zach-snell/bbkt holds a health index of 55 out of 100, placing it in the Moderate band. It scores highest on Engineering Quality (78/100) and lowest on Security (28/100). It was last updated 10 days ago. A single contributor accounts for most of its recent work.
55
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
55
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
Star and fork history 0 ★ / 3 ⇿
0Stars
3Forks
2Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 0Patch 2
OpenSSF Scorecard 2.8 / 10
2.8aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-22 12:54 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"bitbucket",
"cli",
"go",
"mcp",
"mcp-server"
],
"is_fork": false,
"size_kb": 8914,
"has_wiki": true,
"homepage": "https://zach-snell.github.io/bbkt/",
"languages": {
"Go": 308010,
"Shell": 4858
},
"pushed_at": "2026-07-12T05:12:09Z",
"created_at": "2026-02-20T05:15:03Z",
"owner_type": "User",
"updated_at": "2026-07-12T05:10:11Z",
"description": "A Bitbucket CLI and Model Context Protocol (MCP) server in Go.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": null,
"name": "Zach Snell",
"type": "User",
"login": "zach-snell",
"company": "Pariveda Solutions",
"location": "Dallas, TX",
"followers": 30,
"avatar_url": "https://avatars.githubusercontent.com/u/10632545?v=4",
"created_at": "2015-01-21T14:37:10Z",
"is_verified": null,
"public_repos": 39,
"account_age_days": 4199
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.1.11",
"kind": "patch",
"published_at": "2026-07-12T05:12:08Z"
},
{
"tag": "v0.1.10",
"kind": "patch",
"published_at": "2026-07-12T01:15:32Z"
},
{
"tag": "v0.1.9",
"kind": "patch",
"published_at": "2026-07-11T22:58:38Z"
},
{
"tag": "v0.1.8",
"kind": "patch",
"published_at": "2026-05-17T02:39:47Z"
},
{
"tag": "v0.1.7",
"kind": "patch",
"published_at": "2026-05-17T01:32:36Z"
},
{
"tag": "v0.1.6",
"kind": "patch",
"published_at": "2026-05-16T19:56:30Z"
},
{
"tag": "v0.1.5",
"kind": "patch",
"published_at": "2026-05-14T18:22:26Z"
},
{
"tag": "v0.1.4",
"kind": "patch",
"published_at": "2026-04-22T18:56:09Z"
},
{
"tag": "v0.1.3",
"kind": "patch",
"published_at": "2026-03-16T02:20:08Z"
},
{
"tag": "v0.1.2",
"kind": "patch",
"published_at": "2026-02-23T17:14:26Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-02-22T22:14:02Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-02-21T01:26:22Z"
}
],
"recent_commits": [
{
"oid": "d19dfea7a9cc8a3c6a9fd45ca2f05a5a7d240488",
"body": "…tbucket_api)\n\nAdds a first-class escape hatch so agents (and users) hit endpoints bbkt does\nnot wrap with a typed command through bbkt's own authenticated client, instead\nof reading the token out of credentials.json and calling the API by hand.\n\n- CLI: 'bbkt api <path>' mirroring 'gh api' — path-fi\n[…]\nnd accepts the common\n path forms; covered by tests.\n\nThis targets the empirically dominant bypass pattern: raw curl to\napi.bitbucket.org for niche endpoints, which leaked the token into transcripts.",
"is_bot": false,
"headline": "feat(cli,mcp): authenticated Bitbucket API passthrough (bbkt api / bi…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-07-12T05:09:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c00dc0d9113ea9b6f13394515bb55b8220c459b3",
"body": "… under --json\n\nTwo subcommand flags claimed the -p shorthand that the global persistent\n--profile flag now owns, so cobra panicked while merging flags on every\ninvocation of 'bbkt mcp' and 'bbkt pipelines trigger':\n- mcp: --port drops its -p shorthand (long --port only)\n- pipelines trigger: --patte\n[…]\n'prs create' and 'pipelines trigger' verbs no longer\ndrop into interactive prompts when required flags are missing; they return a\nstructured error (rendered as JSON by the existing --json error path).",
"is_bot": false,
"headline": "fix(cli): stop -p shorthand panic on mcp/pipelines trigger; fail fast…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-07-12T01:13:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dc3566718d01859c3ddcd74a1872bef50eb5a08d",
"body": "Recognize a git remote by its effective host, not by spelling the hostname.\nAn scp-like or ssh:// remote whose host is an SSH config alias is resolved\nvia 'ssh -G' and accepted only when its real hostname matches the target;\nthis supports arbitrarily-named aliases and rejects an alias that resolves\n\n[…]\ng).\n\nThe target host defaults to bitbucket.org and can be overridden with\nBBKT_HOST for a self-hosted/alternate domain (git-remote recognition only;\nAPI and OAuth endpoints are configured separately).",
"is_bot": false,
"headline": "feat(cli): resolve ssh host aliases to any-named Bitbucket remotes",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-07-11T22:32:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3dbeb5004c918d6a78768b12f17e78e4b74bce73",
"body": "Git remote inference now recognizes the ssh:// URL-scheme form and\nSSH config host aliases (bitbucket.org-<suffix>, the multi-account\npattern), so a remote like\nssh://git@bitbucket.org-pariveda/parivedasolutions/moxy.git resolves\ncorrectly. The pure URL parsing is extracted into a testable\nparseBitb\n[…]\n resolve, repos\ndelete, source write/delete, pipelines stop, profile use/refresh,\nlogout) now honor --json, emitting a small structured result object.\nHuman output is unchanged when --json is not set.",
