ashfordeOU / grasp

本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

安装 npm:grasp-mcp-server@3.21.0 会引入 275 个包（直接与传递）：其中 4 个存在已知公告，0 个为直接依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [
        "architecture",
        "code-analysis",
        "dependency-graph",
        "mcp",
        "ai",
        "browser-extension",
        "developer-tools",
        "github-action",
        "llm",
        "mcp-server",
        "security-scanner",
        "static-analysis",
        "visualization",
        "claude-code",
        "code-architecture",
        "jetbrains-plugin",
        "vscode-extension",
        "code-intelligence",
        "cursor",
        "dora-metrics"
      ],
      "is_fork": false,
      "size_kb": 35432,
      "has_wiki": true,
      "homepage": "https://ashfordeou.github.io/grasp",
      "languages": {
        "Go": 5182,
        "CSS": 689,
        "Lua": 7303,
        "HTML": 2145436,
        "Java": 9467,
        "Ruby": 632,
        "Rust": 1976,
        "Shell": 3487,
        "Swift": 3539,
        "Kotlin": 36303,
        "Python": 6097,
        "Dockerfile": 3911,
        "Emacs Lisp": 3984,
        "JavaScript": 675508,
        "TypeScript": 991613,
        "Vim Script": 2239
      },
      "pushed_at": "2026-07-17T13:40:59Z",
      "created_at": "2026-04-17T22:02:33Z",
      "owner_type": "User",
      "updated_at": "2026-07-17T13:41:22Z",
      "description": "GRASP — Code architecture visualizer + 150-tool MCP server. Dependency graphs, security scanning, multimodal knowledge graph, ORM tracking, git change impact, graph schema v3. Works with GitHub, GitLab & local dirs. 35 languages. Zero data collection.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": null,
      "default_branch": "main",
      "license_spdx_raw": "NOASSERTION",
      "primary_language": "HTML",
      "significant_languages": [
        "HTML",
        "TypeScript",
        "JavaScript"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Ashforde OÜ",
      "type": "User",
      "login": "ashfordeOU",
      "company": "Ashforde OÜ",
      "location": "Estonia",
      "followers": 2,
      "avatar_url": "https://avatars.githubusercontent.com/u/236818772?v=4",
      "created_at": "2025-10-08T12:45:20Z",
      "is_verified": null,
      "public_repos": 7,
      "account_age_days": 291
    },
    "license": {
      "state": "custom",
      "spdx_id": null,
      "raw_spdx": "NOASSERTION",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v3.21.0",
          "kind": "minor",
          "published_at": "2026-07-17T13:33:28Z"
        },
        {
          "tag": "v3.20.0",
          "kind": "minor",
          "published_at": "2026-05-15T08:58:18Z"
        },
        {
          "tag": "v3.19.0",
          "kind": "minor",
          "published_at": "2026-05-06T19:44:19Z"
        },
        {
          "tag": "v3.18.0",
          "kind": "minor",
          "published_at": "2026-05-03T20:38:17Z"
        },
        {
          "tag": "v3.17.1",
          "kind": "patch",
          "published_at": "2026-04-28T17:52:21Z"
        },
        {
          "tag": "v3.17.0",
          "kind": "minor",
          "published_at": "2026-04-28T15:08:02Z"
        },
        {
          "tag": "v3.15.0",
          "kind": "minor",
          "published_at": "2026-04-26T17:09:02Z"
        },
        {
          "tag": "v3.14.0",
          "kind": "minor",
          "published_at": "2026-04-25T21:49:40Z"
        },
        {
          "tag": "v3.13.3",
          "kind": "patch",
          "published_at": "2026-04-25T18:45:17Z"
        },
        {
          "tag": "v3.13.2",
          "kind": "patch",
          "published_at": "2026-04-25T12:22:15Z"
        },
        {
          "tag": "v3.13.1",
          "kind": "patch",
          "published_at": "2026-04-25T12:04:55Z"
        },
        {
          "tag": "v3.13.0",
          "kind": "minor",
          "published_at": "2026-04-25T10:45:39Z"
        },
        {
          "tag": "v3.12.0",
          "kind": "minor",
          "published_at": "2026-04-25T08:23:23Z"
        },
        {
          "tag": "v3.11.0",
          "kind": "minor",
          "published_at": "2026-04-25T00:17:32Z"
        },
        {
          "tag": "v3.10.0",
          "kind": "minor",
          "published_at": "2026-04-24T18:58:54Z"
        },
        {
          "tag": "v3.9.7",
          "kind": "patch",
          "published_at": "2026-04-24T16:16:51Z"
        },
        {
          "tag": "v3.9.6",
          "kind": "patch",
          "published_at": "2026-04-24T14:10:59Z"
