Public recordAt risk
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-23 22:41 UTC
vlad-zapp / sshtmux
SSH command execution via tmux control mode with connection caching
vlad-zapp/sshtmux holds a health index of 37 out of 100, placing it in the At risk band. It scores highest on Engineering Quality (56/100) and lowest on Community & Adoption (12/100). It was last updated 141 days ago.
37
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
37
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
vlad-zappPersonal account
1 follower10 public repossince Feb 2012
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish |
|---|---|---|---|---|---|
| Go | github.com/vlad-zapp/sshtmux | v0.2.0 | - | 2 | 152 days ago |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
48
Development activity
26Critical
How it's scored
| 9.9/36 | Push recency — last push 141 days ago |
| 1.4/36 | Commit cadence — 2/52 weeks with commits |
| 15/18 | Commit volume — 46 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
Inputs used
| commits_last_year | 46 |
| human_commit_share | 1 |
| days_since_last_push | 141 |
| active_weeks_last_year | 2 |
Release discipline
81Good
How it's scored
| 27/27 | Ships releases — 2 releases published |
| 27/36 | Release recency — latest release 152 days ago |
| 27/27 | Release cadence — a release every ~0.5 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases. |
Inputs used
| releases_count | 2 |
| latest_release_tag | v0.2.0 |
| releases_from_tags | no |
| days_since_latest_release | 152 |
| mean_days_between_releases | 0.5 |
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
12
Popularity & adoption
1Critical
How it's scored
| 0/60 | Stars — 0 stars |
| 0/25 | Forks — 0 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 0 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
25Critical
How it's scored
| 22.5/22.5 | README |
| 0/22.5 | License — no license file detected |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | no |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
41
Issue & PR responsiveness
1Critical
How it's scored
| 0/46.8 | Issue resolution — no issues or no data |
| 0/38.3 | PR acceptance — no decided pull requests or no data |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 0 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.
Ownership & stewardship
40At risk
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 2.2/25 | Owner reach — 1 followers of vlad-zapp |
| 19.6/25 | Track record — 10 public repos, account ~14 yr old |
Inputs used
| followers | 1 |
| owner_type | User |
| is_verified | — |
| owner_login | vlad-zapp |
| public_repos | 10 |
| account_age_days | 5,273 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
92Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on go |
| 35/35 | Publish recency — latest publish 152 days ago |
| 12/20 | Version history — 2 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | github.com/vlad-zapp/sshtmux |
| ecosystems | go |
| any_deprecated | no |
| min_days_since_publish | 152 |
Engineering Quality
Are baseline engineering and documentation practices in place?
56
Engineering practices
60Moderate
How it's scored
| 24/24 | CI workflows — 1 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — no data |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.
Documentation
50Moderate
How it's scored
| 30/30 | README |
| 0/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 0/10 | Topics |
| 10/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | no |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
23
Security posture
23Critical
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — no data |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 0/2.5 | License — license file not detected |
| 0/7.5 | Maintained — 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
| 0/5 | Packaging — no data |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 4.5/7.5 | Vulnerabilities — 4 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 2.3 |
Excluded from scoring (no data or not applicable): ci_tests, packaging. Remaining weights renormalized.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
56
Agent context & guidance
40At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 41 of 46 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.891 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Verify loop (build / test / typecheck)
65Moderate
How it's scored
| 18/18 | One-command bootstrap — Makefile |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 11/11 | Static type checking — Go (statically typed) |
| 10/10 | Reproducible environment — lockfile |
| 4.3/10 | Demonstrated agent practice — 1 of the last 46 commits agent-authored or agent-credited |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | go.sum |
| has_dockerfile | no |
| typed_language | yes |