"is_bot": false,
"headline": "fix(cli): ssh alias/scheme remote parsing + --json on action verbs",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-07-11T22:31:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ca3c7581de379c1b4aaf27ab75e223237af7bf1f",
"body": null,
"is_bot": false,
"headline": "fix(lint): nolint:gosec on bounded slice accesses in ParseArgs",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-17T02:35:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "55181266a3439873128d34af4568e0e2c861c1ca",
"body": "- git.go: add explicit n>=1/n>=2 guards in the positional switch so gosec\n G602 stops worrying about the args[1]/args[2:] indexes; also drop a\n redundant fmt.Sprintf with no formatting args.\n- internal/mcp/utils.go: give ResolveScope's return values names so\n gocritic's unnamedResult check stops \n[…]\nature already\n documents both halves via the godoc).\n- gofmt the test file's struct literal alignment.\n\nNo behavior change; build + tests already passed, but CI's golangci-lint\ncaught the style nits.",
"is_bot": false,
"headline": "fix(lint): satisfy gosec/gocritic/gofmt on the scope-resolver code",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-17T02:33:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6f0ec7d5f815cfcc141eb545c091b7594f4f6c9e",
"body": "…ution\n\nParseArgs is now a layered resolver instead of a 2-state positional gate:\n 1. -R/--repo (workspace/slug or plain slug) + -W/--workspace\n 2. BBKT_REPO and BBKT_WORKSPACE env vars\n 3. positional args ([workspace] [repo-slug])\n 4. git inference from origin\n 5. error listing the cached acce\n[…]\n\"command\": \"bbkt\", \"args\": [\"mcp\"],\n \"env\": { \"BBKT_WORKSPACE\": \"myws\" } }\n\nTool schemas stay required-as-documented; the env is a per-server default\nthe model can always override per call.",
"is_bot": false,
"headline": "feat(cli,mcp): -W/-R flags + BBKT_WORKSPACE/BBKT_REPO env scope resol…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-17T01:49:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a4d4e98c58ef93696337f6f73211e7ed29a0f69f",
"body": "…lank\n\n/user/workspaces returns workspace_access envelopes ({administrator,\nworkspace:{uuid,slug,links}}), not bare workspaces. Decoding straight\ninto Workspace produced rows with empty Slug/UUID/Name and IsPrivate=false,\nso `bbkt workspaces list` showed blank rows for every workspace.\n\nDecode the e\n[…]\nug / UUID / Admin since workspace_base omits Name and is_private —\nuse `bbkt workspaces get <slug>` for full details.\n\nFixture-based regression test pins the envelope shape and the\nadmin-flag mapping.",
"is_bot": false,
"headline": "fix(workspaces): flatten /user/workspaces envelope so listing isn't b…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-17T01:20:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "df62064e2cbcea4d9212840548d3fc29ad3f6e90",
"body": "…e walls\n\nP2 follow-ups from the prior UX audit, applied as one consistent pass\nacross every command in cmd/cli/.\n\nGroups (cmd/cli/groups.go, root.go):\n\n- Top-level help is now grouped into \"Authentication & Profiles\"\n (auth, status, logout, profile), \"Bitbucket Resources\" (workspaces,\n repos, prs\n[…]\nesolve}, pipelines {get, stop, steps, log}, issues {get,\n update}, source {read, history, search, write, delete}). Makes\n required vs optional positionals visible at a glance per POSIX\n convention.",
"is_bot": false,
"headline": "refactor(cli): cobra polish — groups, pagination flags, RunE, no usag…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-16T19:52:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d18882df3caef5ac8d10bde8bc101949d486f459",
"body": "Same staleness pattern as the README, fanned out across the Starlight\ndocs pages:\n\n- introduction.mdx: dropped App Password reference, called out\n scoped Atlassian API tokens + OAuth + multi-profile.\n- installation.mdx: led with the curl|bash install script (both\n system and --user variants), fixe\n[…]\ne (--port), added Required Scope to each tool\n block.\n- index.mdx: small Hero card copy update to mention scoped tokens\n and multi-profile.\n\nVerified: 'pnpm build' from docs/ produces 8 pages clean.",
"is_bot": false,
"headline": "docs(site): align Astro docs with current auth model + CLI surface",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-16T19:39:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7fd91e7f6bc6a794302a59b2390c8a817183c1e5",
"body": "…ed flags\n\nAudit-driven UX fixes across the cobra command tree. Three concrete\nbugs and a pile of clarity wins.\n\nBugs (P0):\n\n- Promote --profile to a true PersistentFlag on RootCmd. Previously\n only registered on 'auth', so 'bbkt --profile work prs list' would\n die with \"unknown flag\" before the P\n[…]\np; --pattern on\n pipelines trigger now references the custom: block in\n bitbucket-pipelines.yml; --strategy listed as an alternation\n instead of a comma-separated set; --status accepts STOPPED too.",
"is_bot": false,
