TypeScriptMIT★ 274 stars⑂ 34 forkssince May 2026View on GitHub ↗
XTraceAI/memory-sdk-ts holds a health index of 47 out of 100, placing it in the At risk band. It scores highest on Vitality (70/100) and lowest on Security (17/100). It was last updated 5 days ago. A single contributor accounts for most of its recent work.
47
overall / 100
At risk
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
47
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Excluded from scoring (no data or not applicable): dangerous_workflow, packaging, pinned_dependencies, signed_releases, token_permissions. Remaining weights renormalized.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
deps.dev does not index npm:@xtraceai/memory@0.5.0; advisories assessed against the repository dependency graph instead
More detail
Star and fork history 0 ★ / 34 ⇿
0Stars
34Forks
2Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 1Patch 1
OpenSSF Scorecard 1.6 / 10
1.6aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-23 06:40 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 2582,
"has_wiki": true,
"homepage": null,
"languages": {
"TypeScript": 249347
},
"pushed_at": "2026-07-17T21:38:28Z",
"created_at": "2026-05-16T01:26:20Z",
"owner_type": "Organization",
"updated_at": "2026-07-22T06:47:50Z",
"description": "TypeScript SDK for the xtrace memory API",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": null,
"name": null,
"type": "Organization",
"login": "XTraceAI",
"company": null,
"location": null,
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/170989492?v=4",
"created_at": "2024-05-28T00:32:34Z",
"is_verified": null,
"public_repos": 6,
"account_age_days": 786
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-07-17T21:37:44Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-07-10T00:37:21Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-24T02:31:29Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-06-01T21:25:34Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-05-31T18:54:30Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-05-27T23:05:22Z"
}
],
"recent_commits": [
{
"oid": "cda5165a021374ae716662d555b53667e6325820",
"body": null,
"is_bot": false,
"headline": "release: v0.5.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-17T21:37:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82f1c2e3da2001f73ff7061f0f6b3e5e0dc13823",
"body": "feat(ai-sdk): withDirectiveRecall — procedural-memory recall around tools",
"is_bot": false,
"headline": "Merge pull request #15 from XTraceAI/fm-feat/ai-sdk-directive-middleware",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T18:43:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4927a7dbf1ad76b1a6c187a92b94be541679f0e2",
"body": "[medium] the reservation cleanup only ran on the success paths; a throwing\noriginalExecute propagated correctly but skipped release(), leaking its\nreserved directive ids into the shared fired set forever — silent loss on\nany later successful call. Wrap the tool call: on throw, settle the\nin-flight r\n[…]\nded), release all, re-throw.\nNew test asserts the error propagates AND the directive resurfaces next call.\n\n65 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): release reserved ids when a tool throws (review)",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:26:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d34e3890d27ea9bcd7c9fb370dd755c8a0aa3346",
"body": "…review)\n\n[low] fired is shared across wrapped tools, and the check (!fired.has) and\nact (add) spanned the tool-execution await — two parallel tool calls (the\nAI SDK runs tools concurrently) could both select the same directive and\ndouble-deliver. Move to optimistic reservation: recall reserves ids \n[…]\niver() no longer owns fired. New concurrency test asserts\nexactly-once delivery across two parallel calls.\n\n64 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): close the fired-once race across concurrent tool calls (…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:20:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e74f2a0203a8d7825db3455184207e13bebc2c91",
"body": "…reactive priority (review)\n\nThree more review findings on the directive middleware:\n\n- [high] a directive recalled at an undeliverable moment (array/number\n result, no observer) was still added to the fired set — silently lost,\n and blocked from a later injectable call, contradicting the 'keeps i\n[…]\now take budget priority.\n\n3 new tests (undeliverable keeps its chance, Date not spread, reactive\npriority); 63 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): correct fired-once accounting, non-plain-object safety, …",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:13:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1cd99de00d1c5cdc4a3db8f59a2d62e6671f0d7e",
