Public recordCritical
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-28 03:32 UTC
kfastov / tgcli
Telegram user console client and archiver
kfastov/tgcli holds a health index of 11 out of 100, placing it in the Critical band. It scores highest on Vitality (79/100) and lowest on Security (24/100). It was last updated 10 days ago. A single contributor accounts for most of its recent work.
11
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
11
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
High-Risk Jurisdiction Policy applies a 20% multiplier to weighted overall health and gives it an At risk ceiling of 49.
Ownership
Konstantin FastovPersonal account
13 followers94 public repossince Jan 2012
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish | Tags |
|---|---|---|---|---|---|---|
| npm | @kfastov/tgcli | 2.2.3 | 708 | 12 | 10 days ago | telegramtelegram-clientmcpmcp-servermtprotofastmcpclaudecursorai-assistantai-agent |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
79
Development activity
65Moderate
How it's scored
| 28.8/36 | Push recency — last push 10 days ago |
| 8.3/36 | Commit cadence — 12/52 weeks with commits |
| 18/18 | Commit volume — 122 commits in the last year |
| 10/10 | OpenSSF Scorecard: Maintained — 30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10 |
Inputs used
| commits_last_year | 122 |
| human_commit_share | 1 |
| days_since_last_push | 10 |
| active_weeks_last_year | 12 |
Release discipline
100Excellent
How it's scored
| 27/27 | Ships releases — 15 releases published |
| 36/36 | Release recency — latest release 10 days ago |
| 27/27 | Release cadence — a release every ~18.7 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 15 |
| latest_release_tag | v2.2.3 |
| releases_from_tags | no |
| days_since_latest_release | 10 |
| mean_days_between_releases | 18.7 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
44
Popularity & adoption
36At risk
How it's scored
| 25.8/60 | Stars — 40 stars |
| 10.7/25 | Forks — 20 forks |
| 0/15 | Watchers — 2 watchers |
Inputs used
| forks | 20 |
| stars | 40 |
| watchers | 2 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
50Moderate
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (MIT) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Ecosystem adoption (downloads)
48At risk
How it's scored
| 38/80 | Monthly downloads — 708 downloads/month across npm |
| 0/20 | Registry dependents — not reported by this ecosystem |
Inputs used
| packages | @kfastov/tgcli |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 708 |
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
52
Maintainer resilience (bus factor)
12Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 0.7/22.5 | Commit distribution — top contributor authored 97% of commits |
| 2.7/13.5 | Contributor breadth — 2 contributors |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 2 |
| top_contributor_share | 0.971 |
Issue & PR responsiveness
58Moderate
How it's scored
| 25.8/46.8 | Issue resolution — 55% of issues closed |
| 32.4/38.3 | PR acceptance — 22/26 decided PRs merged |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/16 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 22 |
| open_issues | 13 |
| closed_issues | 16 |
| issue_closed_ratio | 0.552 |
| closed_unmerged_prs | 4 |
Ownership & stewardship
54Moderate
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 8.2/25 | Owner reach — 13 followers of kfastov |
| 25/25 | Track record — 94 public repos, account ~14 yr old |
Inputs used
| followers | 13 |
| owner_type | User |
| is_verified | — |
| owner_login | kfastov |
| public_repos | 94 |
| account_age_days | 5,314 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
100Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on npm |
| 35/35 | Publish recency — latest publish 10 days ago |
| 20/20 | Version history — 12 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | @kfastov/tgcli |
| ecosystems | npm |
| any_deprecated | no |
| min_days_since_publish | 10 |
Engineering Quality
Are baseline engineering and documentation practices in place?
63
Engineering practices
48At risk
How it's scored
| 24/24 | CI workflows — 1 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 12 merged PRs checked by a CI test -- score normalized to 0 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Documentation
85Excellent
How it's scored
| 30/30 | README |
| 25/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 10/10 | Topics — 7 topics |
| 10/10 | Wiki |
Inputs used
| topics | ai-agents, mcp, mcp-server, telegram, telegram-client, agent-skill, ai |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | yes |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
24
Security posture
8Critical
Jurisdiction risk alert
High-risk jurisdiction exposure detected
1 software.redFlag.role.ownerRussia1 top contributor profilesRussiaSecurity and overall rating: At risk ceiling
Based on self-published public profile locations. This governance signal does not determine nationality, citizenship, intent, sanctions status, or individual trustworthiness.
How jurisdiction exposure is assessedHow it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 0 out of 12 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/16 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 6.8/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 55 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 4 |
| high_risk_jurisdiction_cap | 49 |
| high_risk_jurisdiction_multiplier | 20 |
| security_posture_after_multiplier | 8 |
| security_posture_before_jurisdiction | 40 |
Excluded from scoring (no data or not applicable): signed_releases. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 20% multiplier and gives Security posture an At risk ceiling of 49.
Dependency advisories
88Excellent
How it's scored
| 35/35 | Direct dependencies free of known advisories — no direct dependency carries a known advisory |
| 13.2/25 | Indirect dependencies free of known advisories — 1 affected: @hono/node-server 1.19.15 (moderate 5.9) |
| 40/40 | No advisories left outstanding — no advisory has been public longer than 90 days |
Inputs used
| source | osv |
| advisories | 1 |
| affected_packages | 1 |
| assessed_packages | 182 |
| unassessed_packages | 0 |
| affected_by_severity | moderate 1 |
| direct_affected_packages | 0 |
Matched the npm:@kfastov/tgcli@2.2.3 runtime dependency closure — what installing the published package pulls in — 182 packages. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
51
Agent context & guidance
85Excellent
How it's scored
| 45/45 | Agent instructions — AGENTS.md |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 99 of 100 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.99 |
| agent_instruction_files | AGENTS.md |
| agent_instruction_max_bytes | 3,200 |
How it's scored
| 0/18 | One-command bootstrap |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 0/11 | Static type checking |
| 10/10 | Reproducible environment — Dockerfile, lockfile |
| 4/10 | Demonstrated agent practice — 2 of the last 100 commits agent-authored or agent-credited |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | package-lock.json |
| has_dockerfile | yes |
| typed_language | no |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0.02 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Code legibility for models
51Moderate
How it's scored
| 0/45 | Type-checkable code — JavaScript without a type-check config |
| 51.2/55 | Manageable file sizes — 3/43 source files over 60KB |
Inputs used
| primary_language | JavaScript |
| largest_source_bytes | 120,064 |
| source_files_sampled | 43 |
| oversized_source_files | 3 |
Machine-readable interfaces
20Critical
How it's scored
| 0/40 | API schema (OpenAPI/GraphQL/proto) |
| 20/20 | MCP server |
| 0/40 | Runnable examples |
Inputs used
| example_dirs | — |
| has_mcp_signal | yes |
| api_schema_files | — |
Key facts
40GitHub stars
2contributors
122commits, last 12 months
10days since last push
15releases
1bus factor
13open issues
npmpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
Star and fork history 0 ★ / 20 ⇿
0Stars
20Forks
11Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 1Minor 1Patch 8
Each point covers 2 days.
OpenSSF Scorecard 4.0 / 10
4.0aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 0 | CI-Tests | 0 out of 12 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/16 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 9 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 55 existing vulnerabilities detected |
Direct dependencies 6
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| npm | @modelcontextprotocol/sdk | ^1.25.2 | package.json |
| npm | @mtcute/core | ^0.27.8 | package.json |
| npm | @mtcute/node | ^0.27.8 | package.json |
| npm | better-sqlite3 | ^12.6.0 | package.json |
| npm | commander | ^12.1.0 | package.json |
| npm | qrcode | ^1.5.4 | package.json |
All dependencies 281
Full resolved dependency set from the GitHub dependency graph: 6 direct and 275 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
| Registry | Package | Version | Relation |
|---|---|---|---|
| npm | @modelcontextprotocol/sdk | 1.25.2 | direct |
| npm | @mtcute/core | 0.27.8 | direct |
| npm | @mtcute/node | 0.27.8 | direct |
| npm | better-sqlite3 | 12.6.0 | direct |
| npm | commander | 12.1.0 | direct |
| npm | qrcode | 1.5.4 | direct |
| npm | @emnapi/core | 1.9.1 | indirect |
| npm | @emnapi/runtime | 1.9.1 | indirect |
| npm | @emnapi/wasi-threads | 1.2.0 | indirect |
| npm | @fuman/io | 0.0.19 | indirect |
| npm | @fuman/net | 0.0.19 | indirect |
| npm | @fuman/node | 0.0.19 | indirect |
| npm | @fuman/utils | 0.0.15 | indirect |
| npm | @fuman/utils | 0.0.19 | indirect |
| npm | @hono/node-server | 1.19.8 | indirect |
| npm | @jridgewell/sourcemap-codec | 1.5.5 | indirect |
| npm | @mtcute/file-id | 0.27.8 | indirect |
| npm | @mtcute/html-parser | 0.27.8 | indirect |
| npm | @mtcute/markdown-parser | 0.27.8 | indirect |
| npm | @mtcute/tl | 221.0.0 | indirect |
| npm | @mtcute/tl-runtime | 0.24.3 | indirect |
| npm | @mtcute/wasm | 0.27.8 | indirect |
| npm | @napi-rs/wasm-runtime | 1.1.1 | indirect |
| npm | @oxc-project/types | 0.122.0 | indirect |