"headline": "feat(cli): better cobra help — global --profile, Long+Example, requir…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-16T19:39:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dc84e9f0066228f6fe20d778fff40ccb4e8f6f0a",
"body": "…urface\n\nRewrites the README end-to-end after a ground-truth audit of the binary\nand codebase. Major corrections:\n\n- Installation: lead with the curl|bash installer (system-wide and\n --user variants) instead of the obsolete \"clone + ./install.sh\" flow,\n plus a fish note for fish_add_path on --user\n[…]\nite under docs/.\n\nAlso fixes install.sh post-install hint: 'bbkt login' was a fictional\ncommand (the real command is 'bbkt auth'). Now suggests bbkt auth,\nbbkt auth --oauth, bbkt status, and bbkt mcp.",
"is_bot": false,
"headline": "docs(readme): rewrite for scoped tokens, multi-profile, current CLI s…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-16T19:39:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "459196e30022abd30411d67de14a2e404016ddae",
"body": "…e 20 dep\n\nupload-pages-artifact@v3 bundles upload-artifact@v4 internally, which\nstill runs on Node 20. v5 of upload-pages-artifact was released\nspecifically to pull in upload-artifact@v7 (Node 24).\n\nv4 introduced a behavior change: hidden files (dotfiles) are excluded\nfrom the artifact by default. The docs build output (docs/dist) doesn't\nrely on dotfiles, so this is safe.",
"is_bot": false,
"headline": "chore(ci): bump upload-pages-artifact v3 -> v5 to drop transitive Nod…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-14T19:06:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8ceae30c23a73451f11bc148e68ea46aca4a389",
"body": "Caught the last four after CI surfaced them — the previous bump missed\nthese because the release workflow didn't exercise them:\n\n actions/upload-artifact v4 -> v7 (ci.yml: artifact upload)\n pnpm/action-setup v4 -> v6 (docs.yml: adds pnpm v11 support; we still pin 9)\n actions/setup-node \n[…]\ndy pass cache: 'pnpm' explicitly)\n actions/deploy-pages v4 -> v5 (docs.yml: Node 24 only)\n\nactions/upload-pages-artifact@v3 was not flagged — it's already Node 24\ninternally — and is left at @v3.",
"is_bot": false,
"headline": "chore(ci): bump remaining Node 20 actions to Node 24 majors",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-14T19:03:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bcd62358ae3a588a3094355f0d9b82f7a6037d05",
"body": "Missed in the previous CI bump because release.yml doesn't use codecov,\nso the deprecation only surfaced after CI ran on the prior commit.",
"is_bot": false,
"headline": "chore(ci): bump codecov-action v4 -> v6 (Node 24)",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-14T19:00:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53ffad614ebebbd4bf1d7cab3df0cb782ad0ff45",
"body": "GitHub flagged actions/checkout@v4, actions/setup-go@v5, and\nsoftprops/action-gh-release@v2 as running on the deprecated Node 20\nruntime (force-upgrade to Node 24 on Jun 2, 2026; Node 20 removed\nSep 16, 2026). Bump to the latest majors:\n\n actions/checkout v4 -> v6 (Node 24 since v5)\n a\n[…]\nrkflows (upload-artifact@v4, codecov@v4,\nsetup-node@v4, pnpm/action-setup@v4, upload-pages-artifact@v3,\ndeploy-pages@v4) were not flagged — they already run on Node 24\ninternally — and are left alone.",
"is_bot": false,
"headline": "chore(ci): bump deprecated Node 20 actions to Node 24 majors",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-14T18:58:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3c36a02c551ac5c2bb24e613dafac1b205f01024",
"body": "The old install.sh required Go on the user's machine and built from source.\nReplace with the obx-style installer that pulls a prebuilt binary from the\nmatching GitHub release for the user's OS/arch. release.yml already\npublishes binaries with the expected naming (bbkt-<os>-<arch>[.exe]).\n\nAdds: OS/arch detection, sudo fallback to /usr/local/bin, --user flag for\n~/.local/bin (no sudo), --version/--help flags, colored UX, post-install\nhints for `bbkt login` + MCP client wiring.",
"is_bot": false,
"headline": "chore(install): port releases-downloader installer from obx",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-14T18:13:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "311bd8b1c62af1d46534d0d3ebc7c7a64ff6b17b",
"body": "Bitbucket Cloud REST API has required scoped Atlassian API tokens since\nPhase 2 of app-password deprecation (Sep 9, 2025). Unscoped tokens minted\nvia the \"Create API token\" button at id.atlassian.com authenticate to\nAtlassian but are rejected by Bitbucket's BitbucketCustom auth layer with\na generic \n[…]\nPITokenLogin branches\non errors.As(&AuthError) instead of substring-matching \"403 Forbidden\".\nLogin prompt updated to direct users explicitly at the scoped flow with\nthe corrected granular scope list.",
"is_bot": false,
"headline": "fix(auth): distinguish classic-token rejection from missing scopes",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-05-14T18:13:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "045a46911e6df4c0aabcaff563a721f5c9a16530",