        },
        {
          "tag": "v3.9.5",
          "kind": "patch",
          "published_at": "2026-04-24T10:30:25Z"
        },
        {
          "tag": "v3.9.4",
          "kind": "patch",
          "published_at": "2026-04-24T06:20:26Z"
        },
        {
          "tag": "v3.9.3",
          "kind": "patch",
          "published_at": "2026-04-23T23:24:20Z"
        },
        {
          "tag": "v3.8.2",
          "kind": "patch",
          "published_at": "2026-04-23T23:19:29Z"
        },
        {
          "tag": "v3.8.1",
          "kind": "patch",
          "published_at": "2026-04-23T23:16:53Z"
        },
        {
          "tag": "v3.8.0",
          "kind": "minor",
          "published_at": "2026-04-23T23:12:28Z"
        },
        {
          "tag": "v3.7.2",
          "kind": "patch",
          "published_at": "2026-04-23T23:08:46Z"
        },
        {
          "tag": "v3.7.1",
          "kind": "patch",
          "published_at": "2026-04-23T23:03:41Z"
        },
        {
          "tag": "v3.7.0",
          "kind": "minor",
          "published_at": "2026-04-23T23:02:06Z"
        },
        {
          "tag": "v3.6.2",
          "kind": "patch",
          "published_at": "2026-04-23T22:55:52Z"
        },
        {
          "tag": "v3.6.0",
          "kind": "minor",
          "published_at": "2026-04-23T22:49:44Z"
        },
        {
          "tag": "v3.5.2",
          "kind": "patch",
          "published_at": "2026-04-23T22:42:32Z"
        },
        {
          "tag": "v3.4.2",
          "kind": "patch",
          "published_at": "2026-04-23T23:28:14Z"
        },
        {
          "tag": "v3.3.20",
          "kind": "patch",
          "published_at": "2026-04-23T19:54:22Z"
        },
        {
          "tag": "v3.3.19",
          "kind": "patch",
          "published_at": "2026-04-23T17:18:23Z"
        },
        {
          "tag": "v3.3.18",
          "kind": "patch",
          "published_at": "2026-04-23T16:12:37Z"
        },
        {
          "tag": "v3.3.17",
          "kind": "patch",
          "published_at": "2026-04-23T16:02:37Z"
        },
        {
          "tag": "v3.3.16",
          "kind": "patch",
          "published_at": "2026-04-23T15:58:03Z"
        },
        {
          "tag": "v3.3.15",
          "kind": "patch",
          "published_at": "2026-04-23T15:44:51Z"
        },
        {
          "tag": "v3.3.14",
          "kind": "patch",
          "published_at": "2026-04-23T15:40:47Z"
        },
        {
          "tag": "v3.3.13",
          "kind": "patch",
          "published_at": "2026-04-23T13:41:27Z"
        },
        {
          "tag": "v3.3.12",
          "kind": "patch",
          "published_at": "2026-04-23T12:39:03Z"
        },
        {
          "tag": "v3.3.11",
          "kind": "patch",
          "published_at": "2026-04-23T12:25:28Z"
        },
        {
          "tag": "v3.3.10",
          "kind": "patch",
          "published_at": "2026-04-23T12:09:57Z"
        },
        {
          "tag": "v3.3.9",
          "kind": "patch",
          "published_at": "2026-04-23T11:51:23Z"
        },
        {
          "tag": "v3.3.7",
          "kind": "patch",
          "published_at": "2026-04-23T09:44:17Z"
        },
        {
          "tag": "v3.3.6",
          "kind": "patch",
          "published_at": "2026-04-22T22:57:32Z"
        },
        {
          "tag": "v3.3.5",
          "kind": "patch",
          "published_at": "2026-04-22T21:17:56Z"
        },
        {
          "tag": "v3.3.4",
          "kind": "patch",
          "published_at": "2026-04-22T20:58:31Z"
        },
        {
          "tag": "v3.3.3",
          "kind": "patch",
          "published_at": "2026-04-22T11:35:44Z"
        },
        {
          "tag": "v3.3.2",
          "kind": "patch",
          "published_at": "2026-04-22T11:23:05Z"
        },
        {
          "tag": "v3.3.1",
          "kind": "patch",
          "published_at": "2026-04-22T11:17:38Z"
        },
        {
          "tag": "v3.3.0",
          "kind": "minor",
          "published_at": "2026-04-21T19:32:14Z"
        },
        {
          "tag": "v3.2.1",
          "kind": "patch",
          "published_at": "2026-04-20T10:10:18Z"
        },
        {
          "tag": "v3.2.0",
          "kind": "minor",
          "published_at": "2026-04-20T09:57:05Z"
        },
        {
          "tag": "v3.1.2",
          "kind": "patch",
          "published_at": "2026-04-19T19:35:34Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "bf0397b19af8234ca4775d75e8030146a05d925c",