"body": "…e exact tag (review follow-up)\n\nThe tag-specific neutralize regex missed whitespace/attribute variants\n(</team-directives >, <team-directives foo=x>) that a fuzzy model parser\nwould still honor as a block close. Escape the whole angle-bracket class in\ndirective text instead — provably complete, and the model reads </>\nas literal characters. Test now asserts the whitespace + attribute variants\nare defanged too.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): escape all angle brackets in directive text, not just th…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:06:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "72f8de70d95b377ba1a29d95777f14d8f76c5662",
"body": "…er, redaction, reactive FP\n\nFour MemHub-review findings on the directive middleware:\n\n- [medium] prompt-injection sink: directive text is teammate-authored\n (untrusted) and was appended verbatim inside a <team-directives> block a\n malicious directive could break out of. Neutralize <team-directive\n[…]\n can supply a precise check.\n\n4 new tests (breakout defang, no-clobber, redaction, isFailure suppression);\n60 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): harden withDirectiveRecall per review — injection, clobb…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:00:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0db99173f7cda53a1ce1bf449e3c2a3e43592ea0",
"body": "…ools\n\nWrap any AI SDK tools object so every tool call fires the symbol tripwire:\npre-tool recall runs CONCURRENTLY with execute (never delays the tool), a\nreactive second recall fires when a string result looks like a failure\n(the error text names the true cause — identifiers the args never showed)\n[…]\ntility\nreplay. 7 tests: wire contract, dedup, object/array injection shapes,\nreactive pass, fail-open (error + timeout), no-execute passthrough.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(ai-sdk): withDirectiveRecall — procedural-memory recall around t…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T01:55:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "32421bf9337893e316968d31d837ac9922e76d37",
"body": "feat(directives): memories.trigger() + agentic/namespace ingest",
"is_bot": false,
"headline": "Merge pull request #14 from XTraceAI/fm-feat/directive-trigger-surface",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T23:29:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "caf400ebd2416f0caa502483a8a999560c4ec21b",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: satisfy noUncheckedIndexedAccess in trigger tests",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T01:46:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "016f878a1aca1d31e59bb3fa3a44dba80577e279",
"body": "… procedural-memory surface\n\n- Vendor the fixed staging OpenAPI spec (DirectiveDetails was a dangling\n $ref that hard-failed openapi-typescript — fixed server-side in\n VecDB-Backend #153) and regenerate src/generated/types.ts: first regen\n since the directive/agentic surface shipped.\n- types: les\n[…]\nall recall,\n body passed through verbatim (server defaults stay in charge).\n- tests: trigger wire contract + directive-row typing (49 passing).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(directives): memories.trigger() + agentic/namespace ingest — the…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T01:46:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ea935918c247783daa680f010eda41778607398",
"body": null,
"is_bot": false,
"headline": "0.4.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-10T00:37:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9576b0e5b0ddc1f61c3b831bb31367b59a2bf31c",
"body": "feat: support prompt-less (catch-all) groups",
"is_bot": false,
"headline": "Merge pull request #13 from XTraceAI/claude/jolly-williamson-a11418",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-10T00:35:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dae1cece3cc0476c97e0a6d4d64cb52677c5b913",
"body": "examples/groups-smoke.ts (npm run smoke:groups) walks the whole\ncatch-all surface against a live API: prompted create regression,\nprompt-less create -> prompt null, empty-string 422s on create and\nPATCH, null round-trip through get/list, PATCH converting a catch-all\nto prompted, ingest tagging a sha\n[…]\nonal memory stays untagged (classifier-dependent, so\nsoft-fail), and archived ids echoing in ignored_group_ids. Cleans up\neverything it creates.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: add staging smoke script for catch-all groups",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-08T01:58:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "80f0429296ef2e66a3e8f76c0c8a67dd896a1e24",
"body": "VecDB-Backend now allows creating a group without a prompt\n(GroupCreateRequest.required == [\"name\"] in the regenerated OpenAPI\nspec). A prompt-less group is a catch-all: the ingest classifier tags\nit on every extracted memory it judges shareable, with no per-group\nmatching. Personal memories are nev\n[…]\n can never\n be removed via update\n- Add a create-without-prompt test asserting the request body omits\n the key and the null prompt round-trips\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: support prompt-less (catch-all) groups",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-08T00:50:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "52e831fb4cb11c61d6c33c6283ddc4aaf2aaaf0d",
"body": "feat: webhooks support (client.webhooks + signature verification)",
