
"public_repos": 57,
"account_age_days": 3271
},
"license": {
"state": "standard",
"spdx_id": "AGPL-3.0",
"raw_spdx": "AGPL-3.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.26.7.30.1rc5",
"kind": "other",
"published_at": "2026-07-30T21:46:28Z"
},
{
"tag": "v0.26.7.30.1rc4",
"kind": "other",
"published_at": "2026-07-30T13:05:12Z"
},
{
"tag": "v0.26.7.30.1rc3",
"kind": "other",
"published_at": "2026-07-30T13:02:37Z"
},
{
"tag": "v0.26.7.30.1rc2",
"kind": "other",
"published_at": "2026-07-30T11:55:35Z"
},
{
"tag": "v0.26.7.30.1rc1",
"kind": "other",
"published_at": "2026-07-30T05:01:03Z"
},
{
"tag": "v0.26.7.29.1rc2",
"kind": "other",
"published_at": "2026-07-29T17:53:41Z"
},
{
"tag": "v0.26.7.29.1rc1",
"kind": "other",
"published_at": "2026-07-29T15:42:30Z"
},
{
"tag": "v0.26.7.28.1rc3",
"kind": "other",
"published_at": "2026-07-28T16:26:23Z"
},
{
"tag": "v0.26.7.28.1rc2",
"kind": "other",
"published_at": "2026-07-28T12:01:21Z"
},
{
"tag": "v0.26.7.28.1rc1",
"kind": "other",
"published_at": "2026-07-28T03:07:29Z"
},
{
"tag": "v0.26.7.27.3",
"kind": "other",
"published_at": "2026-07-27T21:16:20Z"
},
{
"tag": "v0.26.7.27.2rc1",
"kind": "other",
"published_at": "2026-07-27T16:27:35Z"
},
{
"tag": "v0.26.7.27.1rc6",
"kind": "other",
"published_at": "2026-07-27T11:41:57Z"
},
{
"tag": "v0.26.7.27.2",
"kind": "other",
"published_at": "2026-07-27T19:38:12Z"
},
{
"tag": "v0.26.7.27.1",
"kind": "other",
"published_at": "2026-07-27T11:42:04Z"
},
{
"tag": "v0.26.7.27.1rc5",
"kind": "other",
"published_at": "2026-07-27T10:52:52Z"
},
{
"tag": "v0.26.7.27.1rc4",
"kind": "other",
"published_at": "2026-07-27T02:07:08Z"
},
{
"tag": "v0.26.7.27.1rc3",
"kind": "other",
"published_at": "2026-07-27T02:02:07Z"
},
{
"tag": "v0.26.7.27.1rc2",
"kind": "other",
"published_at": "2026-07-27T01:26:29Z"
},
{
"tag": "v0.26.7.27.1rc1",
"kind": "other",
"published_at": "2026-07-27T01:10:13Z"
},
{
"tag": "v0.26.7.25.1rc2",
"kind": "other",
"published_at": "2026-07-25T10:03:36Z"
},
{
"tag": "v0.26.7.25.1rc1",
"kind": "other",
"published_at": "2026-07-25T07:36:38Z"
},
{
"tag": "v0.26.7.24.1rc5",
"kind": "other",
"published_at": "2026-07-24T12:21:13Z"
},
{
"tag": "v0.26.7.24.1rc4",
"kind": "other",
"published_at": "2026-07-24T12:19:00Z"
},
{
"tag": "v0.26.7.24.1rc3",
"kind": "other",
"published_at": "2026-07-24T10:41:47Z"
},
{
"tag": "v0.26.7.24.1rc2",
"kind": "other",
"published_at": "2026-07-24T09:59:07Z"
},
{
"tag": "v0.26.7.24.1rc1",
"kind": "other",
"published_at": "2026-07-24T09:18:17Z"
},
{
"tag": "v0.26.7.23.1rc2",
"kind": "other",
"published_at": "2026-07-23T23:00:48Z"
},
{
"tag": "v0.26.7.23.1rc1",
"kind": "other",
"published_at": "2026-07-23T22:40:22Z"
},
{
"tag": "v0.26.7.22.3",
"kind": "other",
"published_at": "2026-07-22T02:24:49Z"
},
{
"tag": "v0.26.7.22.2",
"kind": "other",
"published_at": "2026-07-22T02:16:31Z"
},
{
"tag": "v0.26.7.22.1",
"kind": "other",
"published_at": "2026-07-22T01:49:15Z"
},
{
"tag": "v0.26.7.20.1",
"kind": "other",
"published_at": "2026-07-20T03:29:41Z"
},
{
"tag": "v0.26.7.16.1",
"kind": "other",
"published_at": "2026-07-16T19:44:42Z"
},
{
"tag": "v0.26.7.13.3",
"kind": "other",
"published_at": "2026-07-13T23:52:35Z"
},
{
"tag": "v0.26.7.13.2",
"kind": "other",
"published_at": "2026-07-13T23:13:57Z"
},
{
"tag": "v0.26.7.13.1",
"kind": "other",
"published_at": "2026-07-13T04:10:18Z"
},
{
"tag": "v0.26.7.6.4",
"kind": "other",
"published_at": "2026-07-06T19:01:10Z"
},
{
"tag": "v0.26.7.6.3",
"kind": "other",
"published_at": "2026-07-06T14:00:04Z"
},
{
"tag": "v0.26.7.6.2",
"kind": "other",
"published_at": "2026-07-06T13:55:04Z"
},
{
"tag": "v0.26.7.6.1",
"kind": "other",
"published_at": "2026-07-06T01:47:12Z"
},
{
"tag": "v0.26.7.3.1",
"kind": "other",
"published_at": "2026-07-03T01:17:54Z"
},
{
"tag": "v0.26.6.26.1",
"kind": "other",
"published_at": "2026-06-26T17:53:20Z"
},
{
"tag": "v0.1.10",
"kind": "patch",
"published_at": "2026-06-23T02:36:10Z"
},
{
"tag": "v0.1.9",
"kind": "patch",
"published_at": "2026-06-18T14:35:12Z"
},
{
"tag": "v0.1.8",
"kind": "patch",
"published_at": "2026-06-18T10:59:33Z"
},
{
"tag": "v0.1.7",
"kind": "patch",
"published_at": "2026-06-18T07:26:59Z"
},
{
"tag": "v0.1.6",
"kind": "patch",
"published_at": "2026-06-16T12:10:43Z"
},
{
"tag": "v0.1.5",
"kind": "patch",
"published_at": "2026-06-12T22:55:18Z"
},
{
"tag": "v0.1.4",
"kind": "patch",
"published_at": "2026-06-05T19:28:43Z"
},
{
"tag": "v0.1.3",
"kind": "patch",
"published_at": "2026-06-03T15:33:48Z"
},
{
"tag": "v0.1.2",
"kind": "patch",
"published_at": "2026-06-02T22:44:35Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-06-02T00:22:27Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-06-01T05:40:28Z"
}
],
"recent_commits": [
{
"oid": "3fc4ed55ab4e135d109d66da6acab6b9f7007e21",
"body": "Bumping the Cowork server version so Hot fix 1081, can get to users. https://github.com/mindsdb/anton/pull/278",
"is_bot": false,
"headline": "bump release (#239)",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-27T21:15:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "647cd8813bb0ab831fb27c17e4685f960988e619",
"body": "* ENG-660: user-selectable routing & summarization model\n\nAdds router_provider/router_model user settings (anton's cheap 'thalamus'\nrole: respond-vs-delegate gating + history summarization), independent of\nthe coding model (scratchpad code gen).\n\n- app_settings: ROUTER_MODEL_DEFAULTS (MindsHub->kimi\n[…]\ny.github.com>\nCo-authored-by: MindsDB DevOps / Infrastructure <144632297+mindsdb-devops@users.noreply.github.com>\nCo-authored-by: Minura Punchihewa <49385643+MinuraPunchihewa@users.noreply.github.com>",
"is_bot": true,
"headline": "Weekly release: staging → main (#213)",
"author_name": "mindsdb-release-train[bot]",
"author_login": "mindsdb-release-train[bot]",
"committed_at": "2026-07-27T11:40:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a2cd44a885c7e3fc9a47acf9bedd47fedca1e54b",
"body": "… (#220)\n\n* fix: switch build and scan jobs to use mdb-dev runner for consistency\n\nAligns the runner environment for build and scan jobs with development settings by using \"mdb-dev\" instead of \"mdb-prod,\" ensuring a consistent and simplified setup process.\n\n* fix: comment out build, scan, and deploy\n[…]\n the production GitHub Actions workflow to prevent execution during ongoing investigation or maintenance. This change is meant to pause deployment activities without removing the configurations.\n\n* up",
"is_bot": false,
"headline": "fix: switch build and scan jobs to use mdb-dev runner for consistency…",
"author_name": "Lucas Koontz",
"author_login": "lucas-koontz",
"committed_at": "2026-07-22T02:24:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ec1468de7ff3f4cc4366420f77dc3ddf27d9fefb",
"body": "… (#219)\n\nAligns the runner environment for build and scan jobs with development settings by using \"mdb-dev\" instead of \"mdb-prod,\" ensuring a consistent and simplified setup process.",
"is_bot": false,
"headline": "fix: switch build and scan jobs to use mdb-dev runner for consistency…",
"author_name": "Lucas Koontz",
"author_login": "lucas-koontz",
"committed_at": "2026-07-22T02:15:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e13d31ff9bf9eb0bb0d6d065b2267b2c3a468d25",
"body": "* fix(settings): support legacy server port and ignore K8s service link (ENG-439)\n\nEnsure that both `COWORK_LISTEN_PORT` and legacy `COWORK_SERVER_PORT` are supported for setting server ports, with precedence given to the former. Ignore service link URIs injected as `tcp://` to prevent startup issue\n[…]\ned references from comments\n\nRemove comment references to deprecated issue ENG-439 to clarify the role of COWORK_SERVER_PORT in app settings and associated tests, ensuring consistency and readability.",
"is_bot": false,
"headline": "Fixes legacy port handling and k8s URI injection issues (#218)",
"author_name": "Lucas Koontz",
"author_login": "lucas-koontz",
"committed_at": "2026-07-22T01:48:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4892ab24d2fd45d8bd05aecbfd263e503389937e",
"body": "Add k8s deployment (main)",
"is_bot": false,
"headline": "Merge pull request #214 from mindsdb/add/k8s-deployment-main",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:49:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1af9ebef28a765ec0239939919d343b5ed64840",
"body": null,
"is_bot": false,
"headline": "rename port setting to avoid collision with k8s",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5766f8284433d01e8b5d945ac793a6e46a8eb610",
"body": null,
"is_bot": false,
"headline": "fixi init migration",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e44b0784bfeeeefbedbb47c312bfa0b8e501a30a",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "330156def0c10eec746d0eba14f0bcd6c8833e2f",
"body": null,
"is_bot": false,
"headline": "fix db uri",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5614a6c66bb4495b2af323139de01753929d374e",
"body": null,
"is_bot": false,