          "body": "…islabeled v3.20.0)",
          "is_bot": false,
          "headline": "docs(readme): correct Team Dashboard Parity section to v3.19.0 (was m…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-17T13:40:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c734c21811697bc14accddf8e8c30b4b4799d045",
          "body": "…s, HTTP bridge\n\nBump all version surfaces 3.20.0 -> 3.21.0 and cut release notes for the\nmultimodal work that landed on main after v3.20.0:\n\n- Multimodal Knowledge Graph: 7 MCP tools (grasp_ingest, grasp_kg_ask,\n  grasp_kg_trace, grasp_kg_explain, grasp_kg_stats, grasp_kg_export,\n  grasp_llm_status\n[…]\nit was briefly\nwritten under the v3.20.0 heading alongside the new work). CHANGELOG,\nREADME, mcp/README, docs, in-app help, and JetBrains change-notes all\nupdated. Typecheck + 695 tests + build green.",
          "is_bot": false,
          "headline": "chore(release): v3.21.0 — multimodal knowledge graph, +3 AST language…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T23:20:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ac577408110dc4eed77ad7db4b2a655c17f804be",
          "body": "- index.html + team-dashboard.html: new in-app help section documenting the\n  7 knowledge-graph/LLM tools, HTTP bridge, and 19-language AST support —\n  explicitly marked as MCP-server-side (Node), NOT browser controls, so no\n  non-functional UI was added. Corrected stale 130 tool count to 150.\n- doc\n[…]\nest,llm,semantic}, native\n  AST language count 16 -> 19 (Bash/Elixir/Julia), tool count normalised to 150.\n- mcp/README.md: 'Where it lives' source-layout note.\n\nInformational only; no version bumped.",
          "is_bot": false,
          "headline": "docs(ui): surface multimodal knowledge graph in help, docs, and READMEs",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T23:07:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25c9c28c41883b0495819f4597eefc3da5477b13",
          "body": "…y + docs\n\n- Add tree-sitter extractors + grammar registry entries for bash, elixir, and\n  julia (16 -> 19 AST-backed languages). Grammars pinned to ABI-compatible\n  versions (^0.23.x / ^0.3.x) for tree-sitter 0.22.4; marked external in build.\n  Extractors verified against golden samples (defs, call\n[…]\nge flow would hit; surfaced by the new source files.\n- README: document the multimodal knowledge graph, LLM backends, and HTTP bridge;\n  tool count 130 -> 150.\n\nFull suite green: 79 suites, 695 tests.",
          "is_bot": false,
          "headline": "feat(mcp): AST support for Bash, Elixir, Julia + exec_flow JSON safet…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T22:43:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fe09ce20add351ca25d33c114972860b3b3efaa7",
          "body": "GRASP_HTTP_MCP=1 serves the full tool set over Streamable HTTP instead of\nstdio, with optional GRASP_HTTP_API_KEY (Bearer or x-api-key) and a /health\nendpoint. Grasp's tools are stateless, so one shared endpoint serves a team's\nagents. Configurable via GRASP_HTTP_MCP_PORT (default 7333).\n\nVerified over the wire with a real MCP client: connect, list 150 tools, and\ncall grasp_ingest + grasp_kg_ask through the HTTP transport.",
          "is_bot": false,
          "headline": "feat(mcp): optional MCP-over-HTTP bridge for shared team access",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T22:29:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2a0b8ee9f8f6ac9140510c3de637091f4033bff2",
          "body": "15 network-free tests: file-kind detection, chunking, HTML extraction, LLM\nprovider selection/override, and the full deterministic KG pipeline\n(extract -> stats -> ask -> trace -> explain -> export in all 4 formats).",
          "is_bot": false,
          "headline": "test(mcp): cover ingestion, provider selection, and knowledge graph",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T22:20:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c288ce0e8a91657f7c85909a9ffcab40a1a02be7",
          "body": "- src/semantic/kg-export.ts + grasp_kg_export tool: export the knowledge graph\n  as cypher (Neo4j/FalkorDB), graphml (Gephi/yEd), json, or mermaid; optional\n  write-to-file. Adds allEntities()/allRelations() dump helpers to the store.\n- grasp_adr: replace the hardcoded Anthropic fetch with resolvePr\n[…]\nbackends (anthropic/openai/gemini/\n  deepseek/kimi/azure/bedrock/ollama) and auto-detects a local Ollama.\n\nTool count 149 -> 150. Build green; semantic layer typechecks; all 4 export\nformats verified.",
          "is_bot": false,
