公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-30 20:05 UTC
YawLabs / postgres-mcp
Read-only-by-default MCP server for PostgreSQL. Query, introspect schemas, explain plans, health checks.
YawLabs/postgres-mcp 的健康指数为 100 分中的 55 分，处于「中等」区间。 其得分最高的类别是Vitality（74/100），最低的是Community & Adoption（42/100）。 最近一次更新在 8 天前。 近期的大部分工作由 1 位贡献者完成。
55
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
55
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| npm | @yawlabs/postgres-mcp | 0.7.0 | 6,298 | 32 | 8 天前 | postgrespostgresqldatabasemcpmodel-context-protocolaiagentclaudeclaude-codecursorllmsqlschemaexplain |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
74
开发活跃度
63中等
评分方式
| 28.8/36 | 推送新近度 — 最近一次推送于 8 天前 |
| 6.2/36 | 提交节奏 — 52 周中有 9 周有提交 |
| 18/18 | 提交量 — 最近一年 125 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 125 |
| human_commit_share | 0.95 |
| days_since_last_push | 8 |
| active_weeks_last_year | 9 |
发布纪律
90优秀
评分方式
| 27/27 | 有发布版本 — 已发布 33 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 8 天前 |
| 27/27 | 发布节奏 — 约每 7.4 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — Project has not signed or included provenance with any releases. |
所用输入
| releases_count | 33 |
| latest_release_tag | v0.7.0 |
| releases_from_tags | 否 |
| days_since_latest_release | 8 |
| mean_days_between_releases | 7.4 |
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
42
流行度与采用
5危急
评分方式
| 4.9/60 | 星标 — 3 个星标 |
| 0/25 | 复刻 — 1 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 1 |
| stars | 3 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
70良好
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（MIT） |
| 18/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 是 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
生态采用（下载量）
63中等
评分方式
| 50.7/80 | 月度下载量 — npm 合计每月 6,298 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | @yawlabs/postgres-mcp |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 6,298 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
55
维护者韧性（巴士系数）
18危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0.6/22.5 | 提交分布 — 头号贡献者编写了 98% 的提交 |
| 2.7/13.5 | 贡献者广度 — 2 位贡献者 |
| 6/10 | OpenSSF Scorecard：Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 2 |
| top_contributor_share | 0.975 |
议题与 PR 响应能力
69中等
评分方式
| 41.6/46.8 | 议题解决 — 89% 的议题已关闭 |
| 26.3/38.3 | PR 接受 — 已裁定的 PR 中 11/16 已合并 |
| 1.5/15 | OpenSSF Scorecard：Code-Review — Found 4/27 approved changesets -- score normalized to 1 |
所用输入
| merged_prs | 11 |
| open_issues | 1 |
| closed_issues | 8 |
| issue_closed_ratio | 0.889 |
| closed_unmerged_prs | 5 |
所有权与托管责任
49存在风险
评分方式
| 30/30 | 所有权背书 — 组织持有 |
| 0/20 | 已验证域名 |
| 7.2/25 | 所有者影响力 — YawLabs 有 9 位关注者 |
| 11.5/25 | 既往记录 — 27 个公开仓库，账户约 0 年 |
所用输入
| followers | 9 |
| owner_type | Organization |
| is_verified | — |
| owner_login | YawLabs |
| public_repos | 27 |
| account_age_days | 169 |
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 8 天前 |
| 20/20 | 版本历史 — 32 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | @yawlabs/postgres-mcp |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 8 |
工程质量
基础的工程与文档实践是否到位？
54
工程实践
40存在风险
评分方式
| 0/24 | CI 工作流 |
| 24/24 | 存在测试 |
| 16/16 | Linter 配置 — biome.json |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard：CI-Tests — 0 out of 8 merged PRs checked by a CI test -- score normalized to 0 |
所用输入
| has_ci | 否 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 是 |
| has_precommit_config | 否 |
文档
75良好
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 0/15 | 文档 / 主页站点 |
| 10/10 | 仓库描述 |
| 0/10 | 主题标签 |
| 10/10 | Wiki |
所用输入
| topics | — |
| has_wiki | 是 |
| homepage | — |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
45
安全态势
45存在风险
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 2.2/7.5 | Branch-Protection — branch protection is not maximal on development and all release branches |
| 0/2.5 | CI-Tests — 0 out of 8 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0.8/7.5 | Code-Review — Found 4/27 approved changesets -- score normalized to 1 |
| 1.5/2.5 | Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
| 0/10 | Dangerous-Workflow — 无数据 |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — 无数据 |
| 2.5/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 5 |
| 0.5/5 | SAST — SAST tool is not run on all commits -- score normalized to 1 |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — Project has not signed or included provenance with any releases. |
| 0/7.5 | Token-Permissions — 无数据 |
| 0/7.5 | Vulnerabilities — 17 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 15 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 3 |
| scorecard_aggregate | 4.5 |
已排除计分（无数据或不适用）：dangerous_workflow, packaging, token_permissions。 其余权重已重新归一化。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
68
AI 代理上下文与指引
39存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 38.7/40 | 可读的提交历史 — 95 次人类提交中有 69 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.726 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 0/18 | 一条命令的引导启动 |
| 22/22 | 自动化测试 |
| 11/11 | Lint / 格式化配置 — biome.json |
| 11/11 | 静态类型检查 — tsconfig.json |
| 10/10 | 可复现环境 — lockfile |
| 10/10 | 已体现的代理实践 — 最近 100 次提交中有 66 次由代理编写或署名代理 |
| 8/8 | 自动化维护 — 最近 100 次提交中有 5 次为自动依赖更新 |
| 5/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 5 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | package-lock.json |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 是 |
| typecheck_configs | tsconfig.json |
| agent_commit_share | 0.66 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0.05 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — TypeScript（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 26 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | TypeScript |
| largest_source_bytes | 53,014 |
| source_files_sampled | 26 |
| oversized_source_files | 0 |
关键数据
3GitHub 星标
2贡献者
125最近 12 个月提交数
8距最近推送天数
33发布版本数
1巴士系数（bus factor）
1开放议题
npm软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
OpenSSF Scorecard 4.5 / 10
4.5综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 3 | Branch-Protection | branch protection is not maximal on development and all release branches |
| 0 | CI-Tests | 0 out of 8 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 1 | Code-Review | Found 4/27 approved changesets -- score normalized to 1 |
| 6 | Contributors | project has 2 contributing companies or organizations -- score normalized to 6 |
| 不适用 | Dangerous-Workflow | no workflows found |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 |
| 不适用 | Packaging | packaging workflow not detected |
| 5 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 5 |
| 1 | SAST | SAST tool is not run on all commits -- score normalized to 1 |
| 10 | Security-Policy | security policy file detected |
| 0 | Signed-Releases | Project has not signed or included provenance with any releases. |
| 不适用 | Token-Permissions | No tokens found |
| 0 | Vulnerabilities | 17 existing vulnerabilities detected |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 522,
"has_wiki": true,
"homepage": null,
"languages": {
"Shell": 34127,
"JavaScript": 24624,
"TypeScript": 288352
},
"pushed_at": "2026-07-21T23:51:11Z",
"created_at": "2026-04-21T16:39:36Z",
"owner_type": "Organization",
"updated_at": "2026-07-21T23:51:15Z",
"description": "Read-only-by-default MCP server for PostgreSQL. Query, introspect schemas, explain plans, health checks.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "https://yaw.sh",
"name": "Yaw Labs",
"type": "Organization",
"login": "YawLabs",
"company": null,
"location": null,
"followers": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/260788729?v=4",
"created_at": "2026-02-11T00:00:33Z",
"is_verified": null,
"public_repos": 27,
"account_age_days": 169
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-07-21T23:51:30Z"
},
{
"tag": "v0.6.21",
"kind": "patch",
"published_at": "2026-06-11T18:12:45Z"
},
{
"tag": "v0.6.20",
"kind": "patch",
"published_at": "2026-06-04T13:17:57Z"
},
{
"tag": "v0.6.19",
"kind": "patch",
"published_at": "2026-06-03T02:38:40Z"
},
{
"tag": "v0.6.18",
"kind": "patch",
"published_at": "2026-05-28T21:33:17Z"
},
{
"tag": "v0.6.17",
"kind": "patch",
"published_at": "2026-05-19T12:48:35Z"
},
{
"tag": "v0.6.16",
"kind": "patch",
"published_at": "2026-05-18T14:31:46Z"
},
{
"tag": "v0.6.15",
"kind": "patch",
"published_at": "2026-05-16T17:10:36Z"
},
{
"tag": "v0.6.14",
"kind": "patch",
"published_at": "2026-05-16T17:03:17Z"
},
{
"tag": "v0.6.13",
"kind": "patch",
"published_at": "2026-05-16T16:50:51Z"
},
{
"tag": "v0.6.12",
"kind": "patch",
"published_at": "2026-05-16T16:11:20Z"
},
{
"tag": "v0.6.11",
"kind": "patch",
"published_at": "2026-05-16T15:45:24Z"
},
{
"tag": "v0.6.10",
"kind": "patch",
