Public recordAt risk
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-30 21:49 UTC
mindsdb / cowork-server
FastAPI backend for MindsHub Cowork. Manages projects, conversations, files, scheduling, memory, and agent orchestration with a SQLite-backed data layer.
mindsdb/cowork-server holds a health index of 32 out of 100, placing it in the At risk band. It scores highest on Sustainability & Governance (85/100) and lowest on Security (35/100). It was last updated today. 3 contributors account for most of its recent work.
32
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
32
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
High-Risk Jurisdiction Policy applies a 50% multiplier to weighted overall health and gives it an At risk ceiling of 49.
Ownership
MindsDB IncOrganization
1,416 followers57 public repossince Aug 2017
This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish |
|---|---|---|---|---|---|
| PyPI | cowork-server | 0.26.7.27.3 | 4,576 | 51 | 3 days ago |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
77
Development activity
62Moderate
How it's scored
| 36/36 | Push recency — last push 0 days ago |
| 7.6/36 | Commit cadence — 11/52 weeks with commits |
| 18/18 | Commit volume — 601 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Inputs used
| commits_last_year | 601 |
| human_commit_share | 0.99 |
| days_since_last_push | 0 |
| active_weeks_last_year | 11 |
Release discipline
100Excellent
How it's scored
| 27/27 | Ships releases — 54 releases published |
| 36/36 | Release recency — latest release 0 days ago |
| 27/27 | Release cadence — a release every ~0.3 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 54 |
| latest_release_tag | v0.26.7.30.1rc5 |
| releases_from_tags | no |
| days_since_latest_release | 0 |
| mean_days_between_releases | 0.3 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
38
Popularity & adoption
13Critical
How it's scored
| 7.7/60 | Stars — 4 stars |
| 5/25 | Forks — 5 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 5 |
| stars | 4 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
50Moderate
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (AGPL-3.0) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Ecosystem adoption (downloads)
61Moderate
How it's scored
| 48.8/80 | Monthly downloads — 4,576 downloads/month across pypi |
| 0/20 | Registry dependents — not reported by this ecosystem |
Inputs used
| packages | cowork-server |
| dependents | — |
| ecosystems | pypi |
| total_downloads | — |
| monthly_downloads | 4,576 |
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
85
How it's scored
| 36/54 | Bus factor — 3 contributor(s) cover half of all commits |
| 17.2/22.5 | Commit distribution — top contributor authored 24% of commits |
| 13.5/13.5 | Contributor breadth — 15 contributors |
| 10/10 | OpenSSF Scorecard: Contributors — project has 18 contributing companies or organizations |
Inputs used
| bus_factor | 3 |
| contributors_sampled | 15 |
| top_contributor_share | 0.236 |
Issue & PR responsiveness
91Excellent
How it's scored
| 46.8/46.8 | Issue resolution — 100% of issues closed |
| 31.1/38.3 | PR acceptance — 178/219 decided PRs merged |
| 13.5/15 | OpenSSF Scorecard: Code-Review — Found 12/13 approved changesets -- score normalized to 9 |
Inputs used
| merged_prs | 178 |
| open_issues | 0 |
| closed_issues | 1 |
| issue_closed_ratio | 1 |
| closed_unmerged_prs | 41 |
Ownership & stewardship
78Good
How it's scored
| 30/30 | Ownership backing — organization-owned |
| 0/20 | Verified domain |
| 22.7/25 | Owner reach — 1,416 followers of mindsdb |
| 24.8/25 | Track record — 57 public repos, account ~8 yr old |
Inputs used
| followers | 1,416 |
| owner_type | Organization |
| is_verified | — |
| owner_login | mindsdb |
| public_repos | 57 |
| account_age_days | 3,271 |
Package maintenance
100Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on pypi |
| 35/35 | Publish recency — latest publish 3 days ago |
| 20/20 | Version history — 51 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | cowork-server |
| ecosystems | pypi |
| any_deprecated | no |
| min_days_since_publish | 3 |
Engineering Quality
Are baseline engineering and documentation practices in place?
77
Engineering practices
68Moderate
How it's scored
| 24/24 | CI workflows — 11 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard: CI-Tests — 14 out of 14 merged PRs checked by a CI test -- score normalized to 10 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Documentation
90Excellent
How it's scored
| 30/30 | README |
| 25/25 | Documentation directory |
| 15/15 | Documentation / homepage site — https://mindshub.ai |
| 10/10 | Repository description |
| 0/10 | Topics |
| 10/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | yes |
| homepage | https://mindshub.ai |
| has_readme | yes |
| has_docs_dir | yes |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
35
Security posture
28Critical
Jurisdiction risk alert
High-risk jurisdiction exposure detected
2 top contributor profilesRussiaSecurity and overall rating: At risk ceiling
Based on self-published public profile locations. This governance signal does not determine nationality, citizenship, intent, sanctions status, or individual trustworthiness.
How jurisdiction exposure is assessedHow it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — no data |
| 2.5/2.5 | CI-Tests — 14 out of 14 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 6.8/7.5 | Code-Review — Found 12/13 approved changesets -- score normalized to 9 |
| 2.5/2.5 | Contributors — project has 18 contributing companies or organizations |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0.5/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1 |
| 5/5 | SAST — SAST tool is run on all commits |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 14 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 5.5 |
| high_risk_jurisdiction_cap | 49 |
| high_risk_jurisdiction_multiplier | 50 |
| security_posture_after_multiplier | 28 |
| security_posture_before_jurisdiction | 55 |
Excluded from scoring (no data or not applicable): branch_protection, signed_releases. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 50% multiplier and gives Security posture an At risk ceiling of 49.
Dependency advisories
61Moderate
How it's scored
| 14.6/35 | Direct dependencies free of known advisories — 1 affected: hermes-agent 0.17.0 (high 7.3) |
| 6.8/25 | Indirect dependencies free of known advisories — 1 affected: pillow 12.2.0 (critical 9.1) |
| 40/40 | No advisories left outstanding — no advisory has been public longer than 90 days |
Inputs used
| source | osv |
| advisories | 30 |
| affected_packages | 2 |
| assessed_packages | 103 |
| unassessed_packages | 0 |
| affected_by_severity | critical 1, high 1 |
| direct_affected_packages | 1 |
Matched the pypi:cowork-server@0.26.7.27.3 runtime dependency closure — what installing the published package pulls in — 103 packages. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
50
Agent context & guidance
33At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 32.9/40 | Legible commit history — 61 of 99 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.616 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Verify loop (build / test / typecheck)
61Moderate
How it's scored
| 18/18 | One-command bootstrap — Makefile |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 0/11 | Static type checking |
| 10/10 | Reproducible environment — Dockerfile, lockfile |
| 10/10 | Demonstrated agent practice — 25 of the last 100 commits agent-authored or agent-credited |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 1/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | uv.lock |
| has_dockerfile | yes |
| typed_language | no |
| bootstrap_files | Makefile |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0.25 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Code legibility for models
55Moderate
How it's scored
| 0/45 | Type-checkable code — Python without a type-check config |
| 55/55 | Manageable file sizes — 0/234 source files over 60KB |
Inputs used
| primary_language | Python |
| largest_source_bytes | 55,763 |
| source_files_sampled | 234 |
| oversized_source_files | 0 |
Key facts
4GitHub stars
15contributors
601commits, last 12 months
0days since last push
54releases
3bus factor
0open issues
PyPIpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
Star and fork history 0 ★ / 5 ⇿
0Stars
5Forks
10Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 0Patch 0
OpenSSF Scorecard 5.5 / 10
5.5aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| n/a | Branch-Protection | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| 10 | CI-Tests | 14 out of 14 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 9 | Code-Review | Found 12/13 approved changesets -- score normalized to 9 |
| 10 | Contributors | project has 18 contributing companies or organizations |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 1 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 1 |
| 10 | SAST | SAST tool is run on all commits |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 14 existing vulnerabilities detected |
Direct dependencies 17
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| PyPI | alembic | >=1.17.0 | pyproject.toml |
| PyPI | anton-agent | >=2.26.6.30.1,<3 | pyproject.toml |
| PyPI | cryptography | >=48.0.0 | pyproject.toml |
| PyPI | fastapi | >=0.136.1 | pyproject.toml |
| PyPI | hermes-agent | >=0.15.2,<0.18 | pyproject.toml |
| PyPI | httpx | >=0.27 | pyproject.toml |
| PyPI | pydantic | >=2.12.5 | pyproject.toml |
| PyPI | pydantic-settings | >=2.14.1 | pyproject.toml |
| PyPI | psycopg | >=3.2 | pyproject.toml |
| PyPI | python-multipart | >=0.0.28 | pyproject.toml |
| PyPI | sqlmodel | >=0.0.38 | pyproject.toml |
| PyPI | tzlocal | >=5.0 | pyproject.toml |
| PyPI | uvicorn | >=0.47.0 | pyproject.toml |
| PyPI | markdown | >=3.7 | pyproject.toml |
| PyPI | xhtml2pdf | >=0.2.16 | pyproject.toml |
| PyPI | python-docx | >=1.1.2 | pyproject.toml |
| PyPI | htmldocx | >=0.0.6 | pyproject.toml |
All dependencies 118
Full resolved dependency set from the GitHub dependency graph: 17 direct and 101 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
| Registry | Package | Version | Relation |
|---|---|---|---|
| PyPI | alembic | 1.18.4 | direct |
| PyPI | anton-agent | 2.26.7.6.2 | direct |
| PyPI | cryptography | 48.0.1 | direct |
| PyPI | fastapi | 0.136.3 | direct |
| PyPI | hermes-agent | 0.17.0 | direct |
| PyPI | htmldocx | 0.0.6 | direct |
| PyPI | httpx | 0.28.1 | direct |
| PyPI | markdown | 3.10.2 | direct |
| PyPI | psycopg | 3.3.4 | direct |
| PyPI | pydantic | 2.13.4 | direct |
| PyPI | pydantic-settings | 2.14.1 | direct |
| PyPI | python-docx | 1.2.0 | direct |
| PyPI | python-multipart | 0.0.32 | direct |
| PyPI | sqlmodel | 0.0.38 | direct |
| PyPI | tzlocal | 5.4.3 | direct |
| PyPI | uvicorn | 0.49.0 | direct |
| PyPI | xhtml2pdf | 0.2.17 | direct |
| PyPI | aiohappyeyeballs | 2.6.2 | indirect |
| PyPI | aiohttp | 3.14.0 | indirect |