          "headline": "feat(mcp): knowledge-graph export + multi-provider ADR",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T22:19:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e22dd1f2aa3efd5902a0449a32b85e77f0d9363",
          "body": "Build a queryable knowledge graph from ingested artifacts and expose it as\nsix new MCP tools (143 -> 149):\n\n- src/semantic/kg-store.ts: SQLite-backed KG (entities, relations, chunks) with\n  hybrid lexical+vector retrieval, BFS path-finding, and hub ranking. Every\n  edge tagged EXTRACTED vs INFERRED \n[…]\nrasp_kg_ask, grasp_kg_trace, grasp_kg_explain,\n  grasp_kg_stats, grasp_llm_status.\n\nVerified end-to-end over the MCP protocol (ingest -> ask -> trace) and via the\ndeterministic extractor. Build green.",
          "is_bot": false,
          "headline": "feat(mcp): semantic knowledge graph + natural-language query tools",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T22:16:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "24ab38d3105cf14fda12194c905b7e84f6f9766e",
          "body": "Add the foundation for multimodal knowledge-graph features:\n\n- src/llm/provider.ts: pluggable LLM backends (anthropic, openai, gemini,\n  deepseek, kimi/moonshot, azure, bedrock w/ SigV4, ollama). Local-first —\n  auto-detects a running Ollama before any cloud key; returns null when no\n  provider is c\n[…]\nrs are optional\n  deps that lazy-load with an install hint, keeping the core install lean.\n- build.mjs: mark optional ingestion deps external so they never bundle.\n\nTypechecks clean; full build green.",
          "is_bot": false,
          "headline": "feat(mcp): multimodal ingestion + multi-LLM provider layer",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T22:06:41Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fcb23e8f3c0c8b28e31f2881a338fb73384a0dec",
          "body": "… echo, hid the 422 desc-length rejection)",
          "is_bot": false,
          "headline": "fix(ci): fail loudly on MCP registry publish errors (was masked by ||…",
          "author_name": "Ashforde OÜ",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T13:56:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1492e83e5ed692bef70d852aa8776612a6263c14",
          "body": "…stry publish",
          "is_bot": false,
          "headline": "fix(mcp): shorten server.json description to <=100 chars for MCP regi…",
          "author_name": "Ashforde OÜ",
          "author_login": "ashfordeOU",
          "committed_at": "2026-07-16T13:56:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0ca24769fec4a39f92a3c4f04961ecb428b01780",
          "body": "…ospection",
          "is_bot": false,
          "headline": "merge: add root MCP-server Dockerfile (stdio) for Glama/MCP-host intr…",
          "author_name": "Chakshu Baweja",
          "author_login": "ashfordeOU",
          "committed_at": "2026-06-18T20:52:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5426d35e25f12d9acd9678a4fb4da673f5ebce9a",
          "body": "… false positive)\n\nThe VBA-specific security checks — Shell(), SendKeys, WScript.Shell, Application.Run\nand 'On Error Resume Next' — ran on every file, so the English word 'shell (' in\nnon-VBA prose (e.g. an orbital 'Walker shell (6 planes...)' comment in a TOML)\nfalsely matched /Shell\\s*\\(/i and ra\n[…]\nerified end-to-end: all 46 scenario TOMLs of a PNT simulator now yield 0\nShell-Command-Execution findings, while a real VBA .bas Shell() call is still\ndetected. Adds tests/security-vba-gating.test.ts.",
          "is_bot": false,
          "headline": "fix(security): gate VBA-specific checks to VBA files (fixes 'shell ('…",
          "author_name": "Chakshu Baweja",
          "author_login": "ashfordeOU",
          "committed_at": "2026-06-18T20:35:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "508bedde4e570d3bcc60afd176669c036b472c4f",
          "body": "The existing docker/Dockerfile builds the `grasp` CLI (ENTRYPOINT grasp --help),\nwhich cannot answer the MCP handshake — so Glama reports the server as 'cannot be\ninstalled'. This adds a root Dockerfile that starts the MCP server on stdio\n(dist/index.js, the grasp-mcp bin / npm start), mirroring the proven build stage so\nit stays in lock-step with the published grasp-mcp-server package. Runs with no\nconfig (public repos, 60 req/hr); GITHUB_TOKEN raises limits.",
          "is_bot": false,
          "headline": "Add root MCP-server Dockerfile (stdio) for Glama/MCP-host introspection",
          "author_name": "Chakshu Baweja",