"published_at": "2026-05-16T15:39:28Z"
},
{
"tag": "v0.6.6",
"kind": "patch",
"published_at": "2026-05-16T15:09:04Z"
},
{
"tag": "v0.6.5",
"kind": "patch",
"published_at": "2026-05-16T06:31:42Z"
},
{
"tag": "v0.6.4",
"kind": "patch",
"published_at": "2026-05-15T18:17:35Z"
},
{
"tag": "v0.6.3",
"kind": "patch",
"published_at": "2026-05-15T17:21:43Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2026-05-15T17:03:04Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2026-05-15T16:43:06Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-05-15T04:02:49Z"
},
{
"tag": "v0.5.4",
"kind": "patch",
"published_at": "2026-05-14T04:17:00Z"
},
{
"tag": "v0.5.3",
"kind": "patch",
"published_at": "2026-05-14T02:55:01Z"
},
{
"tag": "v0.5.2",
"kind": "patch",
"published_at": "2026-05-14T02:37:26Z"
},
{
"tag": "v0.5.1",
"kind": "patch",
"published_at": "2026-05-05T17:17:37Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-05-05T05:24:25Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2026-05-05T04:46:19Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-04-25T21:14:18Z"
},
{
"tag": "v0.3.3",
"kind": "patch",
"published_at": "2026-04-24T21:43:26Z"
},
{
"tag": "v0.3.2",
"kind": "patch",
"published_at": "2026-04-24T17:30:40Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2026-04-22T13:42:21Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-04-22T12:51:50Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-04-21T17:26:16Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-04-21T16:40:20Z"
}
],
"recent_commits": [
{
"oid": "b2d8fbc30ac5cc0c2f184cd25faf3eacbe5c6988",
"body": null,
"is_bot": false,
"headline": "v0.7.0",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T23:51:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f5f22e0cef3172f810c652f8ed65c464f04cd5e",
"body": "The stacked PRs (#16/#19) and the conflict resolution between them left\nformat and import-order violations. No CI to catch these anymore.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "style: apply biome formatting after the 0.6.21 feature merges",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T22:43:09Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "7196975bc3fee9eb7a0a3d0f29b9e6082d2aaf65",
"body": "* fix: add foreign-table coverage to pg_advisor and pg_describe_table\n\nCloses #10.\n\npg_advisor.tables_without_primary_key filtered relkind IN ('r','p') and\nsilently missed foreign tables (relkind='f'). A foreign table without a\ndefined PK is the same design-drift signal as a heap table -- the PK is\n\n[…]\nf\n pgstattuple extension state\"\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>\nCo-authored-by: Jeff Yaw <jeff@yaw.sh>",
"is_bot": false,
"headline": "feat(pg_table_bloat): add approx and exact methods via pgstattuple (#19)",
"author_name": "Michael",
"author_login": "HighviewOne",
"committed_at": "2026-07-21T22:37:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e45f403248dee9a6144a7319bf75a059804562cf",
"body": "…tat_statements >= 1.10 (#16)\n\n* test: gate pg_current_wal_lsn REVOKE behind POSTGRES_MCP_DESTRUCTIVE_TESTS=1\n\nThe _warnings-path test for pg_replication_status forces a permission error\nby revoking PUBLIC EXECUTE on pg_catalog.pg_current_wal_lsn(). A hard\nprocess kill between REVOKE and GRANT leave\n[…]\nged (>= 1.10 is still\n the right cutoff for the feature being present)\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(pg_top_queries): add io_read_time_ms / io_write_time_ms for pg_s…",
"author_name": "Michael",
"author_login": "HighviewOne",
"committed_at": "2026-07-21T22:32:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "52fccf0d425da492127089b71fe722df87d405df",
"body": "…number (#17)\n\n* fix(pg_list_tables): cast reltuples to float8 so estimated_rows is a number\n\npg_class.reltuples is float4. Casting it to ::bigint gives an int8 result\n(OID 20), which node-pg parses as a string by default -- so estimated_rows\nwas returning \"42\" (a JSON string) instead of 42 (a JSON \n[…]\n- Integration test updated to accept number|null and assert integrality\n\nCo-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(pg_list_tables): cast reltuples to float8 so estimated_rows is a …",
"author_name": "Michael",
"author_login": "HighviewOne",
"committed_at": "2026-07-21T22:30:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2cbab57296cd45f6be674b8cc67cfada77a4c9d7",
"body": "release.sh:\n- handle git ls-remote failure in the tag-drift guard explicitly instead\n of dying on the ERR trap with git's real error suppressed\n- non-interactive runs now require RELEASE_YES=1 or a piped 'y' instead\n of proceeding unconditionally; a piped decline aborts again\n- correct the SKIP_LI\n[…]\n loop and the comment's\n unbacked schema/handler-drift claim\n\nchangelog:\n- backfill [0.6.17]-[0.6.19] sections for published versions with none\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: address 10 confirmed findings from review of f7b7cb3..a736200 (#21)",
"author_name": "Jeff",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T22:30:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "555e19d9e585272d4560cd58ddac1aa2d1e71a94",
"body": "Actions and Dependabot are disabled org-wide; releases run from the local\nrelease.sh. Removes the now-inert workflow files and version-update config.\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(ci): remove GitHub Actions workflows and dependabot config (#24)",
"author_name": "Jeff",
"author_login": "jeffyaw",
"committed_at": "2026-07-21T21:50:39Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "17ba0ff158e4a44dd7a4279536289fadfdf1987b",
"body": "…ith 3 updates (#23)\n\nBumps the dev-dependencies group with 3 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [esbuild](https://github.com/evanw/esbuild) and [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg).\n\n\nUpdat\n[…]\non-update:semver-minor\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump the dev-dependencies group across 1 directory w…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-21T20:57:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b03ca08a73029b1ddd86192ae461285948c63d2d",
"body": null,
"is_bot": false,
"headline": "add CODEOWNERS for SOC 2 compliance",
"author_name": "Jeff",
"author_login": "jeffyaw",
"committed_at": "2026-06-15T13:06:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1cbf22db0d990fe66892145243a35c3f7477594b",
"body": null,
"is_bot": false,
"headline": "chore(release): v0.6.21",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-11T18:12:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8500cd325f8bf0903ce56acae20f64c992df931e",
"body": "Adopt the @yawlabs/mcp binary pipeline (release.yml 5-platform matrix +\nbuild-binary/stage/update-manifests scripts + sea-config), all derived from\npackage.json. Bootstrap de-TLA'd so the entry bundles to CJS for Node SEA;\nbehaviour unchanged. Added postject devDep.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(release): cross-platform single-binary pipeline (scoop + homebrew)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-11T18:12:36Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3de2b31da1621fc1fb89acca92f6a6b103746177",
"body": "Bumps the dev-dependencies group with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).\n\n\nUpdates `@types/node` from 25.9.1 to 25.9.2\n- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)\n- [Commits](https://github.com/Definite\n[…]\non-update:semver-patch\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump @types/node in the dev-dependencies group (#20)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-11T04:51:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "19a32175c1497ea59b7e0db079f81b2b129c65a4",
"body": "…ith 3 updates (#14)\n\nBumps the dev-dependencies group with 3 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [pg](https://github.com/brianc/no\n[…]\non-update:semver-minor\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump the dev-dependencies group across 1 directory w…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-06-06T16:19:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a73620039a8617450a9d2bb4c364dd35cc356f0f",
"body": null,
"is_bot": false,
"headline": "v0.6.20",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-04T13:17:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c862baae6d0100e552854d0f7cb064df4390c4a",