"headline": "fix port",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "524b035938e553658bfedf4f4bfaed3208ed9fa9",
"body": null,
"is_bot": false,
"headline": "fix port",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e7393bc9f197e3ea42053abcf8f76739a1d7958",
"body": null,
"is_bot": false,
"headline": "add ephemeral:false to base chart",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b2f962a1d4ed0c0bea7d6a3d15434978c82f7d7",
"body": null,
"is_bot": false,
"headline": "remove dumb comment",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97bf4fd1cedb7498b154448a6edfab58c157dbe9",
"body": null,
"is_bot": false,
"headline": "add staging and prod workflows",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8476ca17095f92b67909f4ba3630670ff2d19a41",
"body": null,
"is_bot": false,
"headline": "initial helm chart and docker",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1756cbedf28341e4f1897cfc5cfe47fc8b61ea93",
"body": "Staging (Week of 26-07-13)",
"is_bot": false,
"headline": "Merge pull request #193 from mindsdb/staging",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-20T03:28:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25130df861a206ae07f0d4f8fc054715a9738224",
"body": "feat(ENG-837): add nav branding settings (title, title color, logo, toggle visibility)",
"is_bot": false,
"headline": "Merge pull request #206 from mindsdb/feat/nav-branding-settings",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-17T15:29:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "324498fb4cb5f75e598389de818375cda6795651",
"body": "oauth flow generalization for non-google connectors (plus linear connector)",
"is_bot": false,
"headline": "Merge pull request #202 from mindsdb/general-oauth-flow",
"author_name": "Jorge Torres",
"author_login": "torrmal",
"committed_at": "2026-07-17T13:23:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c35bf03770996b4d460d776764f992b1b0d54eed",
"body": "…oggle visibility)\n\nAdds nav_title, nav_title_color, nav_logo, show_theme_toggle, and\nshow_8bit_toggle to UserSettings so the sidebar can be personalized the\nsame way as the greeting — synced per-account settings, not local-only\nbrowser storage. The settings table is a generic key-value store, so\nthis needs no migration.",
"is_bot": false,
"headline": "feat(ENG-837): add nav branding settings (title, title color, logo, t…",
"author_name": "Jorge Torres",
"author_login": "torrmal",
"committed_at": "2026-07-17T04:53:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "36b012b0453b324704432e3633bde7bf3467091f",
"body": "Sync main back into staging (weekly release cycle workflows)",
"is_bot": false,
"headline": "Merge pull request #205 from mindsdb/main",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-16T21:34:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f103445173d02f4b9141ba248214ae60b0135b60",
"body": "Add weekly release cycle workflows (freeze, release PR, unfreeze)",
"is_bot": false,
"headline": "Merge pull request #179 from mindsdb/add-weekly-merge-workflow",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-16T19:43:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4a0538ac59a620a0ef49f992db3381c6bc6d4ed",
"body": null,
"is_bot": false,
"headline": "added linear support",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-16T18:22:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54f861d4bb1e61b726db08417a96d84c19be1457",
"body": null,
"is_bot": false,
"headline": "oauth flow generalization for non-google connectors",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-16T12:53:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "80239cf6c5bb18442b7a010adcadba05f01929a5",
"body": "Feature/tenancy mode",
"is_bot": false,
"headline": "Merge pull request #196 from mindsdb/feature/tenancy-mode",
"author_name": "Zoran Pandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-16T10:47:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "929a05bad53a22df1ece82d8b220ea08837770f2",
"body": "feat(comments): cowork-server artifact-comments proxy (REST + SSE passthrough)",
"is_bot": false,
"headline": "Merge pull request #154 from mindsdb/feat/comments-step-2",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-15T20:10:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e27e17f1608408003da90930c8ce2ccf42ad754d",
"body": null,
"is_bot": false,
"headline": "Pin sha for github-actions",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-15T17:42:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16be2994cc354f89ce0d89b8aa95b384684dd6e7",
"body": "…ject delete to conversations (ENG-701) (#187)\n\n* fix(delete): clean up attachments on conversation delete; cascade project delete to conversations (ENG-701)\n\nDeleting a conversation or project used to orphan uploaded attachment files\nforever — rows + bytes, invisible in any UI, piling up in ~/.cowo\n[…]\nthe failed conversation + its attachment survive.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(delete): clean up attachments on conversation delete; cascade pro…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-15T15:44:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "74f3bd1180c497dc76f4cf9655d353a8026ad00e",
"body": null,
"is_bot": false,
"headline": "Add tests",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:18:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f54d9ec49688efeb878938cba8003408ceddb52",
"body": null,
"is_bot": false,
"headline": "Audit by default",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:18:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e65de3a245a3bb50993a66f19c4dd027be730e2",
"body": null,
"is_bot": false,
"headline": "Add flag for audit mode",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:18:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "192287839a009f6780b8149aa2647a789b973a5f",
"body": null,
"is_bot": false,
"headline": "Add tests",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:02:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c91db84934946a6380239ff8e0d92dae5b6137e",
"body": null,
"is_bot": false,
"headline": "Check for principal",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:02:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7fb7f727ab372f039aaab3b05891f34068dd10fd",
"body": null,
"is_bot": false,
"headline": "Add tests + check mode",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:02:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4a94462eb9dec343f4a71e3d11d12c859b44514",
"body": null,
"is_bot": false,
"headline": "Add flag",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:01:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "802aca6a9c6538a120c2be355dfa79cf35849666",
"body": "gdrive connector with google picker api",
"is_bot": false,
"headline": "Merge pull request #178 from mindsdb/google_picker_api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-15T12:46:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33dd31aad9763cc60601cc835807da50376bf868",
"body": null,
"is_bot": false,
"headline": "Merge branch 'staging' into google_picker_api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-15T11:41:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33a74a84032694ee0e62e116d5caf5e757424312",
"body": "…timezone-local\n\nfix(scheduler): resolve timezone=\"local\" to system zone, not UTC [ENG-773]",
"is_bot": false,
"headline": "Merge pull request #195 from mindsdb/paul/eng-773-scheduled-tasks-s5-…",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-15T00:01:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5179e4d581bb6433416204c6bec9bd12fd209994",
"body": "…reap-orphaned-running-runs-on-boot-bound\n\nfix(scheduler): reap orphaned running runs on boot; bound run duration [ENG-769]",
"is_bot": false,
"headline": "Merge pull request #194 from mindsdb/paul/eng-769-scheduled-tasks-s1-…",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-15T00:01:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f897f28b936d44cbb7554e51ad4ea550fc0b49f7",
"body": "`timezone=\"local\"` silently resolved to UTC in resolve_timezone(), so a\nschedule saved with \"local\" fired on UTC wall-clock instead of the user's\nzone (and lost DST tracking). Since cowork-server runs on the user's own\nmachine, \"local\" now resolves to the system's real IANA zone via tzlocal,\nfalling\n[…]\nting next_run_at on cadence/timezone edit is deferred to\nthe driver rework (ENG-703); this is the standalone salient bug from ENG-773.\n\nENG-773\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scheduler): resolve timezone=\"local\" to the system zone, not UTC",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T23:19:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "be64a8815036439f8242bdc9c2f0b6f006205162",
"body": null,
"is_bot": false,
"headline": "Merge branch 'main' into staging (content already present)",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T22:26:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fce74003ba6e2fb9f4eb3d2cf6d3eb32d26c79e0",
