XTraceAI/memory-sdk-ts має індекс здоров’я 47 зі 100, що відповідає смузі «У зоні ризику». Найвищий показник — Vitality (70/100), найнижчий — Security (17/100). Останнє оновлення було 5 днів тому. Більшість нещодавньої роботи виконує один учасник.
47
загалом / 100
У зоні ризику
Індекс здоров'я програмного забезпечення
Метрики згруповано у зважені категорії на шкалі 1–100. Загальна оцінка починається як їхнє середнє; коли публічні дані активують Політику юрисдикцій високого ризику, рейтинг коригується й отримує верхню межу 49 («Під ризиком»). Готовність до ШІ не входить до індексу.
47
Відмінний85-100Зразковий; відповідає практично всім перевіреним критеріям
Добрий70-84Здоровий; незначні прогалини
Помірний50-69Прийнятний, але з помітними прогалинами; рекомендовано перевірку
У зоні ризику30-49Суттєві слабкі місця; впровадження потребує обережності
Критичний1-29Серйозні проблеми (покинутий, єдиний мейнтейнер, без базової гігієни)
Профіль оцінок
Кожна вісь — окрема категорія. Форма важить більше, ніж середнє: здоровий об'єкт заповнює всю фігуру, тоді як профіль із піками та провалами означає, що сила в одному вимірі маскує ризик в іншому.
Виключено з оцінювання (немає даних або не застосовно): dangerous_workflow, packaging, pinned_dependencies, signed_releases, token_permissions. Залишкові ваги перенормовано.
Наскільки репозиторій оснащений для розробки та супроводу за участі ШІ-агентів? Незалежний, експериментальний бейдж — вага 0.0, тож він подається окремо і не впливає на загальний індекс здоров'я.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
deps.dev does not index npm:@xtraceai/memory@0.5.0; advisories assessed against the repository dependency graph instead
Докладніше
Історія зірок і форків 0 ★ / 34 ⇿
0Зірки
34Форки
2Релізи
Коли додано кожну зірку й форк — зібрано з GitHub і згруповано за днями. Кумулятивне зростання розміщено просто над денними додаваннями, з яких воно складається, тож їх видно одне проти одного: рівномірне органічне накопичення виглядає зовсім інакше, ніж різкий короткочасний сплеск. Там, де цю різницю можна виміряти, її подано як автентичність росту.
Мажорні 0Мінорні 1Патчі 1
OpenSSF Scorecard 1.6 / 10
1.6сукупно
Незалежна, не прив'язана до інструментів оцінка безпеки від відкритого проєкту OpenSSF Scorecard. Кожна перевірка винагороджує практику безпеки, а не інструмент конкретного постачальника. Перевірки, які Scorecard не зміг визначити, позначено н/д і виключено з оцінки безпеки (вони ніколи не зараховуються як нуль).Scorecard v5.5.0 · 2026-07-23 06:40 UTC
Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Звіт у форматі JSON машиночитний
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 2582,
"has_wiki": true,
"homepage": null,
"languages": {
"TypeScript": 249347
},
"pushed_at": "2026-07-17T21:38:28Z",
"created_at": "2026-05-16T01:26:20Z",
"owner_type": "Organization",
"updated_at": "2026-07-22T06:47:50Z",
"description": "TypeScript SDK for the xtrace memory API",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": null,
"name": null,
"type": "Organization",
"login": "XTraceAI",
"company": null,
"location": null,
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/170989492?v=4",
"created_at": "2024-05-28T00:32:34Z",
"is_verified": null,
"public_repos": 6,
"account_age_days": 786
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-07-17T21:37:44Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-07-10T00:37:21Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-24T02:31:29Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-06-01T21:25:34Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-05-31T18:54:30Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-05-27T23:05:22Z"
}
],
"recent_commits": [
{
"oid": "cda5165a021374ae716662d555b53667e6325820",
"body": null,
"is_bot": false,
"headline": "release: v0.5.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-17T21:37:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82f1c2e3da2001f73ff7061f0f6b3e5e0dc13823",
"body": "feat(ai-sdk): withDirectiveRecall — procedural-memory recall around tools",
"is_bot": false,
"headline": "Merge pull request #15 from XTraceAI/fm-feat/ai-sdk-directive-middleware",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T18:43:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4927a7dbf1ad76b1a6c187a92b94be541679f0e2",
"body": "[medium] the reservation cleanup only ran on the success paths; a throwing\noriginalExecute propagated correctly but skipped release(), leaking its\nreserved directive ids into the shared fired set forever — silent loss on\nany later successful call. Wrap the tool call: on throw, settle the\nin-flight r\n[…]\nded), release all, re-throw.\nNew test asserts the error propagates AND the directive resurfaces next call.\n\n65 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): release reserved ids when a tool throws (review)",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:26:15Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d34e3890d27ea9bcd7c9fb370dd755c8a0aa3346",
"body": "…review)\n\n[low] fired is shared across wrapped tools, and the check (!fired.has) and\nact (add) spanned the tool-execution await — two parallel tool calls (the\nAI SDK runs tools concurrently) could both select the same directive and\ndouble-deliver. Move to optimistic reservation: recall reserves ids \n[…]\niver() no longer owns fired. New concurrency test asserts\nexactly-once delivery across two parallel calls.\n\n64 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): close the fired-once race across concurrent tool calls (…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:20:54Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e74f2a0203a8d7825db3455184207e13bebc2c91",