| npm | @rolldown/binding-android-arm64 | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-darwin-arm64 | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-darwin-x64 | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-freebsd-x64 | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-linux-arm-gnueabihf | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-linux-arm64-gnu | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-linux-arm64-musl | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-linux-ppc64-gnu | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-linux-s390x-gnu | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-linux-x64-gnu | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-linux-x64-musl | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-openharmony-arm64 | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-wasm32-wasi | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-win32-arm64-msvc | 1.0.0-rc.12 | indirect |
| npm | @rolldown/binding-win32-x64-msvc | 1.0.0-rc.12 | indirect |
| npm | @rolldown/pluginutils | 1.0.0-rc.12 | indirect |
| npm | @standard-schema/spec | 1.1.0 | indirect |
| npm | @tybys/wasm-util | 0.10.1 | indirect |
| npm | @types/chai | 5.2.3 | indirect |
| npm | @types/deep-eql | 4.0.2 | indirect |
| npm | @types/estree | 1.0.8 | indirect |
| npm | @types/events | 3.0.0 | indirect |
| npm | @vitest/expect | 4.1.2 | indirect |
| npm | @vitest/mocker | 4.1.2 | indirect |
| npm | @vitest/pretty-format | 4.1.2 | indirect |
| npm | @vitest/runner | 4.1.2 | indirect |
| npm | @vitest/snapshot | 4.1.2 | indirect |
| npm | @vitest/spy | 4.1.2 | indirect |
| npm | @vitest/utils | 4.1.2 | indirect |
| npm | accepts | 1.3.8 | indirect |
| npm | accepts | 2.0.0 | indirect |
| npm | ajv | 8.17.1 | indirect |
| npm | ajv-formats | 3.0.1 | indirect |
| npm | ansi-regex | 5.0.1 | indirect |
| npm | ansi-styles | 4.3.0 | indirect |
| npm | array-flatten | 1.1.1 | indirect |
| npm | assertion-error | 2.0.1 | indirect |
| npm | base64-js | 1.5.1 | indirect |
| npm | bindings | 1.5.0 | indirect |
| npm | bl | 4.1.0 | indirect |
| npm | body-parser | 1.20.3 | indirect |
| npm | body-parser | 2.1.0 | indirect |
| npm | buffer | 5.7.1 | indirect |
| npm | bytes | 3.1.2 | indirect |
| npm | call-bind-apply-helpers | 1.0.2 | indirect |
| npm | call-bound | 1.0.4 | indirect |
| npm | camelcase | 5.3.1 | indirect |
| npm | chai | 6.2.2 | indirect |
| npm | chownr | 1.1.4 | indirect |
| npm | cliui | 6.0.0 | indirect |
| npm | color-convert | 2.0.1 | indirect |
| npm | color-name | 1.1.4 | indirect |
| npm | content-disposition | 0.5.4 | indirect |
| npm | content-disposition | 1.0.0 | indirect |
| npm | content-type | 1.0.5 | indirect |
| npm | convert-source-map | 2.0.0 | indirect |
| npm | cookie | 0.7.1 | indirect |
| npm | cookie-signature | 1.0.6 | indirect |
| npm | cookie-signature | 1.2.2 | indirect |
| npm | cors | 2.8.5 | indirect |
| npm | cross-spawn | 7.0.6 | indirect |
| npm | debug | 2.6.9 | indirect |
| npm | debug | 4.3.6 | indirect |
| npm | debug | 4.4.0 | indirect |
| npm | decamelize | 1.2.0 | indirect |
| npm | decompress-response | 6.0.0 | indirect |
| npm | deep-extend | 0.6.0 | indirect |
| npm | depd | 2.0.0 | indirect |
| npm | destroy | 1.2.0 | indirect |
| npm | detect-libc | 2.1.1 | indirect |
| npm | dijkstrajs | 1.0.3 | indirect |
| npm | dom-serializer | 2.0.0 | indirect |
| npm | domelementtype | 2.3.0 | indirect |
| npm | domhandler | 5.0.3 | indirect |
| npm | domutils | 3.2.2 | indirect |
| npm | dunder-proto | 1.0.1 | indirect |
| npm | ee-first | 1.1.1 | indirect |
| npm | emoji-regex | 8.0.0 | indirect |
| npm | encodeurl | 1.0.2 | indirect |
| npm | encodeurl | 2.0.0 | indirect |
| npm | end-of-stream | 1.4.5 | indirect |
| npm | entities | 4.5.0 | indirect |
| npm | entities | 7.0.1 | indirect |
| npm | es-define-property | 1.0.1 | indirect |
| npm | es-errors | 1.3.0 | indirect |
| npm | es-module-lexer | 2.0.0 | indirect |
| npm | es-object-atoms | 1.1.1 | indirect |
| npm | escape-html | 1.0.3 | indirect |
| npm | estree-walker | 3.0.3 | indirect |
| npm | etag | 1.8.1 | indirect |
| npm | eventsource | 3.0.5 | indirect |
| npm | eventsource-parser | 3.0.0 | indirect |
| npm | expand-template | 2.0.3 | indirect |
| npm | expect-type | 1.3.0 | indirect |
| npm | express | 4.21.2 | indirect |
| npm | express | 5.0.1 | indirect |
| npm | express-rate-limit | 7.5.0 | indirect |
| npm | fast-deep-equal | 3.1.3 | indirect |
| npm | fast-uri | 3.1.0 | indirect |
| npm | fdir | 6.5.0 | indirect |
| npm | file-uri-to-path | 1.0.0 | indirect |
| npm | finalhandler | 1.3.1 | indirect |
| npm | finalhandler | 2.1.0 | indirect |
| npm | find-up | 4.1.0 | indirect |
| npm | forwarded | 0.2.0 | indirect |
| npm | fresh | 0.5.2 | indirect |
| npm | fresh | 2.0.0 | indirect |
| npm | fs-constants | 1.0.0 | indirect |
| npm | fsevents | 2.3.3 | indirect |
| npm | function-bind | 1.1.2 | indirect |
| npm | get-caller-file | 2.0.5 | indirect |
| npm | get-intrinsic | 1.3.0 | indirect |
| npm | get-proto | 1.0.1 | indirect |
| npm | github-from-package | 0.0.0 | indirect |
| npm | gopd | 1.2.0 | indirect |
| npm | has-symbols | 1.1.0 | indirect |
| npm | hasown | 2.0.2 | indirect |
| npm | hono | 4.11.4 | indirect |
| npm | htmlparser2 | 10.1.0 | indirect |
| npm | http-errors | 2.0.0 | indirect |
| npm | iconv-lite | 0.4.24 | indirect |
| npm | iconv-lite | 0.5.2 | indirect |
| npm | iconv-lite | 0.6.3 | indirect |
| npm | ieee754 | 1.2.1 | indirect |
| npm | inherits | 2.0.4 | indirect |
| npm | ini | 1.3.8 | indirect |
| npm | ipaddr.js | 1.9.1 | indirect |
| npm | is-fullwidth-code-point | 3.0.0 | indirect |
| npm | is-promise | 4.0.0 | indirect |
| npm | isexe | 2.0.0 | indirect |
| npm | jose | 6.1.3 | indirect |
| npm | json-schema-traverse | 1.0.0 | indirect |
| npm | json-schema-typed | 8.0.2 | indirect |
| npm | lightningcss | 1.32.0 | indirect |
| npm | lightningcss-android-arm64 | 1.32.0 | indirect |
| npm | lightningcss-darwin-arm64 | 1.32.0 | indirect |
| npm | lightningcss-darwin-x64 | 1.32.0 | indirect |
| npm | lightningcss-freebsd-x64 | 1.32.0 | indirect |
| npm | lightningcss-linux-arm-gnueabihf | 1.32.0 | indirect |
| npm | lightningcss-linux-arm64-gnu | 1.32.0 | indirect |
| npm | lightningcss-linux-arm64-musl | 1.32.0 | indirect |
| npm | lightningcss-linux-x64-gnu | 1.32.0 | indirect |
| npm | lightningcss-linux-x64-musl | 1.32.0 | indirect |
| npm | lightningcss-win32-arm64-msvc | 1.32.0 | indirect |
| npm | lightningcss-win32-x64-msvc | 1.32.0 | indirect |
| npm | locate-path | 5.0.0 | indirect |
| npm | long | 5.2.3 | indirect |
| npm | magic-string | 0.30.21 | indirect |
| npm | math-intrinsics | 1.1.0 | indirect |
| npm | media-typer | 0.3.0 | indirect |
| npm | media-typer | 1.1.0 | indirect |
| npm | merge-descriptors | 1.0.3 | indirect |
| npm | merge-descriptors | 2.0.0 | indirect |
| npm | methods | 1.1.2 | indirect |
| npm | mime | 1.6.0 | indirect |
| npm | mime-db | 1.52.0 | indirect |
| npm | mime-db | 1.53.0 | indirect |
| npm | mime-types | 2.1.35 | indirect |
| npm | mime-types | 3.0.0 | indirect |
| npm | mimic-response | 3.1.0 | indirect |
| npm | minimist | 1.2.8 | indirect |
| npm | mkdirp-classic | 0.5.3 | indirect |
| npm | ms | 2.0.0 | indirect |
| npm | ms | 2.1.2 | indirect |
| npm | ms | 2.1.3 | indirect |
| npm | nanoid | 3.3.11 | indirect |
| npm | napi-build-utils | 2.0.0 | indirect |
| npm | negotiator | 0.6.3 | indirect |
| npm | negotiator | 1.0.0 | indirect |
| npm | node-abi | 3.77.0 | indirect |
| npm | object-assign | 4.1.1 | indirect |
| npm | object-inspect | 1.13.4 | indirect |
| npm | obug | 2.1.1 | indirect |
| npm | on-finished | 2.4.1 | indirect |
| npm | once | 1.4.0 | indirect |
| npm | p-limit | 2.3.0 | indirect |
| npm | p-locate | 4.1.0 | indirect |
| npm | p-try | 2.2.0 | indirect |
| npm | parseurl | 1.3.3 | indirect |
| npm | path-exists | 4.0.0 | indirect |
| npm | path-key | 3.1.1 | indirect |
| npm | path-to-regexp | 0.1.12 | indirect |
| npm | path-to-regexp | 8.2.0 | indirect |
| npm | pathe | 2.0.3 | indirect |
| npm | picocolors | 1.1.1 | indirect |
| npm | picomatch | 4.0.4 | indirect |
| npm | pkce-challenge | 5.0.0 | indirect |
| npm | pngjs | 5.0.0 | indirect |
| npm | postcss | 8.5.8 | indirect |
| npm | prebuild-install | 7.1.3 | indirect |
| npm | proxy-addr | 2.0.7 | indirect |
| npm | pump | 3.0.3 | indirect |
| npm | qs | 6.13.0 | indirect |
| npm | qs | 6.14.0 | indirect |
| npm | range-parser | 1.2.1 | indirect |
| npm | raw-body | 2.5.2 | indirect |
| npm | raw-body | 3.0.0 | indirect |
| npm | rc | 1.2.8 | indirect |
| npm | readable-stream | 3.6.2 | indirect |
| npm | require-directory | 2.1.1 | indirect |
| npm | require-from-string | 2.0.2 | indirect |
| npm | require-main-filename | 2.0.0 | indirect |
| npm | rolldown | 1.0.0-rc.12 | indirect |
| npm | router | 2.1.0 | indirect |
| npm | safe-buffer | 5.2.1 | indirect |
| npm | safer-buffer | 2.1.2 | indirect |
| npm | semver | 7.7.2 | indirect |
| npm | send | 0.19.0 | indirect |
| npm | send | 1.1.0 | indirect |
| npm | serve-static | 1.16.2 | indirect |
| npm | serve-static | 2.1.0 | indirect |
| npm | set-blocking | 2.0.0 | indirect |
| npm | setprototypeof | 1.2.0 | indirect |
| npm | shebang-command | 2.0.0 | indirect |
| npm | shebang-regex | 3.0.0 | indirect |
| npm | side-channel | 1.1.0 | indirect |
| npm | side-channel-list | 1.0.0 | indirect |
| npm | side-channel-map | 1.0.1 | indirect |
| npm | side-channel-weakmap | 1.0.2 | indirect |
| npm | siginfo | 2.0.0 | indirect |
| npm | simple-concat | 1.0.1 | indirect |
| npm | simple-get | 4.0.1 | indirect |
| npm | source-map-js | 1.2.1 | indirect |
| npm | stackback | 0.0.2 | indirect |
| npm | statuses | 2.0.1 | indirect |
| npm | std-env | 4.0.0 | indirect |
| npm | string-width | 4.2.3 | indirect |
| npm | string_decoder | 1.3.0 | indirect |
| npm | strip-ansi | 6.0.1 | indirect |
| npm | strip-json-comments | 2.0.1 | indirect |
| npm | tar-fs | 2.1.4 | indirect |
| npm | tar-stream | 2.2.0 | indirect |
| npm | tinybench | 2.9.0 | indirect |
| npm | tinyexec | 1.0.4 | indirect |
| npm | tinyglobby | 0.2.15 | indirect |
| npm | tinyrainbow | 3.1.0 | indirect |
| npm | toidentifier | 1.0.1 | indirect |
| npm | tslib | 2.8.1 | indirect |
| npm | tunnel-agent | 0.6.0 | indirect |
| npm | type-is | 1.6.18 | indirect |
| npm | type-is | 2.0.0 | indirect |
| npm | unpipe | 1.0.0 | indirect |
| npm | util-deprecate | 1.0.2 | indirect |
| npm | utils-merge | 1.0.1 | indirect |
| npm | vary | 1.1.2 | indirect |
| npm | vite | 8.0.3 | indirect |
| npm | vitest | 4.1.2 | indirect |
| npm | which | 2.0.2 | indirect |
| npm | which-module | 2.0.1 | indirect |
| npm | why-is-node-running | 2.3.0 | indirect |
| npm | wrap-ansi | 6.2.0 | indirect |
| npm | wrappy | 1.0.2 | indirect |
| npm | y18n | 4.0.3 | indirect |
| npm | yargs | 15.4.1 | indirect |
| npm | yargs-parser | 18.1.3 | indirect |
| npm | zod | 4.3.5 | indirect |
| npm | zod-to-json-schema | 3.25.1 | indirect |
Dependency advisories 1
Installing npm:@kfastov/tgcli@2.2.3 pulls in 182 packages, direct and transitive: 1 carry known advisories, of which 0 are direct dependencies.