"is_bot": false,
"headline": "Merge pull request #10 from XTraceAI/feat/webhooks",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:31:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d490de2ba8e31c51e96a7422b7af9b581def0975",
"body": "Codex review (#10): the test sign() helper used the gated\nglobalThis.crypto, so on stock Node 18 the suite ReferenceErrors before\nany assertion. Use node:crypto.webcrypto in the signer so tests cover\nthe advertised node >=18 range (and so the global-absent test can null\nglobalThis.crypto without breaking signing).",
"is_bot": false,
"headline": "test: sign webhook fixtures with node:crypto (Node 18 compat)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:23:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfc3d942d88cef0f6b5829b1610d4965a20fd0b6",
"body": "Codex review (#10): verifyWebhookSignature read globalThis.crypto.subtle,\nwhich on Node 18.x is gated behind --experimental-global-webcrypto — so\nit threw before verifying on stock Node 18 even though the package\nadvertises node >=18.\n\nResolve SubtleCrypto across runtimes: prefer globalThis.crypto.s\n[…]\nzily import node:crypto.webcrypto\n(always present on Node). The import is dynamic + guarded so non-Node\nbundles never pull in node:crypto. Adds a test simulating Node 18\n(globalThis.crypto undefined).",
"is_bot": false,
"headline": "fix: webhook signature verification works on Node 18",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:01:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "caa8de236b05a2f9d38d10580a5a596e38c6b4a2",
"body": "Codex review (#10): at-most-once is misleading given retries — a lost\n2xx after the handler ran triggers a duplicate. State deliveries may be\ndropped or duplicated; dedupe on job_id.",
"is_bot": false,
"headline": "docs: correct webhook delivery semantics in README",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T01:51:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12cbadbfed95485e62b864fc5426345298745bc6",
"body": "Add first-class support for ingestion-completion webhooks:\n\n- client.webhooks.set() / get() / delete() for the per-org /v1/webhooks\n config (set() takes { rotateSecret } to mint a fresh signing secret).\n- verifyWebhookSignature() / parseWebhookEvent() — HMAC-SHA256 over the\n raw body via Web Crypt\n[…]\n,\n WebhookMemoryRef.\n- README \"Webhooks\" section + raw-body verification example.\n\nMinor bump → 0.3.0. 45 tests pass; typecheck + build clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: webhooks support (client.webhooks + signature verification)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T01:37:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0737c6ecd0a88f47d6d54ba4eef5da3df214d76a",
"body": null,
"is_bot": false,
"headline": "change from docs.mem to docs",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-05T16:51:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fa0d3d0f51026ceb411ef192f558d1d4fb7bf4f",
"body": null,
"is_bot": false,
"headline": "release: v0.2.1",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:25:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9cb76798dbedc38f7d04e165942cc1cbe9a42d9e",
"body": "feat(sdk): generalize recall() to union arbitrary scope pools",
"is_bot": false,
"headline": "Merge pull request #8 from XTraceAI/tc/recall-pools",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:15:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "005dcf8ac2b980f6398616d717d801d1c300c31d",
"body": "Addresses Codex P2 on #8: a JS caller (no compiler) passing a bare string, e.g.\npools: [{ group_ids: \"grp_x\" }], slipped past validation because strings have\n.length, then forwarded a non-array group_ids to /v1/memories/search. recall()\nnow rejects any non-array group_ids with a clear error. TS callers are already\nprotected by the string[] type; this guards the untyped path.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): reject a non-array group_ids in a recall pool",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:05:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "685896b713d588ce7e7250c707f3ca568e0a7d39",
"body": "Addresses Codex P2 on #8: a dynamically-built pool like { user_id, group_ids: [] }\npassed validation (user_id is an axis) but then spread group_ids: [] into the\nsearch — an empty any-of that AND-narrows to nothing server-side, silently\nturning a personal recall into a match-nothing scoped search. re\n[…]\nains) and never forwarded; a\npool left with no real axis still throws. Unifies the empty-array and zero-axis\ncases under one rule.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): strip empty axes from recall pools before search",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:57:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "33d19fd3d8ca4147b1c696baac1ecae7bc0a9162",