"body": "…reactive priority (review)\n\nThree more review findings on the directive middleware:\n\n- [high] a directive recalled at an undeliverable moment (array/number\n result, no observer) was still added to the fired set — silently lost,\n and blocked from a later injectable call, contradicting the 'keeps i\n[…]\now take budget priority.\n\n3 new tests (undeliverable keeps its chance, Date not spread, reactive\npriority); 63 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): correct fired-once accounting, non-plain-object safety, …",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:13:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1cd99de00d1c5cdc4a3db8f59a2d62e6671f0d7e",
"body": "…e exact tag (review follow-up)\n\nThe tag-specific neutralize regex missed whitespace/attribute variants\n(</team-directives >, <team-directives foo=x>) that a fuzzy model parser\nwould still honor as a block close. Escape the whole angle-bracket class in\ndirective text instead — provably complete, and the model reads </>\nas literal characters. Test now asserts the whitespace + attribute variants\nare defanged too.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): escape all angle brackets in directive text, not just th…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:06:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "72f8de70d95b377ba1a29d95777f14d8f76c5662",
"body": "…er, redaction, reactive FP\n\nFour MemHub-review findings on the directive middleware:\n\n- [medium] prompt-injection sink: directive text is teammate-authored\n (untrusted) and was appended verbatim inside a <team-directives> block a\n malicious directive could break out of. Neutralize <team-directive\n[…]\n can supply a precise check.\n\n4 new tests (breakout defang, no-clobber, redaction, isFailure suppression);\n60 passing, typecheck + build clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(ai-sdk): harden withDirectiveRecall per review — injection, clobb…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T02:00:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0db99173f7cda53a1ce1bf449e3c2a3e43592ea0",
"body": "…ools\n\nWrap any AI SDK tools object so every tool call fires the symbol tripwire:\npre-tool recall runs CONCURRENTLY with execute (never delays the tool), a\nreactive second recall fires when a string result looks like a failure\n(the error text names the true cause — identifiers the args never showed)\n[…]\ntility\nreplay. 7 tests: wire contract, dedup, object/array injection shapes,\nreactive pass, fail-open (error + timeout), no-execute passthrough.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(ai-sdk): withDirectiveRecall — procedural-memory recall around t…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-15T01:55:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "32421bf9337893e316968d31d837ac9922e76d37",
"body": "feat(directives): memories.trigger() + agentic/namespace ingest",
"is_bot": false,
"headline": "Merge pull request #14 from XTraceAI/fm-feat/directive-trigger-surface",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T23:29:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "caf400ebd2416f0caa502483a8a999560c4ec21b",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: satisfy noUncheckedIndexedAccess in trigger tests",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T01:46:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "016f878a1aca1d31e59bb3fa3a44dba80577e279",
"body": "… procedural-memory surface\n\n- Vendor the fixed staging OpenAPI spec (DirectiveDetails was a dangling\n $ref that hard-failed openapi-typescript — fixed server-side in\n VecDB-Backend #153) and regenerate src/generated/types.ts: first regen\n since the directive/agentic surface shipped.\n- types: les\n[…]\nall recall,\n body passed through verbatim (server defaults stay in charge).\n- tests: trigger wire contract + directive-row typing (49 passing).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(directives): memories.trigger() + agentic/namespace ingest — the…",
"author_name": "felix-xtrace",
"author_login": "felix-xtrace",
"committed_at": "2026-07-14T01:46:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ea935918c247783daa680f010eda41778607398",
"body": null,
"is_bot": false,
"headline": "0.4.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-10T00:37:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9576b0e5b0ddc1f61c3b831bb31367b59a2bf31c",
"body": "feat: support prompt-less (catch-all) groups",
"is_bot": false,
"headline": "Merge pull request #13 from XTraceAI/claude/jolly-williamson-a11418",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-10T00:35:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dae1cece3cc0476c97e0a6d4d64cb52677c5b913",
"body": "examples/groups-smoke.ts (npm run smoke:groups) walks the whole\ncatch-all surface against a live API: prompted create regression,\nprompt-less create -> prompt null, empty-string 422s on create and\nPATCH, null round-trip through get/list, PATCH converting a catch-all\nto prompted, ingest tagging a sha\n[…]\nonal memory stays untagged (classifier-dependent, so\nsoft-fail), and archived ids echoing in ignored_group_ids. Cleans up\neverything it creates.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: add staging smoke script for catch-all groups",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-08T01:58:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "80f0429296ef2e66a3e8f76c0c8a67dd896a1e24",