| Package | Version | Relation | Severity | Advisories | Fixed in |
|---|---|---|---|---|---|
| @hono/node-server | 1.19.15 | indirect | moderate | 1 | 2.0.5 |
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"ai-agents",
"mcp",
"mcp-server",
"telegram",
"telegram-client",
"agent-skill",
"ai"
],
"is_fork": false,
"size_kb": 572,
"has_wiki": true,
"homepage": null,
"languages": {
"Shell": 177,
"Dockerfile": 1318,
"JavaScript": 629170
},
"pushed_at": "2026-07-17T08:49:58Z",
"created_at": "2025-03-19T14:48:50Z",
"owner_type": "User",
"updated_at": "2026-07-17T08:49:31Z",
"description": "Telegram user console client and archiver",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "JavaScript",
"significant_languages": [
"JavaScript"
]
},
"owner": {
"blog": "https://kfastov.github.io",
"name": "Konstantin Fastov",
"type": "User",
"login": "kfastov",
"company": null,
"location": "Moscow, Russia",
"followers": 13,
"avatar_url": "https://avatars.githubusercontent.com/u/1312744?v=4",
"created_at": "2012-01-08T10:16:11Z",
"is_verified": null,
"public_repos": 94,
"account_age_days": 5314
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.2.3",
"kind": "patch",
"published_at": "2026-07-17T08:49:59Z"
},
{
"tag": "v2.2.2",
"kind": "patch",
"published_at": "2026-07-17T07:40:47Z"
},
{
"tag": "v2.2.1",
"kind": "patch",
"published_at": "2026-07-16T19:08:41Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2026-07-16T19:04:57Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2026-04-02T03:43:46Z"
},
{
"tag": "v2.0.8",
"kind": "patch",
"published_at": "2026-02-02T11:22:04Z"
},
{
"tag": "v2.0.7",
"kind": "patch",
"published_at": "2026-01-30T12:35:22Z"
},
{
"tag": "v2.0.6",
"kind": "patch",
"published_at": "2026-01-30T08:21:23Z"
},
{
"tag": "v2.0.5",
"kind": "patch",
"published_at": "2026-01-30T08:19:42Z"
},
{
"tag": "v2.0.4",
"kind": "patch",
"published_at": "2026-01-30T08:15:17Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2026-01-30T08:10:49Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2026-01-29T14:18:30Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2026-01-29T13:51:16Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2026-01-29T10:43:58Z"
},
{
"tag": "v1.x",
"kind": "other",
"published_at": "2026-01-29T10:43:26Z"
}
],
"recent_commits": [
{
"oid": "b738f3bc9a0b2dffa664285a5a44b5d7f410e7a6",
"body": null,
"is_bot": false,
"headline": "fix: use deploy key for Homebrew releases",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-07-17T08:49:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "edd19d6d38765ad15392a31dd0209ce4f7b64c93",
"body": null,
"is_bot": false,
"headline": "fix: enable updates for QR authentication",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-07-17T07:39:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a05f8e2d9cc53970e6f8e1388ee635dda2530cd8",
"body": null,
"is_bot": false,
"headline": "fix: repair trusted npm publishing for v2.2.1",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-07-16T19:08:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a150cc7141871f253e0c1e8f62b69bb8a7370ca1",
"body": null,
"is_bot": false,
"headline": "chore: release v2.2.0",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-07-16T19:02:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df38972459c184893079bc94f8adda91edf5741a",
"body": "fix: route backfill cancel through control server",
"is_bot": false,
"headline": "Merge pull request #57 from kfastov/wb2a-cancel-via-server",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-07-14T17:17:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c50663a529537e3b2c107d4a220280cbd90a43f",
"body": null,
"is_bot": false,
"headline": "fix: route backfill cancel through control server",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-22T15:53:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7bfc8733c888a2c0ed3ebf5ab0fc58b4e31198db",
"body": "refactor: simplify the operations/command layer (#49, #43)",
"is_bot": false,
"headline": "Merge pull request #53 from kfastov/refactor/ops-command-layer",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-22T15:46:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c627189d7b7e1297b62c4531976242a9002d4d24",
"body": "…ero-bytes\n\nmedia download reports \"(0 bytes)\" for successfully downloaded files",
"is_bot": false,
"headline": "Merge pull request #54 from kfastov/pipeline/media-download-reports-z…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-12T11:06:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "015629c5174e9f217bf99c018c41ec7c66c74a02",
"body": null,
"is_bot": false,
"headline": "Rephrase download comment as a present-tense API contract warning",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-12T10:41:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "464279dfe053b0a978e0ad0ac97c88c572b25d5a",
"body": "mtcute's downloadToFile resolves before its write stream flushes, so the\nfs.statSync immediately after it raced the flush and typically reported\n0 bytes for files that were written correctly moments later.\n\nReplace it with downloadAsNodeStream piped through stream/promises\npipeline, which resolves o\n[…]\nl file is removed best-effort and the error\nis rethrown instead of reporting success.\n\nCovers the CLI human output, --json output, and the MCP mediaDownload\ntool, which all share downloadMessageMedia.",
"is_bot": false,
"headline": "Fix media download reporting 0 bytes for completed downloads",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-12T10:34:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "954b78e80d51ea0d00466cb3ebf4a5dba5c1ee3a",
"body": "Internal cleanup of the op/command layer the warm-backend work produced;\nno change to user-visible output, errors, or exit codes.\n\n- runOperation invokes the op directly and only starts a server (then\n retries once) when the call fails because the server is unreachable.\n invoke now raises ServerUn\n[…]\nrst then start-on-connection-failure (and that an op\n error does not spawn a server); the shared source resolution across all\n four source modes (no source mixing); a generic passthrough forwarding.",
"is_bot": false,
"headline": "refactor: simplify the operations/command layer (#49, #43)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-04T14:35:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "33e255aa6baf141e94547b88dc565f17bc21866c",
"body": "feat: retire the legacy in-process worker — server is the sole writer (#45, Step 2)",
"is_bot": false,
"headline": "Merge pull request #52 from kfastov/feat/retire-inprocess-worker",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-04T14:15:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57d06feebd096b1f779765b7a946808427315783",
"body": "…(#45)\n\nNo CLI command runs the queue worker, realtime loop, or takes the exclusive\nstore write lock for queue processing. The always-on control server is the sole\nwriter and queue processor.\n\n- backfill/sync (no --chat): server-routed. --follow auto-starts the server and\n tracks the queue with liv\n[…]\nem. Both auto-start the server.\n- auth is interactive login + session bootstrap only; its post-login sync and\n --follow option are gone.\n- Drop the unused logSendRetry (send retries run server-side).",
"is_bot": false,
"headline": "feat: retire the legacy in-process worker; server is the sole writer …",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-04T13:53:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d6a5548b62cf3d86697d65e65258b904ef8939d",
"body": "…erver\n\nfeat: route all commands through the warm server — thin clients on shared ops (#45, Step 1)",
"is_bot": false,
"headline": "Merge pull request #48 from kfastov/feat/route-all-commands-through-s…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-04T13:36:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1278839f20e3cd2812a7be32b171e06f763ad90",
"body": "A fresh command after the server is down could fail with \"Timed out\nwaiting for the control server to start\" even though the server came up,\nbecause startup blocked on the full Telegram connect + dialog refresh\n(tens of seconds on a large account) before the control listener bound\nand control.json w\n[…]\nmmediately and a\nfresh connect is a few seconds.\n\nAdd an integration test proving control.json is written and ping succeeds\nwhile the connect is still pending, and that an op blocks until it resolves.",
"is_bot": false,
"headline": "fix: make the control server reachable before Telegram init (cold-start)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-04T10:43:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "14faab956cb5cc2e2f0b89ba1daccce9d68baeb4",
"body": "Make every Telegram and archive CLI command a thin client over the\nalways-on control server. Each handler validates args, calls\nrunOperation(op, args), and renders the result; the server executes the\noperation against its warm MTProto connection and open database as the\nsingle writer.\n\n- Simplify ru\n[…]\nSON error; the 30s default send timeout bounds the CLI's wait on\n the invoke.\n- Keep config, service, doctor, and auth local.\n\nTests updated for the server-routed model and new ops; full suite green.",
"is_bot": false,
"headline": "feat: route all telegram/archive commands through the warm server (#45)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-04T08:48:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5348c3f15a78f63d06c4aa964db7710f83fafc83",
"body": "feat: warm-backend thin client — channels-list & group-invite via shared op handlers (#45, B1)",
"is_bot": false,
"headline": "Merge pull request #47 from kfastov/feat/warm-backend-invoke-b1",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-04T08:13:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc9a548439a48059c70be7e8c14c1e698da55d78",
"body": "…a shared op handlers (#45)\n\nIntroduce a shared operation registry so CLI commands and MCP tools execute\none handler, optionally served by the warm always-on server.\n\n- core/operations.js: OPERATIONS map { listChannels, getGroupInviteLink } —\n pure functions of { telegramClient, messageSyncService \n[…]\n- channels list and group invite-link get converted to the seam; the two MCP\n tools call the same OPERATIONS functions.\n\nOpportunistic only: reads use the server if it is up but never auto-start one.",
"is_bot": false,
"headline": "feat: route channels-list and group-invite through the warm server vi…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T17:17:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4d7cc511933a1c63d660a1926198b377889680ca",
"body": "…ices\n\nrefactor: withCommand — scope per-command service acquisition (#45, variant A)",
"is_bot": false,
"headline": "Merge pull request #46 from kfastov/refactor/with-command-scoped-serv…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T17:09:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "35ddabe4c64e1658e927c7743b5101e942e22aa9",
"body": "Introduce core/command-context.js exporting withCommand(globalFlags, opts, fn),\na single seam that owns the per-command boilerplate previously copy-pasted into\n~50 handlers: runWithTimeout, resolveStoreDir, lock acquire/release, scoped\nservice creation, and teardown. Each handler now shrinks to: val\n[…]\nno services.\n\nNo behavior change: same validation, auth checks, output, errors, exit codes,\nand locks. Full suite green (300 tests; +15 new withCommand unit tests).\n\nPart of #45 (variant B closes it).",
"is_bot": false,
"headline": "refactor: scope per-command service acquisition via withCommand (#45)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T17:07:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1650bdd724d97a5876d028e043c48ab183d452e2",
"body": "fix: scope job requeue to the worker — reads no longer mutate jobs (#42, PR-3a)",
"is_bot": false,
"headline": "Merge pull request #44 from kfastov/fix/issue-42-requeue-responsibility",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T16:05:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c91bf7701cdab8885fa503bb9299e7d69dc82039",
"body": "…utates jobs (#42)\n\nMessageSyncService.shutdown() used to blanket-requeue *every* in_progress job\nback to pending on teardown. But every command builds the full service stack via\ncreateServices() and called shutdown() in a finally — so a read-only command\n(e.g. `messages list`, `channels list`, `bac\n[…]\nerver\n (mcp-server.js), the in-process runSync (`sync`/`backfill --once|--follow`),\n and `jobs add`/`jobs retry` (which run processQueue), plus runAuthLogin's\n --follow worker cleanup.\n\nCloses #42.",