"body": "A crash/restart mid-run left a ScheduleRun in `running` forever. The\ndue-check skips schedules with a running run, so one stale row wedged\nthe schedule permanently — it silently never fired again.\n\n- Add ScheduleRunService.reap_orphaned_runs(): on boot, mark every\n `running` run (scheduled and manu\n[…]\n so a hung agent can't stay `running` indefinitely.\n- Tests for the reaper (running->failed, manual runs, finished runs\n untouched).\n\nENG-769\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scheduler): reap orphaned running runs on boot; bound run duration",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T21:48:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "866878ef2dffe18976a0685767ad874dfe4ef071",
"body": "…ixes\n\n[ENG-688] Scheduled task fixes",
"is_bot": false,
"headline": "Merge pull request #181 from mindsdb/tino097/eng-688-scheduled-task-f…",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T19:47:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09516f817a8bce774c1bc82e3c34327e1c68e5b5",
"body": null,
"is_bot": false,
"headline": "moved gdrive logic from harness to connections",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-14T17:55:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64f7251a4940b294a59dd1f64c02801200b614a5",
"body": "chore: back-merge main hotfix into staging",
"is_bot": false,
"headline": "Merge pull request #191 from mindsdb/backmerge/main-hotfixes-to-staging",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T03:39:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "39224922827b3017d342313f9629ef38cfd61026",
"body": "fix(settings): .env model keys are CLI-only, never synced to DB (ENG-739)",
"is_bot": false,
"headline": "Merge pull request #189 from mindsdb/fix/eng-739-env-models-cli-only",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T03:35:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7dbe7ecfad7dc5a7eb8d9424628d699aec08444",
"body": "fix(settings): stop COWORK_SERVER_ORIGIN from populating public_base_url (ENG-632)",
"is_bot": false,
"headline": "Merge pull request #190 from mindsdb/hotfix/eng-632-oauth-origin-alias",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T23:51:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6754fb6207e345a4a94dd978d7b57c08b51c4b43",
"body": "Hotfix for the desktop OAuth origin change (cowork PR #386, ENG-632).\n\nCOWORK_SERVER_ORIGIN was a validation alias for TWO settings: server_origin\n(OAuth redirect base — intended) and public_base_url (channel webhook base).\nThe desktop app sets COWORK_SERVER_ORIGIN=http://127.0.0.1:<port> so OAuth\n\"\n[…]\norigin and webhook\nbase are now decoupled. No other code referenced COWORK_SERVER_ORIGIN; cloud\ndeployments already set COWORK_PUBLIC_BASE_URL.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(settings): stop COWORK_SERVER_ORIGIN from populating public_base_url",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T23:18:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c6c39139d40c234e8780e1b97afcbe478f1e4e57",
"body": "fix(settings): .env model keys are CLI-only, never synced to DB (ENG-739)",
"is_bot": false,
"headline": "Merge pull request #189 from mindsdb/fix/eng-739-env-models-cli-only",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T23:13:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15daadf12d283e2fa0fd52dce69be85961647513",
"body": "…-739)\n\nRemove ANTON_PLANNING_MODEL / ANTON_CODING_MODEL from _ENV_TO_SETTING, the\ntable driving both migrate_env_to_db (first-boot seed) and the\nPOST /settings/raw merge sync.\n\nThe raw-sync path runs on every desktop/web credential push and — via the web\nclient's saveMindsToken — on every scheduled\n[…]\n assert\nthe new invariant: /settings/raw syncs the credential + provider but leaves the\nmodel row unset while preserving the .env line on disk.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(settings): stop syncing .env model keys to the DB — CLI-only (ENG…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T22:32:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ecc02394651a51368ca10527ad90dd759dded8c",
"body": "feat(tools): slim request_credentials schema + data-vault instructions",
"is_bot": false,
"headline": "Merge pull request #185 from mindsdb/feat/slim-connector-tools",
"author_name": "Max Abouchar",
"author_login": "SailingSF",
"committed_at": "2026-07-13T22:16:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ef9b9c620a09484be616500de00171f077a9447",
"body": null,
"is_bot": false,
"headline": "fix: reject path-traversal segments in comments proxy",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-13T08:02:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b0500cdd2324dcf44bc64a2c2bba7c8a0b57bee",
"body": "Staging (Week of 06-07-22)",
"is_bot": false,
"headline": "Merge pull request #163 from mindsdb/staging",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-13T04:09:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20dc8bad43eea6dc5623951ef725c6fc5d96e066",
"body": "…mission/update_form\n\n- request_credentials handler no longer tells the model to call\n fetch_submission (unregistered tool); guidance now matches the\n rewritten prompt's 'server saves on submit' contract.\n- _scrub_secret_values strips 'value' from password-type fields\n (top-level and per-method) \n[…]\nrompt clause restored.\n- Delete the commented-out fetch_submission/update_form blocks in\n tools.py and harness.py (git history preserves them).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tools): address review — scrub secret values, drop dead fetch_sub…",
"author_name": "Max Abouchar",
"author_login": "SailingSF",
"committed_at": "2026-07-11T00:49:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2c8c0f1add74002c82d95faa6d8686d2cbda03fc",
"body": "The request_credentials tool schema (8.7k chars on the wire) and its\nDATA VAULT WORKFLOW prompt (2.9k chars) documented per-field details a model\nalready knows. Cut to the non-obvious contracts only (verbatim registry spec\npass-through, _connector_id, methods[]/PKCE shape, fence formatting,\nnever-echo-credentials): schema ~5k chars, prompt 1.3k chars.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tools): slim request_credentials schema + data-vault instructions",
"author_name": "Max Abouchar",
"author_login": "SailingSF",
"committed_at": "2026-07-11T00:31:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "70a1d751640876971ba42bbf3ff38c3c6774cc32",
"body": null,
"is_bot": false,
"headline": "derive run status from stream terminal record",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-10T16:56:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e8d3d3cfc8c4c89c82569c8c846395bff9abde1d",
"body": null,
"is_bot": false,
"headline": "read run outcome from the stream terminal record",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-10T16:42:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48c8a9361112dd18b0fa076259cf90b3dfd21a6b",
"body": null,
"is_bot": false,
"headline": "fixes from ai code review",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-10T14:51:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b1cebed1c6fd7ad1fc80344aed5d3d7c00a3bf4",
"body": "…eeze)\n\nFollows the rename in mindsdb/github-actions#32. Caller filenames and workflow\nnames are unchanged; only the uses: target paths move.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Point callers at renamed reusable workflows (release-freeze/-pr/-unfr…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-10T00:01:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "75e2fdb3cf33a875cf68319bae71c681399dd934",
"body": "Adds a top-level 'permissions: contents: read' block to each caller so the\nGITHUB_TOKEN is least-privilege (fixes CodeQL actions/missing-workflow-permissions).\nAll privileged operations run through the mindsdb-release-train App token, so\ncontents: read is sufficient for the callers.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Set explicit GITHUB_TOKEN permissions on release-train callers",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T23:47:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9df5b36de89d3d8e9ce1b54d9d70b6c2e0a3e165",
"body": "…orkflows\n\nReplaces the self-contained freeze/release-PR/unfreeze workflows and the\nset-branch-lock.js helper with ~15-line callers of the reusable workflows in\nmindsdb/github-actions (see mindsdb/github-actions#32). Workflow names are\npreserved so the workflow_run chain still fires.\n\nAuth now uses \n[…]\nvisioned\nstaging-freeze ruleset instead of round-tripping branch protection. The\nunfreeze caller carries the merged-release-PR + fork-PR guard.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Refactor release-train workflows to thin callers of shared reusable w…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T23:37:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "be5e0a262667e9860935d49114680d26a888e092",