"body": "VecDB-Backend now allows creating a group without a prompt\n(GroupCreateRequest.required == [\"name\"] in the regenerated OpenAPI\nspec). A prompt-less group is a catch-all: the ingest classifier tags\nit on every extracted memory it judges shareable, with no per-group\nmatching. Personal memories are nev\n[…]\n can never\n be removed via update\n- Add a create-without-prompt test asserting the request body omits\n the key and the null prompt round-trips\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: support prompt-less (catch-all) groups",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-07-08T00:50:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "52e831fb4cb11c61d6c33c6283ddc4aaf2aaaf0d",
"body": "feat: webhooks support (client.webhooks + signature verification)",
"is_bot": false,
"headline": "Merge pull request #10 from XTraceAI/feat/webhooks",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:31:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d490de2ba8e31c51e96a7422b7af9b581def0975",
"body": "Codex review (#10): the test sign() helper used the gated\nglobalThis.crypto, so on stock Node 18 the suite ReferenceErrors before\nany assertion. Use node:crypto.webcrypto in the signer so tests cover\nthe advertised node >=18 range (and so the global-absent test can null\nglobalThis.crypto without breaking signing).",
"is_bot": false,
"headline": "test: sign webhook fixtures with node:crypto (Node 18 compat)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:23:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfc3d942d88cef0f6b5829b1610d4965a20fd0b6",
"body": "Codex review (#10): verifyWebhookSignature read globalThis.crypto.subtle,\nwhich on Node 18.x is gated behind --experimental-global-webcrypto — so\nit threw before verifying on stock Node 18 even though the package\nadvertises node >=18.\n\nResolve SubtleCrypto across runtimes: prefer globalThis.crypto.s\n[…]\nzily import node:crypto.webcrypto\n(always present on Node). The import is dynamic + guarded so non-Node\nbundles never pull in node:crypto. Adds a test simulating Node 18\n(globalThis.crypto undefined).",
"is_bot": false,
"headline": "fix: webhook signature verification works on Node 18",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T02:01:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "caa8de236b05a2f9d38d10580a5a596e38c6b4a2",
"body": "Codex review (#10): at-most-once is misleading given retries — a lost\n2xx after the handler ran triggers a duplicate. State deliveries may be\ndropped or duplicated; dedupe on job_id.",
"is_bot": false,
"headline": "docs: correct webhook delivery semantics in README",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T01:51:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12cbadbfed95485e62b864fc5426345298745bc6",
"body": "Add first-class support for ingestion-completion webhooks:\n\n- client.webhooks.set() / get() / delete() for the per-org /v1/webhooks\n config (set() takes { rotateSecret } to mint a fresh signing secret).\n- verifyWebhookSignature() / parseWebhookEvent() — HMAC-SHA256 over the\n raw body via Web Crypt\n[…]\n,\n WebhookMemoryRef.\n- README \"Webhooks\" section + raw-body verification example.\n\nMinor bump → 0.3.0. 45 tests pass; typecheck + build clean.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: webhooks support (client.webhooks + signature verification)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-24T01:37:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0737c6ecd0a88f47d6d54ba4eef5da3df214d76a",
"body": null,
"is_bot": false,
"headline": "change from docs.mem to docs",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-05T16:51:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2fa0d3d0f51026ceb411ef192f558d1d4fb7bf4f",
"body": null,
"is_bot": false,
"headline": "release: v0.2.1",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:25:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9cb76798dbedc38f7d04e165942cc1cbe9a42d9e",
"body": "feat(sdk): generalize recall() to union arbitrary scope pools",
"is_bot": false,
"headline": "Merge pull request #8 from XTraceAI/tc/recall-pools",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:15:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "005dcf8ac2b980f6398616d717d801d1c300c31d",
"body": "Addresses Codex P2 on #8: a JS caller (no compiler) passing a bare string, e.g.\npools: [{ group_ids: \"grp_x\" }], slipped past validation because strings have\n.length, then forwarded a non-array group_ids to /v1/memories/search. recall()\nnow rejects any non-array group_ids with a clear error. TS callers are already\nprotected by the string[] type; this guards the untyped path.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): reject a non-array group_ids in a recall pool",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T21:05:14Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "685896b713d588ce7e7250c707f3ca568e0a7d39",