"body": "Swaps the live workflow's auth from a seeded API-token profile to an OAuth\nconsumer's client_credentials grant. Cleaner for CI — no credentials file\nto write, no user account involved, and the token lasts 2h. Workflow\nexchanges the consumer key/secret for a bearer, masks it, and hands it to\nthe test\n[…]\n to envelope-shape assertions. Also teach\nliveClient() to prefer env-var auth so the same tests work in CI and\nlocally against a profile.\n\nVerified end-to-end against bbkt-test: all 5 live tests pass.",
"is_bot": false,
"headline": "ci(live): switch live tier to client_credentials grant",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-04-22T18:47:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "01535e9ce1b9bbc1cf6409c9601c93605c862854",
"body": "…4773\n\n- format.go: collapse `label string, value string` into `label, value string`\n (gocritic paramTypeCombine) for KV and KVf.\n- comments_test.go: name the helper's return values (gocritic unnamedResult).\n- credentials_test.go: apply gofmt.\n- go-sdk v1.3.1 → v1.4.1: fixes GO-2026-4770 and GO-2026-4773 flagged by\n govulncheck. No call-site changes required.",
"is_bot": false,
"headline": "fix(ci): resolve lint failures and bump mcp-go-sdk past GO-2026-4770/…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-04-22T18:44:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6dba6886ffa17dd6f7a19b617d8d5cf739d78e29",
"body": "Surfaced by exercising bbkt against real Bitbucket with a live OAuth\nconsumer. Three fixes:\n\n1. ListWorkspaces: /workspaces → /user/workspaces\n Bitbucket deprecated /workspaces, /user/permissions/workspaces, and\n /repositories (the bare cross-workspace list) on 2026-02-25 with\n HTTP 410 (CHANG\n[…]\nands that call the same runStatus/runLogout as the\n existing top-level commands.\n\nRegression tests (endpoints_test.go) pin both URL fixes so a future\nrefactor can't silently reintroduce either path.",
"is_bot": false,
"headline": "fix: follow Bitbucket CHANGE-2770 endpoint deprecations, UX papercuts",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-04-20T04:31:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "add1c601c8b00298476e781c0bcf8f7cc597db87",
"body": "… machine\n\nThe OAuth flow was effectively untested shelfware. Three real issues:\n\n1. bbkt listened on a random free port but never sent redirect_uri in the\n authorize request, so Bitbucket would redirect to whatever callback URL\n was registered on the consumer — which has a fixed port that the r\n[…]\nrver omits it,\nfailed-refresh doesn't clobber creds, empty-token guard, end-to-end\n401-auto-retry path, and 401-without-OAuth passes through (no silent\nretry for Basic Auth). All offline via httptest.",
"is_bot": false,
"headline": "fix(oauth): deterministic callback port + tests for refresh/401 state…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-04-19T20:44:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "13ac9890b14a34204c0ca5cea9318de7f14b02f6",
"body": "Two new layers on top of the unit tests:\n\n1. Fixture replay (runs in normal CI)\n - Uses dnaeon/go-vcr v4 cassettes under testdata/fixtures/.\n - Three hand-crafted cassettes covering the nested-type surface that\n plain JSON assertions miss: full PullRequest with source/destination/\n revie\n[…]\norkflow .github/workflows/live.yml runs nightly and on manual\n dispatch, seeds a ProfileStore from BBKT_API_EMAIL/BBKT_API_TOKEN\n secrets, and exits cleanly if those secrets aren't configured.",
"is_bot": false,
"headline": "test(bitbucket): add VCR fixture replay + live smoke test tier",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-04-19T19:44:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f13e0363856f85a369ac36ef63cb19c83ef79b04",
"body": "…e invariants\n\nCovers the two bugs that slipped through (inline comment null fields, GetRaw\nAccept header) plus auth, error wrapping, IsExpired's 5-min buffer, and the\nlegacy-credentials-file migration path. Tests drive the real Client against\nhttptest.Server so they verify actual on-the-wire behavior rather than\nmock-echo assertions. Mutation-checked: reverting either fix produces a\nfailing test with a diagnostic showing the exact wire-level symptom.",
"is_bot": false,
"headline": "test(bitbucket): add regression tests for recently-fixed bugs and cor…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-04-19T19:30:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18e4b617d7d882314a50ce53ed96dbe3344f0482",
"body": "GetRaw serves four endpoints with different content types: pipeline\nstep logs (application/octet-stream), PR and commit diffs (text/plain),\nand file source (varies by file). Pinning Accept to octet-stream only\nmatches the log endpoint and risks 406 on the others. */* matches all\nof them and preserves the intent of \"raw\".",
"is_bot": false,
"headline": "fix(client): use */* Accept header in GetRaw to cover all raw endpoints",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-04-19T19:23:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4de33e04569b4329c4b445049fd2c218000de711",