"body": "…trand attachments (#182)\n\n* fix(files): key attachment purposes by conversation id only (ENG-338)\n\nRenaming a project stranded every attachment already uploaded to its\nconversations: the purpose tag embedded the mutable project name\n(attachment:{project}:{session}) and renames never relinked existi\n[…]\nards it;\n the one-key dict was shape without consumers).\n\nSuite: 407 passed.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ENG-338: key attachment purposes by conversation id — renames can't s…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-09T22:24:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ccccd0f5ba57a15c12923496d079a3d7e368e8b",
"body": "fix(skills): directory-junction fallback for Windows non-admin symlinks (WinError 1314)",
"is_bot": false,
"headline": "Merge pull request #184 from mindsdb/fix/windows-skill-link-junctions",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T21:53:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f6c6319921e0bf84690bf7c95f924a8b733837f",
"body": "…ileges\n\nOn Windows a non-admin user without Developer Mode cannot create symlinks:\nPath.symlink_to raises OSError [WinError 1314] \"A required privilege is not\nheld by the client\". This crashed server boot — reconcile_all() in\nrun_dev_setup() propagated the raise, so the FastAPI lifespan startup abo\n[…]\n so it can never abort server startup again.\n\nAdds regression tests: link round-trip + \"one unlinkable skill doesn't abort\nthe full reconcile\".\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(skills): fall back to directory junctions when symlinks need priv…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T21:25:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aefad09760a859f247f3254e8b72291c2473d8d2",
"body": "…to a locked model (ENG-597) (#167)\n\n* feat(settings): tier-aware model defaults — free tier never defaults to a locked model (ENG-597)\n\nMindsHub now gates models per plan tier: a free-tier key gets sonnet/haiku\n(the canonical minds-cloud planning/coding defaults) as enabled:false from\n/v1/models, s\n[…]\nhy this slipped).\n\nSuite: 332 passed, ruff clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(settings): tier-aware model defaults — free tier never defaults …",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-09T17:49:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dd0f389c1e363bf7b145581810d4d1e295c7e963",
"body": null,
"is_bot": false,
"headline": "fix for project files for gdrive files",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-09T16:59:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "49efc6c8e819c60dfdb71a143e85e15bd1fa4ff8",
"body": "* fix: restore _stream compat method and fix NOT NULL migration (staging)\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n* fix: remove dead _stream method from ResponsesHandler\n\n_stream had zero callers after the rebase onto staging — the streaming\npath runs through _produce()/buffer, a\n[…]\n-of-band.\n\n---------\n\nCo-authored-by: sejuba <sejuba@7a:37:83:36:3f:61.home>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>\nCo-authored-by: Konstantin Sivakov <konstantin.sivakov@gmail.com>",
"is_bot": false,
"headline": "fix: add migration guard for pre-Alembic DBs (staging) (#86)",
"author_name": "Michael Olayemi Olawepo",
"author_login": "sejubar",
"committed_at": "2026-07-09T16:27:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "56f1d1ed83c01cb77ff0bd02b1c3cfdfd4f02523",
"body": null,
"is_bot": false,
"headline": "added file picker",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-09T16:19:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "46d863bef3e3420632868d1cfbfcc5b4f2729080",
"body": null,
"is_bot": false,
"headline": "trigger langfuse on turns",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T15:19:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b30ac1b79ae043f8b490323f69a5d1260dfbc856",
"body": null,
"is_bot": false,
"headline": "record canceled runs and expose correct flags for the api",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T15:11:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef096337c719ee66a91dfbffe76b589e8f25c70f",
"body": null,
"is_bot": false,
"headline": "fix(comments): don't show orphan notice for intentional general comments",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-09T15:06:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "043f4b3e0240771d592e14e512db33b843af1947",
"body": null,
"is_bot": false,
"headline": "register ds vars for scrubbing",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T14:23:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e68b1e25ab9d06f345a0294de6ac34dc22e5ec2b",
"body": null,
"is_bot": false,
"headline": "feat(comments): report hidden/orphan anchor state from the marker layer",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-09T14:12:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "475a13d8c3dbecdc14d909cfe131778328b37a29",
"body": null,
"is_bot": false,
"headline": "skip cron when success",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T13:59:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "da073bd172b39b602ebfb891a0adbb2c8358c799",
"body": "- Replace the injected iframe layer with the redesigned commenter chrome:\n teal droplet pins, white thread popover, grow-from-pill composer, custom\n pin cursor, gap-space element hit-testing, Alt-to-expand selection\n- Keep it credential-free: the layer posts intents over postMessage; the\n renderer holds creds, performs every API call, and pushes the thread list\n- English confirm copy for delete\n- Update layer tests for the redesigned protocol",
"is_bot": false,
"headline": "feat(comments): redesigned on-artifact comment layer (injected)",
"author_name": "Hazem Aboelsoud",
"author_login": "hazemahmedx0",
"committed_at": "2026-07-09T12:09:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84122a55f419c220ab1471fbe3f153b013428b55",
"body": null,
"is_bot": false,
"headline": "Merge branch 'staging' into google_picker_api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-09T11:07:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "016276c02af3beab2183c4023c2b1f2dee1fe174",
"body": "stop false \"Unpublished changes\" badge on fullstack artifacts",
"is_bot": false,
"headline": "Merge pull request #134 from mindsdb/fix/false-unpublished-changes",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-09T08:45:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a6203a4a7e6ad6a86bbb108f636908ad3bf4efb8",
"body": "…) (#168)\n\n* feat(turn-errors): map model-403s (model_access_denied / model_disabled) to distinct codes + extras (ENG-598)\n\nWhen the gateway rejects the requested MODEL (plan tier gate or admin kill\nswitch), the turn died as a generic anton_error — \"An unexpected error\noccurred\" — with no hint that \n[…]\nched — not\nin scope, present before this change.)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(turn-errors): map model-403s to distinct codes + extras (ENG-598…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-09T01:06:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e13717db8c41c10b7a4c3e3bf3ab4eea3ef265d2",
"body": "feat: single COWORK_HOME data root for full per-build isolation",
"is_bot": false,
"headline": "Merge pull request #174 from mindsdb/feat/cowork-home-data-root",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T01:01:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82a1da968a3cc5f465b36bb50a3341d719941564",
"body": "fix: fail legibly when the database is ahead of this build (ENG-324)",
"is_bot": false,
"headline": "Merge pull request #173 from mindsdb/fix/migration-mismatch-guard",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T23:57:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a2b5cd0a06ab57f6e0d397ffb55ab2c1555a958b",
"body": "The .env search chain kept ~/.anton/.env regardless of COWORK_HOME, so an\nisolated (preview/stable) build still read any value living there that its\nown .env didn't set. A path var in the legacy file (DATABASE_URI,\nMASTER_KEY_PATH, COWORK_PROJECTS_DIR, ...) would resolve every build back\nonto the sa\n[…]\ntion\nexists to prevent. Consult ~/.anton/.env only for the default (prod) home;\nan isolated build reads only <COWORK_HOME>/.env and local .env.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: don't inherit legacy ~/.anton/.env in isolated builds",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T23:28:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "62448aaf8ec5231a25018c5455fc5738fd6f5ded",