"body": "Addresses Codex P2 on #8: a dynamically-built pool like { user_id, group_ids: [] }\npassed validation (user_id is an axis) but then spread group_ids: [] into the\nsearch — an empty any-of that AND-narrows to nothing server-side, silently\nturning a personal recall into a match-nothing scoped search. re\n[…]\nains) and never forwarded; a\npool left with no real axis still throws. Unifies the empty-array and zero-axis\ncases under one rule.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): strip empty axes from recall pools before search",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:57:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "33d19fd3d8ca4147b1c696baac1ecae7bc0a9162",
"body": "Addresses Codex P2 on #8: the round-1 multi-user fix attributed any non-viewer\nrow 'everywhere', but viewerUserId is optional — so a standalone\nrenderMemoriesPrompt() on one user's personal rows (which always carry user_id)\nwith no viewer rendered every line as 'alice: ...', changing the exported\nre\n[…]\n as before. Adds a standalone test (real rows have user_id, the\nfixtures defaulted user_id:null so this regression was invisible).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): gate personal-row author attribution on a known viewer",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:49:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3539b59f17b4b23f50da2b5e8cb80fe2d783b592",
"body": "…ng them\n\nAddresses Codex P2 on #8: the pool filter silently removed any pool with no\nscope axis, so a typo'd `group_id` or an empty `group_ids: []` alongside a valid\npool would make recall() return a plausible-but-incomplete result with the\nrequested scope quietly missing. Now each pool is validate\n[…]\n conditionally must omit it\nexplicitly. ai-sdk tool already normalizes empty groups to undefined, so it\nnever trips the new guard.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): recall() rejects malformed pools instead of silently droppi…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:42:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "906f8b2452e3aa9711031477b25012891fa9fdec",
"body": "Addresses Codex P2 on #8: the anti-bleed filter was gated on pool.user_id, so a\ndeliberately-scoped pool like { user_id, app_id } still got its rows dropped when\nthey carried a non-requested group tag — violating the AND-within-pool contract\n(the axes already narrow it; the caller asked for exactly \n[…]\nly to a PLAIN { user_id } pool (no app_id/agent_id/group_ids);\nany extra axis is treated as a deliberate scope and returned as-is.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): bleed-filter only the plain personal pool, not every user pool",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:35:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "91460e50aead1afc3fd971d2a60540b22307c960",
"body": "… memories\n\nAddresses Codex P2 on #8: with pools: [{user_id}, {app_id:'product-kb'}],\nthe KB rows have no group, so they fell into the Personal / 'memories about\nthe user' section — framing a doc as the user's own fact. recall() now labels\nrows from a non-user, non-group pool with their app_id/agent\n[…]\nhose under that source label (no author attribution). User-pool rows\ntake precedence (a row also from a user pool stays Personal).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(sdk): section app/agent-pool rows under their source, not as user…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T20:03:45Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ed13ffc9331850d4254df4c38256e3b303a297ea",
"body": "- Cross-group anti-bleed filter is now USER-pool-only. It was applied to every\n pool without group_ids, so combining an app/agent pool with a group pool\n silently dropped the app pool's rows that happened to carry an unrelated group\n tag (e.g. a product-KB doc tagged grp_docs, recalled alongside \n[…]\ndocs/types all pools-only,\nno current backward-compat claim). The bots flagged the superseded first commit.\n\n+2 tests (app-pool preserved, second-user attribution) → 30 total. typecheck + build green.",
"is_bot": false,
"headline": "fix(sdk): address #8 review — recall() pool edge cases",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:48:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f56249801b7aee5bc37e4872e22b84c39456c1be",
"body": null,
"is_bot": false,
"headline": "docs(releasing): example version 0.2.1 (next release)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:40:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97b0e35f38d9629ff35a130642a8da48e1a5265a",
"body": null,
"is_bot": false,
"headline": "docs(readme): recall() example uses pools",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:35:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc49b3aa7ea6f954b13c9b31ebc3ca4c580adb76",
"body": "…elds)\n\nPer design review: the convenience form mixed semantics confusingly — it OR'd\nuser_id vs group_ids but AND-narrowed agent_id/app_id, an implicit shape that's\nhard to reason about. Make recall a single, explicit rule instead:\n\n recall({ query, pools: [{ user_id }, { group_ids }] }) // ax\n[…]\n to pools-only. 28 pass, typecheck + build green.\n\nBREAKING CHANGE: recall({ user_id, group_ids }) no longer works; pass\n`pools: [{ user_id }, { group_ids }]`. (Only affects 0.2.0, released days ago.)",
"is_bot": false,
"headline": "refactor(sdk)!: recall() is pools-only (drop the convenience union fi…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:30:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "efb0d2f96a2ec9ace5f3494d599ded4ad952c90d",