"is_bot": false,
"headline": "fix: scope job requeue to the worker; non-worker teardown no longer m…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T13:36:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4dfbeeffb8226ccff57d81b457f41bd7aff46685",
"body": "feat(cli): server-executed backfill client (#30, #26, PR-2b)",
"is_bot": false,
"headline": "Merge pull request #41 from kfastov/feat/issue-30-backfill-cli-2b",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T12:58:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e8fca403dfb57404fb80facc6ffa12298d453504",
"body": "…tatus/count/wait/cancel (#30, #26)\n\nMake the CLI a thin one-shot client over the always-on control API that PR-2a\nadded. Backfill work is executed by the long-lived server, not the CLI process,\nso a `send` (which needs the store write lock) is never blocked by a CLI that is\nbusy backfilling.\n\ncore/\n[…]\n status, and cancel routing up/down. 279 tests pass.\n\nDocs: docs/cli.md and SKILL.md document the server-executed/auto-start model and\nthe new foreground/--background/status/count/wait/cancel surface.",
"is_bot": false,
"headline": "feat(cli): server-executed backfill client — foreground/background, s…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T11:15:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bfba97fb5eddc72756c438f46621625088007ddf",
"body": "feat(server): loopback control API + per-batch progress + idle-exit (#30, PR-2a)",
"is_bot": false,
"headline": "Merge pull request #38 from kfastov/feat/issue-30-backfill-server-2a",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T09:40:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa8d1a752e68bf6bf950dd5b5cd93ed66b2cd5ec",
"body": "…count wrapper (#30)\n\nAddress audit findings on PR-2a (behavior unchanged, suite green).\n\n1. Shared HTTP body reader: extract the character-identical readJsonBody (plus\n the sendJson helper) into a new core/http-util.js. core/control-server.js now\n imports both; mcp-server.js's local readBody is\n[…]\noff the snake_case queue shape; inlining getQueueStats() at those call sites\n would have coupled them (and the tests) to in_progress.\n\nAdds tests/duration.test.js for the newly shared parseDuration.",
"is_bot": false,
"headline": "refactor: extract shared http + duration helpers, drop redundant job-…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-03T09:09:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "81bd9ee0a40b4e3b28c9661f0ad4c0f084ebc8dc",
"body": "… (#30)\n\nServer-side groundwork for the backfill rework (PR-2a). The CLI backfill\nclient commands land separately in PR-2b.\n\nPart A — Always-on loopback control listener (mcp-server.js,\ncore/control-server.js): a dedicated HTTP server bound to 127.0.0.1 that\nruns whenever the server runs, independen\n[…]\nt then\nshuts down gracefully. cli.js `server --idle-exit <duration>` parses with\nparseDuration and passes the value to the spawned mcp-server.js child via\nargv; without it the server stays up forever.",
"is_bot": false,
"headline": "feat(server): add loopback control API, per-batch progress, idle-exit…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-02T14:32:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "42aab377e86f9c1ead6f294587a27b7f96680700",
"body": "feat(cli): rename sync→backfill + channels watch/unwatch (#30, PR-1)",
"is_bot": false,
"headline": "Merge pull request #37 from kfastov/feat/issue-30-backfill-rename",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-02T12:30:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8208ca55637f7a0c7ed910afe02b0b1c743bf42",
"body": "Make the self-documenting names canonical so AI agents discover them via\n`--help`, while keeping the old names working with zero behavior change.\n\n- `backfill` is registered as the command and `sync` is attached via\n commander's `.alias('sync')`. The alias resolves to the same command tree,\n so th\n[…]\nchanges.\n\nTests: tests/backfill-rename.test.js asserts new names hit the same handlers\nand produce the same output as the old names, and that the legacy\n`channels sync --enable/--disable` still works.",
"is_bot": false,
"headline": "feat(cli): rename sync→backfill and channels sync→watch/unwatch (#30)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-02T08:30:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "738a8809be604e8ffc4c6abf72fcde807cd7fdf2",
"body": "fix(send): default 30s timeout + --quiet for send commands (#23)",
"is_bot": false,
"headline": "Merge pull request #36 from kfastov/fix/issue-23-send-default-timeout",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-02T07:14:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76b1ceda987e58e2938c62f155bbba3e9191b911",
"body": "Add a global --quiet flag that silences the informational\n\"Connecting to Telegram…\" status printed on stderr by the send\ncommands.\n\n- Register --quiet next to --json/--timeout on the program.\n- getGlobalFlags now returns quiet: Boolean(options.quiet).\n- printSendStatus takes globalFlags and is a no-\n[…]\nson output are\nunchanged. Docs: --quiet added to the global flags section of\ndocs/cli.md. Tests: tests/send-timeout.test.js covers the status being\nprinted without --quiet and suppressed with --quiet.",
"is_bot": false,
"headline": "feat(cli): add --quiet to suppress send status output (#23)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-02T07:01:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7337fdd1430b388e8ae2a3d002d67d54e7ccd160",
"body": "`tgcli send text|photo|file` could hang forever on a stuck MTProto\nconnection because the global --timeout had no default. Since the primary\nusers are AI agents and scripts, an unbounded send is a silent failure\nmode. Scope a 30s default to the send commands only:\n\n- runSendText/runSendPhoto/runSend\n[…]\nLL.md. Tests: tests/send-timeout.test.js covers the default, an\nexplicit value, --timeout 0 disabling, the scoped exclusion of sync, the\nclear timeout message, and the FLOOD_WAIT-over-budget behavior.",
"is_bot": false,
"headline": "fix(send): apply default 30s timeout to send commands (#23)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-06-02T06:34:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "29a1169599f9b7b34f08107a72e9b25a52f8a434",
"body": "feat: QR login, force SMS, auth recovery, --qr-file PNG output",
"is_bot": false,
"headline": "Merge pull request #34 from kfastov/backport/qr-auth-recovery",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-04-02T03:40:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c35f0594755c4650f3ecdc2cb279bc75b48b9c8",
"body": null,
"is_bot": false,
"headline": "fix: restore unreadCount in listDialogs, simplify auth JSON output",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-04-02T03:39:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83b1eb6d710bcf9b1ff55f8d41081287dcba9ae5",
"body": "…rcode\n\n- tgcli auth --qr --qr-file /tmp/qr.png saves QR as PNG image\n- JSON mode emits QR events to stderr with url and file path\n- QR refreshes automatically write updated PNGs\n- Agent workflow: auth --qr --qr-file /tmp/qr.png, send image to user\n- Replaced qrcode-terminal with qrcode package (supports terminal + PNG + base64)\n- 203 tests passing",
"is_bot": false,
"headline": "feat: add --qr-file for PNG QR output, replace qrcode-terminal with q…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-04-02T01:55:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06d9687c5290ce0faff6209a50253cd54086d3c0",
"body": null,
"is_bot": false,
"headline": "fix: export auth login helper for cli tests",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T12:17:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "759e0a56c4f053ae89dea1e7bfa06c6383dcf028",
"body": null,
"is_bot": false,
"headline": "feat: backport QR login, force SMS, and auth recovery from dapi/tgcli",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T12:14:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58a34f4ebb9212c041172ad6140828a99ad31037",
"body": null,
"is_bot": false,
"headline": "ci: switch npm publish to trusted publishers (OIDC)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T05:48:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "649d93701fa6cf36f52031c8dfc67a2e86a2b7f7",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 2.1.0",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T05:28:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aef84c41bc5623925255cbb252c619c32381826a",
"body": "feat: add tgcli feedback command",
"is_bot": false,
"headline": "Merge pull request #33 from kfastov/feature/feedback-command",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T05:24:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64ccf51ee68b7de5ae9f60b809ff1e2ded815347",
"body": null,
"is_bot": false,
"headline": "fix: hardcode @kfastov as default feedback recipient",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T05:22:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1fb3a176e3fcb7f558633e42c227185a4d1f8b19",
"body": null,
"is_bot": false,
"headline": "docs: clarify what data feedback sends (privacy)",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T05:19:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f5d5877f01273b1a588c1e6ca0bfc6ec26e2270c",
"body": null,
"is_bot": false,
"headline": "simplify: remove category flags, just take plain text",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-30T05:16:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f34ea429eec2dc870050ef62712de77958ab7ed9",
"body": null,
"is_bot": false,
"headline": "feat: add tgcli feedback command for direct maintainer feedback",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T15:49:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0bcc3e46bc65ecbe7bf472bcfe9d049f349fbec0",
"body": "feat: add chat folders CRUD commands",
"is_bot": false,
"headline": "Merge pull request #20 from kfastov/backport/chat-folders",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T12:02:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "23539bed83da37243dc06307dd6d00e67058da56",
"body": null,
"is_bot": false,
"headline": "fix: rebase folders onto main and update docs",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T11:57:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e700f2e96fb75d05c01f69e4da78b83c0bd89d2",
"body": "Full CRUD for Telegram chat folders — lets agents organize chats programmatically.\n\ntelegram-client.js:\n- getFolders, showFolder (with --resolve for peer name resolution),\n createFolder, editFolder, deleteFolder, setFoldersOrder,\n addChatToFolder, removeChatFromFolder, joinChatlist, findFolder\n- H\n[…]\nfolder via invite link\n\nTests: 75 tests covering all folder operations, edge cases, error handling,\npeer normalization, and name resolution.\n\nBackported from dapi/tgcli (https://github.com/dapi/tgcli)",
"is_bot": false,
"headline": "feat: add chat folders CRUD commands",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T11:57:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "63f873abafecb1b9ebfb1663960a9d6172f74cec",
"body": "feat: enhanced send options (parse-mode, reply-to, schedule, silent, send photo)",
"is_bot": false,
"headline": "Merge pull request #19 from kfastov/backport/send-options",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T11:46:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06548e1f37a86874c74654c1a060502d93efc959",
"body": null,
"is_bot": false,
"headline": "fix: unify send retry defaults and update docs",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T11:13:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20e599cf2bd82caa2152ff96a9e8cfacd6e8ca94",
"body": "Backported from dapi/tgcli (https://github.com/dapi/tgcli)\n\ntelegram-client.js:\n- Add helper functions: normalizeParseMode, applyParseMode, resolveScheduleDate,\n resolveReplyTo, buildTextSendParams, buildMediaSendParams, resolveUploadPath,\n resolveOptionalCaption, buildSendMessageResult, buildLowL\n[…]\nldSendSuccessPayload, buildSendErrorPayload, formatSendErrorMessage\n- parseRetryBackoff, getRetryDelayMs\n\nTests: 52 tests covering all new functionality (send-messages.test.js, cli-send-photo.test.js)",