"body": "Replaces the single weekly-merge workflow with the freeze/release-PR/unfreeze\nlifecycle established in mindshub_inference#319: staging-freeze locks staging\non a weekly cron, weekly-merge-staging opens the staging->main release PR, and\nstaging-unfreeze unlocks staging when the release PR merges. Branch-protection\nchanges go through a shared set-branch-lock.js helper using RELEASE_AUTOMATION_TOKEN.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add weekly release cycle workflows (freeze, release PR, unfreeze)",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T21:57:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b8c709be15b164eba3a8869c34d1713ac3d1088d",
"body": "Introduce cowork.common.paths.cowork_home() — a single data root (default\n~/.cowork, overridable via the COWORK_HOME env var) that every cowork path\nderives from: the SQLite DB, projects, files, skills, memory, streams, the\nconnector vault, the master key, oauth state, the .env, and the anton/hermes\n[…]\nATH, …)\nkeep their precedence over the derived default. Default behavior (unset\nCOWORK_HOME) is unchanged: everything resolves under ~/.cowork.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: single COWORK_HOME data root for full per-build isolation",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T21:50:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "27fcc8439a587c38f747e1af2f1f87f783739c41",
"body": "fix(server): remove Python 3.12-only f-string syntax that crashes import on 3.11",
"is_bot": false,
"headline": "Merge pull request #169 from mindsdb/fix/server-python312-import-crash",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T21:34:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4321fc98d42f3c197d16c97db1c372113035d7a2",
"body": "…7) (#143)\n\n* add guard around the key reveal\n\n* test(settings): cover loopback guard on reveal-key + /raw (ENG-457)\n\nTests for _require_local: allows 127.0.0.1/::1, 403s any other peer (incl.\n0.0.0.0 and a None client), and reveal-key / GET-raw reject a non-local\ncaller before touching the DB/env.\n\n[…]\npasses the guard.\n\nFull suite green (287 passed).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(settings): restrict reveal-key + /raw to loopback callers (ENG-45…",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T21:05:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1d1e5a7539e8f855ec42599a63d5405d6fcae7f4",
"body": "setup_logging() clears all root handlers and calls logging.basicConfig(\nforce=True), reconfiguring application-wide logging as a side effect of\nimporting cowork/db/migrations.py (order-dependent clobbering), and\nreturns a logger named cowork.common.logger rather than this module.\nUse logging.getLogger(__name__) like the rest of the codebase.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: use module logger instead of setup_logging() at import",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T20:32:50Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a2c24e907a439011a619585f6dd02e36aca346f3",
"body": "…177)\n\n* feat(channels): channel-aware support-mode prompt via ChannelContext (ENG-591)\n\nChannel turns previously ran the identical harness build as desktop turns,\nso the system prompt steered the model toward desktop-UI affordances.\nThread a ChannelContext (channel_type, is_group, display_name) fro\n[…]\nmention fallback so\n@antonbot doesn't answer a mention aimed at @antonbotdev.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ENG-591: channel-aware support mode + working group mention-gating (#…",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T17:41:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1ba44ffcde9b4daadc7ab6d4c1a2089be26164e3",
"body": "feat: configurable CORS allowed origins (localhost-only default)",
"is_bot": false,
"headline": "Merge pull request #112 from mindsdb/feat/cors-configurable-origins",
"author_name": "Jorge Torres",
"author_login": "torrmal",
"committed_at": "2026-07-08T15:44:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a74f5a525a24c8fd928b43a5de3b11c95a62acc7",
"body": null,
"is_bot": false,
"headline": "switched anton-agent to main",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-08T15:06:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ebf3a59f4b6c63205af456467d166c8e27ddcee4",
"body": null,
"is_bot": false,
"headline": "gdrive connector with google picker api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-08T15:04:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "27e130de722eed158b2356184d5badeb34a60dfd",
"body": "* Detach the channel from project on the /new command\n\n* adress comments on the PR\n\n---------\n\nCo-authored-by: Lucas Koontz <lucas.emanuel.koontz@gmail.com>",
"is_bot": false,
"headline": "Channels and projects (#164) (#166)",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T14:37:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3eb82c09e8fde398988b0f7a0aa218c5538fc440",
"body": null,
"is_bot": false,
"headline": "Merge branch 'staging' into feat/cors-configurable-origins",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T14:00:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f0637106cf88eff30728d5e723136f8330e6bec",
"body": "…eposition on DOM changes",
"is_bot": false,
"headline": "fix(comments): hide artifact markers for hidden/removed anchors and r…",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-08T12:54:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74d2c5449fe3f780f48e3359135e3f4e17f00584",
"body": null,
"is_bot": false,
"headline": "feat(comments): proxy PATCH/DELETE + on-artifact layer edit/delete",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-08T12:37:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8d7b5d69cd908e61165ac0585f89adea916eb224",
"body": "Feat/eng 563 scheduler update",
"is_bot": false,
"headline": "Merge pull request #161 from mindsdb/feat/eng-563-scheduler-update",
"author_name": "Andrey",
"author_login": "ea-rus",
"committed_at": "2026-07-08T08:43:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be4201ccba12a4501a8a3518a939b73270917e70",
"body": "When a newer app advances the schema and an older build is then opened\nagainst the same database, `command.upgrade(head)` fails deep inside\nAlembic with an opaque \"Can't locate revision identified by '<rev>'\"\nand the server never starts.\n\nDetect the condition up front: compare the revision(s) record\n[…]\n preview builds of different\nages sharing cowork-preview.db, or a prod downgrade) into an actionable\nmessage instead of a silent startup crash.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: fail legibly when the database is ahead of this build (ENG-324)",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T00:07:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bfe8d5c6094adbe5127878a93f55c49020073e28",
"body": "…r false-negative (ENG-576) (#171)\n\nThe Settings connectivity probe (ping_provider) and onboarding validation\n(validate_minds) POSTed CODING_MODEL_DEFAULTS[\"minds_cloud\"] = \"haiku\", a PAID\nmodel. MindsHub tier-gates paid models, so a free-tier key gets a 403 — and:\n\n- ping_provider recorded provider\n[…]\n5 new (constant guard, ping + validate use mindshub_air, configured paid\nmodel ignored, missing-key fast-fail). Suite: 320 passed.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(providers): probe MindsHub with a tier-universal model — free-tie…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-07T22:23:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e33769a6468bb0effdd7010547568ab24f4cabb2",
"body": "…ort on 3.11\n\nTwo modules used f-strings that reuse the enclosing quote character inside the\nexpression (PEP 701, valid only on Python 3.12+):\n\n - cowork/common/settings/app_settings.py — the default DB URI\n - cowork/harnesses/memory/adapter.py — the project-memory header\n\nOn any Python < 3.12\n[…]\newrite both to be quote-safe (identical runtime behavior; the DB URI string\nis byte-for-byte unchanged) so the package parses on every version.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(server): remove Python 3.12-only f-string syntax that crashes imp…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-07T20:08:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b404f9ad2d1a72dd46716135bc1ed5689feb9348",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-07T15:22:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "158eef87fdffc44b1cf4002a2a9f40d768cb7b77",
"body": null,
"is_bot": false,
"headline": "use ANTON_PUBLISH_URL if defined",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-07T13:57:23Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 54,
"commits_last_year": 601,
"latest_release_at": "2026-07-30T21:46:28Z",
"latest_release_tag": "v0.26.7.30.1rc5",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 11,
"days_since_latest_release": 0,
"mean_days_between_releases": 0.3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "cowork-server",
"exists": true,
"license": "LicenseRef-Proprietary",
"keywords": [
"Framework :: FastAPI",
"Operating System :: OS Independent",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.12"
],
"ecosystem": "pypi",
"matches_repo": true,
"registry_url": "https://pypi.org/project/cowork-server/",