"body": "Addresses Codex P2 on #8: the round-1 multi-user fix attributed any non-viewer\nrow 'everywhere', but viewerUserId is optional — so a standalone\nrenderMemoriesPrompt() on one user's personal rows (which always carry user_id)\nwith no viewer rendered every line as 'alice: ...', changing the exported\nre\n[…]\n as before. Adds a standalone test (real rows have user_id, the\nfixtures defaulted user_id:null so this regression was invisible).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): gate personal-row author attribution on a known viewer",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:49:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3539b59f17b4b23f50da2b5e8cb80fe2d783b592",
"body": "…ng them\n\nAddresses Codex P2 on #8: the pool filter silently removed any pool with no\nscope axis, so a typo'd `group_id` or an empty `group_ids: []` alongside a valid\npool would make recall() return a plausible-but-incomplete result with the\nrequested scope quietly missing. Now each pool is validate\n[…]\n conditionally must omit it\nexplicitly. ai-sdk tool already normalizes empty groups to undefined, so it\nnever trips the new guard.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): recall() rejects malformed pools instead of silently droppi…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:42:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "906f8b2452e3aa9711031477b25012891fa9fdec",
"body": "Addresses Codex P2 on #8: the anti-bleed filter was gated on pool.user_id, so a\ndeliberately-scoped pool like { user_id, app_id } still got its rows dropped when\nthey carried a non-requested group tag — violating the AND-within-pool contract\n(the axes already narrow it; the caller asked for exactly \n[…]\nly to a PLAIN { user_id } pool (no app_id/agent_id/group_ids);\nany extra axis is treated as a deliberate scope and returned as-is.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): bleed-filter only the plain personal pool, not every user pool",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:35:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "91460e50aead1afc3fd971d2a60540b22307c960",
"body": "… memories\n\nAddresses Codex P2 on #8: with pools: [{user_id}, {app_id:'product-kb'}],\nthe KB rows have no group, so they fell into the Personal / 'memories about\nthe user' section — framing a doc as the user's own fact. recall() now labels\nrows from a non-user, non-group pool with their app_id/agent\n[…]\nhose under that source label (no author attribution). User-pool rows\ntake precedence (a row also from a user pool stays Personal).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): section app/agent-pool rows under their source, not as user…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:03:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ed13ffc9331850d4254df4c38256e3b303a297ea",
"body": "- Cross-group anti-bleed filter is now USER-pool-only. It was applied to every\n pool without group_ids, so combining an app/agent pool with a group pool\n silently dropped the app pool's rows that happened to carry an unrelated group\n tag (e.g. a product-KB doc tagged grp_docs, recalled alongside \n[…]\ndocs/types all pools-only,\nno current backward-compat claim). The bots flagged the superseded first commit.\n\n+2 tests (app-pool preserved, second-user attribution) → 30 total. typecheck + build green.",
"is_bot": false,
"headline": "fix(sdk): address #8 review — recall() pool edge cases",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:48:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f56249801b7aee5bc37e4872e22b84c39456c1be",
"body": null,
"is_bot": false,
"headline": "docs(releasing): example version 0.2.1 (next release)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:40:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97b0e35f38d9629ff35a130642a8da48e1a5265a",
"body": null,
"is_bot": false,
"headline": "docs(readme): recall() example uses pools",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:35:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc49b3aa7ea6f954b13c9b31ebc3ca4c580adb76",
"body": "…elds)\n\nPer design review: the convenience form mixed semantics confusingly — it OR'd\nuser_id vs group_ids but AND-narrowed agent_id/app_id, an implicit shape that's\nhard to reason about. Make recall a single, explicit rule instead:\n\n recall({ query, pools: [{ user_id }, { group_ids }] }) // ax\n[…]\n to pools-only. 28 pass, typecheck + build green.\n\nBREAKING CHANGE: recall({ user_id, group_ids }) no longer works; pass\n`pools: [{ user_id }, { group_ids }]`. (Only affects 0.2.0, released days ago.)",
"is_bot": false,
"headline": "refactor(sdk)!: recall() is pools-only (drop the convenience union fi…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:30:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "efb0d2f96a2ec9ace5f3494d599ded4ad952c90d",
"body": "recall() previously hardcoded the union to `user_id OR group_ids`, which made\nthe union mechanism look group-specific and left other blends (e.g. personal +\na global app_id KB) as a manual two-search merge. The union is general, so\nrecall now takes an explicit `pools` list:\n\n recall({ query, pool\n[…]\netry where groups got a one-liner but app_id\nneeded concurrent manual searches.\n\nTests: +4 (explicit-pool union, validation, cross-pool bleed filter, legacy\nsugar) → 29 total. typecheck + build green.",
"is_bot": false,