| PyPI | aiosignal | 1.4.0 | indirect |
| PyPI | annotated-doc | 0.0.4 | indirect |
| PyPI | annotated-types | 0.7.0 | indirect |
| PyPI | anthropic | 0.105.2 | indirect |
| PyPI | anyio | 4.13.0 | indirect |
| PyPI | arabic-reshaper | 3.0.1 | indirect |
| PyPI | asn1crypto | 1.5.1 | indirect |
| PyPI | attrs | 26.1.0 | indirect |
| PyPI | audioop-lts | 0.2.2 | indirect |
| PyPI | beautifulsoup4 | 4.15.0 | indirect |
| PyPI | certifi | 2026.5.20 | indirect |
| PyPI | cffi | 2.0.0 | indirect |
| PyPI | charset-normalizer | 3.4.7 | indirect |
| PyPI | click | 8.4.1 | indirect |
| PyPI | colorama | 0.4.6 | indirect |
| PyPI | concurrent-log-handler | 0.9.29 | indirect |
| PyPI | coverage | 7.14.3 | indirect |
| PyPI | croniter | 6.0.0 | indirect |
| PyPI | cssselect2 | 0.9.0 | indirect |
| PyPI | dill | 0.3.8 | indirect |
| PyPI | discord-py | 2.7.1 | indirect |
| PyPI | distro | 1.9.0 | indirect |
| PyPI | docstring-parser | 0.18.0 | indirect |
| PyPI | fire | 0.7.1 | indirect |
| PyPI | frozenlist | 1.8.0 | indirect |
| PyPI | greenlet | 3.5.1 | indirect |
| PyPI | h11 | 0.16.0 | indirect |
| PyPI | html5lib | 1.1 | indirect |
| PyPI | httpcore | 1.0.9 | indirect |
| PyPI | httptools | 0.8.0 | indirect |
| PyPI | idna | 3.18 | indirect |
| PyPI | iniconfig | 2.3.0 | indirect |
| PyPI | jinja2 | 3.1.6 | indirect |
| PyPI | jiter | 0.15.0 | indirect |
| PyPI | lxml | 6.1.1 | indirect |
| PyPI | mako | 1.3.12 | indirect |
| PyPI | markdown-it-py | 4.2.0 | indirect |
| PyPI | markupsafe | 3.0.3 | indirect |
| PyPI | mdurl | 0.1.2 | indirect |
| PyPI | multidict | 6.7.1 | indirect |
| PyPI | openai | 2.24.0 | indirect |
| PyPI | oscrypto | 1.3.0 | indirect |
| PyPI | packaging | 26.0 | indirect |
| PyPI | pathspec | 1.1.1 | indirect |
| PyPI | pillow | 12.3.0 | indirect |
| PyPI | pluggy | 1.6.0 | indirect |
| PyPI | portalocker | 3.2.0 | indirect |
| PyPI | prompt-toolkit | 3.0.52 | indirect |
| PyPI | propcache | 0.5.2 | indirect |
| PyPI | psutil | 7.2.2 | indirect |
| PyPI | psycopg-binary | 3.3.4 | indirect |
| PyPI | ptyprocess | 0.7.0 | indirect |
| PyPI | pycparser | 3.0 | indirect |
| PyPI | pydantic-core | 2.46.4 | indirect |
| PyPI | pygments | 2.20.0 | indirect |
| PyPI | pyhanko | 0.35.1 | indirect |
| PyPI | pyhanko-certvalidator | 0.31.1 | indirect |
| PyPI | pyjwt | 2.13.0 | indirect |
| PyPI | pypdf | 6.14.0 | indirect |
| PyPI | pytest | 9.0.3 | indirect |
| PyPI | pytest-asyncio | 1.4.0 | indirect |
| PyPI | pytest-cov | 7.1.0 | indirect |
| PyPI | python-bidi | 0.6.10 | indirect |
| PyPI | python-dateutil | 2.9.0.post0 | indirect |
| PyPI | python-dotenv | 1.2.2 | indirect |
| PyPI | pytz | 2026.2 | indirect |
| PyPI | pywin32 | 312 | indirect |
| PyPI | pywinpty | 2.0.15 | indirect |
| PyPI | pyyaml | 6.0.3 | indirect |
| PyPI | reportlab | 4.5.1 | indirect |
| PyPI | requests | 2.33.0 | indirect |
| PyPI | rich | 14.3.3 | indirect |
| PyPI | ruamel-yaml | 0.18.17 | indirect |
| PyPI | ruamel-yaml-clib | 0.2.15 | indirect |
| PyPI | shellingham | 1.5.4 | indirect |
| PyPI | six | 1.17.0 | indirect |
| PyPI | slack-sdk | 3.42.0 | indirect |
| PyPI | sniffio | 1.3.1 | indirect |
| PyPI | socksio | 1.0.0 | indirect |
| PyPI | soupsieve | 2.8.4 | indirect |
| PyPI | sqlalchemy | 2.0.50 | indirect |
| PyPI | starlette | 1.3.1 | indirect |
| PyPI | svglib | 2.0.2 | indirect |
| PyPI | tenacity | 9.1.4 | indirect |
| PyPI | termcolor | 3.3.0 | indirect |
| PyPI | tinycss2 | 1.5.1 | indirect |
| PyPI | tqdm | 4.67.3 | indirect |
| PyPI | typer | 0.26.7 | indirect |
| PyPI | typing-extensions | 4.15.0 | indirect |
| PyPI | typing-inspection | 0.4.2 | indirect |
| PyPI | tzdata | 2025.3 | indirect |
| PyPI | uritools | 6.1.2 | indirect |
| PyPI | urllib3 | 2.7.0 | indirect |
| PyPI | uvloop | 0.22.1 | indirect |
| PyPI | watchfiles | 1.2.0 | indirect |
| PyPI | wcwidth | 0.7.0 | indirect |
| PyPI | webencodings | 0.5.1 | indirect |
| PyPI | websockets | 15.0.1 | indirect |
| PyPI | yarl | 1.24.2 | indirect |
Dependency advisories 2
Installing pypi:cowork-server@0.26.7.27.3 pulls in 103 packages, direct and transitive: 2 carry known advisories, of which 1 are direct dependencies.
| Package | Version | Relation | Severity | Advisories | Fixed in |
|---|---|---|---|---|---|
| pillow | 12.2.0 | indirect | critical | 26 | 12.3.0 |
| hermes-agent | 0.17.0 | direct | high | 4 | 0.18.0 |
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 3055,
"has_wiki": true,
"homepage": "https://mindshub.ai",
"languages": {
"Mako": 704,
"Python": 1564377,
"Makefile": 818,
"Dockerfile": 1726
},
"pushed_at": "2026-07-30T21:46:27Z",
"created_at": "2026-05-13T23:54:05Z",
"owner_type": "Organization",
"updated_at": "2026-07-27T21:15:40Z",
"description": "FastAPI backend for MindsHub Cowork. Manages projects, conversations, files, scheduling, memory, and agent orchestration with a SQLite-backed data layer.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "AGPL-3.0",
"default_branch": "main",
"license_spdx_raw": "AGPL-3.0",
"primary_language": "Python",
"significant_languages": [
"Python"
]
},
"owner": {
"blog": "mindsdb.com",
"name": "MindsDB Inc",
"type": "Organization",
"login": "mindsdb",
"company": null,
"location": "Berkeley, CA",
"followers": 1416,
"avatar_url": "https://avatars.githubusercontent.com/u/31035808?v=4",
"created_at": "2017-08-15T11:14:59Z",
"is_verified": null,
"public_repos": 57,
"account_age_days": 3271
},
"license": {
"state": "standard",
"spdx_id": "AGPL-3.0",
"raw_spdx": "AGPL-3.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.26.7.30.1rc5",
"kind": "other",
"published_at": "2026-07-30T21:46:28Z"
},
{
"tag": "v0.26.7.30.1rc4",
"kind": "other",
"published_at": "2026-07-30T13:05:12Z"
},
{
"tag": "v0.26.7.30.1rc3",
"kind": "other",
"published_at": "2026-07-30T13:02:37Z"
},
{
"tag": "v0.26.7.30.1rc2",
"kind": "other",
"published_at": "2026-07-30T11:55:35Z"
},
{
"tag": "v0.26.7.30.1rc1",
"kind": "other",
"published_at": "2026-07-30T05:01:03Z"
},
{
"tag": "v0.26.7.29.1rc2",
"kind": "other",
"published_at": "2026-07-29T17:53:41Z"
},
{
"tag": "v0.26.7.29.1rc1",
"kind": "other",
"published_at": "2026-07-29T15:42:30Z"
},
{
"tag": "v0.26.7.28.1rc3",
"kind": "other",
"published_at": "2026-07-28T16:26:23Z"
},
{
"tag": "v0.26.7.28.1rc2",
"kind": "other",
"published_at": "2026-07-28T12:01:21Z"
},
{
"tag": "v0.26.7.28.1rc1",
"kind": "other",
"published_at": "2026-07-28T03:07:29Z"
},
{
"tag": "v0.26.7.27.3",
"kind": "other",
"published_at": "2026-07-27T21:16:20Z"
},
{
"tag": "v0.26.7.27.2rc1",
"kind": "other",
"published_at": "2026-07-27T16:27:35Z"
},
{
"tag": "v0.26.7.27.1rc6",
"kind": "other",
"published_at": "2026-07-27T11:41:57Z"
},
{
"tag": "v0.26.7.27.2",
"kind": "other",
"published_at": "2026-07-27T19:38:12Z"
},
{
"tag": "v0.26.7.27.1",
"kind": "other",
"published_at": "2026-07-27T11:42:04Z"
},
{
"tag": "v0.26.7.27.1rc5",
"kind": "other",
"published_at": "2026-07-27T10:52:52Z"
},
{
"tag": "v0.26.7.27.1rc4",
"kind": "other",
"published_at": "2026-07-27T02:07:08Z"
},
{
"tag": "v0.26.7.27.1rc3",
"kind": "other",
"published_at": "2026-07-27T02:02:07Z"
},
{
"tag": "v0.26.7.27.1rc2",
"kind": "other",
"published_at": "2026-07-27T01:26:29Z"
},
{
"tag": "v0.26.7.27.1rc1",
"kind": "other",
"published_at": "2026-07-27T01:10:13Z"
},
{
"tag": "v0.26.7.25.1rc2",
"kind": "other",
"published_at": "2026-07-25T10:03:36Z"
},
{
"tag": "v0.26.7.25.1rc1",
"kind": "other",
"published_at": "2026-07-25T07:36:38Z"
},
{
"tag": "v0.26.7.24.1rc5",
"kind": "other",
"published_at": "2026-07-24T12:21:13Z"
},
{
"tag": "v0.26.7.24.1rc4",
"kind": "other",
"published_at": "2026-07-24T12:19:00Z"
},
{
"tag": "v0.26.7.24.1rc3",
"kind": "other",
"published_at": "2026-07-24T10:41:47Z"
},
{
"tag": "v0.26.7.24.1rc2",
"kind": "other",
"published_at": "2026-07-24T09:59:07Z"
},
{
"tag": "v0.26.7.24.1rc1",
"kind": "other",
"published_at": "2026-07-24T09:18:17Z"
},
{
"tag": "v0.26.7.23.1rc2",
"kind": "other",
"published_at": "2026-07-23T23:00:48Z"
},
{
"tag": "v0.26.7.23.1rc1",
"kind": "other",
"published_at": "2026-07-23T22:40:22Z"
},
{
"tag": "v0.26.7.22.3",
"kind": "other",
"published_at": "2026-07-22T02:24:49Z"
},
{
"tag": "v0.26.7.22.2",
"kind": "other",
"published_at": "2026-07-22T02:16:31Z"
},
{
"tag": "v0.26.7.22.1",
"kind": "other",
"published_at": "2026-07-22T01:49:15Z"
},
{
"tag": "v0.26.7.20.1",
"kind": "other",
"published_at": "2026-07-20T03:29:41Z"
},
{
"tag": "v0.26.7.16.1",
"kind": "other",
"published_at": "2026-07-16T19:44:42Z"
},
{
"tag": "v0.26.7.13.3",
"kind": "other",
"published_at": "2026-07-13T23:52:35Z"
},
{
"tag": "v0.26.7.13.2",
"kind": "other",
"published_at": "2026-07-13T23:13:57Z"
},
{
"tag": "v0.26.7.13.1",
"kind": "other",
"published_at": "2026-07-13T04:10:18Z"
},
{
"tag": "v0.26.7.6.4",
"kind": "other",
"published_at": "2026-07-06T19:01:10Z"
},
{
"tag": "v0.26.7.6.3",
"kind": "other",
"published_at": "2026-07-06T14:00:04Z"
},
{
"tag": "v0.26.7.6.2",
"kind": "other",
"published_at": "2026-07-06T13:55:04Z"
},
{
"tag": "v0.26.7.6.1",
"kind": "other",
"published_at": "2026-07-06T01:47:12Z"
},
{
"tag": "v0.26.7.3.1",
"kind": "other",
"published_at": "2026-07-03T01:17:54Z"
},
{
"tag": "v0.26.6.26.1",
"kind": "other",
"published_at": "2026-06-26T17:53:20Z"
},
{
"tag": "v0.1.10",
"kind": "patch",
"published_at": "2026-06-23T02:36:10Z"
},
{
"tag": "v0.1.9",
"kind": "patch",
"published_at": "2026-06-18T14:35:12Z"
},
{
"tag": "v0.1.8",
"kind": "patch",
"published_at": "2026-06-18T10:59:33Z"
},
{
"tag": "v0.1.7",
"kind": "patch",
"published_at": "2026-06-18T07:26:59Z"
},
{
"tag": "v0.1.6",
"kind": "patch",
"published_at": "2026-06-16T12:10:43Z"
},
{
"tag": "v0.1.5",
"kind": "patch",
"published_at": "2026-06-12T22:55:18Z"
},
{
"tag": "v0.1.4",
"kind": "patch",
"published_at": "2026-06-05T19:28:43Z"
},
{
"tag": "v0.1.3",
"kind": "patch",
"published_at": "2026-06-03T15:33:48Z"
},
{
"tag": "v0.1.2",
"kind": "patch",
"published_at": "2026-06-02T22:44:35Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-06-02T00:22:27Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-06-01T05:40:28Z"
}
],
"recent_commits": [
{
"oid": "3fc4ed55ab4e135d109d66da6acab6b9f7007e21",
"body": "Bumping the Cowork server version so Hot fix 1081, can get to users. https://github.com/mindsdb/anton/pull/278",
"is_bot": false,
"headline": "bump release (#239)",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-27T21:15:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "647cd8813bb0ab831fb27c17e4685f960988e619",
"body": "* ENG-660: user-selectable routing & summarization model\n\nAdds router_provider/router_model user settings (anton's cheap 'thalamus'\nrole: respond-vs-delegate gating + history summarization), independent of\nthe coding model (scratchpad code gen).\n\n- app_settings: ROUTER_MODEL_DEFAULTS (MindsHub->kimi\n[…]\ny.github.com>\nCo-authored-by: MindsDB DevOps / Infrastructure <144632297+mindsdb-devops@users.noreply.github.com>\nCo-authored-by: Minura Punchihewa <49385643+MinuraPunchihewa@users.noreply.github.com>",
"is_bot": true,
"headline": "Weekly release: staging → main (#213)",
"author_name": "mindsdb-release-train[bot]",
"author_login": "mindsdb-release-train[bot]",