"body": "WIP from a prior session plus this session's address-all pass. The CHANGELOG\nentry is the authoritative change list; commit message is intentionally terse\nbecause release.sh (step 4) will create a per-version commit on top of this\nwith the version bump + tag.\n\nCHANGELOG sections:\n- Fixed: wrapToolHa\n[…]\ntSchema round-trip test\n- Docs: pg_query description re-order, getPool env-var snapshot reword\n- Infrastructure: REQUIRE_MATRIX=1 in release.sh\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: cut 0.6.20",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-04T13:11:44Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0a309a25cdc8f2f6b766f0f6fae87e0b486c8ef1",
"body": "Closes the full-pass digest's actionable items, mostly the file-for-later\ntier. Bundled in this commit because the working tree at session start\nalready had in-flight v0.6.20 work sitting across 18 files; a clean\nseparation would have required git add -p on every hunk.\n\nAddress-all edits:\n- src/api.\n[…]\ns from a prior session\n\nVerified: tsc --noEmit clean, 214/214 unit tests pass (128/128 in the\ntools suite where the new round-trip test lives).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: address-all pass + bundled WIP",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-04T13:00:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "af44415954af43a3890267d9bd782446137e4889",
"body": null,
"is_bot": false,
"headline": "v0.6.19",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-03T02:38:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b9d29208a653fc62e0c873b3b2f184b6e7bfc70",
"body": "…olHandler for testability\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: cover MCP result wrapper + connect-failure path; extract wrapTo…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-03T02:13:03Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d9cf4ccf6973d1da74454d8598e14fbffad2fa45",
"body": "…on't false-abort\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): compare tag-object shas in drift guard so resume runs d…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-03T01:34:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ee59d2352a2efb2ae32611a9a47664dc4dfcc447",
"body": "GitHub's Markdown sanitizer strips <a href> values whose scheme isn't on\nits allowlist (http/https/mailto/...), so a badge linking straight to\nyaw://install rendered the image but dropped the link -- the click did\nnothing. Point it at https://yaw.sh/mcp/install, which forwards the\nverbatim query to the yaw:// install handler the app registered.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(readme): point \"Add to Yaw MCP\" badge at the https forwarder",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-06-02T14:34:27Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6287b19d392ee7123013ea453ea3a9748027282b",
"body": "Prior wording claimed the failure happens AFTER npm publish via\nnon-fast-forward rejection. Both clauses wrong: the tag-push step\nruns BEFORE npm publish, and `git push --follow-tags` (used in 11\nof 12 release.sh files) silently SKIPS a tag that already exists\non the remote rather than rejecting it.\n[…]\nease create` then publishes a GitHub release linked to that\nstale commit while npm carries the new one. Re-stated accordingly.\n\nNo code change.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(release): fix tag-drift comment to describe the real failure mode",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T22:04:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f2af583dced176d2fdc465d57329d53fa838c2dc",
"body": "Before pushing the bump commit + tag, query origin for the same tag\nname and compare SHAs. If origin already has the tag at a different\ncommit (rewound elsewhere, parallel release race), fail with a clear\nmessage instead of letting the push silently non-fast-forward AFTER\nnpm publish has already started -- which would leave the npm release\nwithout a matching git tag.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): refuse to push if origin's tag drifted from local",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:57:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "908a1f7bafc0d1a148bd64e18cddcb74cbecc893",
"body": "Wraps `npm`/`pnpm` so any `lint*` subcommand becomes a no-op when\nSKIP_LINT=1 is set. Workaround for the MINGW64-ARM64 case where the\nnpm-run-script wrapper segfaults on exit-cleanup and biome itself\nfails silently (platform-windows.md). Apply only when the lint\nrunner is broken on the host; the next CI / clean-runner release\ncatches any lint regression.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): add SKIP_LINT=1 escape hatch for broken lint runners",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:47:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d999a344279d9291ea772d24e8b36265a26f9f94",
"body": null,
"is_bot": false,
"headline": "v0.6.18",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:33:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74d41d7d0cd0942250cfb43f779112de5690e92d",
"body": "Drift between server.json and package.json went undetected because\nprior releases predated the release.sh unconditional-sync fix.\nBringing server.json forward so the working tree matches what's\nalready on npm and on the MCP Registry.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: sync server.json version to match package.json",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:26:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4f84f2a8ddc950f80da713fe7977b98b54e84c34",
"body": "release.sh's `read -p \"Continue?\"` aborted under `set -euo\npipefail` when stdin wasn't a tty, requiring an `echo y |`\nworkaround for headless invocations. Gate the read with\n`[ -t 0 ]`; non-interactive callers now proceed without\nconfirmation (with an info line so they know).\n\nSurfaced during the fetch-mcp v0.3.3 release flow.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): tty-gate the confirmation prompt",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:19:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "8649082d335e4ef4516c389bce51ead934c5b6af",
"body": "…ump else\n\nThe server.json jq-sync lived inside the `else` branch of \"is\npackage.json already at target version?\". On a resume run (e.g.\nbump commit made by hand on a prior session, like this one's\nv0.14.3 -> 0.14.3 bump in beaf1cd), the script hits the \"skip\"\nbranch and never touches server.json --\n[…]\ntion; the inner check makes\nit a no-op when server.json is already in sync.\n\nObserved on the v0.14.3 mcp-compliance release flow earlier today.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): sync server.json unconditionally, not only inside the b…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T21:01:34Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c15d3cd092efe55369c05e27e0275af27742038",
"body": "When MCP_REGISTRY_TOKEN is unset, source it from `gh auth token`\ninstead of failing outright. The gh CLI's session token (after\n`gh auth login`) carries admin:org scope, which covers the\nread:org claim mcp-publisher needs for the io.github.YawLabs/*\nnamespace. Removes the env-var prereq for anyone with a working\ngh CLI session, while still respecting an explicit override.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): fall back to gh auth token for MCP Registry",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T20:34:44Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f7b7cb3445106b9b23cde55dff9659f9ce9b4953",
"body": "Move the post-release MCP Registry publish (server.json sync,\nmcp-publisher install, login, publish) into release.sh as a\nnew Step 6 between GitHub release and Verify. Auth switches\nfrom github-oidc (Actions-only) to a PAT via 'login github\n-token $MCP_REGISTRY_TOKEN' so it runs locally.\n\nAlso exten\n[…]\nfrom this machine:\n * active npm session (npm login --auth-type=web)\n * MCP_REGISTRY_TOKEN env var = GitHub PAT with read:org\n for YawLabs\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: fold MCP Registry publish into release.sh, drop release.yml",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T20:25:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "39e98680341f62c4d4f9ada79c2969c4269e2935",
"body": "Comment in step 2 said the matrix was \"gated by integration.yml\nworkflow\"; integration.yml was removed in aef0d18, so the matrix\nno longer runs in CI under any path. Refresh the comment to say\nso explicitly -- behavior unchanged (CI still skips, local WSL\nstill runs), but readers won't go looking for a workflow that\nisn't there.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(release): integration matrix is now a local-only pre-tag gate",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T20:04:31Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f0785f19317a953040a852fac50e1b97b26de35a",