"headline": "feat(sdk): generalize recall() to union arbitrary scope pools",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:14:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3eb4ff53b80174b6cf18e46862b903243623b600",
"body": "docs: add RELEASING.md (manual npm publish flow)",
"is_bot": false,
"headline": "Merge pull request #7 from XTraceAI/tc/releasing-doc",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:15:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94024e4c4f675a5b99adc30c7ce3811a17b16805",
"body": null,
"is_bot": false,
"headline": "docs(releasing): verify npm whoami is tristangc before publishing",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "124bee96927799a47c70244a9c3d28b5e14e9918",
"body": "… 0.2.0 run",
"is_bot": false,
"headline": "docs(releasing): publish before tagging; add troubleshooting from the…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:04:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5957a9dfc1d3a8e38ca0cbda1ef0d8ff92453d6",
"body": null,
"is_bot": false,
"headline": "Merge main (0.2.0 release commit)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c389cf965f9a517fa3b1db9fa9d1a3770252d0e0",
"body": null,
"is_bot": false,
"headline": "release: v0.2.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:54:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01285b22c665e822618b69f727b031b19f34a9ea",
"body": null,
"is_bot": false,
"headline": "Merge main (#6) into releasing-doc",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:30:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4ffe319ac38ca7704efa5d8dc95a5581c24e484",
"body": null,
"is_bot": false,
"headline": "docs: add RELEASING.md (manual npm publish flow)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:28:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c165eb63d2fd11b7cd1b79e45f1012c70980edac",
"body": "feat(sdk): recall() (personal + shared) + sync SDK to deployed API",
"is_bot": false,
"headline": "Merge pull request #6 from XTraceAI/tc/sdk-recall-and-sync",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T17:38:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "43f614857f5b40616c9f2619253429088d3353bd",
"body": "Two genuinely-new review findings on the prior commit (the others re-flagged\nby the bots were already fixed there):\n\n- limit=1 no longer always favors the personal scope. The round-robin took\n personal first every round, so `recall({ user_id, group_ids, limit: 1 })`\n dropped the shared scope even \n[…]\nall to untagged memories\".) This\n complements the earlier render-side fix (sections only requested groups).\n\nTests: +2 (limit-1 global-max, other-group exclusion) → 25 total. typecheck +\nbuild green.",
"is_bot": false,
"headline": "fix(sdk): recall() limit=1 fairness + drop other-group bleed (round 2)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T16:53:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "32f150d2fe051738508732d95349a08466a8823d",
"body": "Four issues flagged by Codex/Cursor on recall() + the ai-sdk tools:\n\n- save_memory now forwards the group scope. memoryTools normalizes the group\n scope once (groupIds) and BOTH search_memory (via recall) and save_memory\n (via ingest group_ids) use it, so model-saved facts can be group-tagged and\n\n[…]\nedGroupIds keeps the prior \"section every tag\" behavior (back-compat).\n\nTests: +7 (fair-merge, requested-group bucketing, multi-tag, tool save/gate) —\n23 total across 3 files. typecheck + build green.",
"is_bot": false,
"headline": "fix(sdk): address #6 review — recall group-scope correctness",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T08:15:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c83ce46a8691759c91bc7b189f3e761128d0de01",
"body": "Shared (group) lines now carry their author so a multi-traveler group is\nunambiguous: \"<user_id>: <fact>\", or \"you: <fact>\" when it's the caller's own\nrow (recall passes the caller as viewerUserId). Personal lines stay\nunattributed (always the caller). Uses m.user_id — which a cross-user group\nread \n[…]\nead (alice→\"you\", bob→\"bob-…\"). 17 tests,\ntypecheck + build green.\n\nNote: shows the raw user_id; human display names would be a phase-2 concern\n(server template / widened payload), tracked in ENG-108.",
"is_bot": false,
"headline": "feat(sdk): attribute group memories to their author in recall() prompt",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T08:02:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fdfac348c6ec1244a0c49b21d4ad76bc5e294ed7",
"body": "…able format)\n\nExtract the prompt format into a JSON-serializable PromptTemplate\n(DEFAULT_PROMPT_TEMPLATE) that drives renderMemoriesPrompt: header,\npersonal/unknown-group labels, per-type tags, and category/date toggles.\nDefault output is unchanged.\n\nSets up phase 2: a future API endpoint can retur\n[…]\n, full\nartifact bodies, or char-budgeting without also widening the search payload.\n\nExports PromptTemplate + DEFAULT_PROMPT_TEMPLATE. 16 tests (added a\ncustom-template case); typecheck + build green.",
"is_bot": false,