"committed_at": "2026-07-27T11:40:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a2cd44a885c7e3fc9a47acf9bedd47fedca1e54b",
"body": "… (#220)\n\n* fix: switch build and scan jobs to use mdb-dev runner for consistency\n\nAligns the runner environment for build and scan jobs with development settings by using \"mdb-dev\" instead of \"mdb-prod,\" ensuring a consistent and simplified setup process.\n\n* fix: comment out build, scan, and deploy\n[…]\n the production GitHub Actions workflow to prevent execution during ongoing investigation or maintenance. This change is meant to pause deployment activities without removing the configurations.\n\n* up",
"is_bot": false,
"headline": "fix: switch build and scan jobs to use mdb-dev runner for consistency…",
"author_name": "Lucas Koontz",
"author_login": "lucas-koontz",
"committed_at": "2026-07-22T02:24:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ec1468de7ff3f4cc4366420f77dc3ddf27d9fefb",
"body": "… (#219)\n\nAligns the runner environment for build and scan jobs with development settings by using \"mdb-dev\" instead of \"mdb-prod,\" ensuring a consistent and simplified setup process.",
"is_bot": false,
"headline": "fix: switch build and scan jobs to use mdb-dev runner for consistency…",
"author_name": "Lucas Koontz",
"author_login": "lucas-koontz",
"committed_at": "2026-07-22T02:15:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e13d31ff9bf9eb0bb0d6d065b2267b2c3a468d25",
"body": "* fix(settings): support legacy server port and ignore K8s service link (ENG-439)\n\nEnsure that both `COWORK_LISTEN_PORT` and legacy `COWORK_SERVER_PORT` are supported for setting server ports, with precedence given to the former. Ignore service link URIs injected as `tcp://` to prevent startup issue\n[…]\ned references from comments\n\nRemove comment references to deprecated issue ENG-439 to clarify the role of COWORK_SERVER_PORT in app settings and associated tests, ensuring consistency and readability.",
"is_bot": false,
"headline": "Fixes legacy port handling and k8s URI injection issues (#218)",
"author_name": "Lucas Koontz",
"author_login": "lucas-koontz",
"committed_at": "2026-07-22T01:48:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4892ab24d2fd45d8bd05aecbfd263e503389937e",
"body": "Add k8s deployment (main)",
"is_bot": false,
"headline": "Merge pull request #214 from mindsdb/add/k8s-deployment-main",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:49:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1af9ebef28a765ec0239939919d343b5ed64840",
"body": null,
"is_bot": false,
"headline": "rename port setting to avoid collision with k8s",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5766f8284433d01e8b5d945ac793a6e46a8eb610",
"body": null,
"is_bot": false,
"headline": "fixi init migration",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e44b0784bfeeeefbedbb47c312bfa0b8e501a30a",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "330156def0c10eec746d0eba14f0bcd6c8833e2f",
"body": null,
"is_bot": false,
"headline": "fix db uri",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5614a6c66bb4495b2af323139de01753929d374e",
"body": null,
"is_bot": false,
"headline": "fix port",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "524b035938e553658bfedf4f4bfaed3208ed9fa9",
"body": null,
"is_bot": false,
"headline": "fix port",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e7393bc9f197e3ea42053abcf8f76739a1d7958",
"body": null,
"is_bot": false,
"headline": "add ephemeral:false to base chart",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b2f962a1d4ed0c0bea7d6a3d15434978c82f7d7",
"body": null,
"is_bot": false,
"headline": "remove dumb comment",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97bf4fd1cedb7498b154448a6edfab58c157dbe9",
"body": null,
"is_bot": false,
"headline": "add staging and prod workflows",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8476ca17095f92b67909f4ba3630670ff2d19a41",
"body": null,
"is_bot": false,
"headline": "initial helm chart and docker",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-21T06:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1756cbedf28341e4f1897cfc5cfe47fc8b61ea93",
"body": "Staging (Week of 26-07-13)",
"is_bot": false,
"headline": "Merge pull request #193 from mindsdb/staging",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-20T03:28:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25130df861a206ae07f0d4f8fc054715a9738224",
"body": "feat(ENG-837): add nav branding settings (title, title color, logo, toggle visibility)",
"is_bot": false,
"headline": "Merge pull request #206 from mindsdb/feat/nav-branding-settings",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-17T15:29:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "324498fb4cb5f75e598389de818375cda6795651",
"body": "oauth flow generalization for non-google connectors (plus linear connector)",
"is_bot": false,
"headline": "Merge pull request #202 from mindsdb/general-oauth-flow",
"author_name": "Jorge Torres",
"author_login": "torrmal",
"committed_at": "2026-07-17T13:23:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c35bf03770996b4d460d776764f992b1b0d54eed",
"body": "…oggle visibility)\n\nAdds nav_title, nav_title_color, nav_logo, show_theme_toggle, and\nshow_8bit_toggle to UserSettings so the sidebar can be personalized the\nsame way as the greeting — synced per-account settings, not local-only\nbrowser storage. The settings table is a generic key-value store, so\nthis needs no migration.",
"is_bot": false,
"headline": "feat(ENG-837): add nav branding settings (title, title color, logo, t…",
"author_name": "Jorge Torres",
"author_login": "torrmal",
"committed_at": "2026-07-17T04:53:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "36b012b0453b324704432e3633bde7bf3467091f",
"body": "Sync main back into staging (weekly release cycle workflows)",
"is_bot": false,
"headline": "Merge pull request #205 from mindsdb/main",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-16T21:34:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f103445173d02f4b9141ba248214ae60b0135b60",
"body": "Add weekly release cycle workflows (freeze, release PR, unfreeze)",
"is_bot": false,
"headline": "Merge pull request #179 from mindsdb/add-weekly-merge-workflow",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-16T19:43:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4a0538ac59a620a0ef49f992db3381c6bc6d4ed",
"body": null,
"is_bot": false,
"headline": "added linear support",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-16T18:22:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54f861d4bb1e61b726db08417a96d84c19be1457",
"body": null,
"is_bot": false,
"headline": "oauth flow generalization for non-google connectors",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-16T12:53:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "80239cf6c5bb18442b7a010adcadba05f01929a5",
"body": "Feature/tenancy mode",
"is_bot": false,
"headline": "Merge pull request #196 from mindsdb/feature/tenancy-mode",
"author_name": "Zoran Pandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-16T10:47:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "929a05bad53a22df1ece82d8b220ea08837770f2",
"body": "feat(comments): cowork-server artifact-comments proxy (REST + SSE passthrough)",
"is_bot": false,
"headline": "Merge pull request #154 from mindsdb/feat/comments-step-2",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-15T20:10:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e27e17f1608408003da90930c8ce2ccf42ad754d",
"body": null,
"is_bot": false,
"headline": "Pin sha for github-actions",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-15T17:42:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16be2994cc354f89ce0d89b8aa95b384684dd6e7",
"body": "…ject delete to conversations (ENG-701) (#187)\n\n* fix(delete): clean up attachments on conversation delete; cascade project delete to conversations (ENG-701)\n\nDeleting a conversation or project used to orphan uploaded attachment files\nforever — rows + bytes, invisible in any UI, piling up in ~/.cowo\n[…]\nthe failed conversation + its attachment survive.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(delete): clean up attachments on conversation delete; cascade pro…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-15T15:44:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "74f3bd1180c497dc76f4cf9655d353a8026ad00e",
"body": null,
"is_bot": false,
"headline": "Add tests",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:18:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f54d9ec49688efeb878938cba8003408ceddb52",
"body": null,
"is_bot": false,
"headline": "Audit by default",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:18:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e65de3a245a3bb50993a66f19c4dd027be730e2",
"body": null,
"is_bot": false,
"headline": "Add flag for audit mode",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:18:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "192287839a009f6780b8149aa2647a789b973a5f",
"body": null,
"is_bot": false,
"headline": "Add tests",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:02:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c91db84934946a6380239ff8e0d92dae5b6137e",
"body": null,
"is_bot": false,
"headline": "Check for principal",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:02:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7fb7f727ab372f039aaab3b05891f34068dd10fd",
"body": null,
"is_bot": false,
"headline": "Add tests + check mode",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:02:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4a94462eb9dec343f4a71e3d11d12c859b44514",
"body": null,
"is_bot": false,
"headline": "Add flag",
"author_name": "ZoranPandovski",
"author_login": "ZoranPandovski",
"committed_at": "2026-07-15T13:01:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "802aca6a9c6538a120c2be355dfa79cf35849666",
"body": "gdrive connector with google picker api",
"is_bot": false,
"headline": "Merge pull request #178 from mindsdb/google_picker_api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-15T12:46:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33dd31aad9763cc60601cc835807da50376bf868",
"body": null,
"is_bot": false,
"headline": "Merge branch 'staging' into google_picker_api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-15T11:41:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33a74a84032694ee0e62e116d5caf5e757424312",
"body": "…timezone-local\n\nfix(scheduler): resolve timezone=\"local\" to system zone, not UTC [ENG-773]",
"is_bot": false,
"headline": "Merge pull request #195 from mindsdb/paul/eng-773-scheduled-tasks-s5-…",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-15T00:01:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5179e4d581bb6433416204c6bec9bd12fd209994",
"body": "…reap-orphaned-running-runs-on-boot-bound\n\nfix(scheduler): reap orphaned running runs on boot; bound run duration [ENG-769]",
"is_bot": false,