"body": "Companion to the prior chore(ci) commit -- release.yml had a\njobs.ci (or jobs.integration) block that `uses:`d the now-deleted\nci.yml/integration.yml, with release.needs gating on it. Without\nthis fix the next tag push would fail at the `uses:` reference.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): drop needs: ref to removed reusable workflow",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T19:40:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "aef0d182ca95f068b0ea6da225466f22a48a8077",
"body": "Reduce GitHub Actions to only the release flow (publish to npm,\nMCP Registry, and GitHub Releases). Removes ci.yml, deprecate.yml,\nand any integration/bench/docker/nightly siblings.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(ci): drop non-release workflows",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T19:31:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "387220549f5504d033e89873a35e17e8fabdb359",
"body": "Replaces the cloud-account install badge with a yaw://install?... deep\nlink that fires Yaw Terminal's local protocol handler. The handler\nshows a confirmation dialog with the verbatim command + args + env\nkeys + source before appending the server to ~/.yaw-mcp/config.json.\nAccompanying \"One click adds this to your mcp.hosting account\"\nsentence updated to match the new local-install flow.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(readme): swap mcp.hosting badge -> Add to Yaw MCP yaw:// deep link",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-28T19:10:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "35a8fc803b3d7e887be8c8616ed9daf6494017e4",
"body": "The @latest tag makes npx re-resolve against the npm registry on every\nspawn, so each MCP session uses the newest published version instead of\nwhatever happens to be in the npx metadata cache. Matches what the\nmcp.hosting dashboard catalog already writes for new installs.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs(readme): pin npx spawn to @latest for auto-update",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-24T17:05:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "fe5d49942a077d807dd6da7050be770028eeb2f1",
"body": "Followups to the previous CI-handoff rollout. All landed in the same\nstep-5 block:\n\n1. Tightened detection grep from \"npm publish|NODE_AUTH_TOKEN|release.sh\"\n to \"npm publish|NODE_AUTH_TOKEN\". The release.sh alternation was too\n broad -- any workflow that merely RUNS the script (lint, dry-run)\n \n[…]\nlater\n failures (smoke test, MCP Registry publish, attestation upload).\n\nRolled out to the same 12 repos that received the CI-handoff change.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): address six issues from review of the CI-handoff step",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T13:46:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "efdf9633f985eff770ce6ce5028a61c79e1ed601",
"body": "The local release.sh step 5 was attempting to npm-publish from the\nworkstation in parallel with the same operation in CI -- release.yml\nruns `bash release.sh` itself with CI=true and\nNODE_AUTH_TOKEN=secrets.NPM_TOKEN on every v* tag push. So when a dev\nruns release.sh locally:\n\n 1. Steps 1-4 (lint/\n[…]\nh-type=web`.\n\nEliminates the entire class of \"workstation publish failed because\nnpmrc is stale\" failures. Originated on YawLabs/aws-mcp@1.2.0.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(release): hand off to CI instead of racing it at step 5",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T13:13:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4413ceb21dd4675a3af67b2c3681fc279f55725f",
"body": null,
"is_bot": false,
"headline": "v0.6.17",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T12:47:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f74d5837a33f3e47855ff3652630980e121ae082",
"body": "./release.sh 0.1.0 \"feat: add foo\" now commits tracked changes\n(git add -u, never sweeps untracked) and pushes BEFORE running\nthe existing 8-step release flow. Untouched if the 2nd arg is\nomitted -- the manual two-step is still the default and CI mode\nignores the arg entirely.\n\nPre-commit runs lint:\n[…]\nase.sh step 1. The integration\nmatrix still runs in step 2 -- the matrix gates the tag, not the\nfeature commit, so we don't double-pay it here.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(release): accept optional pre-release commit message as 2nd arg",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T12:41:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4514e3c9bff6dea09f71c4ccaf9974e898ce3e31",
"body": "release.sh now runs scripts/post-publish-smoke.sh as step 8 so the\npublished tarball is exercised end-to-end (npm install + bin invoke)\nbefore the release is declared done -- the prior step-7 `npm view`\nprobe only checked registry metadata, which can lag a working install\non CDN edges. Status glyphs\n[…]\nut (vs flooring)\n\nscripts/wsl-test-matrix.sh: capture full output to a temp log so a\nfailing test name survives summary noise on the FAIL path.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: wire post-publish smoke into release + coverage tests",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-19T12:31:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "646f2051508b9fe9e9c2e1c554f431c9a01f09ac",
"body": "Reusable post-release smoke: installs @yawlabs/postgres-mcp@<version>\nfrom the registry into an isolated tmp dir, invokes the bin, asserts\nthe reported version matches. Uses `cd \"${TMP:?...}\"` so an empty\nmktemp result aborts before `npm init -y` can run in cwd -- the\nexact failure mode that scrambled this repo's package.json mid-\nsession when ad-hoc bash smoke checks fell through.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: add post-publish smoke script with ${TMP:?} guard",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:48:19Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b68a03e47568a77466f089d85e0c2d1b8eb2d419",
"body": "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: changelog entry for v0.6.16",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:40:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6e9017d75696a5d44742c594cd88af8b9dbb4c13",
"body": null,
"is_bot": false,
"headline": "v0.6.16",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:30:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8721268ae0466ab24807ae64d015e7895c32277",
"body": "The inline try/catch in the _warnings test left the cluster's\npg_current_wal_lsn() ungrantable to PUBLIC if cleanup itself raised\n(e.g. shutdown() throwing). Moving the REVOKE/GRANT into a nested\ndescribe's before/after means node:test guarantees the GRANT runs\nwhenever the matching REVOKE ran -- assertion failure, body throw,\nor future second `it()` in the block.\n\nVerified against PG17 and PG18 via the WSL integration matrix.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: scope pg_replication_status REVOKE/GRANT to before/after hooks",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-18T14:28:17Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "bd5a89536a5a488bb66dc35919c3a60dc7a80e2f",
"body": null,
"is_bot": false,
"headline": "v0.6.15",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:09:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "605303572b0ad24ce6f594bc87e14e9096db4a2a",
"body": "runUserQueryBounded opens SAVEPOINT __pgmcp_sp around the user SQL and\nRELEASEs it at the end. A setup/teardown hook that opens a savepoint\nwith the same name would be unwound by the inner RELEASE here. Today\nno hook collides (only HypoPG uses hooks and it doesn't open\nsavepoints), but the name was undocumented as reserved.\n\nContract note for future hook authors; no behavior change.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: reserve __pgmcp_sp savepoint name on RunHooks (#8)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:09:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "67eef8f8b2ed1dc83d9a6cc7c26ddabc6e3ec57e",
"body": null,
"is_bot": false,
"headline": "v0.6.14",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:01:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f539a714f9af4b06fa6331faaeecee36b07368ab",
"body": "paramValue was unbounded recursive via z.lazy(). A pathologically nested\nrequest body could surface a `Maximum call stack size exceeded`\nRangeError instead of a clear validation error. In practice JSON.parse\ncaps recursion well below Node's stack limit, but defense in depth: a\nclear \"exceeds maximum\n[…]\nnesting, mixed array/object nesting,\nand the per-element semantic (one over-cap entry rejects the whole\narray even when surrounded by scalars).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: cap paramValue nesting depth at 32 levels (#7)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T17:01:51Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "75afb6ca939f79b8c988be1a79ad3738ff41cd41",