"body": "recall() previously hardcoded the union to `user_id OR group_ids`, which made\nthe union mechanism look group-specific and left other blends (e.g. personal +\na global app_id KB) as a manual two-search merge. The union is general, so\nrecall now takes an explicit `pools` list:\n\n recall({ query, pool\n[…]\netry where groups got a one-liner but app_id\nneeded concurrent manual searches.\n\nTests: +4 (explicit-pool union, validation, cross-pool bleed filter, legacy\nsugar) → 29 total. typecheck + build green.",
"is_bot": false,
"headline": "feat(sdk): generalize recall() to union arbitrary scope pools",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-06-01T19:14:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3eb4ff53b80174b6cf18e46862b903243623b600",
"body": "docs: add RELEASING.md (manual npm publish flow)",
"is_bot": false,
"headline": "Merge pull request #7 from XTraceAI/tc/releasing-doc",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:15:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94024e4c4f675a5b99adc30c7ce3811a17b16805",
"body": null,
"is_bot": false,
"headline": "docs(releasing): verify npm whoami is tristangc before publishing",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "124bee96927799a47c70244a9c3d28b5e14e9918",
"body": "… 0.2.0 run",
"is_bot": false,
"headline": "docs(releasing): publish before tagging; add troubleshooting from the…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:04:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5957a9dfc1d3a8e38ca0cbda1ef0d8ff92453d6",
"body": null,
"is_bot": false,
"headline": "Merge main (0.2.0 release commit)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T19:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c389cf965f9a517fa3b1db9fa9d1a3770252d0e0",
"body": null,
"is_bot": false,
"headline": "release: v0.2.0",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:54:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01285b22c665e822618b69f727b031b19f34a9ea",
"body": null,
"is_bot": false,
"headline": "Merge main (#6) into releasing-doc",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:30:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4ffe319ac38ca7704efa5d8dc95a5581c24e484",
"body": null,
"is_bot": false,
"headline": "docs: add RELEASING.md (manual npm publish flow)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T18:28:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c165eb63d2fd11b7cd1b79e45f1012c70980edac",
"body": "feat(sdk): recall() (personal + shared) + sync SDK to deployed API",
"is_bot": false,
"headline": "Merge pull request #6 from XTraceAI/tc/sdk-recall-and-sync",
"author_name": "Tristan Chen",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T17:38:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "43f614857f5b40616c9f2619253429088d3353bd",
"body": "Two genuinely-new review findings on the prior commit (the others re-flagged\nby the bots were already fixed there):\n\n- limit=1 no longer always favors the personal scope. The round-robin took\n personal first every round, so `recall({ user_id, group_ids, limit: 1 })`\n dropped the shared scope even \n[…]\nall to untagged memories\".) This\n complements the earlier render-side fix (sections only requested groups).\n\nTests: +2 (limit-1 global-max, other-group exclusion) → 25 total. typecheck +\nbuild green.",
"is_bot": false,
"headline": "fix(sdk): recall() limit=1 fairness + drop other-group bleed (round 2)",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T16:53:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "32f150d2fe051738508732d95349a08466a8823d",
"body": "Four issues flagged by Codex/Cursor on recall() + the ai-sdk tools:\n\n- save_memory now forwards the group scope. memoryTools normalizes the group\n scope once (groupIds) and BOTH search_memory (via recall) and save_memory\n (via ingest group_ids) use it, so model-saved facts can be group-tagged and\n\n[…]\nedGroupIds keeps the prior \"section every tag\" behavior (back-compat).\n\nTests: +7 (fair-merge, requested-group bucketing, multi-tag, tool save/gate) —\n23 total across 3 files. typecheck + build green.",
"is_bot": false,
"headline": "fix(sdk): address #6 review — recall group-scope correctness",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T08:15:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c83ce46a8691759c91bc7b189f3e761128d0de01",
"body": "Shared (group) lines now carry their author so a multi-traveler group is\nunambiguous: \"<user_id>: <fact>\", or \"you: <fact>\" when it's the caller's own\nrow (recall passes the caller as viewerUserId). Personal lines stay\nunattributed (always the caller). Uses m.user_id — which a cross-user group\nread \n[…]\nead (alice→\"you\", bob→\"bob-…\"). 17 tests,\ntypecheck + build green.\n\nNote: shows the raw user_id; human display names would be a phase-2 concern\n(server template / widened payload), tracked in ENG-108.",
"is_bot": false,
"headline": "feat(sdk): attribute group memories to their author in recall() prompt",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T08:02:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fdfac348c6ec1244a0c49b21d4ad76bc5e294ed7",
"body": "…able format)\n\nExtract the prompt format into a JSON-serializable PromptTemplate\n(DEFAULT_PROMPT_TEMPLATE) that drives renderMemoriesPrompt: header,\npersonal/unknown-group labels, per-type tags, and category/date toggles.\nDefault output is unchanged.\n\nSets up phase 2: a future API endpoint can retur\n[…]\n, full\nartifact bodies, or char-budgeting without also widening the search payload.\n\nExports PromptTemplate + DEFAULT_PROMPT_TEMPLATE. 16 tests (added a\ncustom-template case); typecheck + build green.",