"body": "The Bitbucket step log endpoint returns application/octet-stream\nand rejected the hardcoded Accept: application/json from do()\nwith HTTP 406. Makes do()'s Accept header configurable via a\nvariadic parameter (default still application/json) and updates\nGetRaw to request application/octet-stream, which unblocks\n`bbkt pipelines log` and the MCP get-step-log action.\n\nCloses #2",
"is_bot": false,
"headline": "fix(pipelines): send correct Accept header for step log (406)",
"author_name": "Aulia Lionar",
"author_login": "alionar",
"committed_at": "2026-04-19T19:23:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2df50d2c44a39722d579b23db352350ac9ce090",
"body": "…endering\n\nAdds ,omitempty to Inline.From and Inline.To so single-sided\ninline comments (added or removed lines) don't serialize with\n\"from\":null / \"to\":null. Bitbucket's API rejects null on these\nfields and requires absence, which caused duplicate-rendering\nworkarounds that anchored comments to both diff sides.\n\nCloses #1",
"is_bot": false,
"headline": "fix(inline-comments): omit null from/to fields to prevent duplicate r…",
"author_name": "Vitautas Brazas",
"author_login": "Millon15",
"committed_at": "2026-04-19T19:23:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "011a45f739daec17a4e102515b9c3f027ea5a795",
"body": "…spection",
"is_bot": false,
"headline": "feat: add --no-auth flag to MCP command for unauthenticated server in…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-03-16T02:16:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "60ea607b61804f480d671b6cc083bfd86d3fb24e",
"body": null,
"is_bot": false,
"headline": "docs: add glama.json for server claiming [skip ci]",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-03-07T20:32:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97e9954cc6cbf818e5c3a694f2852caeef5c5257",
"body": "Replace raw JSON dumps with formatted tables (list commands) and\nkey-value displays (detail commands) across all CLI commands. Add\nglobal --json flag to preserve raw JSON output when needed.\nRe-record demo GIF with real formatted output.",
"is_bot": false,
"headline": "feat: add human-readable CLI output with --json flag for raw output",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-23T18:35:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9d0c2c881ad3186bbe7b76e706ec11fb23888b0",
"body": null,
"is_bot": false,
"headline": "docs: fix demo GIF (canned output, no PII)",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-23T18:03:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a47f1128ab7159addaf1f3e91bdc11d62c76f654",
"body": "This reverts commit 429b01c58918609382e4dc1fb143276d7033edea.",
"is_bot": false,
"headline": "Revert \"docs: re-record demo GIF with properly built binary\"",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-23T17:44:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "429b01c58918609382e4dc1fb143276d7033edea",
"body": null,
"is_bot": false,
"headline": "docs: re-record demo GIF with properly built binary",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-23T17:43:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e22db88d7d963d157bad426ba528592fc97cfece",
"body": null,
"is_bot": false,
"headline": "docs: add VHS demo GIF, badges, and embed in README",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-23T17:12:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ee32597a521a47e66324fb884107722e9c1b660",
"body": null,
"is_bot": false,
"headline": "docs: switch from MIT to Apache-2.0 license",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T23:10:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24da3f4c29151c504e267a1f9469930db9f2301c",
"body": null,
"is_bot": false,
"headline": "chore: ignore root level bbkt binary in gitignore",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T23:04:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca74a374accc7b5f078317d3efcddb43bf23f9a4",
"body": null,
"is_bot": false,
"headline": "docs: add github issue templates, pr template, and contributing guide",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T23:02:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfab3d54b37100af127e784c7b53550ace51cd1c",
"body": null,
"is_bot": false,
"headline": "docs: add MIT License",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T23:01:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88f1d9ce938d2de791641caef06d91a2f9562f6c",
"body": null,
"is_bot": false,
"headline": "docs: add comprehensive reference guides for CLI and MCP tools",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T22:16:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e62768ca0d969eeb4a3e2bf3a40b48c7779004e",
"body": null,
"is_bot": false,
"headline": "ci: bump actions/setup-go version to 1.26",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T22:11:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbd3fa48ea2c312c997a523ac1a00e678bfa5b48",
"body": null,
"is_bot": false,
"headline": "fix(mcp): add omitempty to json payloads to fix PR creation",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T22:04:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b40af7bd63029a54aa71e546db99ea6b249f9752",
"body": null,
"is_bot": false,