| bootstrap_files | Makefile |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0.022 |
| toolchain_manifests | go.mod |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Excellent
How it's scored
| 45/45 | Type-checkable code — Go (statically typed) |
| 55/55 | Manageable file sizes — 0/25 source files over 60KB |
Inputs used
| primary_language | Go |
| largest_source_bytes | 16,428 |
| source_files_sampled | 25 |
| oversized_source_files | 0 |
Machine-readable interfaces
20Critical
How it's scored
| 0/40 | API schema (OpenAPI/GraphQL/proto) |
| 20/20 | MCP server |
| 0/40 | Runnable examples |
Inputs used
| example_dirs | — |
| has_mcp_signal | yes |
| api_schema_files | — |
Key facts
0GitHub stars
-contributors
46commits, last 12 months
141days since last push
2releases
-bus factor
0open issues
Gopackage ecosystems
Data collection warnings
- Contributor list unavailable
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
OpenSSF Scorecard 2.3 / 10
2.3aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| n/a | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 0 | License | license file not detected |
| 0 | Maintained | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
| n/a | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 6 | Vulnerabilities | 4 existing vulnerabilities detected |
Direct dependencies 2
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| Go | github.com/BurntSushi/toml | v1.6.0 | go.mod |
| Go | github.com/modelcontextprotocol/go-sdk | v1.3.1 | go.mod |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 266,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 178845,
"Makefile": 552
},
"pushed_at": "2026-03-04T21:53:48Z",
"created_at": "2026-02-21T05:31:30Z",
"owner_type": "User",
"updated_at": "2026-03-04T21:53:53Z",
"description": "SSH command execution via tmux control mode with connection caching",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "vlad-zapp",
"company": null,
"location": null,
"followers": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/1436747?v=4",
"created_at": "2012-02-14T13:34:30Z",
"is_verified": null,
"public_repos": 10,
"account_age_days": 5273
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-02-21T18:30:05Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-02-21T06:02:36Z"
}
],
"recent_commits": [
{
"oid": "e584248b57776beaeeec4f51f641400e6b21fc89",
"body": "Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "Fix idle session reuse after timeout",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-03-04T21:53:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "2e6dc808bd03500e4b75b8686d6078029eb5d183",
"body": "Create an auto-named tmux session first, then from within control mode\nkill any old session with the desired name and rename ours. This avoids\nthe problem where killing the last session causes the tmux server to\nexit and takes down the SSH connection.",
"is_bot": false,
"headline": "Always create fresh tmux session and kill on disconnect",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-26T03:24:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0ca435bb0a50437d1c7f89117505aa5756f1f33",
"body": "The 1024-item output channel buffer caused silent data drops on large\ncommand output (~13MB). During each 200ms poll cycle, SendCommand\nblocks the Exec loop for ~50ms (SSH roundtrip). At high chunk rates,\nthe buffer overflows and readLoop drops data via the default select\ncase.\n\nIncreasing to 65536 items prevents overflow for outputs up to ~32MB\neven during poll blocks. Also increases the post-completion drain\nidle timeout from 100ms to 200ms for better reliability on slow\nconnections.",
"is_bot": false,
"headline": "Increase output channel buffer to 65536 and bump drain idle to 200ms",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-26T03:14:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "145c1ca6d8189d703145c4a3ad6aee7a8dde4fa8",
"body": "Add startup_timeout config option (global and per-host) that bounds\nthe tmux startup sequence. Default increased from 30s to 60s.\n\nExample: startup_timeout = \"2m\"",
"is_bot": false,
"headline": "Make startup timeout configurable (default 60s)",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-26T03:09:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2666c45a49099193a3f2e20aa126e601b814e3e1",
"body": "When an existing tmux session is the last one on the server,\nkill-session causes the tmux server to exit, which can kill the\nSSH connection (especially through proxies).\n\nNow session creation retries on failure: reconnects SSH and runs\nnew-session without kill (the old session is already dead).\n\nAlso adds a 30s startup timeout to bound the entire tmux setup\nsequence and prevent indefinite hangs when SSH connections die\nsilently.",
"is_bot": false,
"headline": "Reconnect SSH when kill-session takes down the connection",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-26T02:41:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "480c68c50190dffe0fd1e906a6b2383ceeb8d099",