          "author_login": "ashfordeOU",
          "committed_at": "2026-06-16T21:31:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "35ee8ea9c97174cf26e3b593627ac77293b16921",
          "body": "…hing",
          "is_bot": false,
          "headline": "revert(zed-extension): restore ELv2 license, disable Zed store publis…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-15T08:55:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ea260b05618be73c45612ee9546184fbaa470002",
          "body": null,
          "is_bot": false,
          "headline": "fix(zed-extension): correct Apache 2.0 section 9 wording",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T22:34:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ac15d187093dfe819bf4dd798a30f376762973b",
          "body": null,
          "is_bot": false,
          "headline": "fix(ci): use extensions/grasp-code-architecture as submodule path",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T22:15:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "58cd86b444d54cc450bf5c4f033dbd361c6d4563",
          "body": "…s.toml",
          "is_bot": false,
          "headline": "fix(ci): correct extension ID to grasp-code-architecture in extension…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T22:13:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "851a8b60c8a811ae4fc90cd7833d37170581a1ec",
          "body": null,
          "is_bot": false,
          "headline": "fix(ci): always include path = zed-extension in extensions.toml for Zed",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T22:10:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4b93fd559473840414881611a0e989d834b1f5ce",
          "body": null,
          "is_bot": false,
          "headline": "fix(zed-extension): Apache 2.0 license for Zed store compliance",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T22:06:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8bb34f2c937c9b277033847b434ae3a819de45b5",
          "body": null,
          "is_bot": false,
          "headline": "fix(zed-extension): MIT license for Zed store compliance (wrapper only)",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T21:49:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8a611b0dd71b3e68edf8e99054062e6ec9d8fba8",
          "body": null,
          "is_bot": false,
          "headline": "revert(zed-extension): restore Elastic License 2.0",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T21:42:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "78f35adc3646aeb21cce3bdec072d1f648d7bd26",
          "body": "…iance",
          "is_bot": false,
          "headline": "fix(zed-extension): replace ELv2 with MIT license for Zed store compl…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T21:22:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7530f70bb8e1e5b60c8a4192aea139a72365548d",
          "body": null,
          "is_bot": false,
          "headline": "docs: update README for v3.20.0 — 5-layer security suite, 131 tools",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T21:18:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e55db168c5af79e8e74fc9d5f0da505472046720",
          "body": "- grasp_vulnerabilities: add container/runtime CVE detection via NIST NVD\n  (parses Dockerfiles, docker-compose.yml, CI YAML for pinned image versions)\n- grasp_vulnerabilities: add supply-chain integrity checks (local, no network)\n  (npm lockfile sha512 coverage, go.sum, Cargo.lock, pip --hash= pinn\n[…]\n flags\n- new tool: grasp_vuln_watch (start/stop/status/history scheduled monitoring)\n- 38 new tests in mcp/tests/container-vuln.test.ts (all passing)\n- bump v3.19.0 to v3.20.0 across all version files",
          "is_bot": false,
          "headline": "feat: v3.20.0 — full security scanning suite",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-14T21:01:55Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "68a1483dc2b4cbe24697547cda0db1092aca3a89",
          "body": "…ls, MCP resources/prompts, config",
          "is_bot": false,
          "headline": "docs(zed-extension): comprehensive README — architecture, all 130 too…",
          "author_name": "Ashforde OÜ",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-08T11:03:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bd0e7b7d38d1db4b72068f5aab7f46e8a7aaf7e2",
          "body": null,
          "is_bot": false,
          "headline": "fix(zed-extension): update author email to contact@ashforde.org",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-08T10:48:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b12fa8a8aa95cab0d61fd203698e7cee1d72fe5",