"headline": "fix(cli): include read:workspace in auth wizard recommended scopes",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T21:51:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d403b9f3144ddf2a0bf1f36855a9a762d94f3cd9",
"body": "… exhaustion and llm hallucinations",
"is_bot": false,
"headline": "feat(mcp): multiplex 40 tools into 9 modular tools to prevent context…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-22T20:55:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "674fb510a41dfcbd56e8d150bc29f82f9727ac44",
"body": null,
"is_bot": false,
"headline": "fix: map bitbucket api token namespaces to mcp oauth scopes",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T17:42:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5a334d96b7aadc3bc5eb57335e9b255e63740221",
"body": "…workspaces API",
"is_bot": false,
"headline": "refactor: transition multi-profile inference engine to bitbucket API …",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T04:02:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "324abc73b3421f69d5632f36fbdf5ecf2de6368a",
"body": null,
"is_bot": false,
"headline": "feat: complete multi-profile inference engine",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T02:09:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e5f1be1c0eb4d34d20201adf9c0f94cbe2b19da",
"body": null,
"is_bot": false,
"headline": "docs: replace residual obsidian-go-mcp template strings with bbkt",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T01:29:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9479c490f5d0567a413e849b7bfcd59196c97f5c",
"body": null,
"is_bot": false,
"headline": "feat(build): implement dynamic git tag versioning via ldflags",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T01:25:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "535e744969017a15164920e5585182bbad96d496",
"body": null,
"is_bot": false,
"headline": "fix(cli): add version property to root command",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T01:23:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "194388053a222959dabb21bf22cc3f51466b6b89",
"body": null,
"is_bot": false,
"headline": "chore(mcp): rename mcp server instance from bitbucket-mcp to bbkt",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T01:18:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b29039e937d2d64e0e9f559a004879a95a0738e0",
"body": null,
"is_bot": false,
"headline": "chore(config): rename config directory to bbkt",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T01:17:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2f2cb16f4d0cc61676e16e6f4d3c2fdfb73dc50",
"body": null,
"is_bot": false,
"headline": "perf(mcp): reuse cached token scopes on mcp server startup",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T01:14:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df82df3a7281b9382a0420421625c635ca71796e",
"body": null,
"is_bot": false,
"headline": "fix(mcp): tolerate 403s during dynamic token scope extraction",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-21T00:57:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40b01701d329e8bd7f2595fb93dd1682f12b08ce",
"body": "…structions",
"is_bot": false,
"headline": "docs: add api token scope recommendations and explicit tool denial in…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T22:19:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8e76e170b43e3d4d62eea6980f626c3499764bd",
"body": "…ospection",
"is_bot": false,
"headline": "feat(auth): add atlassian api token support and dynamic mcp tool intr…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T22:18:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfa9fae2b2596836f601e125cd6d7a8a6323b2d7",
"body": null,
"is_bot": false,
"headline": "feat: add install script and mise task",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T16:31:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e9d32ab3ce24c621cdff73d8f2a967fd5c53625",
"body": null,
"is_bot": false,
"headline": "feat: migrate to official go SDK with Streamable Transport",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T06:07:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b46bc3c9190e5b648184ec13d01216192388b7fa",
"body": "…lure",
"is_bot": false,
"headline": "fix(docs): remove missing starlight image reference causing build fai…",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T05:17:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a7afd971137457a8fe5aae4249bbf38f941d9b50",
"body": null,
"is_bot": false,
"headline": "feat: initial go-live release, docs, and client stability fixes",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T05:14:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e4ed87fa0f528470e8d3a20c7d6db0f8b2d40d8",
"body": "Kill TokenData type entirely — OAuth and API token both use Credentials\nstored at ~/.config/bitbucket-mcp/credentials.json. OAuthLogin saves\ndirectly to credentials.json. No legacy migration or backwards compat.",
"is_bot": false,
"headline": "Remove legacy token.json, unify auth on Credentials",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T01:46:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11ead7689fb85f03aa13ab180c0987c79f064b57",