"headline": "Merge pull request #194 from mindsdb/paul/eng-769-scheduled-tasks-s1-…",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-15T00:01:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f897f28b936d44cbb7554e51ad4ea550fc0b49f7",
"body": "`timezone=\"local\"` silently resolved to UTC in resolve_timezone(), so a\nschedule saved with \"local\" fired on UTC wall-clock instead of the user's\nzone (and lost DST tracking). Since cowork-server runs on the user's own\nmachine, \"local\" now resolves to the system's real IANA zone via tzlocal,\nfalling\n[…]\nting next_run_at on cadence/timezone edit is deferred to\nthe driver rework (ENG-703); this is the standalone salient bug from ENG-773.\n\nENG-773\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scheduler): resolve timezone=\"local\" to the system zone, not UTC",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T23:19:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "be64a8815036439f8242bdc9c2f0b6f006205162",
"body": null,
"is_bot": false,
"headline": "Merge branch 'main' into staging (content already present)",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T22:26:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fce74003ba6e2fb9f4eb3d2cf6d3eb32d26c79e0",
"body": "A crash/restart mid-run left a ScheduleRun in `running` forever. The\ndue-check skips schedules with a running run, so one stale row wedged\nthe schedule permanently — it silently never fired again.\n\n- Add ScheduleRunService.reap_orphaned_runs(): on boot, mark every\n `running` run (scheduled and manu\n[…]\n so a hung agent can't stay `running` indefinitely.\n- Tests for the reaper (running->failed, manual runs, finished runs\n untouched).\n\nENG-769\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(scheduler): reap orphaned running runs on boot; bound run duration",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T21:48:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "866878ef2dffe18976a0685767ad874dfe4ef071",
"body": "…ixes\n\n[ENG-688] Scheduled task fixes",
"is_bot": false,
"headline": "Merge pull request #181 from mindsdb/tino097/eng-688-scheduled-task-f…",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T19:47:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09516f817a8bce774c1bc82e3c34327e1c68e5b5",
"body": null,
"is_bot": false,
"headline": "moved gdrive logic from harness to connections",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-14T17:55:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64f7251a4940b294a59dd1f64c02801200b614a5",
"body": "chore: back-merge main hotfix into staging",
"is_bot": false,
"headline": "Merge pull request #191 from mindsdb/backmerge/main-hotfixes-to-staging",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T03:39:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "39224922827b3017d342313f9629ef38cfd61026",
"body": "fix(settings): .env model keys are CLI-only, never synced to DB (ENG-739)",
"is_bot": false,
"headline": "Merge pull request #189 from mindsdb/fix/eng-739-env-models-cli-only",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-14T03:35:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7dbe7ecfad7dc5a7eb8d9424628d699aec08444",
"body": "fix(settings): stop COWORK_SERVER_ORIGIN from populating public_base_url (ENG-632)",
"is_bot": false,
"headline": "Merge pull request #190 from mindsdb/hotfix/eng-632-oauth-origin-alias",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T23:51:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6754fb6207e345a4a94dd978d7b57c08b51c4b43",
"body": "Hotfix for the desktop OAuth origin change (cowork PR #386, ENG-632).\n\nCOWORK_SERVER_ORIGIN was a validation alias for TWO settings: server_origin\n(OAuth redirect base — intended) and public_base_url (channel webhook base).\nThe desktop app sets COWORK_SERVER_ORIGIN=http://127.0.0.1:<port> so OAuth\n\"\n[…]\norigin and webhook\nbase are now decoupled. No other code referenced COWORK_SERVER_ORIGIN; cloud\ndeployments already set COWORK_PUBLIC_BASE_URL.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(settings): stop COWORK_SERVER_ORIGIN from populating public_base_url",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T23:18:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "c6c39139d40c234e8780e1b97afcbe478f1e4e57",
"body": "fix(settings): .env model keys are CLI-only, never synced to DB (ENG-739)",
"is_bot": false,
"headline": "Merge pull request #189 from mindsdb/fix/eng-739-env-models-cli-only",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T23:13:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15daadf12d283e2fa0fd52dce69be85961647513",
"body": "…-739)\n\nRemove ANTON_PLANNING_MODEL / ANTON_CODING_MODEL from _ENV_TO_SETTING, the\ntable driving both migrate_env_to_db (first-boot seed) and the\nPOST /settings/raw merge sync.\n\nThe raw-sync path runs on every desktop/web credential push and — via the web\nclient's saveMindsToken — on every scheduled\n[…]\n assert\nthe new invariant: /settings/raw syncs the credential + provider but leaves the\nmodel row unset while preserving the .env line on disk.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(settings): stop syncing .env model keys to the DB — CLI-only (ENG…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-13T22:32:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ecc02394651a51368ca10527ad90dd759dded8c",
"body": "feat(tools): slim request_credentials schema + data-vault instructions",
"is_bot": false,
"headline": "Merge pull request #185 from mindsdb/feat/slim-connector-tools",
"author_name": "Max Abouchar",
"author_login": "SailingSF",
"committed_at": "2026-07-13T22:16:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ef9b9c620a09484be616500de00171f077a9447",
"body": null,
"is_bot": false,
"headline": "fix: reject path-traversal segments in comments proxy",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-13T08:02:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b0500cdd2324dcf44bc64a2c2bba7c8a0b57bee",
"body": "Staging (Week of 06-07-22)",
"is_bot": false,
"headline": "Merge pull request #163 from mindsdb/staging",
"author_name": "Hamish Fagg",
"author_login": "hamishfagg",
"committed_at": "2026-07-13T04:09:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20dc8bad43eea6dc5623951ef725c6fc5d96e066",
"body": "…mission/update_form\n\n- request_credentials handler no longer tells the model to call\n fetch_submission (unregistered tool); guidance now matches the\n rewritten prompt's 'server saves on submit' contract.\n- _scrub_secret_values strips 'value' from password-type fields\n (top-level and per-method) \n[…]\nrompt clause restored.\n- Delete the commented-out fetch_submission/update_form blocks in\n tools.py and harness.py (git history preserves them).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(tools): address review — scrub secret values, drop dead fetch_sub…",
"author_name": "Max Abouchar",
"author_login": "SailingSF",
"committed_at": "2026-07-11T00:49:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2c8c0f1add74002c82d95faa6d8686d2cbda03fc",
"body": "The request_credentials tool schema (8.7k chars on the wire) and its\nDATA VAULT WORKFLOW prompt (2.9k chars) documented per-field details a model\nalready knows. Cut to the non-obvious contracts only (verbatim registry spec\npass-through, _connector_id, methods[]/PKCE shape, fence formatting,\nnever-echo-credentials): schema ~5k chars, prompt 1.3k chars.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(tools): slim request_credentials schema + data-vault instructions",
"author_name": "Max Abouchar",
"author_login": "SailingSF",
"committed_at": "2026-07-11T00:31:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "70a1d751640876971ba42bbf3ff38c3c6774cc32",
"body": null,
"is_bot": false,
"headline": "derive run status from stream terminal record",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-10T16:56:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e8d3d3cfc8c4c89c82569c8c846395bff9abde1d",
"body": null,
"is_bot": false,
"headline": "read run outcome from the stream terminal record",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-10T16:42:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "48c8a9361112dd18b0fa076259cf90b3dfd21a6b",
"body": null,
"is_bot": false,
"headline": "fixes from ai code review",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-10T14:51:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b1cebed1c6fd7ad1fc80344aed5d3d7c00a3bf4",
"body": "…eeze)\n\nFollows the rename in mindsdb/github-actions#32. Caller filenames and workflow\nnames are unchanged; only the uses: target paths move.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Point callers at renamed reusable workflows (release-freeze/-pr/-unfr…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-10T00:01:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "75e2fdb3cf33a875cf68319bae71c681399dd934",
"body": "Adds a top-level 'permissions: contents: read' block to each caller so the\nGITHUB_TOKEN is least-privilege (fixes CodeQL actions/missing-workflow-permissions).\nAll privileged operations run through the mindsdb-release-train App token, so\ncontents: read is sufficient for the callers.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Set explicit GITHUB_TOKEN permissions on release-train callers",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T23:47:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9df5b36de89d3d8e9ce1b54d9d70b6c2e0a3e165",
"body": "…orkflows\n\nReplaces the self-contained freeze/release-PR/unfreeze workflows and the\nset-branch-lock.js helper with ~15-line callers of the reusable workflows in\nmindsdb/github-actions (see mindsdb/github-actions#32). Workflow names are\npreserved so the workflow_run chain still fires.\n\nAuth now uses \n[…]\nvisioned\nstaging-freeze ruleset instead of round-tripping branch protection. The\nunfreeze caller carries the merged-release-PR + fork-PR guard.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Refactor release-train workflows to thin callers of shared reusable w…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T23:37:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "be5e0a262667e9860935d49114680d26a888e092",
"body": "…trand attachments (#182)\n\n* fix(files): key attachment purposes by conversation id only (ENG-338)\n\nRenaming a project stranded every attachment already uploaded to its\nconversations: the purpose tag embedded the mutable project name\n(attachment:{project}:{session}) and renames never relinked existi\n[…]\nards it;\n the one-key dict was shape without consumers).\n\nSuite: 407 passed.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ENG-338: key attachment purposes by conversation id — renames can't s…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-09T22:24:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ccccd0f5ba57a15c12923496d079a3d7e368e8b",
"body": "fix(skills): directory-junction fallback for Windows non-admin symlinks (WinError 1314)",
"is_bot": false,