          "body": null,
          "is_bot": false,
          "headline": "fix(zed-extension): use Elastic License 2.0 (consistent with main repo)",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-08T10:46:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "963cbec65ccd019db4b4064ef81f94b72947b8d9",
          "body": "…ntext_server_configuration\n\n- id: grasp → grasp-code-architecture (descriptive, required by Zed guidelines)\n- Add [context_servers.grasp-code-architecture] section to extension.toml\n- Replace raw npx with zed::npm_install_package + zed::node_binary_path() pattern\n- Add context_server_configuration with installation instructions\n- Bump zed_extension_api 0.2.0 → 0.7.0\n- Add MIT LICENSE file (required for Zed extension publishing)\n- Bump extension version to 3.19.0",
          "is_bot": false,
          "headline": "fix(zed-extension): fix extension ID, use npm_install_package, add co…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-08T10:33:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5de452e80c518c8e9f62490ab5ba071a969c6397",
          "body": "server-start + MCP handshake + grasp_analyze can exceed 60s on busy CI\nrunners. Individual tool-call timeouts remain at 60s.",
          "is_bot": false,
          "headline": "fix(ci): raise beforeAll timeout in smoke-new-tools to 120s",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-07T20:32:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d56c74197b69d8dfb73a9f2c6c5e4e4f74d74f93",
          "body": "…board, sync core-tools strings\n\nteam-dashboard.html was missing 13 individual tool entries present in index.html:\ngrasp_req_trace, grasp_anomaly, grasp_reuse, grasp_safety_trace, grasp_run_diff,\ngrasp_eval_coverage, grasp_sbom, grasp_dora, grasp_adr, grasp_brain_index,\ngrasp_brain_status, grasp_con\n[…]\ngrasp_ask.\nAlso updates dashboard core-tools string to include all 14 additions.\n\nindex.html core-tools blurb was missing 8 export tools and the 14 tools above —\nnow matches the full 130-tool surface.",
          "is_bot": false,
          "headline": "docs(help): fill help section gaps — add 13 missing MCP tools to dash…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-07T20:05:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2d3b5a4d6d4acf43324890c026181947a9cfb05c",
          "body": "…dex.html — eliminate false positive on team-dashboard.html",
          "is_bot": false,
          "headline": "fix(security-scanner): sync innerHTML XSS filter in parser.js with in…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T20:16:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a042e19bbf0a520ac70b34785cf0c87e6eae1d46",
          "body": "…rminator set to include ;, ), , , ]",
          "is_bot": false,
          "headline": "fix(security-scanner): eliminate innerHTML false positive — extend te…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T20:11:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0ca02dbbde7edacce13a083716a97dc95edf16e2",
          "body": null,
          "is_bot": false,
          "headline": "docs: update README What's New for v3.19.0, fix stale version refs",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T19:48:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b2ee8cd6748eadc15ed6e349b98a89758cd5a492",
          "body": null,
          "is_bot": false,
          "headline": "chore: bump version to v3.19.0",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T19:34:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97be3e95a392a8cdaf0224bfa428c30394a202c3",
          "body": "…click + / and ? bindings",
          "is_bot": false,
          "headline": "feat(team-dashboard): kbd-fab — keyboard shortcut popover with hover/…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T18:34:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "55dcb3eb69144c53f1ec587bec85df7f35e9602f",
          "body": "…breakpoint improvements",
          "is_bot": false,
          "headline": "feat(team-dashboard): mobile polish — More menu, auth-bar flex-wrap, …",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T18:27:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a6228f3c18a776cf123abdfa1518c61c1d559bc1",
          "body": "…zure, Gitea",
          "is_bot": false,
          "headline": "feat(team-dashboard): multi-provider auth — GitLab, GHE, Bitbucket, A…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T18:25:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "26a2a27a1b870d4ef9215ed960f04e6f1e2ad7a8",