"body": "Go MCP server using mcp-go v0.44.0 for Bitbucket Cloud REST API v2.0.\n\nTools: workspaces, repositories, branches/tags, commits/diffs,\npull requests, PR comments, source/files, and pipelines.\n\nAuth: API token (Basic Auth, default) and OAuth 2.0 auth code grant.\nCredentials stored at ~/.config/bitbucket-mcp/credentials.json.",
"is_bot": false,
"headline": "Initial commit: Bitbucket Cloud MCP server with 42 tools",
"author_name": "Zach Snell",
"author_login": "zach-snell",
"committed_at": "2026-02-20T01:32:58Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 12,
"commits_last_year": 61,
"latest_release_at": "2026-07-12T05:12:08Z",
"latest_release_tag": "v0.1.11",
"releases_from_tags": false,
"days_since_last_push": 10,
"active_weeks_last_year": 8,
"days_since_latest_release": 10,
"mean_days_between_releases": 15.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 71,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "github.com/zach-snell/bbkt",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/zach-snell/bbkt",
"is_deprecated": false,
"latest_version": "v0.1.11",
"repository_url": "https://github.com/zach-snell/bbkt",
"versions_count": 12,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-12T05:09:55Z",
"latest_version_yanked": null,
"days_since_latest_publish": 10
}
]
},
"popularity": {
"forks": 3,
"stars": 4,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2026-03-03",
"count": 1
},
{
"date": "2026-03-30",
"count": 1
},
{
"date": "2026-04-29",
"count": 1
}
],
"complete": true,
"collected": 3,
"total_forks": 3
},
"star_history": null,
"open_issues_and_prs": 5
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": true,
"bootstrap_files": [
".mise.toml"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"docs/tsconfig.json"
],
"toolchain_manifests": [
"go.mod"
],
"largest_source_bytes": 15444,
"source_files_sampled": 58,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"docs/package.json",
"go.mod"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go",
"npm"
],
"dependencies": [
{
"name": "github.com/charmbracelet/huh",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.8.0"
},
{
"name": "github.com/modelcontextprotocol/go-sdk",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.4.1"
},
{
"name": "github.com/spf13/cobra",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "gopkg.in/dnaeon/go-vcr.v4",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v4.0.6"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 5,
"merged_prs": 2,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 2
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "zach-snell",
"commits": 59,
"avatar_url": "https://avatars.githubusercontent.com/u/10632545?v=4"
},
{
"type": "User",
"login": "alionar",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/18596757?v=4"
},
{
"type": "User",
"login": "Millon15",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/32433787?v=4"
}
],
"contributors_sampled": 3,
"top_contributor_share": 0.967
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"docs.yml",
"live.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yml"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum",
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 2 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 2/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "18 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "35 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "d19dfea7a9cc8a3c6a9fd45ca2f05a5a7d240488",
"ran_at": "2026-07-22T12:54:13Z",
"aggregate_score": 2.8,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-22T09:40:01Z",
"oldest_open_prs": [
{
"number": 5,
"created_at": "2026-06-23T17:16:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 6,
"created_at": "2026-06-23T17:17:01Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 7,
"created_at": "2026-06-23T17:17:03Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 8,
"created_at": "2026-06-23T17:43:55Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 9,
"created_at": "2026-06-25T10:26:09Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-04-19T19:23:11Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/zach-snell/bbkt",
"host": "github.com",
"name": "bbkt",
"owner": "zach-snell"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"security": 28,
"vitality": 72,
"community": 41,
"governance": 48,
"engineering": 78
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 72,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"commits_last_year": 61,
"human_commit_share": 1,
"days_since_last_push": 10,
"active_weeks_last_year": 8
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 10 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "8/52 weeks with commits",
"points": 5.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 8
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "61 commits in the last year",
"points": 16.1,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 61
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "18 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 12,
"latest_release_tag": "v0.1.11",
"releases_from_tags": false,
"days_since_latest_release": 10,