"body": null,
"is_bot": false,
"headline": "v0.6.13",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:49:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "324dd632f79f11ed3fcd4bcc30ea414c6cc4e432",
"body": "pg_cancel_backend / pg_terminate_backend return false for both\n\"no such PID\" and \"permission denied\", but postgres emits a NOTICE\ndistinguishing them. The handler now attaches a 'notice' listener to\nthe underlying client during the signal call and folds any captured\nNOTICE into the `note` field when\n[…]\nll (which bypasses\nrunInternal because it needs the per-client notice listener) reports\nerrors with the same shape as the rest of the codebase.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: capture pg NOTICE in pg_kill to disambiguate signaled=false (#6)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:49:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ff5a88ea07284423c85dd70ea35100c5311cbb6",
"body": null,
"is_bot": false,
"headline": "v0.6.12",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:09:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "044d3c7cd79068cc87595e7107ec771cf608f754",
"body": "Row-level contention (SELECT FOR UPDATE + UPDATE) is the common case in\napp workloads. The waiter queues on a `transactionid` lock with\npg_locks.relation = NULL because the wait is on the holder's xid, not on\na relation. The previous CASE returned `relation: null` here and gave\nthe agent no hint as \n[…]\ng\nACCESS EXCLUSIVE test renamed to \"table-lock contention\" to clarify it\ncovers the bl.relation IS NOT NULL branch. Both pass on PG17 and PG18.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: resolve relation for transactionid waits in pg_inspect_locks (#5)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T16:09:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "bac0d3b8e7d8348291ed09a1d5b8df25e0c73754",
"body": null,
"is_bot": false,
"headline": "v0.6.11",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:43:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b708335588eaef6ea73acabed71b30693e13cd7",
"body": "inspect_locks test:\n- Replace the 500ms hardcoded sleep with a 5s polling loop on\n pg_blocking_pids(). Beats both flakes on slow CI hosts (waiter not\n yet queued at 500ms) and wasted time on fast ones.\n- Move await on waiterPromise into the finally block so an assertion\n failure mid-test still dr\n[…]\nuser-facing changelog.\n- Rewrite [0.6.10] to describe the six shipped coverage tests directly\n rather than narrating the journey to get there.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: tighten inspect_locks test, consolidate changelog",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:42:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "152acd9d8d64651f604da01b0af69a7008bba006",
"body": null,
"is_bot": false,
"headline": "v0.6.10",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:38:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "14d666828b3bcf9281959ac3b88248e5c6d57475",
"body": "The test failed in CI three times running (v0.6.7, 0.6.8, 0.6.9) for\ndifferent reasons each time, while passing locally. Root cause turned\nout to be that pg_stat_statements on PG17/18 fingerprints\n`SELECT 1 AS x_a` and `SELECT 2 AS x_b` to the same query id -- column\naliases are stripped from the ju\n[…]\nage additions are unaffected.\n\nReplaced the test with a note documenting the attempts so future\ncontributors don't redo the same investigation.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: remove the pg_top_queries orderBy=calls ordering test",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:38:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "abb480cbbbcb38705ecbe35a6984179e78905a98",
"body": null,
"is_bot": false,
"headline": "v0.6.9",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:33:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65d7d94c56a2231dab052754212285d660d35be5",
"body": "The previous attempt routed marker queries through pgQuery.handler,\nwhich wraps user SQL in DECLARE ... CURSOR FOR ... The cursor wrap\nmade the test depend on pg_stat_statements.track_utility=on so the\nDECLARE itself would be tracked -- CI postgres images don't guarantee\nthis default, so the marker \n[…]\ness of track_utility. Also adds a diagnostic dump on\nfailure so any future divergence between local and CI is visible from\nthe assertion error.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: stage pg_top_queries markers via runInternal, not pgQuery",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:33:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "127a20ddb2ef16a8abcc67a567adfba3fbe27a03",
"body": null,
"is_bot": false,
"headline": "v0.6.8",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:28:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "803f8b0f9911b99eceba7f4a1d142036a17cac41",
"body": "The numeric-ordering test for pg_top_queries staged a 12-call query and\na 2-call query then asserted ranking. CI starts with a fresh\npg_stat_statements that accumulates 100+ distinct normalized queries\nfrom fixture setup and earlier integration tests, which pushed the\n2-call marker out of the handle\n[…]\nible.\n\nReset pg_stat_statements before staging the markers. If reset isn't\navailable (no superuser / no extension), skip the assertion cleanly.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: reset pg_stat_statements before the calls-ordering assertion",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:28:00Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5836cf23ae85fdec7d898da29519b0868573d2ba",
"body": null,
"is_bot": false,
"headline": "v0.6.7",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:24:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a566b86517a132db179a5d470bc328d5f66276ea",
"body": "Adds seven integration tests for branches the existing suite exercised\non only one side, plus one structural regression guard.\n\n- pg_inspect_locks: real ACCESS EXCLUSIVE contention with two side\n clients. Covers the LATERAL unnest of pg_blocking_pids() and the\n per-(blocked, blocker) row shape the\n[…]\nchemas and excludes pg_*/information_schema.\n- pg_describe_table on a materialized view: kind='materialized_view'\n branch of the relkind CASE.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: close gaps from the coverage audit",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:23:57Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d819cfa1d0d8bfe82dcf8f996e54b12c2bcebd01",
"body": null,
"is_bot": false,
"headline": "v0.6.6",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:07:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7ad3c2615bacd281c98d64bb497c0186ac086d4",
"body": "… shape\n\npg_table_privileges is backed by information_schema.table_privileges,\nwhich postgres filters by what the calling role can see -- least-\nprivileged roles may miss grants on unrelated third-party roles. Call\nout the caveat and recommend pg_read_all_data / superuser for a\ncomplete picture.\n\npg\n[…]\ng_pids(), so a session waiting\non N blockers appears on N rows. Document the shape and suggest\ngrouping by blocked_pid for a per-session count.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: clarify pg_table_privileges visibility and pg_inspect_locks row…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T15:02:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0ad274c94b79466c6236c0c5743be3c2a6f00834",
"body": null,
"is_bot": false,
"headline": "v0.6.5",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T06:30:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0712feb384f9ce4f8dcd2d7735f00f517d2bc27d",
"body": "…rule\n\n- pg_explain returns an explicit error if EXPLAIN comes back with zero rows\n rather than a misleading `{plan: \"\"}` / `{plan: undefined}` payload.\n- pg_kill description: pg_signal_backend does not cover superuser-owned\n backends; only a superuser can signal another superuser's session.",
"is_bot": false,
"headline": "fix: tighten pg_explain zero-row response, clarify pg_kill superuser …",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-16T06:30:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e62543b086fb0e4cb3a9a7c7dca5b17608470dfb",
"body": "Add server.json + mcpName + four release.yml steps. OIDC auth.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: publish to the Official MCP Registry via OIDC (v0.6.4)",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T18:15:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b01fa284382a3bbc8f1f111f38944f02c12676d7",