"is_deprecated": false,
"latest_version": "0.26.7.27.3",
"repository_url": "https://github.com/mindsdb/cowork-server",
"versions_count": 51,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 4576,
"first_published_at": "2026-06-02T00:22:52.046265Z",
"latest_published_at": "2026-07-27T21:16:56.556176Z",
"latest_version_yanked": null,
"days_since_latest_publish": 3
}
]
},
"popularity": {
"forks": 5,
"stars": 4,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-06-26",
"count": 1
},
{
"date": "2026-07-08",
"count": 1
},
{
"date": "2026-07-18",
"count": 1
},
{
"date": "2026-07-19",
"count": 1
},
{
"date": "2026-07-20",
"count": 1
}
],
"complete": true,
"collected": 5,
"total_forks": 5
},
"star_history": null,
"open_issues_and_prs": 40
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 55763,
"source_files_sampled": 234,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [
{
"name": "pillow",
"direct": false,
"version": "12.2.0",
"severity": "critical",
"ecosystem": "pypi",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-45hq-cxwh-f6vc",
"GHSA-4x4j-2g7c-83w6",
"GHSA-5x94-69rx-g8h2",
"GHSA-62p4-gmf7-7g93",
"GHSA-6r8x-57c9-28j4",
"GHSA-8v84-f9pq-wr9x",
"GHSA-9hw9-ch79-4vh6",
"GHSA-fj7v-r99m-22gq",
"GHSA-jjj6-mw9f-p565",
"GHSA-pg7v-jwj7-p798"
],
"fixed_version": "12.3.0",
"advisory_count": 26,
"oldest_advisory_days": 24
},
{
"name": "hermes-agent",
"direct": true,
"version": "0.17.0",
"severity": "high",
"ecosystem": "pypi",
"cvss_score": 7.3,
"advisory_ids": [
"GHSA-mv8x-fg99-32mf",
"GHSA-pmqc-57g8-c22c",
"GHSA-xq8w-9jvx-gm3v",
"PYSEC-2026-2513"
],
"fixed_version": "0.18.0",
"advisory_count": 4,
"oldest_advisory_days": 59
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"high": 1,
"critical": 1
},
"advisory_count": 30,
"affected_count": 2,
"assessed_count": 103,
"malicious_count": 0,
"assessed_package": "pypi:cowork-server@0.26.7.27.3",
"unassessed_count": 0,
"direct_affected_count": 1
},
"ecosystems": [
"pypi"
],
"dependencies": [
{
"name": "alembic",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=1.17.0"
},
{
"name": "anton-agent",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2.26.6.30.1,<3"
},
{
"name": "cryptography",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=48.0.0"
},
{
"name": "fastapi",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.136.1"
},
{
"name": "hermes-agent",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.15.2,<0.18"
},
{
"name": "httpx",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.27"
},
{
"name": "pydantic",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2.12.5"
},
{
"name": "pydantic-settings",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2.14.1"
},
{
"name": "psycopg",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=3.2"
},
{
"name": "python-multipart",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.28"
},
{
"name": "sqlmodel",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.38"
},
{
"name": "tzlocal",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=5.0"
},
{
"name": "uvicorn",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.47.0"
},
{
"name": "markdown",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=3.7"
},
{
"name": "xhtml2pdf",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.2.16"
},
{
"name": "python-docx",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=1.1.2"
},
{
"name": "htmldocx",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.6"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "alembic",
"direct": true,
"version": "1.18.4",
"ecosystem": "pypi"
},
{
"name": "anton-agent",
"direct": true,
"version": "2.26.7.6.2",
"ecosystem": "pypi"
},
{
"name": "cryptography",
"direct": true,
"version": "48.0.1",
"ecosystem": "pypi"
},
{
"name": "fastapi",
"direct": true,
"version": "0.136.3",
"ecosystem": "pypi"
},
{
"name": "hermes-agent",
"direct": true,
"version": "0.17.0",
"ecosystem": "pypi"
},
{
"name": "htmldocx",
"direct": true,
"version": "0.0.6",
"ecosystem": "pypi"
},
{
"name": "httpx",
"direct": true,
"version": "0.28.1",
"ecosystem": "pypi"
},
{
"name": "markdown",
"direct": true,
"version": "3.10.2",
"ecosystem": "pypi"
},
{
"name": "psycopg",
"direct": true,
"version": "3.3.4",
"ecosystem": "pypi"
},
{
"name": "pydantic",
"direct": true,
"version": "2.13.4",
"ecosystem": "pypi"
},
{
"name": "pydantic-settings",
"direct": true,
"version": "2.14.1",
"ecosystem": "pypi"
},
{
"name": "python-docx",
"direct": true,
"version": "1.2.0",
"ecosystem": "pypi"
},
{
"name": "python-multipart",
"direct": true,
"version": "0.0.32",
"ecosystem": "pypi"
},
{
"name": "sqlmodel",
"direct": true,
"version": "0.0.38",
"ecosystem": "pypi"
},
{
"name": "tzlocal",
"direct": true,
"version": "5.4.3",
"ecosystem": "pypi"
},
{
"name": "uvicorn",
"direct": true,
"version": "0.49.0",
"ecosystem": "pypi"
},
{
"name": "xhtml2pdf",
"direct": true,
"version": "0.2.17",
"ecosystem": "pypi"
},
{
"name": "aiohappyeyeballs",
"direct": false,
"version": "2.6.2",
"ecosystem": "pypi"
},
{
"name": "aiohttp",
"direct": false,
"version": "3.14.0",
"ecosystem": "pypi"
},
{
"name": "aiosignal",
"direct": false,
"version": "1.4.0",
"ecosystem": "pypi"
},
{
"name": "annotated-doc",
"direct": false,
"version": "0.0.4",
"ecosystem": "pypi"
},
{
"name": "annotated-types",
"direct": false,
"version": "0.7.0",
"ecosystem": "pypi"
},
{
"name": "anthropic",
"direct": false,
"version": "0.105.2",
"ecosystem": "pypi"
},
{
"name": "anyio",
"direct": false,
"version": "4.13.0",
"ecosystem": "pypi"
},
{
"name": "arabic-reshaper",
"direct": false,
"version": "3.0.1",
"ecosystem": "pypi"
},
{
"name": "asn1crypto",
"direct": false,
"version": "1.5.1",
"ecosystem": "pypi"
},
{
"name": "attrs",
"direct": false,
"version": "26.1.0",
"ecosystem": "pypi"
},
{
"name": "audioop-lts",
"direct": false,
"version": "0.2.2",
"ecosystem": "pypi"
},
{
"name": "beautifulsoup4",
"direct": false,
"version": "4.15.0",
"ecosystem": "pypi"
},
{
"name": "certifi",
"direct": false,
"version": "2026.5.20",
"ecosystem": "pypi"
},
{
"name": "cffi",
"direct": false,
"version": "2.0.0",
"ecosystem": "pypi"
},
{
"name": "charset-normalizer",
"direct": false,
"version": "3.4.7",
"ecosystem": "pypi"
},
{
"name": "click",
"direct": false,
"version": "8.4.1",
"ecosystem": "pypi"
},
{
"name": "colorama",
"direct": false,
"version": "0.4.6",
"ecosystem": "pypi"
},
{
"name": "concurrent-log-handler",
"direct": false,
"version": "0.9.29",
"ecosystem": "pypi"
},
{
"name": "coverage",
"direct": false,
"version": "7.14.3",
"ecosystem": "pypi"
},
{
"name": "croniter",
"direct": false,
"version": "6.0.0",
"ecosystem": "pypi"
},
{
"name": "cssselect2",
"direct": false,
"version": "0.9.0",
"ecosystem": "pypi"
},
{
"name": "dill",
"direct": false,
"version": "0.3.8",
"ecosystem": "pypi"
},
{
"name": "discord-py",
"direct": false,
"version": "2.7.1",
"ecosystem": "pypi"
},
{
"name": "distro",
"direct": false,
"version": "1.9.0",
"ecosystem": "pypi"
},
{
"name": "docstring-parser",
"direct": false,
"version": "0.18.0",
"ecosystem": "pypi"
},
{
"name": "fire",
"direct": false,
"version": "0.7.1",
"ecosystem": "pypi"
},
{
"name": "frozenlist",
"direct": false,
"version": "1.8.0",
"ecosystem": "pypi"
},
{
"name": "greenlet",
"direct": false,
"version": "3.5.1",
"ecosystem": "pypi"
},
{
"name": "h11",
"direct": false,
"version": "0.16.0",
"ecosystem": "pypi"
},
{
"name": "html5lib",
"direct": false,
"version": "1.1",
"ecosystem": "pypi"
},
{
"name": "httpcore",
"direct": false,
"version": "1.0.9",
"ecosystem": "pypi"
},
{
"name": "httptools",
"direct": false,
"version": "0.8.0",
"ecosystem": "pypi"
},
{
"name": "idna",
"direct": false,
"version": "3.18",
"ecosystem": "pypi"
},
{
"name": "iniconfig",
"direct": false,
"version": "2.3.0",
"ecosystem": "pypi"
},
{
"name": "jinja2",
"direct": false,
"version": "3.1.6",
"ecosystem": "pypi"
},
{
"name": "jiter",
"direct": false,
"version": "0.15.0",
"ecosystem": "pypi"
},
{
"name": "lxml",
"direct": false,
"version": "6.1.1",
"ecosystem": "pypi"
},
{
"name": "mako",
"direct": false,
"version": "1.3.12",
"ecosystem": "pypi"
},
{
"name": "markdown-it-py",
"direct": false,
"version": "4.2.0",
"ecosystem": "pypi"
},
{
"name": "markupsafe",
"direct": false,
"version": "3.0.3",
"ecosystem": "pypi"
},
{
"name": "mdurl",
"direct": false,
"version": "0.1.2",
"ecosystem": "pypi"
},
{
"name": "multidict",
"direct": false,
"version": "6.7.1",
"ecosystem": "pypi"
},
{
"name": "openai",
"direct": false,
"version": "2.24.0",
"ecosystem": "pypi"
},
{
"name": "oscrypto",
"direct": false,
"version": "1.3.0",
"ecosystem": "pypi"
},
{
"name": "packaging",
"direct": false,
"version": "26.0",
"ecosystem": "pypi"
},
{
"name": "pathspec",
"direct": false,
"version": "1.1.1",
"ecosystem": "pypi"
},
{
"name": "pillow",
"direct": false,
"version": "12.3.0",
"ecosystem": "pypi"
},
{
"name": "pluggy",
"direct": false,
"version": "1.6.0",
"ecosystem": "pypi"
},
{
"name": "portalocker",
"direct": false,
"version": "3.2.0",