"headline": "Merge pull request #184 from mindsdb/fix/windows-skill-link-junctions",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T21:53:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f6c6319921e0bf84690bf7c95f924a8b733837f",
"body": "…ileges\n\nOn Windows a non-admin user without Developer Mode cannot create symlinks:\nPath.symlink_to raises OSError [WinError 1314] \"A required privilege is not\nheld by the client\". This crashed server boot — reconcile_all() in\nrun_dev_setup() propagated the raise, so the FastAPI lifespan startup abo\n[…]\n so it can never abort server startup again.\n\nAdds regression tests: link round-trip + \"one unlinkable skill doesn't abort\nthe full reconcile\".\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(skills): fall back to directory junctions when symlinks need priv…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T21:25:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "aefad09760a859f247f3254e8b72291c2473d8d2",
"body": "…to a locked model (ENG-597) (#167)\n\n* feat(settings): tier-aware model defaults — free tier never defaults to a locked model (ENG-597)\n\nMindsHub now gates models per plan tier: a free-tier key gets sonnet/haiku\n(the canonical minds-cloud planning/coding defaults) as enabled:false from\n/v1/models, s\n[…]\nhy this slipped).\n\nSuite: 332 passed, ruff clean.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(settings): tier-aware model defaults — free tier never defaults …",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-09T17:49:41Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "dd0f389c1e363bf7b145581810d4d1e295c7e963",
"body": null,
"is_bot": false,
"headline": "fix for project files for gdrive files",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-09T16:59:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "49efc6c8e819c60dfdb71a143e85e15bd1fa4ff8",
"body": "* fix: restore _stream compat method and fix NOT NULL migration (staging)\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n* fix: remove dead _stream method from ResponsesHandler\n\n_stream had zero callers after the rebase onto staging — the streaming\npath runs through _produce()/buffer, a\n[…]\n-of-band.\n\n---------\n\nCo-authored-by: sejuba <sejuba@7a:37:83:36:3f:61.home>\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>\nCo-authored-by: Konstantin Sivakov <konstantin.sivakov@gmail.com>",
"is_bot": false,
"headline": "fix: add migration guard for pre-Alembic DBs (staging) (#86)",
"author_name": "Michael Olayemi Olawepo",
"author_login": "sejubar",
"committed_at": "2026-07-09T16:27:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "56f1d1ed83c01cb77ff0bd02b1c3cfdfd4f02523",
"body": null,
"is_bot": false,
"headline": "added file picker",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-09T16:19:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "46d863bef3e3420632868d1cfbfcc5b4f2729080",
"body": null,
"is_bot": false,
"headline": "trigger langfuse on turns",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T15:19:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b30ac1b79ae043f8b490323f69a5d1260dfbc856",
"body": null,
"is_bot": false,
"headline": "record canceled runs and expose correct flags for the api",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T15:11:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef096337c719ee66a91dfbffe76b589e8f25c70f",
"body": null,
"is_bot": false,
"headline": "fix(comments): don't show orphan notice for intentional general comments",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-09T15:06:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "043f4b3e0240771d592e14e512db33b843af1947",
"body": null,
"is_bot": false,
"headline": "register ds vars for scrubbing",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T14:23:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e68b1e25ab9d06f345a0294de6ac34dc22e5ec2b",
"body": null,
"is_bot": false,
"headline": "feat(comments): report hidden/orphan anchor state from the marker layer",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-09T14:12:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "475a13d8c3dbecdc14d909cfe131778328b37a29",
"body": null,
"is_bot": false,
"headline": "skip cron when success",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-09T13:59:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "da073bd172b39b602ebfb891a0adbb2c8358c799",
"body": "- Replace the injected iframe layer with the redesigned commenter chrome:\n teal droplet pins, white thread popover, grow-from-pill composer, custom\n pin cursor, gap-space element hit-testing, Alt-to-expand selection\n- Keep it credential-free: the layer posts intents over postMessage; the\n renderer holds creds, performs every API call, and pushes the thread list\n- English confirm copy for delete\n- Update layer tests for the redesigned protocol",
"is_bot": false,
"headline": "feat(comments): redesigned on-artifact comment layer (injected)",
"author_name": "Hazem Aboelsoud",
"author_login": "hazemahmedx0",
"committed_at": "2026-07-09T12:09:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84122a55f419c220ab1471fbe3f153b013428b55",
"body": null,
"is_bot": false,
"headline": "Merge branch 'staging' into google_picker_api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-09T11:07:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "016276c02af3beab2183c4023c2b1f2dee1fe174",
"body": "stop false \"Unpublished changes\" badge on fullstack artifacts",
"is_bot": false,
"headline": "Merge pull request #134 from mindsdb/fix/false-unpublished-changes",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-09T08:45:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a6203a4a7e6ad6a86bbb108f636908ad3bf4efb8",
"body": "…) (#168)\n\n* feat(turn-errors): map model-403s (model_access_denied / model_disabled) to distinct codes + extras (ENG-598)\n\nWhen the gateway rejects the requested MODEL (plan tier gate or admin kill\nswitch), the turn died as a generic anton_error — \"An unexpected error\noccurred\" — with no hint that \n[…]\nched — not\nin scope, present before this change.)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(turn-errors): map model-403s to distinct codes + extras (ENG-598…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-09T01:06:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e13717db8c41c10b7a4c3e3bf3ab4eea3ef265d2",
"body": "feat: single COWORK_HOME data root for full per-build isolation",
"is_bot": false,
"headline": "Merge pull request #174 from mindsdb/feat/cowork-home-data-root",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-09T01:01:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82a1da968a3cc5f465b36bb50a3341d719941564",
"body": "fix: fail legibly when the database is ahead of this build (ENG-324)",
"is_bot": false,
"headline": "Merge pull request #173 from mindsdb/fix/migration-mismatch-guard",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T23:57:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a2b5cd0a06ab57f6e0d397ffb55ab2c1555a958b",
"body": "The .env search chain kept ~/.anton/.env regardless of COWORK_HOME, so an\nisolated (preview/stable) build still read any value living there that its\nown .env didn't set. A path var in the legacy file (DATABASE_URI,\nMASTER_KEY_PATH, COWORK_PROJECTS_DIR, ...) would resolve every build back\nonto the sa\n[…]\ntion\nexists to prevent. Consult ~/.anton/.env only for the default (prod) home;\nan isolated build reads only <COWORK_HOME>/.env and local .env.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: don't inherit legacy ~/.anton/.env in isolated builds",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T23:28:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "62448aaf8ec5231a25018c5455fc5738fd6f5ded",
"body": "Replaces the single weekly-merge workflow with the freeze/release-PR/unfreeze\nlifecycle established in mindshub_inference#319: staging-freeze locks staging\non a weekly cron, weekly-merge-staging opens the staging->main release PR, and\nstaging-unfreeze unlocks staging when the release PR merges. Branch-protection\nchanges go through a shared set-branch-lock.js helper using RELEASE_AUTOMATION_TOKEN.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add weekly release cycle workflows (freeze, release PR, unfreeze)",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T21:57:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b8c709be15b164eba3a8869c34d1713ac3d1088d",
"body": "Introduce cowork.common.paths.cowork_home() — a single data root (default\n~/.cowork, overridable via the COWORK_HOME env var) that every cowork path\nderives from: the SQLite DB, projects, files, skills, memory, streams, the\nconnector vault, the master key, oauth state, the .env, and the anton/hermes\n[…]\nATH, …)\nkeep their precedence over the derived default. Default behavior (unset\nCOWORK_HOME) is unchanged: everything resolves under ~/.cowork.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: single COWORK_HOME data root for full per-build isolation",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T21:50:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "27fcc8439a587c38f747e1af2f1f87f783739c41",
"body": "fix(server): remove Python 3.12-only f-string syntax that crashes import on 3.11",
"is_bot": false,
"headline": "Merge pull request #169 from mindsdb/fix/server-python312-import-crash",
"author_name": "Paul Newsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T21:34:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4321fc98d42f3c197d16c97db1c372113035d7a2",
"body": "…7) (#143)\n\n* add guard around the key reveal\n\n* test(settings): cover loopback guard on reveal-key + /raw (ENG-457)\n\nTests for _require_local: allows 127.0.0.1/::1, 403s any other peer (incl.\n0.0.0.0 and a None client), and reveal-key / GET-raw reject a non-local\ncaller before touching the DB/env.\n\n[…]\npasses the guard.\n\nFull suite green (287 passed).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(settings): restrict reveal-key + /raw to loopback callers (ENG-45…",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T21:05:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1d1e5a7539e8f855ec42599a63d5405d6fcae7f4",
"body": "setup_logging() clears all root handlers and calls logging.basicConfig(\nforce=True), reconfiguring application-wide logging as a side effect of\nimporting cowork/db/migrations.py (order-dependent clobbering), and\nreturns a logger named cowork.common.logger rather than this module.\nUse logging.getLogger(__name__) like the rest of the codebase.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: use module logger instead of setup_logging() at import",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T20:32:50Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a2c24e907a439011a619585f6dd02e36aca346f3",