          "body": "…style inline SVG",
          "is_bot": false,
          "headline": "feat(team-dashboard): icon system — replace emoji chrome with Lucide-…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-06T09:36:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "76076c0ac86a8fcd96bcba64f5842577f2d9e6ce",
          "body": "…accent, full token set)\n\n- Replace indigo accent #6366f1 with teal #00d4aa (default :root) and update light theme accent #4f46e5 → #00a884 to match index.html\n- Add missing tokens: --bg4, --hover, --border2, --t0, --accbg, --cyan, --pink — semantic parity with index\n- Bulk swap 50× rgba(99,102,241,…) → rgba(0,212,170,…) covering keyframes, body grid, glows, focus rings, hover states\n- Logo gradient #fff→acc2→#c4b5fd → #fff→acc→#0099cc to match index brand",
          "is_bot": false,
          "headline": "feat(team-dashboard): visual brand sweep — match index palette (teal …",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T18:40:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f9c9921d71c3d93354c8732ce084217590eb6b74",
          "body": "…ting site",
          "is_bot": false,
          "headline": "docs(help): document 8 new export formats in team-dashboard and marke…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T16:40:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f53ec02befd9c215ffdf978483ecd16dc78cdddd",
          "body": "… complexity threshold",
          "is_bot": false,
          "headline": "refactor(mcp): split graph-exporters.ts into per-format modules below…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T16:36:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f06baa0aee9365d8a1c0817304a4c0a7eb45c4b9",
          "body": "README.md — adds the 8 new grasp_export_* tools to the Tools Reference\ntable, expands the headline 'Graph exports' bullet to cover all 11\nformats, and updates the 'Export Reports' summary line.\n\nmcp/README.md — adds an entry per format in the Tools Reference table\nwith rendering hints and tool ecosystems (Graphviz CLI, Mermaid live\neditor, d2 CLI, PlantUML server, Visual Studio Architecture window,\nGephi, app.diagrams.net, spreadsheet apps).",
          "is_bot": false,
          "headline": "docs: document 8 new export formats in README and mcp/README",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T15:45:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4293278afa1c5f44b64c3d27cb56b8b8f0a18eb2",
          "body": "…GML, GEXF, draw.io, CSV\n\nAdds eight new portable graph-export formats, each available both as an\nMCP tool (grasp_export_<format>) and a one-click browser Export menu\noption, joining the existing GraphML / Cypher / Obsidian Canvas exports.\n\nmcp/src/graph-exporters.ts — 8 new pure exporters (exportDo\n[…]\nocuments the formats in the in-app Export & Share\nhelp section.\n\nTests: 11 new graph-exporter unit tests + 9 new smoke tests (one per\nnew tool) all green; full mcp test suite still passes (481 + 151).",
          "is_bot": false,
          "headline": "feat(mcp): add 8 graph export formats — DOT, Mermaid, D2, PlantUML, D…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T15:45:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c370248f0d682f5fb5c0ac5aadc5487d63626f48",
          "body": null,
          "is_bot": false,
          "headline": "fix(ui): tighten gap between kbd-fab and help-fab on desktop",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T13:25:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb993247e35d77e2af279af2749446f9599b3ba7",
          "body": "…nditionally hidden)",
          "is_bot": false,
          "headline": "fix(mobile): allow right panel to open as drawer at <=768px (was unco…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T12:26:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "42267136a178caa9c001c797dafa894a14970ffa",
          "body": "… Dashboard (still in More menu)",
          "is_bot": false,
          "headline": "fix(mobile): hide viz picker at <=1080px to prevent overlap with Team…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T12:12:52Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "08731ceb6037bc9b8e2059da7fbf15e43ea63c36",
          "body": "…anel icons not 3-line)",
          "is_bot": false,
          "headline": "fix(mobile): differentiate left/right panel toggles from More menu (p…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T12:10:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9bd9b64df6c92b3ee81db145e38ed70af7ee1ac1",
          "body": "…wrap",