"ecosystem": "pypi"
},
{
"name": "prompt-toolkit",
"direct": false,
"version": "3.0.52",
"ecosystem": "pypi"
},
{
"name": "propcache",
"direct": false,
"version": "0.5.2",
"ecosystem": "pypi"
},
{
"name": "psutil",
"direct": false,
"version": "7.2.2",
"ecosystem": "pypi"
},
{
"name": "psycopg-binary",
"direct": false,
"version": "3.3.4",
"ecosystem": "pypi"
},
{
"name": "ptyprocess",
"direct": false,
"version": "0.7.0",
"ecosystem": "pypi"
},
{
"name": "pycparser",
"direct": false,
"version": "3.0",
"ecosystem": "pypi"
},
{
"name": "pydantic-core",
"direct": false,
"version": "2.46.4",
"ecosystem": "pypi"
},
{
"name": "pygments",
"direct": false,
"version": "2.20.0",
"ecosystem": "pypi"
},
{
"name": "pyhanko",
"direct": false,
"version": "0.35.1",
"ecosystem": "pypi"
},
{
"name": "pyhanko-certvalidator",
"direct": false,
"version": "0.31.1",
"ecosystem": "pypi"
},
{
"name": "pyjwt",
"direct": false,
"version": "2.13.0",
"ecosystem": "pypi"
},
{
"name": "pypdf",
"direct": false,
"version": "6.14.0",
"ecosystem": "pypi"
},
{
"name": "pytest",
"direct": false,
"version": "9.0.3",
"ecosystem": "pypi"
},
{
"name": "pytest-asyncio",
"direct": false,
"version": "1.4.0",
"ecosystem": "pypi"
},
{
"name": "pytest-cov",
"direct": false,
"version": "7.1.0",
"ecosystem": "pypi"
},
{
"name": "python-bidi",
"direct": false,
"version": "0.6.10",
"ecosystem": "pypi"
},
{
"name": "python-dateutil",
"direct": false,
"version": "2.9.0.post0",
"ecosystem": "pypi"
},
{
"name": "python-dotenv",
"direct": false,
"version": "1.2.2",
"ecosystem": "pypi"
},
{
"name": "pytz",
"direct": false,
"version": "2026.2",
"ecosystem": "pypi"
},
{
"name": "pywin32",
"direct": false,
"version": "312",
"ecosystem": "pypi"
},
{
"name": "pywinpty",
"direct": false,
"version": "2.0.15",
"ecosystem": "pypi"
},
{
"name": "pyyaml",
"direct": false,
"version": "6.0.3",
"ecosystem": "pypi"
},
{
"name": "reportlab",
"direct": false,
"version": "4.5.1",
"ecosystem": "pypi"
},
{
"name": "requests",
"direct": false,
"version": "2.33.0",
"ecosystem": "pypi"
},
{
"name": "rich",
"direct": false,
"version": "14.3.3",
"ecosystem": "pypi"
},
{
"name": "ruamel-yaml",
"direct": false,
"version": "0.18.17",
"ecosystem": "pypi"
},
{
"name": "ruamel-yaml-clib",
"direct": false,
"version": "0.2.15",
"ecosystem": "pypi"
},
{
"name": "shellingham",
"direct": false,
"version": "1.5.4",
"ecosystem": "pypi"
},
{
"name": "six",
"direct": false,
"version": "1.17.0",
"ecosystem": "pypi"
},
{
"name": "slack-sdk",
"direct": false,
"version": "3.42.0",
"ecosystem": "pypi"
},
{
"name": "sniffio",
"direct": false,
"version": "1.3.1",
"ecosystem": "pypi"
},
{
"name": "socksio",
"direct": false,
"version": "1.0.0",
"ecosystem": "pypi"
},
{
"name": "soupsieve",
"direct": false,
"version": "2.8.4",
"ecosystem": "pypi"
},
{
"name": "sqlalchemy",
"direct": false,
"version": "2.0.50",
"ecosystem": "pypi"
},
{
"name": "starlette",
"direct": false,
"version": "1.3.1",
"ecosystem": "pypi"
},
{
"name": "svglib",
"direct": false,
"version": "2.0.2",
"ecosystem": "pypi"
},
{
"name": "tenacity",
"direct": false,
"version": "9.1.4",
"ecosystem": "pypi"
},
{
"name": "termcolor",
"direct": false,
"version": "3.3.0",
"ecosystem": "pypi"
},
{
"name": "tinycss2",
"direct": false,
"version": "1.5.1",
"ecosystem": "pypi"
},
{
"name": "tqdm",
"direct": false,
"version": "4.67.3",
"ecosystem": "pypi"
},
{
"name": "typer",
"direct": false,
"version": "0.26.7",
"ecosystem": "pypi"
},
{
"name": "typing-extensions",
"direct": false,
"version": "4.15.0",
"ecosystem": "pypi"
},
{
"name": "typing-inspection",
"direct": false,
"version": "0.4.2",
"ecosystem": "pypi"
},
{
"name": "tzdata",
"direct": false,
"version": "2025.3",
"ecosystem": "pypi"
},
{
"name": "uritools",
"direct": false,
"version": "6.1.2",
"ecosystem": "pypi"
},
{
"name": "urllib3",
"direct": false,
"version": "2.7.0",
"ecosystem": "pypi"
},
{
"name": "uvloop",
"direct": false,
"version": "0.22.1",
"ecosystem": "pypi"
},
{
"name": "watchfiles",
"direct": false,
"version": "1.2.0",
"ecosystem": "pypi"
},
{
"name": "wcwidth",
"direct": false,
"version": "0.7.0",
"ecosystem": "pypi"
},
{
"name": "webencodings",
"direct": false,
"version": "0.5.1",
"ecosystem": "pypi"
},
{
"name": "websockets",
"direct": false,
"version": "15.0.1",
"ecosystem": "pypi"
},
{
"name": "yarl",
"direct": false,
"version": "1.24.2",
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 118,
"direct_count": 17,
"indirect_count": 101
}
},
"maintainership": {
"issues": {
"open_prs": 40,
"merged_prs": 178,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 1,
"closed_unmerged_prs": 41
},
"bus_factor": 3,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "MinuraPunchihewa",
"commits": 141,
"avatar_url": "https://avatars.githubusercontent.com/u/49385643?v=4"
},
{
"type": "User",
"login": "pnewsam",
"commits": 111,
"avatar_url": "https://avatars.githubusercontent.com/u/22651415?v=4"
},
{
"type": "User",
"login": "ea-rus",
"commits": 60,
"avatar_url": "https://avatars.githubusercontent.com/u/8502631?v=4"
},
{
"type": "User",
"login": "StpMax",
"commits": 52,
"avatar_url": "https://avatars.githubusercontent.com/u/4068133?v=4"
},
{
"type": "User",
"login": "torrmal",
"commits": 50,
"avatar_url": "https://avatars.githubusercontent.com/u/5898506?v=4"
},
{
"type": "User",
"login": "martyna-mindsdb",
"commits": 43,
"avatar_url": "https://avatars.githubusercontent.com/u/109554435?v=4"
},
{
"type": "User",
"login": "SailingSF",
"commits": 40,
"avatar_url": "https://avatars.githubusercontent.com/u/33883149?v=4"
},
{
"type": "User",
"login": "tino097",
"commits": 26,
"avatar_url": "https://avatars.githubusercontent.com/u/2707446?v=4"
},
{
"type": "User",
"login": "alecantu7",
"commits": 22,
"avatar_url": "https://avatars.githubusercontent.com/u/18293000?v=4"
},
{
"type": "User",
"login": "hamishfagg",
"commits": 18,
"avatar_url": "https://avatars.githubusercontent.com/u/895845?v=4"
}
],
"contributors_sampled": 15,
"top_contributor_share": 0.236
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"build-deploy.yml",
"cla.yml",
"dev-build-deploy.yml",
"pipeline-watchdog.yml",
"publish-staging.yml",
"publish.yml",
"staging-freeze.yml",
"staging-unfreeze.yml",
"stale-deploy.yml",
"tests-unit.yml",
"weekly-merge-staging.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 9,
"reason": "Found 12/13 approved changesets -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 18 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 1,
"reason": "dependency not pinned by hash detected -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "14 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "3fc4ed55ab4e135d109d66da6acab6b9f7007e21",
"ran_at": "2026-07-30T21:48:58Z",
"aggregate_score": 5.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-30T21:33:14Z",
"oldest_open_prs": [
{
"number": 38,
"created_at": "2026-06-12T21:14:33Z",
"last_comment_at": "2026-06-17T19:07:21Z",
"last_comment_author": "MinuraPunchihewa"
},
{
"number": 76,
"created_at": "2026-06-20T00:22:20Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 77,
"created_at": "2026-06-21T21:45:08Z",
"last_comment_at": "2026-07-09T08:48:55Z",
"last_comment_author": "hazemahmedx0"
},
{
"number": 79,
"created_at": "2026-06-22T12:44:21Z",
"last_comment_at": "2026-07-10T14:57:42Z",
"last_comment_author": "entelligence-ai-pr-reviews"
},
{
"number": 96,
"created_at": "2026-06-24T15:55:05Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 97,
"created_at": "2026-06-24T15:55:08Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 98,
"created_at": "2026-06-24T15:55:10Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 99,
"created_at": "2026-06-24T15:55:13Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 100,
"created_at": "2026-06-24T15:55:15Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 101,
"created_at": "2026-06-24T16:14:34Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 102,
"created_at": "2026-06-24T16:15:07Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 103,
"created_at": "2026-06-24T16:20:43Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 104,
"created_at": "2026-06-24T16:23:25Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 105,
"created_at": "2026-06-24T16:24:28Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 106,
"created_at": "2026-06-24T16:29:38Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 107,
"created_at": "2026-06-24T16:52:55Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 108,
"created_at": "2026-06-24T17:09:34Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 130,
"created_at": "2026-06-26T17:13:48Z",
"last_comment_at": "2026-07-08T16:19:20Z",
"last_comment_author": "github-actions"
},
{
"number": 155,
"created_at": "2026-07-03T16:06:03Z",
"last_comment_at": "2026-07-06T11:09:29Z",
"last_comment_author": "tino097"
},
{
"number": 156,
"created_at": "2026-07-04T02:46:59Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-30T21:45:08Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/mindsdb/cowork-server",