"headline": "refactor(sdk): make recall() prompt template-driven (phase 1 of swapp…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:46:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "070cbfd23a74f336f17d331aa3b31c173e417c8c",
"body": "…tags)\n\nFacts still render as plain statements; artifacts and episodes now get a\ntype tag and their title — \"[document] <title>: <text>\" and\n\"[conversation] <title>: <text>\" — so the agent can tell a stored document\nor a past conversation from a stated fact. Uses only m.type / m.details\nalready on e\n[…]\nparity\nwould need a backend assemble-over-merged-set endpoint, which adds a\nsequential round-trip after the fan-out — declined here to keep recall fast.\n\nTest added; 15 total, typecheck + build green.",
"is_bot": false,
"headline": "feat(sdk): light type-awareness in recall() render (artifact/episode …",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:40:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e4db7ced321adae7747553f96ea6fae50ebdf771",
"body": "Memory rows carry only opaque group_ids, so the prompt couldn't name the\ngroup. recall() now resolves group id → name from the registry (one\nGET /v1/groups, fired in parallel with the searches — ~free latency,\nbest-effort: a lookup failure falls back to id labels rather than failing\nthe call). rende\n[…]\nacts under its own name.\n\nTests: name-resolution + per-group sectioning + id fallback (14 total).\nValidated live on staging — shared section headed by the group name,\nopaque id absent from the prompt.",
"is_bot": false,
"headline": "feat(sdk): recall() labels shared sections by group NAME",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:29:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7da2318468fa82712acab75342634779b041eb01",
"body": "…egories + date\n\nrenderMemoriesPrompt now groups the merged memories into \"Personal\" and\n\"Shared (group)\" sections (by each row's group_ids — tagged = shared,\nuntagged = personal), falling back to a flat list when only one kind is\npresent. Each bullet carries the memory's categories (`[...]`) and re\n[…]\nhile staying fully deterministic and client-side (no LLM, no backend\ncall). Still overridable via `recall(..., { render })`.\n\nAdded a grouping test; updated the flat-list test for the new line format.",
"is_bot": false,
"headline": "feat(sdk): richer recall() prompt — split personal vs shared, add cat…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:15:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7da7a9c443ec8a66a356678a29ff8a8d9872a86",
"body": "…yed API\n\n## recall() — personal + shared (group) read in one call\n\nSearch scoping is AND-everything (\"scope by what you pass\"), so a combined\n\"my own preferences AND the trip's shared facts\" read can't be one request\n(`{user_id, group_ids}` intersects). `client.memories.recall()` rebuilds that\nunio\n[…]\negenerated via `npm run gen:types`) is still\nstale; left out of scope — it's a reference artifact, not part of the public surface.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add recall() (personal + shared) and sync SDK to the deplo…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:00:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fd9978d4ef5e4f4bb0381c78a7b0b2d409898077",
"body": "update readme",
"is_bot": false,
"headline": "Merge pull request #5 from XTraceAI/chore/update-readme",
"author_name": "Liwen O.",
"author_login": "liwenXtrace",
"committed_at": "2026-05-28T20:22:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d4aeac0be566bcf843196856223fdaf2a25e373",
"body": null,
"is_bot": false,
"headline": "update readme",
"author_name": "Sebastian Gonzalez",
"author_login": "sgonz-xtrace",
"committed_at": "2026-05-28T19:58:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9eb8ebb70ec58aabf0d0813bcb3fc62d1a53039",
"body": "Flip the SDK-side default in memories.ingest() so the artifact\nextraction stage runs unless callers explicitly pass\n`extract_artifacts: false`. The server still treats an absent key\nas off, so the SDK now sends the resolved value on every request.\n\nThe ai-sdk wrappers (auto-ingest middleware in prov\n[…]\n message pairs and\none-line facts rarely benefit from the artifact stage and it is the\nmost expensive extraction step.\n\nBumps version to 0.1.1.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: default extract_artifacts to true for direct ingest",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-27T23:05:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ed0a44319a8a323c3e3ee5f8007793ef482b36b",
"body": "Two patterns ship under @xtraceai/memory/ai-sdk:\n\n- createXtraceMemory(): wraps any LanguageModel so it auto-searches\n memory before each call and auto-ingests the turn after. Mem0's\n provider pattern — set it and forget it.\n\n- memoryTools(): exposes search_memory and save_memory as tools the\n LL\n[…]\ns where the model decides\n when to read / write memory.\n\nai and zod are optional peer dependencies; users who only import\nthe core SDK don't pull them in. Bumps version to 0.1.0 (new public\nsurface).",
"is_bot": false,