"body": "…output on large responses\n\n- Add max_message_size config option (default 100MB, was hardcoded 10MB)\n- Thread max message size through daemon and client via config\n- Fix output truncation: replace non-blocking collectRemaining with\n drainWithGrace that resets a 100ms idle timer on each chunk, with\n a 30s hard cap\n- Improve MCP tool description with usage rules",
"is_bot": false,
"headline": "Configurable max IPC message size (default 100MB) and fix incomplete …",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-26T02:23:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e2cfd6f9619400d9eee51d4801fe138951b3820",
"body": "Replace send-keys -l (literal) with send-keys -H (hex) to prevent\nembedded newlines from breaking tmux control mode's line-based protocol.\nNewline bytes are sent as Ctrl+V (0x16) + newline (0x0a) for literal\ninsertion into the line editor without triggering execution.",
"is_bot": false,
"headline": "Switch send-keys from literal mode to hex mode for newline safety",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-24T17:04:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e80cfec93f0711bf0252ce20879ab298184e45a",
"body": "Make command timeout a per-request parameter. CLI gets --timeout flag\n(e.g. --timeout 2m), MCP tool gets a timeout field in seconds. Default\nremains 30s. MCP enforces a 10-minute maximum to prevent LLMs from\nhanging the system.",
"is_bot": false,
"headline": "Add configurable command timeout for CLI and MCP",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-23T16:24:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb55f4474f3e6c1abe2d0e37cf5ca0f022568b0c",
"body": "When a command times out, the remote process keeps running but the\nsession stayed in the pool. The next command would reuse the dirty\nsession. Now handleExec evicts the session on timeout so the next\ncommand gets a fresh connection with a clean tmux session.",
"is_bot": false,
"headline": "Evict session from pool on command timeout",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T23:17:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab411f64c4b089076570ed494c5b82690825f657",
"body": null,
"is_bot": false,
"headline": "Remove docs/plans directory",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T06:05:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f63f250e703d7b790b7b6ced35f640addf79fbb",
"body": "Replace -A (attach-or-create) with kill-session + new-session so each\nconnection starts with a clean pane. On Close, kill-session instead of\ndetach so the tmux session doesn't persist after disconnect. This\nprevents stale state from accumulating across reconnections.",
"is_bot": false,
"headline": "Always create fresh tmux session and kill on disconnect",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T05:34:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "345c8fe6bac66e008a421e90d3c1c99716c5e799",
"body": "When reattaching to an existing tmux session (-A), the pane accumulates\ngarbage from previous failed attempts and SSH host key prompts from shell\ninit scripts. Now we respawn-pane -k for a clean shell, wait for init\nscripts to run, send Ctrl-C to dismiss any prompts, then drain output\nbefore running init.",
"is_bot": false,
"headline": "Respawn pane and send Ctrl-C before init to clear stale state",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T05:25:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "931f79c5d061c83b15877fe0b49d1ca6ad7d53b7",
"body": null,
"is_bot": false,
"headline": "Add capture-pane diagnostic before init to inspect pane state",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T05:14:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf9b06190783393af542078011b2a89a284a340b",
"body": "The stderr streaming goroutine was starting after the entire pre-command\nflow (4+ seconds later), so all SSH debug lines appeared with the same\nlate timestamp. Now the goroutine starts immediately after sess.Start()\nso SSH verbose output appears in real-time during pre-command wait.",
"is_bot": false,
"headline": "Fix SSH stderr log ordering: start goroutine right after sess.Start",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T05:04:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6bc17cc1e565a64bc4b2319d83a0bac31359a59",
"body": "SSH -v flag was only added when the daemon's global vlog was enabled,\nbut that flag is only set in the client process. Now the verbose flag\nis propagated per-request from the context's vlog writer through the\ndialer to the SSH session. SSH stderr is captured via StderrPipe and\nstreamed to the client through vlog so users see SSH debug output when\nrunning sshtmux -v.",
"is_bot": false,