"is_bot": false,
"headline": "refactor(sdk): make recall() prompt template-driven (phase 1 of swapp…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:46:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "070cbfd23a74f336f17d331aa3b31c173e417c8c",
"body": "…tags)\n\nFacts still render as plain statements; artifacts and episodes now get a\ntype tag and their title — \"[document] <title>: <text>\" and\n\"[conversation] <title>: <text>\" — so the agent can tell a stored document\nor a past conversation from a stated fact. Uses only m.type / m.details\nalready on e\n[…]\nparity\nwould need a backend assemble-over-merged-set endpoint, which adds a\nsequential round-trip after the fan-out — declined here to keep recall fast.\n\nTest added; 15 total, typecheck + build green.",
"is_bot": false,
"headline": "feat(sdk): light type-awareness in recall() render (artifact/episode …",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:40:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e4db7ced321adae7747553f96ea6fae50ebdf771",
"body": "Memory rows carry only opaque group_ids, so the prompt couldn't name the\ngroup. recall() now resolves group id → name from the registry (one\nGET /v1/groups, fired in parallel with the searches — ~free latency,\nbest-effort: a lookup failure falls back to id labels rather than failing\nthe call). rende\n[…]\nacts under its own name.\n\nTests: name-resolution + per-group sectioning + id fallback (14 total).\nValidated live on staging — shared section headed by the group name,\nopaque id absent from the prompt.",
"is_bot": false,
"headline": "feat(sdk): recall() labels shared sections by group NAME",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:29:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7da2318468fa82712acab75342634779b041eb01",
"body": "…egories + date\n\nrenderMemoriesPrompt now groups the merged memories into \"Personal\" and\n\"Shared (group)\" sections (by each row's group_ids — tagged = shared,\nuntagged = personal), falling back to a flat list when only one kind is\npresent. Each bullet carries the memory's categories (`[...]`) and re\n[…]\nhile staying fully deterministic and client-side (no LLM, no backend\ncall). Still overridable via `recall(..., { render })`.\n\nAdded a grouping test; updated the flat-list test for the new line format.",
"is_bot": false,
"headline": "feat(sdk): richer recall() prompt — split personal vs shared, add cat…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:15:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a7da7a9c443ec8a66a356678a29ff8a8d9872a86",
"body": "…yed API\n\n## recall() — personal + shared (group) read in one call\n\nSearch scoping is AND-everything (\"scope by what you pass\"), so a combined\n\"my own preferences AND the trip's shared facts\" read can't be one request\n(`{user_id, group_ids}` intersects). `client.memories.recall()` rebuilds that\nunio\n[…]\negenerated via `npm run gen:types`) is still\nstale; left out of scope — it's a reference artifact, not part of the public surface.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(sdk): add recall() (personal + shared) and sync SDK to the deplo…",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-31T07:00:28Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fd9978d4ef5e4f4bb0381c78a7b0b2d409898077",
"body": "update readme",
"is_bot": false,
"headline": "Merge pull request #5 from XTraceAI/chore/update-readme",
"author_name": "Liwen O.",
"author_login": "liwenXtrace",
"committed_at": "2026-05-28T20:22:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d4aeac0be566bcf843196856223fdaf2a25e373",
"body": null,
"is_bot": false,
"headline": "update readme",
"author_name": "Sebastian Gonzalez",
"author_login": "sgonz-xtrace",
"committed_at": "2026-05-28T19:58:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9eb8ebb70ec58aabf0d0813bcb3fc62d1a53039",
"body": "Flip the SDK-side default in memories.ingest() so the artifact\nextraction stage runs unless callers explicitly pass\n`extract_artifacts: false`. The server still treats an absent key\nas off, so the SDK now sends the resolved value on every request.\n\nThe ai-sdk wrappers (auto-ingest middleware in prov\n[…]\n message pairs and\none-line facts rarely benefit from the artifact stage and it is the\nmost expensive extraction step.\n\nBumps version to 0.1.1.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: default extract_artifacts to true for direct ingest",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-27T23:05:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2ed0a44319a8a323c3e3ee5f8007793ef482b36b",
"body": "Two patterns ship under @xtraceai/memory/ai-sdk:\n\n- createXtraceMemory(): wraps any LanguageModel so it auto-searches\n memory before each call and auto-ingests the turn after. Mem0's\n provider pattern — set it and forget it.\n\n- memoryTools(): exposes search_memory and save_memory as tools the\n LL\n[…]\ns where the model decides\n when to read / write memory.\n\nai and zod are optional peer dependencies; users who only import\nthe core SDK don't pull them in. Bumps version to 0.1.0 (new public\nsurface).",
"is_bot": false,