"body": "release.sh only bumps package.json; CHANGELOG headings move by hand.\n0.6.3 was the deferred pg_replication_status _warnings test.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: backfill CHANGELOG [0.6.3] heading",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:22:53Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "3d5b15e809912cb83ad0211c9395494660ee84da",
"body": null,
"is_bot": false,
"headline": "v0.6.3",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:20:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ee9504da2aa55b31fb00915c82168ed2c13aeea4",
"body": "The success-case shape was pinned in 0.6.1; the populated-_warnings path\nwas deferred because a plain LOGIN role doesn't actually trigger\npermission-denied on a standalone cluster (pg_current_wal_lsn is\nPUBLIC-callable, slot views just return empty for non-pg_monitor).\n\nThis test REVOKEs EXECUTE on \n[…]\nhe rest of the suite. The success-\ncase shape assertion in each of their existing tests already protects\nthe construction code from regression.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: close the deferred pg_replication_status _warnings populated path",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:19:10Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9d3cc56e370d3ae6e6eeab5abfea7363f1acde27",
"body": "release.sh only bumps package.json -- the CHANGELOG headings have to be\nmoved by hand. Closes the [Unreleased] block for 0.6.1 (the fix bundle)\nand adds an Infrastructure entry for 0.6.2 (test coverage only, no\nbehavior change).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: backfill CHANGELOG [0.6.1] and [0.6.2] headings",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:07:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4cddc0324d5849beaa386cc7bae9bbd809bf66cc",
"body": null,
"is_bot": false,
"headline": "v0.6.2",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:01:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdf14cdc349649af1dbfad50939bbef2e8539e04",
"body": "Adds integration coverage for pg_kill (signaled=false on PID 1, and both\ncancel/terminate against an out-of-band pg.Client backend), the previously\nzero-positive-coverage pg_advisor checks (public_tables_without_rls,\nsequence_exhaustion with the post-0.5.2 numeric-precision formula),\npg_unused_index\n[…]\nr_full sequence at 80%, and two\ncluster-scoped roles (mcp_test_group, mcp_test_member); teardown drops\nthe roles in order so reruns stay green.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "test: close coverage gaps surfaced by the coverage audit",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T17:00:43Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fbdd36ebafda9fc96e292a589b9c06c4463403a9",
"body": null,
"is_bot": false,
"headline": "v0.6.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T16:41:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4bacab0d169ef25136d018bc4bdf06f0f4b84ec3",
"body": "- identSchema enforces postgres's 63-byte NAMEDATALEN limit (not JS\n char length) and is shared from params.ts across schemas/stats/admin/\n explain; explain.ts also byte-checks per-piece in validateHypoIndex\n so direct-handler callers bypassing Zod get the same protection.\n- pg_advisor.tables_wit\n[…]\nt silently fall through to pg's default.\n- pg_top_queries extension presence + version probes consolidated into\n a single round-trip (3 -> 2).\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: tighten ident validation, advisor coverage, partial-failure shape",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T16:40:22Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "9d2ad5ec728817171ced16081dc853190099358c",
"body": null,
"is_bot": false,
"headline": "v0.6.0",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T04:00:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93700395e1d6ad5d80e0129e934a4a4ba4427b32",
"body": "`pg_readonly` always runs inside `BEGIN READ ONLY` regardless of\n`ALLOW_WRITES`, so hosts that gate tools individually (Claude Code\npermissions, mcp.hosting) have a stable always-safe target to auto-allow.\n`pg_query` keeps its existing behavior.\n\nREADME reframes the access story around the role in `\n[…]\ncipes), and positions\n`ALLOW_WRITES` as defense-in-depth. The postgres role enforces server-side;\nthe env var is the belt to the role's braces.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: add pg_readonly tool, lead with role-based access control",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-15T03:57:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1f1d4c4b73891632dc4bcafac3a38ac385456f08",
"body": "Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add \"Add to mcp.hosting\" install button",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T19:37:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ef5fbffdb69697f9858f5c9c3b3a310f2da09e28",
"body": null,
"is_bot": false,
"headline": "v0.5.4",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T04:15:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abb558b415044720f0fea5411590dd77017c87db",
"body": "Mechanical sweep -- every U+2014 em-dash across source, docs, CHANGELOG,\nREADME, workflows, and release.sh replaced with a single ASCII hyphen.\nNo logic changes; lint clean, tests 139/139 green.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "style: replace all em-dashes with hyphens",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T04:00:46Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "dc859e4ad101c2e317f438263835bb7bfa76ea2a",
"body": "…hest\n\nThe prior verify step sampled the highest non-current version and\nchecked if its deprecated string matched $MESSAGE. That's correct only\nwhen the deprecate range covers the highest version. A narrow range like\n'0.5.x' wouldn't touch the highest version (0.6.0) at all, so the\nsampler would tim\n[…]\nmatch means\nthe deprecate landed. As a side benefit, the per-version state dump now\nreuses the same doc instead of issuing N+1 follow-up calls.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix deprecate.yml verify sampler — check any-version-matches, not hig…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T03:09:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2edfbac026620e32792b0a174e8f2606df66a6a9",
"body": "Self-contained writeup framing the structural fix (extended query protocol)\nagainst the Datadog-documented stacked-query injection in the archived\n@modelcontextprotocol/server-postgres. Includes migration diff and a\nshort tour of what else changes if you swap. Draft; not yet published.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Add blog post draft on the deprecated postgres-mcp SQLi",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T03:02:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a5fa8b188f2f7173ff3d20bdb5e5709b13c33f0a",
"body": "Mirrors release.yml -- workflow_dispatch input, NODE_AUTH_TOKEN from\norg NPM_TOKEN, no local WebAuthn session. Inputs pass via env vars;\nshares the release-npm concurrency group with release.yml. Verify\nstep retries the public-registry view to outlast CDN propagation\nlag (~10-30s typical) so the run log accurately reflects state.\n\nTrigger:\n gh workflow run deprecate.yml \\\n -f versionRange='<X.Y.Z' \\\n -f message='outdated -- install latest'",
"is_bot": false,
"headline": "Add deprecate.yml: CI-driven npm deprecate via NPM_TOKEN",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T03:01:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cff22c9a20e7b877b565bee07e76c42140f3ce90",
"body": null,
"is_bot": false,
"headline": "v0.5.3",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:53:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58bb00971c4a45c304795ddacb6a76fd38794530",
"body": "In-range bumps to hono, fast-uri, express-rate-limit, ip-address. All\nfour reach us only through @modelcontextprotocol/sdk's HTTP-transport\npath, which this server doesn't use (stdio only); esbuild tree-shakes\nthem out of dist/index.js. Practical exposure was already nil; this\nclears the audit noise on future `npm install` runs.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: npm audit fix — patch transitive deps via MCP SDK",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:51:01Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "4a655d3337106cf3c1bbbeec6491cedee3e3860b",
"body": "…ith 3 updates (#4)\n\nBumps the dev-dependencies group with 3 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [zod](https://github.com/colinhack\n[…]\non-update:semver-minor\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump the dev-dependencies group across 1 directory w…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-14T02:48:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6489ed822508859c78697cc2dae3b06d082c9705",