"headline": "feat(ai-sdk): add Vercel AI SDK integration at /ai-sdk subpath",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-22T21:29:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "94b0f91704f3690a4753c4aa19a256295d04b54d",
"body": null,
"is_bot": false,
"headline": "chore: drop mem0 from package keywords",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-22T01:27:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65ece6d0f47cb575d2c942781078749b299abca5",
"body": null,
"is_bot": false,
"headline": "docs: point at app.xtrace.ai for credentials + docs link",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-21T21:07:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "98639fa66f23b5f8e32c7b16036ba96c13915618",
"body": "- Default baseUrl now points to https://api.production.xtrace.ai\n (was api.xtrace.ai, which returns 404)\n- Re-apply scope rename @xtrace → @xtraceai that was lost in reset\n- Bump to 0.0.2",
"is_bot": false,
"headline": "fix: correct production base URL to api.production.xtrace.ai",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-20T23:56:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d866fe6a0b7fc167ad2215cb15021b95ba4ea10",
"body": "Tests will land in a follow-up PR. The --passWithNoTests flag\nkeeps prepublishOnly from blocking the squat release.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: bump to 0.0.1 + allow empty test suite for publish",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:28:12Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "428c38aa06236463a9fb7983f2e7f05b7e931290",
"body": "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: use canonical XTraceAI casing in repo URLs",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:26:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b7fb885a1ce1ace44f91c56fc9f56ccfd83759b9",
"body": "Hand-written SDK targeting the v0.1 xtrace memory API. Covers\ningest (async + sync via wait=true), job polling with exponential\nbackoff, list (cursor-paginated async iterator), get, update,\ndelete, search, and the retrieve sugar for context_prompt.\n\nTypes match the live staging /openapi.json (regene\n[…]\neLimited, Unprocessable, etc.) keyed on the API's stable\nerror.code strings.\n\nEnd-to-end smoke test against staging passes (examples/smoke.ts).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: initial @xtrace/memory TypeScript SDK",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:23:30Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 6,
"commits_last_year": 60,
"latest_release_at": "2026-07-17T21:37:44Z",
"latest_release_tag": "v0.5.0",
"releases_from_tags": true,
"days_since_last_push": 5,
"active_weeks_last_year": 8,
"days_since_latest_release": 5,
"mean_days_between_releases": 10.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@xtraceai/memory",
"exists": true,
"license": "MIT",
"keywords": [
"xtrace",
"memory",
"sdk",
"ai",
"agent",
"ai-sdk",
"vercel-ai-sdk"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@xtraceai/memory",
"is_deprecated": false,
"latest_version": "0.5.0",
"repository_url": "https://github.com/XTraceAI/memory-sdk-ts",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 5024,
"first_published_at": "2026-05-16T01:42:32.983000Z",
"latest_published_at": "2026-07-17T21:38:18.141000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 34,
"stars": 274,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2026-05-28",
"count": 19
},
{
"date": "2026-05-29",
"count": 1
},
{
"date": "2026-05-30",
"count": 1
},
{
"date": "2026-05-31",
"count": 2
},
{
"date": "2026-06-02",
"count": 1
},
{
"date": "2026-06-04",
"count": 2
},
{
"date": "2026-06-05",
"count": 3
},
{
"date": "2026-06-06",
"count": 4
},
{
"date": "2026-06-12",
"count": 1
}
],
"complete": true,
"collected": 34,
"total_forks": 34
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 23316,
"source_files_sampled": 22,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 10,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 4
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "tristan-xtrace",
"commits": 48,
"avatar_url": "https://avatars.githubusercontent.com/u/276746865?v=4"
},
{
"type": "User",
"login": "felix-xtrace",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/170989441?v=4"
},
{
"type": "User",
"login": "liwenXtrace",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/170989218?v=4"
},
{
"type": "User",
"login": "sgonz-xtrace",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/223328257?v=4"
}
],
"contributors_sampled": 4,
"top_contributor_share": 0.8
},
"quality_signals": {
"has_ci": false,
"has_tests": true,
"ci_workflows": [],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/9 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": null,
"reason": "no dependencies found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 1,
"reason": "9 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "cda5165a021374ae716662d555b53667e6325820",
"ran_at": "2026-07-23T06:40:23Z",
"aggregate_score": 1.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-17T21:37:56Z",
"oldest_open_prs": [
{
"number": 9,
"created_at": "2026-06-15T05:39:10Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-15T18:43:23Z",
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/XTraceAI/memory-sdk-ts",