"headline": "feat(ai-sdk): add Vercel AI SDK integration at /ai-sdk subpath",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-22T21:29:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "94b0f91704f3690a4753c4aa19a256295d04b54d",
"body": null,
"is_bot": false,
"headline": "chore: drop mem0 from package keywords",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-22T01:27:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65ece6d0f47cb575d2c942781078749b299abca5",
"body": null,
"is_bot": false,
"headline": "docs: point at app.xtrace.ai for credentials + docs link",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-21T21:07:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "98639fa66f23b5f8e32c7b16036ba96c13915618",
"body": "- Default baseUrl now points to https://api.production.xtrace.ai\n (was api.xtrace.ai, which returns 404)\n- Re-apply scope rename @xtrace → @xtraceai that was lost in reset\n- Bump to 0.0.2",
"is_bot": false,
"headline": "fix: correct production base URL to api.production.xtrace.ai",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-20T23:56:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d866fe6a0b7fc167ad2215cb15021b95ba4ea10",
"body": "Tests will land in a follow-up PR. The --passWithNoTests flag\nkeeps prepublishOnly from blocking the squat release.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: bump to 0.0.1 + allow empty test suite for publish",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:28:12Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "428c38aa06236463a9fb7983f2e7f05b7e931290",
"body": "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: use canonical XTraceAI casing in repo URLs",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:26:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b7fb885a1ce1ace44f91c56fc9f56ccfd83759b9",
"body": "Hand-written SDK targeting the v0.1 xtrace memory API. Covers\ningest (async + sync via wait=true), job polling with exponential\nbackoff, list (cursor-paginated async iterator), get, update,\ndelete, search, and the retrieve sugar for context_prompt.\n\nTypes match the live staging /openapi.json (regene\n[…]\neLimited, Unprocessable, etc.) keyed on the API's stable\nerror.code strings.\n\nEnd-to-end smoke test against staging passes (examples/smoke.ts).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: initial @xtrace/memory TypeScript SDK",
"author_name": "tristan-xtrace",
"author_login": "tristan-xtrace",
"committed_at": "2026-05-16T01:23:30Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 6,
"commits_last_year": 60,
"latest_release_at": "2026-07-17T21:37:44Z",
"latest_release_tag": "v0.5.0",
"releases_from_tags": true,
"days_since_last_push": 5,
"active_weeks_last_year": 8,
"days_since_latest_release": 5,
"mean_days_between_releases": 10.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 50,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@xtraceai/memory",
"exists": true,
"license": "MIT",
"keywords": [
"xtrace",
"memory",
"sdk",
"ai",
"agent",
"ai-sdk",
"vercel-ai-sdk"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@xtraceai/memory",
"is_deprecated": false,
"latest_version": "0.5.0",
"repository_url": "https://github.com/XTraceAI/memory-sdk-ts",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 5024,
"first_published_at": "2026-05-16T01:42:32.983000Z",
"latest_published_at": "2026-07-17T21:38:18.141000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 34,
"stars": 274,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2026-05-28",
"count": 19
},
{
"date": "2026-05-29",
"count": 1
},
{
"date": "2026-05-30",
"count": 1
},
{
"date": "2026-05-31",
"count": 2
},
{
"date": "2026-06-02",
"count": 1
},
{
"date": "2026-06-04",
"count": 2
},
{
"date": "2026-06-05",
"count": 3
},
{
"date": "2026-06-06",
"count": 4
},
{
"date": "2026-06-12",
"count": 1
}
],
"complete": true,
"collected": 34,
"total_forks": 34
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 23316,
"source_files_sampled": 22,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 10,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 4
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "tristan-xtrace",
"commits": 48,
"avatar_url": "https://avatars.githubusercontent.com/u/276746865?v=4"
},
{
"type": "User",
"login": "felix-xtrace",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/170989441?v=4"
},
{
"type": "User",
"login": "liwenXtrace",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/170989218?v=4"
},
{
"type": "User",
"login": "sgonz-xtrace",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/223328257?v=4"
}
],
"contributors_sampled": 4,
"top_contributor_share": 0.8
},
"quality_signals": {
"has_ci": false,
"has_tests": true,
"ci_workflows": [],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/9 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": null,
"reason": "no dependencies found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 1,
"reason": "9 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "cda5165a021374ae716662d555b53667e6325820",
"ran_at": "2026-07-23T06:40:23Z",
"aggregate_score": 1.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-17T21:37:56Z",
"oldest_open_prs": [
{
"number": 9,
"created_at": "2026-06-15T05:39:10Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-15T18:43:23Z",
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/XTraceAI/memory-sdk-ts",
"host": "github.com",
"name": "memory-sdk-ts",
"owner": "XTraceAI"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 47,
"inputs": {