"headline": "Stream SSH stderr to client and fix per-request verbose flag",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T04:52:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4dc7a44198d20bd62d6374ec9a34f4fb389baa3f",
"body": "Log actual %output data content (not just length) so init hangs\ncan be diagnosed by seeing what the pane shell actually outputs\nafter command execution.",
"is_bot": false,
"headline": "Stream daemon logs to client in real-time and add init diagnostics",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T04:37:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95f1f1c68a41847ffac2bdc5a1f2daf4c8cd0474",
"body": "Log each step of RunInit (unset, send-keys-l, echo, enter, poll) with\ntags and timing. Log consumeEcho timeout with accumulated data. Log\npoll results with count and rv value. This helps diagnose init hangs\non remote hosts.",
"is_bot": false,
"headline": "Add diagnostic logging to controller readLoop and executor steps",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T04:00:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30308ebde7157f26fffa6d8a825c1e705d54e7fd",
"body": "… commands\n\nDiscover the tmux socket path via display-message #{socket_path} from\ncontrol mode and pass it explicitly with -S to pane-embedded tmux\ncommands. This eliminates the dependency on $TMUX env var which may\nnot be set after sudo/toor shell transitions.\n\nFalls back to configured TmuxSocketPath if discovery returns empty.",
"is_bot": false,
"headline": "Fix wait-for hang: use explicit -S socket path in shell-embedded tmux…",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T03:22:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a0843c8a9306f78c9f6c9d5b849cb86ccf2cdcdb",
"body": "… escaping\n\nSwitch from printf completion marker back to @sshtmux-rv pane option polling.\nThe printf approach failed on tmux 3.0a because single quotes in the shell\nline were mangled by tmux's argument parser (ShellQuote's '\\'' produced\nbackslashes instead of literal quotes).\n\nChanges:\n- Use tmux se\n[…]\ny 200ms (configurable)\n- Use double quotes throughout to avoid single-quote escaping issues\n- Include accumulated %output in timeout errors for diagnostics\n- Add %output logging to controller readLoop",
"is_bot": false,
"headline": "Fix init hang on tmux 3.0a: use @sshtmux-rv polling with double-quote…",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T03:07:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6c4705ddba15a33664ed471fed5c7bf08b7d4337",
"body": "The executor embedded 'tmux set-option -p @sshtmux-rv $?' in the shell\nline typed into the pane, requiring tmux to be accessible from within\nthe pane's shell. On some hosts this fails silently (PATH, socket\npermissions, environment differences), causing RunInit to hang forever.\n\nReplace with a print\n[…]\nminates the dependency on running tmux inside the pane, removes\n200ms polling (instant detection via %output), and simplifies the\nExecutor by removing socketPath, tmuxCmd(), and socket path discovery.",
"is_bot": false,
"headline": "Fix RunInit hang: replace tmux pane-option polling with printf marker",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T02:16:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "70f915062edd215d9ca7bce43d2ed9a969896e60",
"body": "Route %output notifications to buffered channel on controller.\nAdd FormatSendKeysLiteral/FormatSendKeysEnter helpers for two-phase send.\nRemove post-init verify block (no longer needed without wait-for).\nClean up stale comments referencing capture-pane and wait-for.",
"is_bot": false,
"headline": "Replace polling+capture-pane executor with %output streaming",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T00:16:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc73dc5b9ecdaafca638bb89a0bf88ea6317b9c5",
"body": "The executor now uses two-phase send with %output streaming instead of\n@sshtmux-done polling. Update noopController in both daemon and client\ntest files to:\n\n- Add buffered outputCh field and return it from OutputCh()\n- Simulate terminal echo on send-keys -l by extracting quoted text\n and pushing i\n[…]\nsplay-message queries instead of \"1\"\n for @sshtmux-done (which no longer exists)\n- Remove unused mockFactory from connpool_test.go\n- Initialize outputCh: make(chan string, 1024) at all creation sites",
"is_bot": false,
"headline": "Update noopController in daemon/client tests for streaming executor",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T00:14:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ea3096fad3d976b67f6ea6a0fbef1e54a7643213",
"body": "Replace capture-pane/wait-for based mocking in TestSessionExec and\nTestSessionExecTimeout with streaming %output-based mocking that matches\nthe new two-phase send executor flow. Remove the now-unused setupExecMock\nhelper from executor_test.go.",
"is_bot": false,