"host": "github.com",
"name": "memory-sdk-ts",
"owner": "XTraceAI"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 47,
"inputs": {
"security": 17,
"vitality": 70,
"community": 54,
"governance": 51,
"engineering": 34
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 70,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"commits_last_year": 60,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 8
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "8/52 weeks with commits",
"points": 5.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 8
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "60 commits in the last year",
"points": 16,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 60
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 6,
"latest_release_tag": "v0.5.0",
"releases_from_tags": true,
"days_since_latest_release": 5,
"mean_days_between_releases": 10.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "6 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 6
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~10.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 10.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 54,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"forks": 34,
"stars": 274,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "274 stars",
"points": 39.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 274
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "34 forks",
"points": 12.7,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 34
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 62,
"inputs": {
"packages": [
"@xtraceai/memory"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 5024
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "5,024 downloads/month across npm",
"points": 49.3,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 5024,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 51,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 4,
"top_contributor_share": 0.8
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 80% of commits",
"points": 4.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 80
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "4 contributors",
"points": 5.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 4
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 51,
"inputs": {
"merged_prs": 10,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 4
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "10/14 decided PRs merged",
"points": 27.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 10,
"decided": 14
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"followers": 3,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "XTraceAI",
"public_repos": 6,
"account_age_days": 786
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of XTraceAI",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "XTraceAI"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "6 public repos, account ~2 yr old",
"points": 10.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 6
}
},
{
"code": "account_age_years",
"params": {
"years": 2
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@xtraceai/memory"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "9 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 9
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 34,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "critical",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_ci": false,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 17,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dangerous_workflow",
"packaging",
"pinned_dependencies",
"signed_releases",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 17,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 13,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 5,
"scorecard_aggregate": 1.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "9 existing vulnerabilities detected",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 57,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.933,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "56 of 60 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 56,
"sampled": 60
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_pinned_dependencies"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.367,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "22 of the last 60 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 22,
"sampled": 60
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 23316,
"source_files_sampled": 22,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/22 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 22,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@xtraceai/memory@0.5.0; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-23T06:40:37.908397Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/x/XTraceAI/memory-sdk-ts.svg",
"full_name": "XTraceAI/memory-sdk-ts",
"license_state": "standard",
"license_spdx": "MIT"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with XTraceAI/memory-sdk-ts. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