"body": "0.5.1 shipped without a CHANGELOG entry; 0.5.2 had no entry before tag.\nDocuments the type-name lookup fix and WSL drive translation in 0.5.1,\nand the full-pass findings + release-flow hardening + workflow smoke\ntest retry in 0.5.2.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Backfill CHANGELOG entries for 0.5.1 and 0.5.2",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:45:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "5e8b43bcbf28945e148fe4db5ac5e5639647387e",
"body": "Registry propagation has two cache layers that desynchronize across CDN\nedges: `npm view` reads metadata, `npx -y` fetches the tarball. The prior\nloop polled `npm view` for the version to appear, then did a single `npx\n-y` -- on v0.5.2 (2026-05-14) `npm view` returned 0.5.2 instantly but the\nimmediate `npx` hit a different edge and returned ETARGET. Retrying the\nwhole smoke check (6 x 10s) covers both cache layers.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Retry the npx smoke test itself, not just the npm view probe",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:40:04Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a0a64671e2121eaa365165f858c78180e0ee50b3",
"body": null,
"is_bot": false,
"headline": "v0.5.2",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:36:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c377a1a97edaf13ad0c45791c512e04958fac45",
"body": "…fault, doc/script hygiene\n\n- schemas.ts: pg_describe_table emits a warning when the kind fetch fails\n instead of silently reporting \"table\" for what may be a view.\n- admin.ts: pg_advisor sequence_exhaustion divides in numeric, not float8;\n preserves precision past 2^53 where the >= threshold chec\n[…]\nate.\n- release.sh: Verify step uses the same 5x5s retry loop as the CI smoke test\n instead of a one-shot sleep that flakes on a slow registry.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "Address full-pass findings: kind warning, numeric pct_used, hypopg de…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-14T02:33:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "a51491146cf0b31be3ef8f90e950d3d30403447b",
"body": "Matches the pattern Jeff converged on in electron-mcp/release.yml. The\n${{ github.workflow }} interpolation evaluates to the workflow's\n'name:' field, so a future rename ('Release' -> 'Publish' or similar)\nwould silently fragment the queue across the rename window: the old\nruns are still grouped und\n[…]\n put all release\nruns into one queue), so no observable behavior change. The fix is\nprophylactic against a future workflow rename.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Use literal 'release-npm' as concurrency group key",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-06T19:44:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8b3aae6b2c7b49f8a6b52cd8cfc563cfe01bffa9",
"body": "Two bugs in the prior 'Harden release flow' commit, plus a related\nbuild-redundancy item from the same review:\n\n* release.yml: the concurrency group was 'release-${{ github.ref }}'.\n github.ref for a tag push is 'refs/tags/vX.Y.Z' -- different per tag,\n so two tags pushed back-to-back would get se\n[…]\nl-fast value (catches tsup config\n errors at PR time, not release time). Comment in each ci.yml\n explains the per-repo decision.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Fix CI concurrency ref-scope bug; remove redundant build step from CI",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-06T19:32:23Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6f9a1c4532cc8de6dcf2eb5d8ba3d183f04fdf6b",
"body": "…concurrency\n\n* git tag now uses -a so 'git push --follow-tags' actually pushes it.\n Lightweight tags are silently skipped by --follow-tags (release commit\n lands but the tag never reaches origin), which would have broken every\n CI release after this point. Caught by review before any failed run.\n[…]\nyml gains a top-level 'concurrency' block so two tags pushed\n back-to-back serialize their publish jobs instead of racing on npm.\n\nCo-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "Harden release flow: annotated tags, versioned idempotency check, CI …",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-06T19:16:05Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0706fdb815b9c0c73406d033a8debca6be424adb",
"body": null,
"is_bot": false,
"headline": "v0.5.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T17:15:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e47dac0975e341e622d4fd7825fc2f92bd9d7ec",
"body": "…ive translation\n\n- api.ts: route resolveTypeNames through safeResolveTypeNames so a transient\n pg_type lookup error logs to stderr and falls back to {} instead of\n swallowing the user's successful query result.\n- release.sh: replace hardcoded /c/ -> /mnt/c/ with a sed regex so the WSL\n matrix step works from any Windows drive.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: preserve query rows on type-name lookup failure; portable WSL dr…",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T17:15:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b0818de320573ec6b17e09a0a5189d3d7833feec",
"body": "BREAKING: engines.node bumped from >=18 to >=20.\n\nCI has been on [20, 22] since 0.4.1, integration + release exclusively\non Node 20+. Node 18 was effectively unsupported in practice; this\nrelease makes the declared support match. esbuild target (\"node18\" ->\n\"node20\") and release.sh prerequisite comment updated to match.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.5.0",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T05:21:55Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "efa4822776eb3aee0ac1b77e8b2b747021f44f28",
"body": "Node 18 reached end of life on 2025-04-30. Drop it from the CI matrix\nand bump package.json engines to >=20 so the supported-version contract\nmatches what we actually test.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: drop Node 18 from matrix, bump engines to >=20",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T05:11:21Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "acca36979074b8aa371e6ab26cc90b2d5e771334",
"body": "Lockfile carried 0.4.0 in the root version fields because the bump in\nthe v0.4.1 commit did not re-run npm install. No dependency changes.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: sync package-lock.json to 0.4.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T05:04:13Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "97638b0b2d7aa912fd45b2cd829696f3e67590c3",
"body": "Post-publish step does `npx @yawlabs/postgres-mcp@${VERSION} --version`\nfrom a temp dir and asserts the output matches the tag, so a packaging\nregression (missing shebang, bad \"files\" entry, broken esbuild output)\nfails the release run instead of reaching real users. Includes a 5x5s\nretry loop for registry propagation lag.\n\nWill apply to v0.4.2+; v0.4.1 already shipped clean per `npm view`.\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "ci: smoke-test published package after release",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T04:51:28Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "824d5cc7ed4ff1f9bd05afafa1e81d9109d79f11",
"body": "Bumps the dev-dependencies group with 1 update in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).\n\n\nUpdates `@biomejs/biome` from 2.4.12 to 2.4.13\n- [Release notes](https://github.com/biomejs/biome/releases)\n- [Changelog](https://github.com/biom\n[…]\non-update:semver-patch\n dependency-group: dev-dependencies\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "chore(deps-dev): Bump @biomejs/biome (#2)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-05T04:50:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d564963948ae5da7bdbfd9911fd6a8c832862f99",
"body": "- withSharedClient: multi-query handlers share one connection (no pool starvation)\n- runUserQueryBounded distinguishes DECLARE vs FETCH/CLOSE failures (retry safety)\n- pg_top_queries orderBy \"calls\" sorts numerically (was lexical)\n- pg_describe_table not-found message escapes user names via JSON.str\n[…]\niers\n- pg_top_queries calls/rows now bigint-as-text for consistency\n- CI plumbing mirroring tailscale-mcp: ci.yml, integration.yml, release.yml\n\nCo-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>",
"is_bot": false,
"headline": "v0.4.1",
"author_name": "Jeff Yaw",
"author_login": "jeffyaw",
"committed_at": "2026-05-05T04:42:50Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 33,
"commits_last_year": 125,