"body": "…177)\n\n* feat(channels): channel-aware support-mode prompt via ChannelContext (ENG-591)\n\nChannel turns previously ran the identical harness build as desktop turns,\nso the system prompt steered the model toward desktop-UI affordances.\nThread a ChannelContext (channel_type, is_group, display_name) fro\n[…]\nmention fallback so\n@antonbot doesn't answer a mention aimed at @antonbotdev.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ENG-591: channel-aware support mode + working group mention-gating (#…",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T17:41:21Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1ba44ffcde9b4daadc7ab6d4c1a2089be26164e3",
"body": "feat: configurable CORS allowed origins (localhost-only default)",
"is_bot": false,
"headline": "Merge pull request #112 from mindsdb/feat/cors-configurable-origins",
"author_name": "Jorge Torres",
"author_login": "torrmal",
"committed_at": "2026-07-08T15:44:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a74f5a525a24c8fd928b43a5de3b11c95a62acc7",
"body": null,
"is_bot": false,
"headline": "switched anton-agent to main",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-08T15:06:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ebf3a59f4b6c63205af456467d166c8e27ddcee4",
"body": null,
"is_bot": false,
"headline": "gdrive connector with google picker api",
"author_name": "martyna-mindsdb",
"author_login": "martyna-mindsdb",
"committed_at": "2026-07-08T15:04:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "27e130de722eed158b2356184d5badeb34a60dfd",
"body": "* Detach the channel from project on the /new command\n\n* adress comments on the PR\n\n---------\n\nCo-authored-by: Lucas Koontz <lucas.emanuel.koontz@gmail.com>",
"is_bot": false,
"headline": "Channels and projects (#164) (#166)",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T14:37:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3eb82c09e8fde398988b0f7a0aa218c5538fc440",
"body": null,
"is_bot": false,
"headline": "Merge branch 'staging' into feat/cors-configurable-origins",
"author_name": "Konstantin Sivakov",
"author_login": "tino097",
"committed_at": "2026-07-08T14:00:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f0637106cf88eff30728d5e723136f8330e6bec",
"body": "…eposition on DOM changes",
"is_bot": false,
"headline": "fix(comments): hide artifact markers for hidden/removed anchors and r…",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-08T12:54:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74d2c5449fe3f780f48e3359135e3f4e17f00584",
"body": null,
"is_bot": false,
"headline": "feat(comments): proxy PATCH/DELETE + on-artifact layer edit/delete",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-08T12:37:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8d7b5d69cd908e61165ac0585f89adea916eb224",
"body": "Feat/eng 563 scheduler update",
"is_bot": false,
"headline": "Merge pull request #161 from mindsdb/feat/eng-563-scheduler-update",
"author_name": "Andrey",
"author_login": "ea-rus",
"committed_at": "2026-07-08T08:43:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be4201ccba12a4501a8a3518a939b73270917e70",
"body": "When a newer app advances the schema and an older build is then opened\nagainst the same database, `command.upgrade(head)` fails deep inside\nAlembic with an opaque \"Can't locate revision identified by '<rev>'\"\nand the server never starts.\n\nDetect the condition up front: compare the revision(s) record\n[…]\n preview builds of different\nages sharing cowork-preview.db, or a prod downgrade) into an actionable\nmessage instead of a silent startup crash.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: fail legibly when the database is ahead of this build (ENG-324)",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-08T00:07:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bfe8d5c6094adbe5127878a93f55c49020073e28",
"body": "…r false-negative (ENG-576) (#171)\n\nThe Settings connectivity probe (ping_provider) and onboarding validation\n(validate_minds) POSTed CODING_MODEL_DEFAULTS[\"minds_cloud\"] = \"haiku\", a PAID\nmodel. MindsHub tier-gates paid models, so a free-tier key gets a 403 — and:\n\n- ping_provider recorded provider\n[…]\n5 new (constant guard, ping + validate use mindshub_air, configured paid\nmodel ignored, missing-key fast-fail). Suite: 320 passed.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(providers): probe MindsHub with a tier-universal model — free-tie…",
"author_name": "Alejandro Cantu",
"author_login": "alecantu7",
"committed_at": "2026-07-07T22:23:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e33769a6468bb0effdd7010547568ab24f4cabb2",
"body": "…ort on 3.11\n\nTwo modules used f-strings that reuse the enclosing quote character inside the\nexpression (PEP 701, valid only on Python 3.12+):\n\n - cowork/common/settings/app_settings.py — the default DB URI\n - cowork/harnesses/memory/adapter.py — the project-memory header\n\nOn any Python < 3.12\n[…]\newrite both to be quote-safe (identical runtime behavior; the DB URI string\nis byte-for-byte unchanged) so the package parses on every version.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(server): remove Python 3.12-only f-string syntax that crashes imp…",
"author_name": "pnewsam",
"author_login": "pnewsam",
"committed_at": "2026-07-07T20:08:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b404f9ad2d1a72dd46716135bc1ed5689feb9348",
"body": null,
"is_bot": false,
"headline": "fix",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-07T15:22:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "158eef87fdffc44b1cf4002a2a9f40d768cb7b77",
"body": null,
"is_bot": false,
"headline": "use ANTON_PUBLISH_URL if defined",
"author_name": "Max Stepanov",
"author_login": "StpMax",
"committed_at": "2026-07-07T13:57:23Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 54,
"commits_last_year": 601,
"latest_release_at": "2026-07-30T21:46:28Z",
"latest_release_tag": "v0.26.7.30.1rc5",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 11,
"days_since_latest_release": 0,
"mean_days_between_releases": 0.3
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "cowork-server",
"exists": true,
"license": "LicenseRef-Proprietary",
"keywords": [
"Framework :: FastAPI",
"Operating System :: OS Independent",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.12"
],
"ecosystem": "pypi",
"matches_repo": true,
"registry_url": "https://pypi.org/project/cowork-server/",
"is_deprecated": false,
"latest_version": "0.26.7.27.3",
"repository_url": "https://github.com/mindsdb/cowork-server",
"versions_count": 51,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 4576,
"first_published_at": "2026-06-02T00:22:52.046265Z",
"latest_published_at": "2026-07-27T21:16:56.556176Z",
"latest_version_yanked": null,
"days_since_latest_publish": 3
}
]
},
"popularity": {
"forks": 5,
"stars": 4,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-06-26",
"count": 1
},
{
"date": "2026-07-08",
"count": 1
},
{
"date": "2026-07-18",
"count": 1
},
{
"date": "2026-07-19",
"count": 1
},
{
"date": "2026-07-20",
"count": 1
}
],
"complete": true,
"collected": 5,
"total_forks": 5
},
"star_history": null,
"open_issues_and_prs": 40
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 55763,
"source_files_sampled": 234,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [
{
"name": "pillow",
"direct": false,
"version": "12.2.0",
"severity": "critical",
"ecosystem": "pypi",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-45hq-cxwh-f6vc",
"GHSA-4x4j-2g7c-83w6",
"GHSA-5x94-69rx-g8h2",
"GHSA-62p4-gmf7-7g93",
"GHSA-6r8x-57c9-28j4",
"GHSA-8v84-f9pq-wr9x",
"GHSA-9hw9-ch79-4vh6",
"GHSA-fj7v-r99m-22gq",
"GHSA-jjj6-mw9f-p565",
"GHSA-pg7v-jwj7-p798"
],
"fixed_version": "12.3.0",
"advisory_count": 26,
"oldest_advisory_days": 24
},
{
"name": "hermes-agent",
"direct": true,
"version": "0.17.0",
"severity": "high",
"ecosystem": "pypi",
"cvss_score": 7.3,
"advisory_ids": [
"GHSA-mv8x-fg99-32mf",
"GHSA-pmqc-57g8-c22c",
"GHSA-xq8w-9jvx-gm3v",
"PYSEC-2026-2513"
],
"fixed_version": "0.18.0",
"advisory_count": 4,
"oldest_advisory_days": 59
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"high": 1,
"critical": 1
},
"advisory_count": 30,
"affected_count": 2,
"assessed_count": 103,
"malicious_count": 0,
"assessed_package": "pypi:cowork-server@0.26.7.27.3",
"unassessed_count": 0,
"direct_affected_count": 1
},
"ecosystems": [
"pypi"
],
"dependencies": [
{
"name": "alembic",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=1.17.0"
},
{
"name": "anton-agent",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2.26.6.30.1,<3"
},
{
"name": "cryptography",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=48.0.0"
},
{
"name": "fastapi",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.136.1"
},
{
"name": "hermes-agent",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.15.2,<0.18"
},
{
"name": "httpx",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.27"
},
{
"name": "pydantic",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2.12.5"
},
{
"name": "pydantic-settings",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2.14.1"
},
{
"name": "psycopg",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=3.2"
},
{
"name": "python-multipart",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.28"
},
{
"name": "sqlmodel",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.38"
},
{
"name": "tzlocal",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=5.0"
},
{
"name": "uvicorn",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.47.0"
},
{
"name": "markdown",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=3.7"
},
{
"name": "xhtml2pdf",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.2.16"
},
{
"name": "python-docx",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=1.1.2"
},
{
"name": "htmldocx",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=0.0.6"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "alembic",
"direct": true,
"version": "1.18.4",
"ecosystem": "pypi"
},
{
"name": "anton-agent",
"direct": true,
"version": "2.26.7.6.2",
"ecosystem": "pypi"
},
{
"name": "cryptography",
"direct": true,
"version": "48.0.1",
"ecosystem": "pypi"
},
{
"name": "fastapi",
"direct": true,
"version": "0.136.3",
"ecosystem": "pypi"
},
{
"name": "hermes-agent",
"direct": true,
"version": "0.17.0",
"ecosystem": "pypi"
},
{
"name": "htmldocx",
"direct": true,
"version": "0.0.6",
"ecosystem": "pypi"
},
{
"name": "httpx",
"direct": true,
"version": "0.28.1",
"ecosystem": "pypi"
},
{
"name": "markdown",
"direct": true,
"version": "3.10.2",
"ecosystem": "pypi"
},
{
"name": "psycopg",
"direct": true,
"version": "3.3.4",
"ecosystem": "pypi"
},
{
"name": "pydantic",
"direct": true,
"version": "2.13.4",
"ecosystem": "pypi"
},
{
"name": "pydantic-settings",
"direct": true,
"version": "2.14.1",
"ecosystem": "pypi"
},
{
"name": "python-docx",
"direct": true,
"version": "1.2.0",
"ecosystem": "pypi"
},
{
"name": "python-multipart",
"direct": true,
"version": "0.0.32",
"ecosystem": "pypi"
},
{
"name": "sqlmodel",
"direct": true,
"version": "0.0.38",
"ecosystem": "pypi"
},
{
"name": "tzlocal",
"direct": true,
"version": "5.4.3",
"ecosystem": "pypi"
},
{
"name": "uvicorn",
"direct": true,
"version": "0.49.0",
"ecosystem": "pypi"
},
{
"name": "xhtml2pdf",
"direct": true,
"version": "0.2.17",
"ecosystem": "pypi"
},
{
"name": "aiohappyeyeballs",
"direct": false,
"version": "2.6.2",