"is_bot": false,
"headline": "feat: backport enhanced send options from dapi/tgcli",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T07:26:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "218784e84f40a971640f8250e6f258dc9ae88e65",
"body": "refactor: unify retry modules — delete retry.js, single send-utils.js",
"is_bot": false,
"headline": "Merge pull request #32 from kfastov/improve/unify-retry",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-29T02:02:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea695f76465417f9973d4693219e5a71c2b0a6d8",
"body": null,
"is_bot": false,
"headline": "refactor: unify retry modules into single send-utils.js",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-28T16:46:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02435ee95d88a315f84a73a78be13e61124ac0a3",
"body": "feat(core): add retry system with error classification and backoff strategies",
"is_bot": false,
"headline": "Merge pull request #18 from kfastov/backport/retry-system",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-28T16:41:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e5aad5d4341bf910afa2eb8ef025b21395943a67",
"body": "feat: improve message pagination UX (before-id, after-id, hasMore cursor)",
"is_bot": false,
"headline": "Merge pull request #31 from kfastov/improve/pagination-ux",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-28T16:14:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c94bb8aa628200c5e7e0f5f943a60bf40dc8bfe9",
"body": null,
"is_bot": false,
"headline": "docs: document --before-id/--after-id pagination and hasMore cursor",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-28T16:11:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "56a9804da689b631515f395307a1007587852a32",
"body": null,
"is_bot": false,
"headline": "fix: improve message pagination cursors",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-28T15:11:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73862b24e624d6262bfe0691ca069e1cd2b24230",
"body": "…d-work-with-read-mark\n\nfeat(channels): add mark-read support and channel listing with unread counts",
"is_bot": false,
"headline": "Merge pull request #17 from AlexanderMakarov/feature/dump-channels-an…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-28T15:04:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1221044103dd17845fbbd0b3fa733304e5f78528",
"body": "…rategies\n\nBackported from dapi/tgcli (https://github.com/dapi/tgcli)\nCo-authored-by: dapi",
"is_bot": false,
"headline": "feat(core): add retry system with error classification and backoff st…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-03-28T01:11:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a25a7e1562ca42e5345e108351d02e8be64a6e74",
"body": "Adds --offset-id CLI flag and corresponding offsetId support in\nTelegramClient.getMessagesByChannelId(), allowing callers to fetch\nmessages older than a given message ID. Useful for paginating through\nlarge channels without re-fetching already-seen messages.",
"is_bot": false,
"headline": "feat(messages): add --offset-id option for pagination",
"author_name": "4ellendger",
"author_login": "AlexanderMakarov",
"committed_at": "2026-03-01T20:50:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77b7b81b2b0a06fa931cde6db56865085367595b",
"body": null,
"is_bot": false,
"headline": "feat(cli): add channels mark-read command",
"author_name": "4ellendger",
"author_login": "AlexanderMakarov",
"committed_at": "2026-03-01T19:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e088e78142a057f23138e84b8c4b098c611239b",
"body": null,
"is_bot": false,
"headline": "feat(mcp): add markChannelRead tool",
"author_name": "4ellendger",
"author_login": "AlexanderMakarov",
"committed_at": "2026-03-01T19:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2f31551e613a183b624d3c50bffec12c50e0e1a",
"body": null,
"is_bot": false,
"headline": "feat(client): add markChannelRead method",
"author_name": "4ellendger",
"author_login": "AlexanderMakarov",
"committed_at": "2026-03-01T19:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "493a3e7fdbef1121b52a05cd4ba6644a8b42c8f4",
"body": "addOffset was set to -safeBefore (shifting toward older messages) instead\nof -safeAfter (shifting toward newer messages), so the history window\nnever included messages after the target.\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: messages context returned empty after due to wrong offset direction",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-02-26T06:39:29Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "458cc1821845def76a954b1003130692c2717883",
"body": "…ntities\n\n- Use Telegram contacts.search API instead of client-side dialog filtering\n- Detect and remove stale lock files from dead processes via PID check\n- Add shared read locks (LOCK.read.<pid>) so read-only commands don't block each other\n- Extract URLs from message entities (text_link, url) into new `urls` field\n- Add TODO for MCP server locking gap\n\nCo-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: native chat search, stale lock recovery, read/write locks, URL e…",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-02-26T05:03:51Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "abbb9c517230f0738d392c69aed3e302c84f57ab",
"body": null,
"is_bot": false,
"headline": "chore(release): v2.0.8",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-02-02T11:21:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3af26c13459dd14a12dbd17143e0e375ad9307af",
"body": null,
"is_bot": false,
"headline": "docs(skill): add tgcli skill",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-02-02T11:12:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "827bb6e5dca352f79afd6c734a2aa820c7b9bd37",
"body": null,
"is_bot": false,
"headline": "feat(cli): add config commands",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-02-02T08:35:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e3d825accd4c5371ccea5646f215d2213e2b714",
"body": null,
"is_bot": false,
"headline": "docs(readme): simplify",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-02-02T07:09:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "840d5bfd25871393b23a2ce213aa7ef6b4efd5d5",
"body": null,
"is_bot": false,
"headline": "fix(service): prevent mtcute shutdown warning",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-02-01T08:21:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d52c6ef33f14241de40f6b11a56569bc97f90ed",
"body": null,
"is_bot": false,
"headline": "chore(release): v2.0.7",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T12:34:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b52f7d61d2802937ee2911e2480ea5fda3201592",
"body": null,
"is_bot": false,
"headline": "feat(service): add background service commands",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T11:42:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1560996cf8714ca012cb1c61a7841bed5526db4f",
"body": null,
"is_bot": false,
"headline": "chore(release): v2.0.6",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T08:21:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84376cdf497267bb2160d4c46c1de3b340e0a680",
"body": null,
"is_bot": false,
"headline": "chore(release): v2.0.5",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T08:19:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6cd808f0c47b49c411071b53f56ecde6c32f18b4",
"body": null,
"is_bot": false,
"headline": "chore(release): v2.0.4",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T08:14:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c97a57eb1af52e0b3f4e0830ac42455068d8fb3e",
"body": null,
"is_bot": false,
"headline": "chore(release): v2.0.3",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T08:10:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "290e29ce4fccf5e30a980a00143ad1b640d42182",
"body": null,
"is_bot": false,
"headline": "ci: add release workflow",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T08:09:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a45654c828ae6603ad3f3d85a01ae685dac7e62",
"body": null,
"is_bot": false,
"headline": "fix(cli): improve messages display",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T07:49:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8dab3c8be2be8e5b3e9e9ba68f67b9a566f812bd",
"body": null,
"is_bot": false,
"headline": "refactor(cli): flatten groups invite",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T06:56:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8fc67a4613da0f29c7946678e259aa3d29db0d48",
"body": null,
"is_bot": false,
"headline": "refactor(cli): switch to commander",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-30T06:44:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "60e96a3e5d356d71f5972ea89ffb08dfcfbdfdb7",
"body": null,
"is_bot": false,
"headline": "fix(auth): clamp negative timeouts",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T14:17:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7407545c940116248990ffc1807e4d82cbe0375f",
"body": null,
"is_bot": false,
"headline": "chore(release): v2.0.1",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T13:50:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9da4ec34d54f03fca985e4cd03dcedb1b9e1ffe",
"body": null,
"is_bot": false,
"headline": "feat(auth): show account in status",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T10:36:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a02bb5a44c20f02c4eadf7199b66b2055913b03",
"body": null,
"is_bot": false,
"headline": "feat(auth): hide 2FA password input",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T10:22:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "072e378d8e7653f08aabad5ca6c6dbc8c3e57ec3",
"body": null,
"is_bot": false,
"headline": "feat(config): store credentials in tgcli store",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T09:44:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "56df257585e79e2cbc5d7f23e8c5308596b6de02",
"body": null,
"is_bot": false,
"headline": "chore: remove dotenv",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T09:09:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9cb37a4d1d6f7cb84053159cd231f2e962f61ece",
"body": null,
"is_bot": false,
"headline": "chore(release): bump to v2.0.0",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T06:43:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7025a4a84da357b58383ddff0914a12f6781e426",
"body": null,
"is_bot": false,
"headline": "docs: add migration guide",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T06:41:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a867226507f228707c9315b03a1d285214ce22aa",
"body": null,
"is_bot": false,
"headline": "docs: refresh tgcli docs",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T06:40:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cba053e47b97df5305dc901c770e60f14c136b8e",
"body": null,
"is_bot": false,
"headline": "feat(tgcli): rename CLI and unify store",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T06:40:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5cdf11360af91d5caf743f46f35cf45a1c1a0b41",
"body": null,
"is_bot": false,
"headline": "docs(plan): update tgcli rollout plan",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T06:24:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "014f643eef41b9f93bb86c78e3454b5fb01a7fea",
"body": null,
"is_bot": false,
"headline": "feat(core): extract shared store services",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-29T06:23:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c6b09d99e0ce043ce7f0b78f0d5d54a4554200ed",
"body": null,
"is_bot": false,
"headline": "feat(cli): add sync jobs and timeouts",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T09:52:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f1ab9ddd90814681840187840e567abe1aca5c8",
"body": null,
"is_bot": false,
"headline": "feat(cli): add channels/messages/tags/metadata commands",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T09:31:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "374ddb4fa9de19f3ceb5564ea1e215d46f762650",
"body": null,
"is_bot": false,
"headline": "chore(cli): add install script and refresh README",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T09:11:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b3b2dbc82cd19a4c7a34d85f0d97247db7ed9c47",
"body": null,