"latest_release_at": "2026-07-21T23:51:30Z",
"latest_release_tag": "v0.7.0",
"releases_from_tags": false,
"days_since_last_push": 8,
"active_weeks_last_year": 9,
"days_since_latest_release": 8,
"mean_days_between_releases": 7.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 75,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@yawlabs/postgres-mcp",
"exists": true,
"license": "MIT",
"keywords": [
"postgres",
"postgresql",
"database",
"mcp",
"model-context-protocol",
"ai",
"agent",
"claude",
"claude-code",
"cursor",
"llm",
"sql",
"schema",
"explain"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@yawlabs/postgres-mcp",
"is_deprecated": false,
"latest_version": "0.7.0",
"repository_url": "https://github.com/YawLabs/postgres-mcp",
"versions_count": 32,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 6298,
"first_published_at": "2026-04-21T16:40:18.757000Z",
"latest_published_at": "2026-07-21T23:51:21.679000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 8
}
]
},
"popularity": {
"forks": 1,
"stars": 3,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-06-27",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 53014,
"source_files_sampled": 26,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 11,
"open_issues": 1,
"closed_ratio": 0.889,
"closed_issues": 8,
"closed_unmerged_prs": 5
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "jeffyaw",
"commits": 117,
"avatar_url": "https://avatars.githubusercontent.com/u/4382801?v=4"
},
{
"type": "User",
"login": "HighviewOne",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/6977445?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.975
},
"quality_signals": {
"has_ci": false,
"has_tests": true,
"ci_workflows": [],
"has_docs_dir": true,
"linter_configs": [
"biome.json"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 1,
"reason": "Found 4/27 approved changesets -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 6,
"reason": "project has 2 contributing companies or organizations -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 5,
"reason": "dependency not pinned by hash detected -- score normalized to 5",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 1,
"reason": "SAST tool is not run on all commits -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "17 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "b2d8fbc30ac5cc0c2f184cd25faf3eacbe5c6988",
"ran_at": "2026-07-30T20:05:29Z",
"aggregate_score": 4.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-21T23:51:12Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-21T22:37:37Z",
"ci_last_conclusion": null,
"oldest_open_issues": [
{
"number": 25,
"created_at": "2026-07-30T07:52:21Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/YawLabs/postgres-mcp",
"host": "github.com",
"name": "postgres-mcp",
"owner": "YawLabs"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"security": 45,
"vitality": 74,
"community": 42,
"governance": 55,
"engineering": 54
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 74,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 63,
"inputs": {
"commits_last_year": 125,
"human_commit_share": 0.95,
"days_since_last_push": 8,
"active_weeks_last_year": 9
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 8 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "9/52 weeks with commits",
"points": 6.2,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 9
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "125 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 125
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 33,
"latest_release_tag": "v0.7.0",
"releases_from_tags": false,
"days_since_latest_release": 8,
"mean_days_between_releases": 7.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "33 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 33
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 8 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~7.4 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 7.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 42,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 5,
"inputs": {
"forks": 1,
"stars": 3,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "3 stars",
"points": 4.9,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 3
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 63,
"inputs": {
"packages": [
"@yawlabs/postgres-mcp"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 6298
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "6,298 downloads/month across npm",
"points": 50.7,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 6298,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 55,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 18,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.975
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 98% of commits",
"points": 0.6,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 98
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 6,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"merged_prs": 11,
"open_issues": 1,
"closed_issues": 8,
"issue_closed_ratio": 0.889,
"closed_unmerged_prs": 5
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "89% of issues closed",
"points": 41.6,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 89
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "11/16 decided PRs merged",
"points": 26.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 11,
"decided": 16
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 4/27 approved changesets -- score normalized to 1",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"followers": 9,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "YawLabs",
"public_repos": 27,
"account_age_days": 169
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "9 followers of YawLabs",
"points": 7.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 9,
"login": "YawLabs"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "27 public repos, account ~0 yr old",
"points": 11.5,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 27
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@yawlabs/postgres-mcp"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 8
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 8 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 8
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "32 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 32
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 54,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_ci": false,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "biome.json",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "biome.json"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 45,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dangerous-Workflow, Packaging, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dangerous_workflow",
"packaging",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 45,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 4.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 8 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 4/27 approved changesets -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 2.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 1",
"points": 0.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "17 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 1
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 68,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 39,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.726,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "69 of 95 human commits state their intent (structured subject or explanatory body)",
"points": 38.7,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 69,
"sampled": 95
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.66,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0.05
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "biome.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "biome.json"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "66 of the last 100 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 66,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "5 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 5,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 5,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 53014,
"source_files_sampled": 26,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/26 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 26,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-30T20:05:38.744975Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/y/YawLabs/postgres-mcp.svg",
"full_name": "YawLabs/postgres-mcp",
"license_state": "standard",
"license_spdx": "MIT"
}