"headline": "Update session integration tests for streaming executor",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T00:13:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bcd9d22f80e71deade5f5ef23df1cccaf62aeb91",
"body": "Replace the old pollForDone + @sshtmux-done approach with the same\ntwo-phase send (literal + Enter) streaming flow used by Exec. RunInit\nnow resets @sshtmux-rv, sends the command via send-keys -l, consumes\nthe echo from %output, presses Enter, then polls @sshtmux-rv.\n\nDelete pollForDone and captureInitDiagnostics which are no longer used.\nReplace TestRunInit/TestRunInitSendKeysFormat/TestRunInitUsesSocketPath\nwith streaming-aware equivalents.",
"is_bot": false,
"headline": "Rewrite RunInit with streaming %output flow",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T00:10:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a833949bd14550f9b9b5076ae622120a0121007",
"body": "Replace the polling + capture-pane flow with two-phase send + %output\nstreaming. The new Exec method types the command with send-keys -l\n(no Enter), waits for the echo to appear on the %output channel, then\npresses Enter and collects output while polling @sshtmux-rv for the\nexit code.\n\nKey changes:\n\n[…]\nask 5 will handle that)\n- Keep StripANSI (used by mcpserver)\n- Update mockController with buffered outputCh field\n- Replace all old Exec tests with streaming-aware tests\n- Keep RunInit tests unchanged",
"is_bot": false,
"headline": "Rewrite Executor.Exec with streaming %output flow",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-22T00:05:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c7e5c83539f8ac6c23ef437778190aded893b041",
"body": "9 tasks: controller outputCh, mock updates, send-keys helpers,\nExec rewrite, RunInit rewrite, session tests, daemon tests,\ncleanup, and release build.",
"is_bot": false,
"headline": "Add streaming executor implementation plan",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T23:49:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65eba39edbff455b7234a02497c19bf2c5b8369a",
"body": "Replace polling + capture-pane with %output streaming and two-phase\nsend-keys to eliminate echo stripping, clear-history, and the\n@sshtmux-done pane option.",
"is_bot": false,
"headline": "Add streaming executor design doc",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T23:40:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae4facacb31bc2353d16403239062aba69d705c7",
"body": "Adds verbose logging to the tmux control mode reader, deliverResponse,\nand SendCommand to diagnose why the control connection stops responding\nafter the init pipeline completes. Also adds a post-init verification\ncommand to detect the issue early and more granular step logging in Exec.",
"is_bot": false,
"headline": "Add diagnostic logging to controller readLoop and executor steps",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T21:17:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4374b58d0074781d968a6fff901356d994e2354a",
"body": "Sequential send-keys commands fail because the shell's line editor can\nflush the pty input buffer (tcflush) when redrawing its prompt between\ncommands. The second set of keystrokes arrives during this window and\nis lost, causing the wait-for to block forever.\n\nCombine all init commands (user + internal) into a single shell line\nseparated by semicolons, sent as one send-keys + one wait-for. Since\nthe first send-keys always succeeds, this avoids the problem entirely.",
"is_bot": false,
"headline": "Combine all init commands into single send-keys to prevent input loss",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T20:54:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f4f926d5636a1d187562fc698e86bf33f1e51ae",
"body": "Daemon logs were buffered in bytes.Buffer and only sent with the final\nresponse. User saw nothing between \"sending exec request\" and timeout.\n\nChanged protocol to stream log lines as they happen: daemon sends\nintermediate Response messages with Streaming=true, client prints them\nimmediately. Final r\n[…]\nlse.\n\nAlso added per-init-command timeout (10s) so a single hung init doesn't\nconsume the entire 60s request timeout, and capture-pane diagnostics on\ninit failure to show what the shell is displaying.",
"is_bot": false,
"headline": "Stream daemon logs to client in real-time and add init diagnostics",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T20:47:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4c15785b64a19139dc1463806beed7422d853ecd",
"body": "… commands\n\nWhen pre_command spawns a login shell (e.g. toor → sudo -H eksh -l), the\nTMUX env var may be lost or incorrect in the pane. Shell-embedded tmux\ncommands (wait-for -S, set-option) used bare \"tmux\" which couldn't find\nthe server → signal never arrived → wait-for blocked until timeout.\n\nNow\n[…]\n. Also discovers the socket path via #{socket_path} when not\nexplicitly configured.\n\nAdded logging to RunInit for visibility during init (previously a black box\nbetween \"discovered pane\" and timeout).",