"is_bot": false,
"headline": "feat(contacts): add contacts/groups/topics tools",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T09:01:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c97088e6d7139369292e1d768de3819a67d066d3",
"body": null,
"is_bot": false,
"headline": "feat(mcp): retire legacy message tools",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T08:11:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfe3d00a84304c1d30e62bc5f725533e050eedde",
"body": null,
"is_bot": false,
"headline": "feat(media): add send/download and metadata",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T08:04:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "406fc47e24def4ba7f0ebda886ab17b8fd7a4415",
"body": null,
"is_bot": false,
"headline": "feat(storage): index message links and topics",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T07:21:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "daecfe77a8ee457d13b68797092af8267dd322b6",
"body": null,
"is_bot": false,
"headline": "feat(mcp): add consolidated message tools",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T07:03:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "162304ece19e1ebc535731c462c0236fc625a728",
"body": null,
"is_bot": false,
"headline": "feat(cli): add vnext scaffold",
"author_name": "Konstantin Fastov",
"author_login": "kfastov",
"committed_at": "2026-01-28T06:43:30Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 15,
"commits_last_year": 122,
"latest_release_at": "2026-07-17T08:49:59Z",
"latest_release_tag": "v2.2.3",
"releases_from_tags": false,
"days_since_last_push": 10,
"active_weeks_last_year": 12,
"days_since_latest_release": 10,
"mean_days_between_releases": 18.7
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@kfastov/tgcli",
"exists": true,
"license": "MIT",
"keywords": [
"telegram",
"telegram-client",
"mcp",
"mcp-server",
"mtproto",
"fastmcp",
"claude",
"cursor",
"ai-assistant",
"ai-agent"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@kfastov/tgcli",
"is_deprecated": false,
"latest_version": "2.2.3",
"repository_url": "https://github.com/kfastov/tgcli",
"versions_count": 12,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 708,
"first_published_at": "2026-01-29T11:52:33.192000Z",
"latest_published_at": "2026-07-17T08:50:30.528000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 10
}
]
},
"popularity": {
"forks": 20,
"stars": 40,
"watchers": 2,
"fork_history": {
"days": [
{
"date": "2025-03-20",
"count": 1
},
{
"date": "2025-03-26",
"count": 1
},
{
"date": "2025-04-01",
"count": 1
},
{
"date": "2025-04-03",
"count": 1
},
{
"date": "2025-04-10",
"count": 1
},
{
"date": "2025-04-29",
"count": 1
},
{
"date": "2025-10-08",
"count": 1
},
{
"date": "2025-11-15",
"count": 1
},
{
"date": "2025-11-18",
"count": 2
},
{
"date": "2025-12-19",
"count": 1
},
{
"date": "2026-01-11",
"count": 1
},
{
"date": "2026-02-26",
"count": 1
},
{
"date": "2026-03-04",
"count": 1
},
{
"date": "2026-03-06",
"count": 1
},
{
"date": "2026-04-13",
"count": 1
},
{
"date": "2026-05-23",
"count": 1
},
{
"date": "2026-06-17",
"count": 1
}
],
"complete": true,
"collected": 18,
"total_forks": 20
},
"star_history": null,
"open_issues_and_prs": 15
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 120064,
"source_files_sampled": 43,
"oversized_source_files": 3,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 3200
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [
{
"name": "@hono/node-server",
"direct": false,
"version": "1.19.15",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 5.9,
"advisory_ids": [
"GHSA-frvp-7c67-39w9"
],
"fixed_version": "2.0.5",
"advisory_count": 1,
"oldest_advisory_days": 6
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"moderate": 1
},
"advisory_count": 1,
"affected_count": 1,
"assessed_count": 182,
"malicious_count": 0,
"assessed_package": "npm:@kfastov/tgcli@2.2.3",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@modelcontextprotocol/sdk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.25.2"
},
{
"name": "@mtcute/core",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.27.8"
},
{
"name": "@mtcute/node",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.27.8"
},
{
"name": "better-sqlite3",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^12.6.0"
},
{
"name": "commander",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^12.1.0"
},
{
"name": "qrcode",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.5.4"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "@modelcontextprotocol/sdk",
"direct": true,
"version": "1.25.2",
"ecosystem": "npm"
},
{
"name": "@mtcute/core",
"direct": true,
"version": "0.27.8",
"ecosystem": "npm"
},
{
"name": "@mtcute/node",
"direct": true,
"version": "0.27.8",
"ecosystem": "npm"
},
{
"name": "better-sqlite3",
"direct": true,
"version": "12.6.0",
"ecosystem": "npm"
},
{
"name": "commander",
"direct": true,
"version": "12.1.0",
"ecosystem": "npm"
},
{
"name": "qrcode",
"direct": true,
"version": "1.5.4",
"ecosystem": "npm"
},
{
"name": "@emnapi/core",
"direct": false,
"version": "1.9.1",
"ecosystem": "npm"
},
{
"name": "@emnapi/runtime",
"direct": false,
"version": "1.9.1",
"ecosystem": "npm"
},
{
"name": "@emnapi/wasi-threads",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "@fuman/io",
"direct": false,
"version": "0.0.19",
"ecosystem": "npm"
},
{
"name": "@fuman/net",
"direct": false,
"version": "0.0.19",
"ecosystem": "npm"
},
{
"name": "@fuman/node",
"direct": false,
"version": "0.0.19",
"ecosystem": "npm"
},
{
"name": "@fuman/utils",
"direct": false,
"version": "0.0.15",
"ecosystem": "npm"
},
{
"name": "@fuman/utils",
"direct": false,
"version": "0.0.19",
"ecosystem": "npm"
},
{
"name": "@hono/node-server",
"direct": false,
"version": "1.19.8",
"ecosystem": "npm"
},
{
"name": "@jridgewell/sourcemap-codec",
"direct": false,
"version": "1.5.5",
"ecosystem": "npm"
},
{
"name": "@mtcute/file-id",
"direct": false,
"version": "0.27.8",
"ecosystem": "npm"
},
{
"name": "@mtcute/html-parser",
"direct": false,
"version": "0.27.8",
"ecosystem": "npm"
},
{
"name": "@mtcute/markdown-parser",
"direct": false,
"version": "0.27.8",
"ecosystem": "npm"
},
{
"name": "@mtcute/tl",
"direct": false,
"version": "221.0.0",
"ecosystem": "npm"
},
{
"name": "@mtcute/tl-runtime",
"direct": false,
"version": "0.24.3",
"ecosystem": "npm"
},
{
"name": "@mtcute/wasm",
"direct": false,
"version": "0.27.8",
"ecosystem": "npm"
},
{
"name": "@napi-rs/wasm-runtime",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "@oxc-project/types",
"direct": false,
"version": "0.122.0",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-android-arm64",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-darwin-arm64",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-darwin-x64",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-freebsd-x64",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-linux-arm-gnueabihf",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-linux-arm64-gnu",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-linux-arm64-musl",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-linux-ppc64-gnu",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-linux-s390x-gnu",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-linux-x64-gnu",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-linux-x64-musl",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-openharmony-arm64",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-wasm32-wasi",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-win32-arm64-msvc",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/binding-win32-x64-msvc",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@rolldown/pluginutils",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "@standard-schema/spec",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "@tybys/wasm-util",
"direct": false,
"version": "0.10.1",
"ecosystem": "npm"
},
{
"name": "@types/chai",
"direct": false,
"version": "5.2.3",
"ecosystem": "npm"
},
{
"name": "@types/deep-eql",
"direct": false,
"version": "4.0.2",
"ecosystem": "npm"
},
{
"name": "@types/estree",
"direct": false,
"version": "1.0.8",
"ecosystem": "npm"
},
{
"name": "@types/events",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "@vitest/expect",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "@vitest/mocker",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "@vitest/pretty-format",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "@vitest/runner",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "@vitest/snapshot",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "@vitest/spy",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "@vitest/utils",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "accepts",
"direct": false,
"version": "1.3.8",
"ecosystem": "npm"
},
{
"name": "accepts",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "ajv",
"direct": false,
"version": "8.17.1",
"ecosystem": "npm"
},
{
"name": "ajv-formats",
"direct": false,
"version": "3.0.1",
"ecosystem": "npm"
},
{
"name": "ansi-regex",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "ansi-styles",
"direct": false,
"version": "4.3.0",
"ecosystem": "npm"
},
{
"name": "array-flatten",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "assertion-error",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "base64-js",
"direct": false,
"version": "1.5.1",
"ecosystem": "npm"
},
{
"name": "bindings",
"direct": false,
"version": "1.5.0",
"ecosystem": "npm"
},
{
"name": "bl",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "body-parser",
"direct": false,
"version": "1.20.3",
"ecosystem": "npm"
},
{
"name": "body-parser",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "buffer",
"direct": false,
"version": "5.7.1",
"ecosystem": "npm"
},
{
"name": "bytes",
"direct": false,
"version": "3.1.2",
"ecosystem": "npm"
},
{
"name": "call-bind-apply-helpers",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "call-bound",
"direct": false,
"version": "1.0.4",
"ecosystem": "npm"
},
{
"name": "camelcase",
"direct": false,
"version": "5.3.1",
"ecosystem": "npm"
},
{
"name": "chai",
"direct": false,
"version": "6.2.2",
"ecosystem": "npm"
},
{
"name": "chownr",
"direct": false,
"version": "1.1.4",
"ecosystem": "npm"
},
{
"name": "cliui",
"direct": false,
"version": "6.0.0",
"ecosystem": "npm"
},
{
"name": "color-convert",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "color-name",
"direct": false,
"version": "1.1.4",
"ecosystem": "npm"
},
{
"name": "content-disposition",
"direct": false,
"version": "0.5.4",
"ecosystem": "npm"
},
{
"name": "content-disposition",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "content-type",
"direct": false,
"version": "1.0.5",
"ecosystem": "npm"
},
{
"name": "convert-source-map",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "cookie",
"direct": false,
"version": "0.7.1",
"ecosystem": "npm"
},
{
"name": "cookie-signature",
"direct": false,
"version": "1.0.6",
"ecosystem": "npm"
},
{
"name": "cookie-signature",
"direct": false,
"version": "1.2.2",
"ecosystem": "npm"
},
{
"name": "cors",
"direct": false,
"version": "2.8.5",
"ecosystem": "npm"
},
{
"name": "cross-spawn",
"direct": false,
"version": "7.0.6",
"ecosystem": "npm"
},
{
"name": "debug",
"direct": false,
"version": "2.6.9",
"ecosystem": "npm"
},
{
"name": "debug",
"direct": false,
"version": "4.3.6",
"ecosystem": "npm"
},
{
"name": "debug",
"direct": false,
"version": "4.4.0",
"ecosystem": "npm"
},
{
"name": "decamelize",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "decompress-response",
"direct": false,
"version": "6.0.0",
"ecosystem": "npm"
},
{
"name": "deep-extend",
"direct": false,
"version": "0.6.0",
"ecosystem": "npm"
},
{
"name": "depd",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "destroy",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "detect-libc",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "dijkstrajs",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "dom-serializer",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "domelementtype",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
},
{
"name": "domhandler",
"direct": false,
"version": "5.0.3",
"ecosystem": "npm"
},
{
"name": "domutils",
"direct": false,
"version": "3.2.2",
"ecosystem": "npm"
},
{
"name": "dunder-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "ee-first",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "emoji-regex",