"ecosystem": "pypi"
},
{
"name": "aiohttp",
"direct": false,
"version": "3.14.0",
"ecosystem": "pypi"
},
{
"name": "aiosignal",
"direct": false,
"version": "1.4.0",
"ecosystem": "pypi"
},
{
"name": "annotated-doc",
"direct": false,
"version": "0.0.4",
"ecosystem": "pypi"
},
{
"name": "annotated-types",
"direct": false,
"version": "0.7.0",
"ecosystem": "pypi"
},
{
"name": "anthropic",
"direct": false,
"version": "0.105.2",
"ecosystem": "pypi"
},
{
"name": "anyio",
"direct": false,
"version": "4.13.0",
"ecosystem": "pypi"
},
{
"name": "arabic-reshaper",
"direct": false,
"version": "3.0.1",
"ecosystem": "pypi"
},
{
"name": "asn1crypto",
"direct": false,
"version": "1.5.1",
"ecosystem": "pypi"
},
{
"name": "attrs",
"direct": false,
"version": "26.1.0",
"ecosystem": "pypi"
},
{
"name": "audioop-lts",
"direct": false,
"version": "0.2.2",
"ecosystem": "pypi"
},
{
"name": "beautifulsoup4",
"direct": false,
"version": "4.15.0",
"ecosystem": "pypi"
},
{
"name": "certifi",
"direct": false,
"version": "2026.5.20",
"ecosystem": "pypi"
},
{
"name": "cffi",
"direct": false,
"version": "2.0.0",
"ecosystem": "pypi"
},
{
"name": "charset-normalizer",
"direct": false,
"version": "3.4.7",
"ecosystem": "pypi"
},
{
"name": "click",
"direct": false,
"version": "8.4.1",
"ecosystem": "pypi"
},
{
"name": "colorama",
"direct": false,
"version": "0.4.6",
"ecosystem": "pypi"
},
{
"name": "concurrent-log-handler",
"direct": false,
"version": "0.9.29",
"ecosystem": "pypi"
},
{
"name": "coverage",
"direct": false,
"version": "7.14.3",
"ecosystem": "pypi"
},
{
"name": "croniter",
"direct": false,
"version": "6.0.0",
"ecosystem": "pypi"
},
{
"name": "cssselect2",
"direct": false,
"version": "0.9.0",
"ecosystem": "pypi"
},
{
"name": "dill",
"direct": false,
"version": "0.3.8",
"ecosystem": "pypi"
},
{
"name": "discord-py",
"direct": false,
"version": "2.7.1",
"ecosystem": "pypi"
},
{
"name": "distro",
"direct": false,
"version": "1.9.0",
"ecosystem": "pypi"
},
{
"name": "docstring-parser",
"direct": false,
"version": "0.18.0",
"ecosystem": "pypi"
},
{
"name": "fire",
"direct": false,
"version": "0.7.1",
"ecosystem": "pypi"
},
{
"name": "frozenlist",
"direct": false,
"version": "1.8.0",
"ecosystem": "pypi"
},
{
"name": "greenlet",
"direct": false,
"version": "3.5.1",
"ecosystem": "pypi"
},
{
"name": "h11",
"direct": false,
"version": "0.16.0",
"ecosystem": "pypi"
},
{
"name": "html5lib",
"direct": false,
"version": "1.1",
"ecosystem": "pypi"
},
{
"name": "httpcore",
"direct": false,
"version": "1.0.9",
"ecosystem": "pypi"
},
{
"name": "httptools",
"direct": false,
"version": "0.8.0",
"ecosystem": "pypi"
},
{
"name": "idna",
"direct": false,
"version": "3.18",
"ecosystem": "pypi"
},
{
"name": "iniconfig",
"direct": false,
"version": "2.3.0",
"ecosystem": "pypi"
},
{
"name": "jinja2",
"direct": false,
"version": "3.1.6",
"ecosystem": "pypi"
},
{
"name": "jiter",
"direct": false,
"version": "0.15.0",
"ecosystem": "pypi"
},
{
"name": "lxml",
"direct": false,
"version": "6.1.1",
"ecosystem": "pypi"
},
{
"name": "mako",
"direct": false,
"version": "1.3.12",
"ecosystem": "pypi"
},
{
"name": "markdown-it-py",
"direct": false,
"version": "4.2.0",
"ecosystem": "pypi"
},
{
"name": "markupsafe",
"direct": false,
"version": "3.0.3",
"ecosystem": "pypi"
},
{
"name": "mdurl",
"direct": false,
"version": "0.1.2",
"ecosystem": "pypi"
},
{
"name": "multidict",
"direct": false,
"version": "6.7.1",
"ecosystem": "pypi"
},
{
"name": "openai",
"direct": false,
"version": "2.24.0",
"ecosystem": "pypi"
},
{
"name": "oscrypto",
"direct": false,
"version": "1.3.0",
"ecosystem": "pypi"
},
{
"name": "packaging",
"direct": false,
"version": "26.0",
"ecosystem": "pypi"
},
{
"name": "pathspec",
"direct": false,
"version": "1.1.1",
"ecosystem": "pypi"
},
{
"name": "pillow",
"direct": false,
"version": "12.3.0",
"ecosystem": "pypi"
},
{
"name": "pluggy",
"direct": false,
"version": "1.6.0",
"ecosystem": "pypi"
},
{
"name": "portalocker",
"direct": false,
"version": "3.2.0",
"ecosystem": "pypi"
},
{
"name": "prompt-toolkit",
"direct": false,
"version": "3.0.52",
"ecosystem": "pypi"
},
{
"name": "propcache",
"direct": false,
"version": "0.5.2",
"ecosystem": "pypi"
},
{
"name": "psutil",
"direct": false,
"version": "7.2.2",
"ecosystem": "pypi"
},
{
"name": "psycopg-binary",
"direct": false,
"version": "3.3.4",
"ecosystem": "pypi"
},
{
"name": "ptyprocess",
"direct": false,
"version": "0.7.0",
"ecosystem": "pypi"
},
{
"name": "pycparser",
"direct": false,
"version": "3.0",
"ecosystem": "pypi"
},
{
"name": "pydantic-core",
"direct": false,
"version": "2.46.4",
"ecosystem": "pypi"
},
{
"name": "pygments",
"direct": false,
"version": "2.20.0",
"ecosystem": "pypi"
},
{
"name": "pyhanko",
"direct": false,
"version": "0.35.1",
"ecosystem": "pypi"
},
{
"name": "pyhanko-certvalidator",
"direct": false,
"version": "0.31.1",
"ecosystem": "pypi"
},
{
"name": "pyjwt",
"direct": false,
"version": "2.13.0",
"ecosystem": "pypi"
},
{
"name": "pypdf",
"direct": false,
"version": "6.14.0",
"ecosystem": "pypi"
},
{
"name": "pytest",
"direct": false,
"version": "9.0.3",
"ecosystem": "pypi"
},
{
"name": "pytest-asyncio",
"direct": false,
"version": "1.4.0",
"ecosystem": "pypi"
},
{
"name": "pytest-cov",
"direct": false,
"version": "7.1.0",
"ecosystem": "pypi"
},
{
"name": "python-bidi",
"direct": false,
"version": "0.6.10",
"ecosystem": "pypi"
},
{
"name": "python-dateutil",
"direct": false,
"version": "2.9.0.post0",
"ecosystem": "pypi"
},
{
"name": "python-dotenv",
"direct": false,
"version": "1.2.2",
"ecosystem": "pypi"
},
{
"name": "pytz",
"direct": false,
"version": "2026.2",
"ecosystem": "pypi"
},
{
"name": "pywin32",
"direct": false,
"version": "312",
"ecosystem": "pypi"
},
{
"name": "pywinpty",
"direct": false,
"version": "2.0.15",
"ecosystem": "pypi"
},
{
"name": "pyyaml",
"direct": false,
"version": "6.0.3",
"ecosystem": "pypi"
},
{
"name": "reportlab",
"direct": false,
"version": "4.5.1",
"ecosystem": "pypi"
},
{
"name": "requests",
"direct": false,
"version": "2.33.0",
"ecosystem": "pypi"
},
{
"name": "rich",
"direct": false,
"version": "14.3.3",
"ecosystem": "pypi"
},
{
"name": "ruamel-yaml",
"direct": false,
"version": "0.18.17",
"ecosystem": "pypi"
},
{
"name": "ruamel-yaml-clib",
"direct": false,
"version": "0.2.15",
"ecosystem": "pypi"
},
{
"name": "shellingham",
"direct": false,
"version": "1.5.4",
"ecosystem": "pypi"
},
{
"name": "six",
"direct": false,
"version": "1.17.0",
"ecosystem": "pypi"
},
{
"name": "slack-sdk",
"direct": false,
"version": "3.42.0",
"ecosystem": "pypi"
},
{
"name": "sniffio",
"direct": false,
"version": "1.3.1",
"ecosystem": "pypi"
},
{
"name": "socksio",
"direct": false,
"version": "1.0.0",
"ecosystem": "pypi"
},
{
"name": "soupsieve",
"direct": false,
"version": "2.8.4",
"ecosystem": "pypi"
},
{
"name": "sqlalchemy",
"direct": false,
"version": "2.0.50",
"ecosystem": "pypi"
},
{
"name": "starlette",
"direct": false,
"version": "1.3.1",
"ecosystem": "pypi"
},
{
"name": "svglib",
"direct": false,
"version": "2.0.2",
"ecosystem": "pypi"
},
{
"name": "tenacity",
"direct": false,
"version": "9.1.4",
"ecosystem": "pypi"
},
{
"name": "termcolor",
"direct": false,
"version": "3.3.0",
"ecosystem": "pypi"
},
{
"name": "tinycss2",
"direct": false,
"version": "1.5.1",
"ecosystem": "pypi"
},
{
"name": "tqdm",
"direct": false,
"version": "4.67.3",
"ecosystem": "pypi"
},
{
"name": "typer",
"direct": false,
"version": "0.26.7",
"ecosystem": "pypi"
},
{
"name": "typing-extensions",
"direct": false,
"version": "4.15.0",
"ecosystem": "pypi"
},
{
"name": "typing-inspection",
"direct": false,
"version": "0.4.2",
"ecosystem": "pypi"
},
{
"name": "tzdata",
"direct": false,
"version": "2025.3",
"ecosystem": "pypi"
},
{
"name": "uritools",
"direct": false,
"version": "6.1.2",
"ecosystem": "pypi"
},
{
"name": "urllib3",
"direct": false,
"version": "2.7.0",
"ecosystem": "pypi"
},
{
"name": "uvloop",
"direct": false,
"version": "0.22.1",
"ecosystem": "pypi"
},
{
"name": "watchfiles",
"direct": false,
"version": "1.2.0",
"ecosystem": "pypi"
},
{
"name": "wcwidth",
"direct": false,
"version": "0.7.0",
"ecosystem": "pypi"
},
{
"name": "webencodings",
"direct": false,
"version": "0.5.1",
"ecosystem": "pypi"
},
{
"name": "websockets",
"direct": false,
"version": "15.0.1",
"ecosystem": "pypi"
},
{
"name": "yarl",
"direct": false,
"version": "1.24.2",
"ecosystem": "pypi"
}
],
"collected": true,
"truncated": false,
"total_count": 118,
"direct_count": 17,
"indirect_count": 101
}
},
"maintainership": {
"issues": {
"open_prs": 40,
"merged_prs": 178,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 1,
"closed_unmerged_prs": 41
},
"bus_factor": 3,
"bot_contributors": 2,
"top_contributors": [
{
"type": "User",
"login": "MinuraPunchihewa",
"commits": 141,
"avatar_url": "https://avatars.githubusercontent.com/u/49385643?v=4"
},
{
"type": "User",
"login": "pnewsam",
"commits": 111,
"avatar_url": "https://avatars.githubusercontent.com/u/22651415?v=4"
},
{
"type": "User",
"login": "ea-rus",
"commits": 60,
"avatar_url": "https://avatars.githubusercontent.com/u/8502631?v=4"
},
{
"type": "User",
"login": "StpMax",
"commits": 52,
"avatar_url": "https://avatars.githubusercontent.com/u/4068133?v=4"
},
{
"type": "User",
"login": "torrmal",
"commits": 50,
"avatar_url": "https://avatars.githubusercontent.com/u/5898506?v=4"
},
{
"type": "User",
"login": "martyna-mindsdb",
"commits": 43,
"avatar_url": "https://avatars.githubusercontent.com/u/109554435?v=4"
},
{
"type": "User",
"login": "SailingSF",
"commits": 40,
"avatar_url": "https://avatars.githubusercontent.com/u/33883149?v=4"
},
{
"type": "User",
"login": "tino097",
"commits": 26,
"avatar_url": "https://avatars.githubusercontent.com/u/2707446?v=4"
},
{
"type": "User",
"login": "alecantu7",
"commits": 22,
"avatar_url": "https://avatars.githubusercontent.com/u/18293000?v=4"
},
{
"type": "User",
"login": "hamishfagg",
"commits": 18,
"avatar_url": "https://avatars.githubusercontent.com/u/895845?v=4"
}
],
"contributors_sampled": 15,
"top_contributor_share": 0.236
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"build-deploy.yml",
"cla.yml",
"dev-build-deploy.yml",
"pipeline-watchdog.yml",
"publish-staging.yml",
"publish.yml",
"staging-freeze.yml",
"staging-unfreeze.yml",
"stale-deploy.yml",
"tests-unit.yml",
"weekly-merge-staging.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"uv.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 9,
"reason": "Found 12/13 approved changesets -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 18 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 1,
"reason": "dependency not pinned by hash detected -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 10,
"reason": "SAST tool is run on all commits",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "14 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "3fc4ed55ab4e135d109d66da6acab6b9f7007e21",
"ran_at": "2026-07-30T21:48:58Z",
"aggregate_score": 5.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-30T21:33:14Z",
"oldest_open_prs": [
{
"number": 38,
"created_at": "2026-06-12T21:14:33Z",
"last_comment_at": "2026-06-17T19:07:21Z",