"host": "github.com",
"name": "cowork-server",
"owner": "mindsdb"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": "High-Risk Jurisdiction Policy applies a 50% multiplier to weighted overall health and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "jurisdiction_overall_adjustment",
"params": {
"cap": 49,
"pct": 50
}
}
],
"value": 32,
"inputs": {
"security": 35,
"vitality": 77,
"community": 38,
"governance": 85,
"engineering": 77,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 50,
"weighted_overall_before_jurisdiction": 65,
"overall_after_jurisdiction_multiplier": 32
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 77,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 62,
"inputs": {
"commits_last_year": 601,
"human_commit_share": 0.99,
"days_since_last_push": 0,
"active_weeks_last_year": 11
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "11/52 weeks with commits",
"points": 7.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 11
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "601 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 601
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 54,
"latest_release_tag": "v0.26.7.30.1rc5",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 0.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "54 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 54
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 38,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"forks": 5,
"stars": 4,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "4 stars",
"points": 7.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 4
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "5 forks",
"points": 5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 5
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (AGPL-3.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "AGPL-3.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 61,
"inputs": {
"packages": [
"cowork-server"
],
"dependents": null,
"ecosystems": "pypi",
"total_downloads": null,
"monthly_downloads": 4576
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "4,576 downloads/month across pypi",
"points": 48.8,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 4576,
"ecosystems": "pypi"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "excellent",
"name": "Sustainability & Governance",
"value": 85,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "good",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"bus_factor": 3,
"contributors_sampled": 15,
"top_contributor_share": 0.236
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "3 contributor(s) cover half of all commits",
"points": 36,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 3
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 24% of commits",
"points": 17.2,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 24
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "15 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 15
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 18 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 91,
"inputs": {
"merged_prs": 178,
"open_issues": 0,
"closed_issues": 1,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 41
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "178/219 decided PRs merged",
"points": 31.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 178,
"decided": 219
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 12/13 approved changesets -- score normalized to 9",
"points": 13.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 78,
"inputs": {
"followers": 1416,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "mindsdb",
"public_repos": 57,
"account_age_days": 3271
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1,416 followers of mindsdb",
"points": 22.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1416,
"login": "mindsdb"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "57 public repos, account ~8 yr old",
"points": 24.8,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 57
}
},
{
"code": "account_age_years",
"params": {
"years": 8
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"cowork-server"
],
"ecosystems": "pypi",
"any_deprecated": false,
"min_days_since_publish": 3
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on pypi",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "pypi"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 3 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 3
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "51 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 51
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 77,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "11 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 11
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": "https://mindshub.ai",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://mindshub.ai",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 35,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Signed-Releases. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 50% multiplier to Security posture and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "jurisdiction_posture_adjustment",
"params": {
"cap": 49,
"pct": 50
}
}
],
"value": 28,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 5.5,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 50,
"security_posture_after_multiplier": 28,
"security_posture_before_jurisdiction": 55
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 12/13 approved changesets -- score normalized to 9",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 18 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 1",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "14 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "moderate",
"name": "Dependency advisories",
"note": "Matched the pypi:cowork-server@0.26.7.27.3 runtime dependency closure — what installing the published package pulls in — 103 packages. Reachability is not analyzed.",
"notes": [
{
"code": "advisories_scope_published",
"params": {
"package": "pypi:cowork-server@0.26.7.27.3",
"assessed": 103
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 61,
"inputs": {
"source": "osv",
"advisories": 30,
"affected_packages": 2,
"assessed_packages": 103,
"unassessed_packages": 0,
"affected_by_severity": "critical 1, high 1",
"direct_affected_packages": 1
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "1 affected: hermes-agent 0.17.0 (high 7.3)",
"points": 14.6,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "hermes-agent 0.17.0 (high 7.3)"
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "1 affected: pillow 12.2.0 (critical 9.1)",
"points": 6.8,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "pillow 12.2.0 (critical 9.1)"
}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory has been public longer than 90 days",
"points": 40,
"status": "met",
"details": [
{
"code": "advisories_none_stale",
"params": {
"days": 90
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 103,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "moderate",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 50,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": true,
"exposures": [
{
"role": "top_contributor",
"count": 2,
"country": "Russia"
}
],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 12
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "Russia: top_contributor (2)",
"points": 50,
"status": "partial",
"details": [
{
"code": "jurisdiction_exposure",
"params": {
"role": "top_contributor",
"count": 2,
"country": "Russia"
}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 50,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 33,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.616,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "61 of 99 human commits state their intent (structured subject or explanatory body)",
"points": 32.9,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 61,
"sampled": 99
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"uv.lock"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.25,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "25 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 25,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 1",
"points": 1,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 55763,
"source_files_sampled": 234,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/234 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 234,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-30T21:49:23.960358Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/m/mindsdb/cowork-server.svg",
"full_name": "mindsdb/cowork-server",
"license_state": "standard",
"license_spdx": "AGPL-3.0"
}Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
Cómo se sitúa un resultado dentro del registro general: estadísticas agregadas — PyPI.