"direct": false,
"version": "8.0.0",
"ecosystem": "npm"
},
{
"name": "encodeurl",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "encodeurl",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "end-of-stream",
"direct": false,
"version": "1.4.5",
"ecosystem": "npm"
},
{
"name": "entities",
"direct": false,
"version": "4.5.0",
"ecosystem": "npm"
},
{
"name": "entities",
"direct": false,
"version": "7.0.1",
"ecosystem": "npm"
},
{
"name": "es-define-property",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "es-errors",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "es-module-lexer",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "es-object-atoms",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "escape-html",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "estree-walker",
"direct": false,
"version": "3.0.3",
"ecosystem": "npm"
},
{
"name": "etag",
"direct": false,
"version": "1.8.1",
"ecosystem": "npm"
},
{
"name": "eventsource",
"direct": false,
"version": "3.0.5",
"ecosystem": "npm"
},
{
"name": "eventsource-parser",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "expand-template",
"direct": false,
"version": "2.0.3",
"ecosystem": "npm"
},
{
"name": "expect-type",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "express",
"direct": false,
"version": "4.21.2",
"ecosystem": "npm"
},
{
"name": "express",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "express-rate-limit",
"direct": false,
"version": "7.5.0",
"ecosystem": "npm"
},
{
"name": "fast-deep-equal",
"direct": false,
"version": "3.1.3",
"ecosystem": "npm"
},
{
"name": "fast-uri",
"direct": false,
"version": "3.1.0",
"ecosystem": "npm"
},
{
"name": "fdir",
"direct": false,
"version": "6.5.0",
"ecosystem": "npm"
},
{
"name": "file-uri-to-path",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "finalhandler",
"direct": false,
"version": "1.3.1",
"ecosystem": "npm"
},
{
"name": "finalhandler",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "find-up",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "forwarded",
"direct": false,
"version": "0.2.0",
"ecosystem": "npm"
},
{
"name": "fresh",
"direct": false,
"version": "0.5.2",
"ecosystem": "npm"
},
{
"name": "fresh",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "fs-constants",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "fsevents",
"direct": false,
"version": "2.3.3",
"ecosystem": "npm"
},
{
"name": "function-bind",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "get-caller-file",
"direct": false,
"version": "2.0.5",
"ecosystem": "npm"
},
{
"name": "get-intrinsic",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "get-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "github-from-package",
"direct": false,
"version": "0.0.0",
"ecosystem": "npm"
},
{
"name": "gopd",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "has-symbols",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "hasown",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "hono",
"direct": false,
"version": "4.11.4",
"ecosystem": "npm"
},
{
"name": "htmlparser2",
"direct": false,
"version": "10.1.0",
"ecosystem": "npm"
},
{
"name": "http-errors",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "iconv-lite",
"direct": false,
"version": "0.4.24",
"ecosystem": "npm"
},
{
"name": "iconv-lite",
"direct": false,
"version": "0.5.2",
"ecosystem": "npm"
},
{
"name": "iconv-lite",
"direct": false,
"version": "0.6.3",
"ecosystem": "npm"
},
{
"name": "ieee754",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "inherits",
"direct": false,
"version": "2.0.4",
"ecosystem": "npm"
},
{
"name": "ini",
"direct": false,
"version": "1.3.8",
"ecosystem": "npm"
},
{
"name": "ipaddr.js",
"direct": false,
"version": "1.9.1",
"ecosystem": "npm"
},
{
"name": "is-fullwidth-code-point",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "is-promise",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "isexe",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "jose",
"direct": false,
"version": "6.1.3",
"ecosystem": "npm"
},
{
"name": "json-schema-traverse",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "json-schema-typed",
"direct": false,
"version": "8.0.2",
"ecosystem": "npm"
},
{
"name": "lightningcss",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-android-arm64",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-darwin-arm64",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-darwin-x64",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-freebsd-x64",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-linux-arm-gnueabihf",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-linux-arm64-gnu",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-linux-arm64-musl",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-linux-x64-gnu",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-linux-x64-musl",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-win32-arm64-msvc",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "lightningcss-win32-x64-msvc",
"direct": false,
"version": "1.32.0",
"ecosystem": "npm"
},
{
"name": "locate-path",
"direct": false,
"version": "5.0.0",
"ecosystem": "npm"
},
{
"name": "long",
"direct": false,
"version": "5.2.3",
"ecosystem": "npm"
},
{
"name": "magic-string",
"direct": false,
"version": "0.30.21",
"ecosystem": "npm"
},
{
"name": "math-intrinsics",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "media-typer",
"direct": false,
"version": "0.3.0",
"ecosystem": "npm"
},
{
"name": "media-typer",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "merge-descriptors",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "merge-descriptors",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "methods",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "mime",
"direct": false,
"version": "1.6.0",
"ecosystem": "npm"
},
{
"name": "mime-db",
"direct": false,
"version": "1.52.0",
"ecosystem": "npm"
},
{
"name": "mime-db",
"direct": false,
"version": "1.53.0",
"ecosystem": "npm"
},
{
"name": "mime-types",
"direct": false,
"version": "2.1.35",
"ecosystem": "npm"
},
{
"name": "mime-types",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "mimic-response",
"direct": false,
"version": "3.1.0",
"ecosystem": "npm"
},
{
"name": "minimist",
"direct": false,
"version": "1.2.8",
"ecosystem": "npm"
},
{
"name": "mkdirp-classic",
"direct": false,
"version": "0.5.3",
"ecosystem": "npm"
},
{
"name": "ms",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "ms",
"direct": false,
"version": "2.1.2",
"ecosystem": "npm"
},
{
"name": "ms",
"direct": false,
"version": "2.1.3",
"ecosystem": "npm"
},
{
"name": "nanoid",
"direct": false,
"version": "3.3.11",
"ecosystem": "npm"
},
{
"name": "napi-build-utils",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "negotiator",
"direct": false,
"version": "0.6.3",
"ecosystem": "npm"
},
{
"name": "negotiator",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "node-abi",
"direct": false,
"version": "3.77.0",
"ecosystem": "npm"
},
{
"name": "object-assign",
"direct": false,
"version": "4.1.1",
"ecosystem": "npm"
},
{
"name": "object-inspect",
"direct": false,
"version": "1.13.4",
"ecosystem": "npm"
},
{
"name": "obug",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "on-finished",
"direct": false,
"version": "2.4.1",
"ecosystem": "npm"
},
{
"name": "once",
"direct": false,
"version": "1.4.0",
"ecosystem": "npm"
},
{
"name": "p-limit",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
},
{
"name": "p-locate",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "p-try",
"direct": false,
"version": "2.2.0",
"ecosystem": "npm"
},
{
"name": "parseurl",
"direct": false,
"version": "1.3.3",
"ecosystem": "npm"
},
{
"name": "path-exists",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "path-key",
"direct": false,
"version": "3.1.1",
"ecosystem": "npm"
},
{
"name": "path-to-regexp",
"direct": false,
"version": "0.1.12",
"ecosystem": "npm"
},
{
"name": "path-to-regexp",
"direct": false,
"version": "8.2.0",
"ecosystem": "npm"
},
{
"name": "pathe",
"direct": false,
"version": "2.0.3",
"ecosystem": "npm"
},
{
"name": "picocolors",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "picomatch",
"direct": false,
"version": "4.0.4",
"ecosystem": "npm"
},
{
"name": "pkce-challenge",
"direct": false,
"version": "5.0.0",
"ecosystem": "npm"
},
{
"name": "pngjs",
"direct": false,
"version": "5.0.0",
"ecosystem": "npm"
},
{
"name": "postcss",
"direct": false,
"version": "8.5.8",
"ecosystem": "npm"
},
{
"name": "prebuild-install",
"direct": false,
"version": "7.1.3",
"ecosystem": "npm"
},
{
"name": "proxy-addr",
"direct": false,
"version": "2.0.7",
"ecosystem": "npm"
},
{
"name": "pump",
"direct": false,
"version": "3.0.3",
"ecosystem": "npm"
},
{
"name": "qs",
"direct": false,
"version": "6.13.0",
"ecosystem": "npm"
},
{
"name": "qs",
"direct": false,
"version": "6.14.0",
"ecosystem": "npm"
},
{
"name": "range-parser",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "raw-body",
"direct": false,
"version": "2.5.2",
"ecosystem": "npm"
},
{
"name": "raw-body",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "rc",
"direct": false,
"version": "1.2.8",
"ecosystem": "npm"
},
{
"name": "readable-stream",
"direct": false,
"version": "3.6.2",
"ecosystem": "npm"
},
{
"name": "require-directory",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "require-from-string",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "require-main-filename",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "rolldown",
"direct": false,
"version": "1.0.0-rc.12",
"ecosystem": "npm"
},
{
"name": "router",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "safe-buffer",
"direct": false,
"version": "5.2.1",
"ecosystem": "npm"
},
{
"name": "safer-buffer",
"direct": false,
"version": "2.1.2",
"ecosystem": "npm"
},
{
"name": "semver",
"direct": false,
"version": "7.7.2",
"ecosystem": "npm"
},
{
"name": "send",
"direct": false,
"version": "0.19.0",
"ecosystem": "npm"
},
{
"name": "send",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "serve-static",
"direct": false,
"version": "1.16.2",
"ecosystem": "npm"
},
{
"name": "serve-static",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "set-blocking",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "setprototypeof",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "shebang-command",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "shebang-regex",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "side-channel",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "side-channel-list",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "side-channel-map",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "side-channel-weakmap",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "siginfo",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "simple-concat",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "simple-get",
"direct": false,
"version": "4.0.1",
"ecosystem": "npm"
},
{
"name": "source-map-js",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "stackback",
"direct": false,
"version": "0.0.2",
"ecosystem": "npm"
},
{
"name": "statuses",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "std-env",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "string-width",
"direct": false,
"version": "4.2.3",
"ecosystem": "npm"
},
{
"name": "string_decoder",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "strip-ansi",
"direct": false,
"version": "6.0.1",
"ecosystem": "npm"
},
{
"name": "strip-json-comments",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "tar-fs",
"direct": false,
"version": "2.1.4",
"ecosystem": "npm"
},
{
"name": "tar-stream",
"direct": false,
"version": "2.2.0",
"ecosystem": "npm"
},
{
"name": "tinybench",
"direct": false,
"version": "2.9.0",
"ecosystem": "npm"
},
{
"name": "tinyexec",
"direct": false,
"version": "1.0.4",
"ecosystem": "npm"
},
{
"name": "tinyglobby",
"direct": false,
"version": "0.2.15",
"ecosystem": "npm"
},
{
"name": "tinyrainbow",
"direct": false,
"version": "3.1.0",
"ecosystem": "npm"
},
{
"name": "toidentifier",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "tslib",
"direct": false,
"version": "2.8.1",
"ecosystem": "npm"
},
{
"name": "tunnel-agent",
"direct": false,
"version": "0.6.0",
"ecosystem": "npm"
},
{
"name": "type-is",
"direct": false,
"version": "1.6.18",
"ecosystem": "npm"
},
{