"last_comment_author": "MinuraPunchihewa"
},
{
"number": 76,
"created_at": "2026-06-20T00:22:20Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 77,
"created_at": "2026-06-21T21:45:08Z",
"last_comment_at": "2026-07-09T08:48:55Z",
"last_comment_author": "hazemahmedx0"
},
{
"number": 79,
"created_at": "2026-06-22T12:44:21Z",
"last_comment_at": "2026-07-10T14:57:42Z",
"last_comment_author": "entelligence-ai-pr-reviews"
},
{
"number": 96,
"created_at": "2026-06-24T15:55:05Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 97,
"created_at": "2026-06-24T15:55:08Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 98,
"created_at": "2026-06-24T15:55:10Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 99,
"created_at": "2026-06-24T15:55:13Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 100,
"created_at": "2026-06-24T15:55:15Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 101,
"created_at": "2026-06-24T16:14:34Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 102,
"created_at": "2026-06-24T16:15:07Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 103,
"created_at": "2026-06-24T16:20:43Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 104,
"created_at": "2026-06-24T16:23:25Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 105,
"created_at": "2026-06-24T16:24:28Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 106,
"created_at": "2026-06-24T16:29:38Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 107,
"created_at": "2026-06-24T16:52:55Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 108,
"created_at": "2026-06-24T17:09:34Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 130,
"created_at": "2026-06-26T17:13:48Z",
"last_comment_at": "2026-07-08T16:19:20Z",
"last_comment_author": "github-actions"
},
{
"number": 155,
"created_at": "2026-07-03T16:06:03Z",
"last_comment_at": "2026-07-06T11:09:29Z",
"last_comment_author": "tino097"
},
{
"number": 156,
"created_at": "2026-07-04T02:46:59Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-30T21:45:08Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/mindsdb/cowork-server",
"host": "github.com",
"name": "cowork-server",
"owner": "mindsdb"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": "High-Risk Jurisdiction Policy applies a 50% multiplier to weighted overall health and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "jurisdiction_overall_adjustment",
"params": {
"cap": 49,
"pct": 50
}
}
],
"value": 32,
"inputs": {
"security": 35,
"vitality": 77,
"community": 38,
"governance": 85,
"engineering": 77,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 50,
"weighted_overall_before_jurisdiction": 65,
"overall_after_jurisdiction_multiplier": 32
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 77,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 62,
"inputs": {
"commits_last_year": 601,
"human_commit_share": 0.99,
"days_since_last_push": 0,
"active_weeks_last_year": 11
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "11/52 weeks with commits",
"points": 7.6,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 11
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "601 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 601
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 54,
"latest_release_tag": "v0.26.7.30.1rc5",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 0.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "54 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 54
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 38,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"forks": 5,
"stars": 4,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "4 stars",
"points": 7.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 4
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "5 forks",
"points": 5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 5
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (AGPL-3.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "AGPL-3.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 61,
"inputs": {
"packages": [
"cowork-server"
],
"dependents": null,
"ecosystems": "pypi",
"total_downloads": null,
"monthly_downloads": 4576
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "4,576 downloads/month across pypi",
"points": 48.8,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 4576,
"ecosystems": "pypi"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "excellent",
"name": "Sustainability & Governance",
"value": 85,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "good",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"bus_factor": 3,
"contributors_sampled": 15,
"top_contributor_share": 0.236
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "3 contributor(s) cover half of all commits",
"points": 36,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 3
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 24% of commits",
"points": 17.2,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 24
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "15 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 15
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 18 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 91,
"inputs": {
"merged_prs": 178,
"open_issues": 0,
"closed_issues": 1,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 41
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "178/219 decided PRs merged",
"points": 31.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 178,
"decided": 219
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 12/13 approved changesets -- score normalized to 9",
"points": 13.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 78,
"inputs": {
"followers": 1416,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "mindsdb",
"public_repos": 57,
"account_age_days": 3271
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1,416 followers of mindsdb",
"points": 22.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1416,
"login": "mindsdb"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "57 public repos, account ~8 yr old",
"points": 24.8,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 57
}
},
{
"code": "account_age_years",
"params": {
"years": 8
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"cowork-server"
],
"ecosystems": "pypi",
"any_deprecated": false,
"min_days_since_publish": 3
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on pypi",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "pypi"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 3 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 3
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "51 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 51
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 77,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "11 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 11
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": "https://mindshub.ai",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://mindshub.ai",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 35,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Signed-Releases. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 50% multiplier to Security posture and gives it an At risk ceiling of 49.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "jurisdiction_posture_adjustment",
"params": {
"cap": 49,
"pct": 50
}
}
],
"value": 28,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 5.5,
"high_risk_jurisdiction_cap": 49,
"high_risk_jurisdiction_multiplier": 50,
"security_posture_after_multiplier": 28,
"security_posture_before_jurisdiction": 55
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "14 out of 14 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 12/13 approved changesets -- score normalized to 9",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 18 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 1",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is run on all commits",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "14 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "moderate",
"name": "Dependency advisories",
"note": "Matched the pypi:cowork-server@0.26.7.27.3 runtime dependency closure — what installing the published package pulls in — 103 packages. Reachability is not analyzed.",
"notes": [
{
"code": "advisories_scope_published",
"params": {
"package": "pypi:cowork-server@0.26.7.27.3",
"assessed": 103
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 61,
"inputs": {
"source": "osv",
"advisories": 30,
"affected_packages": 2,
"assessed_packages": 103,
"unassessed_packages": 0,
"affected_by_severity": "critical 1, high 1",
"direct_affected_packages": 1
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "1 affected: hermes-agent 0.17.0 (high 7.3)",
"points": 14.6,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "hermes-agent 0.17.0 (high 7.3)"
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "1 affected: pillow 12.2.0 (critical 9.1)",
"points": 6.8,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "pillow 12.2.0 (critical 9.1)"
}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory has been public longer than 90 days",
"points": 40,
"status": "met",
"details": [
{
"code": "advisories_none_stale",
"params": {
"days": 90
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 103,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "moderate",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 50,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": true,
"exposures": [
{
"role": "top_contributor",
"count": 2,
"country": "Russia"
}
],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 12
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "Russia: top_contributor (2)",
"points": 50,
"status": "partial",
"details": [
{
"code": "jurisdiction_exposure",
"params": {
"role": "top_contributor",
"count": 2,
"country": "Russia"
}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 50,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 33,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.616,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "61 of 99 human commits state their intent (structured subject or explanatory body)",
"points": 32.9,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 61,
"sampled": 99
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"uv.lock"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.25,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "25 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 25,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 1",
"points": 1,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 55763,
"source_files_sampled": 234,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/234 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 234,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-30T21:49:23.960358Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/m/mindsdb/cowork-server.svg",
"full_name": "mindsdb/cowork-server",
"license_state": "standard",
"license_spdx": "AGPL-3.0"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — PyPI.