"is_bot": false,
"headline": "Fix wait-for hang: use explicit -S socket path in shell-embedded tmux…",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T20:35:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9aaa35badb3ab41f04c7cfea64578f6ddfe25c8",
"body": "…ically\n\nsend-keys and wait-for were sent as two separate SSH round trips. For fast\nbuiltins (e.g. export PS1=''), the shell could execute and signal the\nwait-for channel before the wait-for command reached tmux, causing a\npermanent block and ~56s timeout.\n\nSendCommandPipeline writes multiple tmux commands in a single Write() call,\neliminating the SSH round-trip gap. tmux processes them in FIFO order:\nsend-keys first (immediate response), then wait-for (blocks until signal).",
"is_bot": false,
"headline": "Fix wait-for signal-loss race by pipelining send-keys + wait-for atom…",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T20:18:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17b12ab0fabc9bc3be36efaf3200ceea5732df3d",
"body": "…ttings\n\n- Add channel semaphore to Executor for concurrent command safety\n- Replace global verbose capture with per-request context-carried logging\n- Replace time.Sleep pre-command readiness with stdout-read pattern\n- Set PS1='' and remove fragile prompt detection from output processing\n- Move ANSI stripping from executor to MCP layer\n- Remove unused OutputChan from Controller interface\n- Add configurable Term and HistoryLimit to config with per-host overrides",
"is_bot": false,
"headline": "Improve code quality: race-free logging, robust sync, configurable se…",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T18:29:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e8195257497f0fedc9b017c1bdf3be92c2ae2e0",
"body": "Instead of collecting asynchronous %output notifications (which had timing\nissues with large/slow outputs), use capture-pane -p -J -S - after wait-for\nto synchronously retrieve the complete pane content via %begin/%end.\n\nFlow: clear-history → send-keys → wait-for → capture-pane → display-message\n\nThis eliminates all timing issues, goroutines, and prompt detection hacks.",
"is_bot": false,
"headline": "Replace %output collection with capture-pane for robust output retrieval",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T08:51:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e277b2e4312f7f63d80080e646fa906b6a4d29c",
"body": "The 50ms quiet period caused output loss for commands with large output\n(like kubectl get pods -A) where network latency creates >50ms gaps\nbetween output chunks.\n\nPhase 2 now waits for the shell prompt (we set PS1='$ ') instead of a\nfixed timer. The prompt is a reliable termination signal because t\n[…]\nted.\n\nUses endsWithShellPrompt() which only matches the prompt as a standalone\nchunk or after a newline — not as a suffix of arbitrary output — to\navoid false positives from commands that output \"$ \".",
"is_bot": false,
"headline": "Use prompt detection instead of timer for output collection",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T08:33:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0cdc459b5b49e0f84094e62fd32ae8af6bef1777",
"body": "The daemon runs with stderr discarded, so vlog output went nowhere.\nNow when a client sends Verbose: true, the daemon captures all vlog\noutput during request handling into a buffer and returns it in the\nresponse Logs field. The client prints these logs to stderr.\n\n- Add StartCapture/StopCapture to vlog for per-request log buffering\n- Add Logs field to daemon Response\n- Client prints resp.Logs to stderr when present",
"is_bot": false,
"headline": "Capture daemon logs per-request and send back to client",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T08:19:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c98462991a100ddcf2f2b767edaad88c016e2090",
"body": "- Use exec.Command instead of exec.CommandContext so SSH processes\n outlive individual request contexts (fixes stale session cache bug)\n- Add Verbose field to daemon Request protocol; daemon sets vlog\n per-request so verbose only activates when client passes -v\n- Add Alive() to Controller interface for session liveness detection\n- Pool.Get() evicts dead sessions and creates new ones automatically\n- Make vlog.Enabled atomic to prevent data races with concurrent requests",
"is_bot": false,
"headline": "Fix SSH session dying between requests and add per-request verbose",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T08:08:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a7d9612ac4c628b5b039caade3039138bdc071ef",
"body": "Verbose mode (-v as first arg) enables timestamped debug logging to\nstderr throughout the stack: CLI, daemon, session, executor, and SSH.\nAlso passes -v to the ssh binary for SSH-level debug output.\n\nFix pre_command to send it as a separate stdin line instead of joining\nwith semicolon, so commands that open a new shell (e.g. sudo -i) work\ncorrectly.",