"security": 17,
"vitality": 70,
"community": 54,
"governance": 51,
"engineering": 34
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 70,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"commits_last_year": 60,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 8
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "8/52 weeks with commits",
"points": 5.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 8
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "60 commits in the last year",
"points": 16,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 60
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 6,
"latest_release_tag": "v0.5.0",
"releases_from_tags": true,
"days_since_latest_release": 5,
"mean_days_between_releases": 10.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "6 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 6
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~10.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 10.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 54,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"forks": 34,
"stars": 274,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "274 stars",
"points": 39.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 274
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "34 forks",
"points": 12.7,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 34
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 62,
"inputs": {
"packages": [
"@xtraceai/memory"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 5024
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "5,024 downloads/month across npm",
"points": 49.3,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 5024,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 51,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 4,
"top_contributor_share": 0.8
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 80% of commits",
"points": 4.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 80
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "4 contributors",
"points": 5.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 4
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 51,
"inputs": {
"merged_prs": 10,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 4
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "10/14 decided PRs merged",
"points": 27.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 10,
"decided": 14
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"followers": 3,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "XTraceAI",
"public_repos": 6,
"account_age_days": 786
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of XTraceAI",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "XTraceAI"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "6 public repos, account ~2 yr old",
"points": 10.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 6
}
},
{
"code": "account_age_years",
"params": {
"years": 2
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@xtraceai/memory"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "9 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 9
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 34,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "critical",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_ci": false,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "critical",
"name": "Security",
"value": 17,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dangerous_workflow",
"packaging",
"pinned_dependencies",
"signed_releases",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 17,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 13,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 5,
"scorecard_aggregate": 1.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 5 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/9 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "9 existing vulnerabilities detected",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 57,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.933,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "56 of 60 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 56,
"sampled": 60
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_pinned_dependencies"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.367,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "22 of the last 60 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 22,
"sampled": 60
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 23316,
"source_files_sampled": 22,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/22 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 22,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@xtraceai/memory@0.5.0; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-23T06:40:37.908397Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/x/XTraceAI/memory-sdk-ts.svg",
"full_name": "XTraceAI/memory-sdk-ts",
"license_state": "standard",
"license_spdx": "MIT"
}
Пов’язані записи
Перевірені репозиторії, що мають спільні каталожні теги або екосистеми з XTraceAI/memory-sdk-ts. Читати поруч →
Оцінки — це сигнали, а не гарантії. Вони відображають публічно видимі практики на GitHub — це не аудит коду й не гарантія безпеки.
Відсутні дані виключаються, а ваги перенормовуються — нуль за відсутність ніколи не ставиться. Методологія версіонована й відкрита: метрики v1.13.0, схема v0.27.0 — повна методологія · вікі метрик.