"mean_days_between_releases": 15.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "12 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 12
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 10 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 10
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~15.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 15.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 41,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"forks": 3,
"stars": 4,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "4 stars",
"points": 7.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 4
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "3 forks",
"points": 2.5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 3
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 48,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 17,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 3,
"top_contributor_share": 0.967
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 97% of commits",
"points": 0.7,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 97
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "3 contributors",
"points": 4.1,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 3
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 36,
"inputs": {
"merged_prs": 2,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 2
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "2/4 decided PRs merged",
"points": 19.1,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 2,
"decided": 4
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 2/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 56,
"inputs": {
"followers": 30,
"owner_type": "User",
"is_verified": null,
"owner_login": "zach-snell",
"public_repos": 39,
"account_age_days": 4199
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "30 followers of zach-snell",
"points": 10.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 30,
"login": "zach-snell"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "39 public repos, account ~11 yr old",
"points": 23.7,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 39
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/zach-snell/bbkt"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 10
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 10 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 10
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "12 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 12
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 78,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "4 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 4
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 2 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"topics": [
"bitbucket",
"cli",
"go",
"mcp",
"mcp-server"
],
"has_wiki": true,
"homepage": "https://zach-snell.github.io/bbkt/",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://zach-snell.github.io/bbkt/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "5 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 5
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 28,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 28,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 2.8
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 2 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 2/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "18 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "35 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 4
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 59,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.984,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "60 of 61 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 60,
"sampled": 61
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 72,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum",
"pnpm-lock.yaml"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
".mise.toml"
],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"docs/tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [
"go.mod"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": ".mise.toml",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".mise.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "docs/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "docs/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 61",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 61
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 15444,
"source_files_sampled": 58,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/58 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 58,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "critical",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 20,
"inputs": {
"example_dirs": [],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-22T12:54:21.623628Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/z/zach-snell/bbkt.svg",
"full_name": "zach-snell/bbkt",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with zach-snell/bbkt. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.26.0 — full methodology · metrics wiki.