"name": "type-is",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "unpipe",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "util-deprecate",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "utils-merge",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "vary",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "vite",
"direct": false,
"version": "8.0.3",
"ecosystem": "npm"
},
{
"name": "vitest",
"direct": false,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "which",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "which-module",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "why-is-node-running",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
},
{
"name": "wrap-ansi",
"direct": false,
"version": "6.2.0",
"ecosystem": "npm"
},
{
"name": "wrappy",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "y18n",
"direct": false,
"version": "4.0.3",
"ecosystem": "npm"
},
{
"name": "yargs",
"direct": false,
"version": "15.4.1",
"ecosystem": "npm"
},
{
"name": "yargs-parser",
"direct": false,
"version": "18.1.3",
"ecosystem": "npm"
},
{
"name": "zod",
"direct": false,
"version": "4.3.5",
"ecosystem": "npm"
},
{
"name": "zod-to-json-schema",
"direct": false,
"version": "3.25.1",
"ecosystem": "npm"
}
],
"collected": true,
"truncated": false,
"total_count": 281,
"direct_count": 6,
"indirect_count": 275
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 22,
"open_issues": 13,
"closed_ratio": 0.552,
"closed_issues": 16,
"closed_unmerged_prs": 4
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "kfastov",
"commits": 136,
"avatar_url": "https://avatars.githubusercontent.com/u/1312744?v=4"
},
{
"type": "User",
"login": "AlexanderMakarov",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/2630978?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.971
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 12 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/16 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "55 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "b738f3bc9a0b2dffa664285a5a44b5d7f410e7a6",
"ran_at": "2026-07-28T03:31:57Z",
"aggregate_score": 4,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-17T08:50:43Z",
"oldest_open_prs": [
{
"number": 35,
"created_at": "2026-04-13T06:23:43Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 56,
"created_at": "2026-06-17T12:43:04Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-14T17:17:07Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 5,
"created_at": "2025-04-14T12:52:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 7,
"created_at": "2025-04-14T15:31:21Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 9,
"created_at": "2025-04-22T11:30:02Z",
"last_comment_at": "2025-04-30T08:14:59Z",
"last_comment_author": "kfastov"
},
{
"number": 22,
"created_at": "2026-03-28T07:36:05Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 27,
"created_at": "2026-03-28T08:40:40Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 29,
"created_at": "2026-03-28T08:40:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 39,
"created_at": "2026-06-03T09:20:10Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 40,
"created_at": "2026-06-03T09:39:14Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 43,
"created_at": "2026-06-03T12:59:03Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 49,
"created_at": "2026-06-04T12:38:26Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 50,
"created_at": "2026-06-04T12:38:29Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 51,
"created_at": "2026-06-04T12:38:33Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 58,
"created_at": "2026-07-17T09:15:32Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/kfastov/tgcli",
"host": "github.com",
"name": "tgcli",
"owner": "kfastov"
},
"metrics": {
"overall": {
"key": "overall",
"band": "critical",
"name": "Overall health",
"note": "High-Risk Jurisdiction Policy applies a 20% multiplier to weighted overall health and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "jurisdiction_overall_adjustment",
"params": {
"cap": 49,
"pct": 20
}
}
],
"value": 11,
"inputs": {
"security": 24,
"vitality": 79,
"community": 44,
"governance": 52,
"engineering": 63,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 20,
"weighted_overall_before_jurisdiction": 54,
"overall_after_jurisdiction_multiplier": 11
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 79,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"commits_last_year": 122,
"human_commit_share": 1,
"days_since_last_push": 10,
"active_weeks_last_year": 12
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 10 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "12/52 weeks with commits",
"points": 8.3,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 12
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "122 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 122
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 15,
"latest_release_tag": "v2.2.3",
"releases_from_tags": false,
"days_since_latest_release": 10,
"mean_days_between_releases": 18.7
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "15 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 15
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 10 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~18.7 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 18.7
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 10,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 10 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 10
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 44,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 36,
"inputs": {
"forks": 20,
"stars": 40,
"watchers": 2,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "40 stars",
"points": 25.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 40
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "20 forks",
"points": 10.7,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 20
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "2 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 2
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "at_risk",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 48,
"inputs": {
"packages": [
"@kfastov/tgcli"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 708
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "708 downloads/month across npm",
"points": 38,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 708,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 52,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 12,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.971
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 97% of commits",
"points": 0.7,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 97
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"merged_prs": 22,
"open_issues": 13,
"closed_issues": 16,
"issue_closed_ratio": 0.552,
"closed_unmerged_prs": 4
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "55% of issues closed",
"points": 25.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 55
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "22/26 decided PRs merged",
"points": 32.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 22,
"decided": 26
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/16 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 54,
"inputs": {
"followers": 13,
"owner_type": "User",
"is_verified": null,
"owner_login": "kfastov",
"public_repos": 94,
"account_age_days": 5314
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "13 followers of kfastov",
"points": 8.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 13,
"login": "kfastov"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "94 public repos, account ~14 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 94
}
},
{
"code": "account_age_years",
"params": {
"years": 14
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@kfastov/tgcli"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 10
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 10 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 10
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "12 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 12
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 63,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 48,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 12 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"topics": [
"ai-agents",
"mcp",
"mcp-server",
"telegram",
"telegram-client",
"agent-skill",
"ai"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "7 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 7
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 24,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 20% multiplier to Security posture and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "jurisdiction_posture_adjustment",
"params": {
"cap": 49,
"pct": 20
}
}
],
"value": 8,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 20,
"security_posture_after_multiplier": 8,
"security_posture_before_jurisdiction": 40
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 12 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/16 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "55 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Matched the npm:@kfastov/tgcli@2.2.3 runtime dependency closure — what installing the published package pulls in — 182 packages. Reachability is not analyzed.",
"notes": [
{
"code": "advisories_scope_published",
"params": {
"package": "npm:@kfastov/tgcli@2.2.3",
"assessed": 182
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 88,
"inputs": {
"source": "osv",
"advisories": 1,
"affected_packages": 1,
"assessed_packages": 182,
"unassessed_packages": 0,
"affected_by_severity": "moderate 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "1 affected: @hono/node-server 1.19.15 (moderate 5.9)",
"points": 13.2,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "@hono/node-server 1.19.15 (moderate 5.9)"
}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory has been public longer than 90 days",
"points": 40,
"status": "met",
"details": [
{
"code": "advisories_none_stale",
"params": {
"days": 90
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 182,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "critical",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 20,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": true,
"exposures": [
{
"role": "owner",
"count": 1,
"country": "Russia"
},
{
"role": "top_contributor",
"count": 1,
"country": "Russia"
}
],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "Russia: owner (1); Russia: top_contributor (1)",
"points": 20,
"status": "partial",
"details": [
{
"code": "jurisdiction_exposure",
"params": {
"role": "owner",
"count": 1,
"country": "Russia"
}
},
{
"code": "jurisdiction_exposure_next",
"params": {
"role": "top_contributor",
"count": 1,
"country": "Russia"
}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 51,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.99,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 3200
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 99,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "at_risk",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 36,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.02,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "2 of the last 100 commits agent-authored or agent-credited",
"points": 4,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 51,
"inputs": {
"primary_language": "JavaScript",
"largest_source_bytes": 120064,
"source_files_sampled": 43,
"oversized_source_files": 3
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "JavaScript without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "JavaScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "3/43 source files over 60KB",
"points": 51.2,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 43,
"oversized": 3
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "critical",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 20,
"inputs": {
"example_dirs": [],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-28T03:32:13.226192Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kfastov/tgcli.svg",
"full_name": "kfastov/tgcli",
"license_state": "standard",
"license_spdx": "MIT"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — npm.