"is_bot": false,
"headline": "Add -v verbose flag and fix pre_command to use stdin",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T07:47:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "437b30fd0ab5eb3c54ea03daabeabcbca54424d9",
"body": "Shells out to the system ssh command for full compatibility with\n~/.ssh/config: ProxyJump, ProxyCommand, Match, Include, certificates,\nFIDO keys, and all other openssh features work out of the box.\n\nRemoves golang.org/x/crypto/ssh and kevinburke/ssh_config dependencies.",
"is_bot": false,
"headline": "Use openssh binary instead of Go SSH library",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T07:24:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "403ee80663e89cb7c95485a6a6cb00ee5511dac0",
"body": "Skips SSH host key verification by default so connections work without\na known_hosts entry. Set ignore_host_keys = false to restore strict\nhost key checking.",
"is_bot": false,
"headline": "Add ignore_host_keys option, default true",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T06:57:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b3c6fd2fd058e102f6c2d620d32c2fb086501769",
"body": "Adds .vscode/mcp.json for easy MCP server integration with VS Code\nCopilot. Updates README with setup instructions for both VS Code and\nClaude Code.",
"is_bot": false,
"headline": "Add VS Code MCP manifest and setup instructions",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T06:30:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b83fcc5d03a7056431ff22c1bbafd7057be95d34",
"body": "Allows configuring a shell command (e.g. \"sudo -i\") that runs before\nthe tmux invocation on the remote host. Supports global and per-host\noverrides.",
"is_bot": false,
"headline": "Add pre_command config option for running commands before tmux",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T06:12:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "80f069f3ed65bfa03af81cb10381c002fe7b21f1",
"body": "Mouse mode generates escape sequences that interfere with output\nparsing in control mode.",
"is_bot": false,
"headline": "Disable tmux mouse mode on session startup",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T06:01:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "676a1f73e7f7a181e332b7037685b10a37f81688",
"body": "Only the exec tool is needed for AI tool integration.",
"is_bot": false,
"headline": "Remove disconnect and status tools from MCP server",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T05:56:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d0cecee96834708e5352acb63890af51dabf641a",
"body": null,
"is_bot": false,
"headline": "Add README with usage and configuration guide",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T05:51:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c09bb0780609cd8a6d4a393a16b4df50d18abeb7",
"body": "SSH command execution tool using tmux control mode with persistent\nconnection caching. Includes MCP server for AI tool integration.\n\n- tmux control mode controller with FIFO command correlation\n- Session management with wait-for synchronization\n- Connection pool with TTL-based expiry\n- Unix socket daemon with IPC protocol\n- CLI client with auto-daemon startup\n- MCP server (stdio transport)\n- GitHub Actions CI for Linux x64 and Windows builds",
"is_bot": false,
"headline": "Initial commit: sshtmux - SSH via tmux control mode",
"author_name": "Vlad Grutsenko",
"author_login": null,
"committed_at": "2026-02-21T05:32:28Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 2,
"commits_last_year": 46,
"latest_release_at": "2026-02-21T18:30:05Z",
"latest_release_tag": "v0.2.0",
"releases_from_tags": false,
"days_since_last_push": 141,
"active_weeks_last_year": 2,
"days_since_latest_release": 152,
"mean_days_between_releases": 0.5
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/vlad-zapp/sshtmux",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/vlad-zapp/sshtmux",
"is_deprecated": false,
"latest_version": "v0.2.0",
"repository_url": "https://github.com/vlad-zapp/sshtmux",
"versions_count": 2,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-02-21T18:29:47Z",
"latest_version_yanked": null,
"days_since_latest_publish": 152
}
]
},
"popularity": {
"forks": 0,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0,
"collected_at": null
},
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": true,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 16428,
"source_files_sampled": 25,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/BurntSushi/toml",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.6.0"
},
{
"name": "github.com/modelcontextprotocol/go-sdk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.3.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": null,
"bot_contributors": 0,
"top_contributors": [],
"contributors_sampled": null,
"top_contributor_share": null
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"build.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 6,
"reason": "4 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "e584248b57776beaeeec4f51f641400e6b21fc89",
"ran_at": "2026-07-23T22:41:52Z",
"aggregate_score": 2.3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-03-04T21:55:14Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/vlad-zapp/sshtmux",
"host": "github.com",
"name": "sshtmux",
"owner": "vlad-zapp"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 37,
"inputs": {
"security": 23,
"vitality": 48,
"community": 12,
"governance": 41,
"engineering": 56
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "at_risk",
"name": "Vitality",
"value": 48,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "critical",
"name": "Development activity",
"note": null,
"notes": [],
"value": 26,
"inputs": {
"commits_last_year": 46,
"human_commit_share": 1,
"days_since_last_push": 141,
"active_weeks_last_year": 2
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 141 days ago",
"points": 9.9,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 141
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "2/52 weeks with commits",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 2
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "46 commits in the last year",
"points": 15,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 46
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 81,
"inputs": {
"releases_count": 2,
"latest_release_tag": "v0.2.0",
"releases_from_tags": false,
"days_since_latest_release": 152,
"mean_days_between_releases": 0.5
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "2 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 2
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 152 days ago",
"points": 27,
"status": "partial",
"details": [
{
"code": "release_recency",
"params": {
"days": 152
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.5 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.5
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 12,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 41,
"weight": 0.24,
"metrics": [
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"followers": 1,
"owner_type": "User",
"is_verified": null,
"owner_login": "vlad-zapp",
"public_repos": 10,
"account_age_days": 5273
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1 followers of vlad-zapp",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1,
"login": "vlad-zapp"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "10 public repos, account ~14 yr old",
"points": 19.6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 10
}
},
{
"code": "account_age_years",
"params": {
"years": 14
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"packages": [
"github.com/vlad-zapp/sshtmux"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 152
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 152 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 152
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "2 published versions",
"points": 12,
"status": "partial",
"details": [
{
"code": "published_versions",
"params": {
"count": 2
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 56,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 23,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 23,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 2.3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "4 existing vulnerabilities detected",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 56,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.891,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "41 of 46 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 41,
"sampled": 46
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.022,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "1 of the last 46 commits agent-authored or agent-credited",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 1,
"sampled": 46
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 16428,
"source_files_sampled": 25,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/25 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 25,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "critical",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 20,
"inputs": {
"example_dirs": [],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Contributor list unavailable",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-23T22:41:55.805759Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/v/vlad-zapp/sshtmux.svg",
"full_name": "vlad-zapp/sshtmux",
"license_state": "absent",
"license_spdx": null
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — Go.