          "is_bot": false,
          "headline": "fix(mobile): hide auth-badge caption on narrow screens, prevent text …",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T12:04:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c885c2cc77939104d790e8e20e7d8681b9855cf0",
          "body": null,
          "is_bot": false,
          "headline": "fix(mobile): make viz picker, FABs, and topbar work on phones",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T11:57:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8178fab9514e8ed36b29fe8c00854a30ac30ec62",
          "body": null,
          "is_bot": false,
          "headline": "fix(ui): place kbd-fab to the left of help-fab on the same row",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T11:56:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "090b788a514a0831e483d6eac897a7a908130a24",
          "body": null,
          "is_bot": false,
          "headline": "fix(ui): stack kbd-fab above help-fab so they don't overlap",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T11:55:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b1bc0055b3c39aa88797042c86bd971fcd9f6ab",
          "body": null,
          "is_bot": false,
          "headline": "fix(ui): remove overflow:hidden on viz-topbar so picker dropdown shows",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T11:36:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f74d128e9e0ad93f53421c7c7d241a01a4277749",
          "body": null,
          "is_bot": false,
          "headline": "feat(ui): collapse 10-button viz toolbar into a single dropdown picker",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T11:33:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "69027d0480c78789da381dc5e05dc43e020b0633",
          "body": "…es a distinct network icon",
          "is_bot": false,
          "headline": "fix(ui): replace duplicate magnifying-glass icon — Query Graph now us…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-04T11:29:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "823cab8630c0a930f7e65ae673e1c63e7f9aa6af",
          "body": "- README.md (English): grasp_graph_schema description updated to schema v3, listing TestFile node and 12 edge types with TESTS and COVERS\n- README.hi.md / README.ja.md / README.ko.md / README.zh.md: same update applied with localized phrasing\n- index.html: in-app help-modal entry for grasp_graph_schema updated to Schema v3 wording\n- team-dashboard.html: matching update in the dashboard help modal\n- Delete docs/audit-2026-05-04.md (internal artifact, not for the public repo)",
          "is_bot": false,
          "headline": "docs: update Schema v2 -> v3 in tool descriptions and in-app help",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:44:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3e7f9d8099027ba5313d8e682718a6a28a6007d9",
          "body": "README.md:\n- Reconcile 'AI Chat - 15 Providers' heading -> '11 Providers + Routers' to match the actual table count\n- Distribution table: Raycast/Zed status -> 'Store (PR per release)' (matches CLAUDE.md release flow)\n- Replace 'grasp.dev API' teaser with honest 'Self-hostable SaaS API (saas/)' labe\n[…]\n an inline screenshot of the dependency graph (referencing main branch raw URL so the npm view shows it)\n\ndocs/architecture.md:\n- Add SnapshotData JSON example + grasp_diff_snapshots delta description",
          "is_bot": false,
          "headline": "docs: medium/low polish from audit",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:43:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "2c6f15a10419c8e29481684b87b2e7f74b18bf61",
          "body": "README.md:\n- Add 'Who is Grasp for?' persona table (8 personas) after What is Grasp\n- Add 'What makes Grasp different' capability comparison (without naming any specific competitor)\n- Add Troubleshooting table (12 entries: rate limits, port conflicts, embedder timeout, WASM grammar, brain.db perms, \n[…]\nMCP Resources - 8 live data URIs' subsection under MCP Server Setup\n\nmcp/README.md:\n- Add 'Claude Code Slash Commands' section\n- Add Privacy section linking to PRIVACY.md\n- Mention in-app help popover",
          "is_bot": false,
          "headline": "docs: add troubleshooting, glossary, personas, comparison sections",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:41:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d6063d5998c39e1ae590fa5a04420e6bbfee6421",
          "body": "- Update tool count 121 -> 130 in all 4 localized READMEs\n- Update version refs 3.17.1 -> 3.18.0 (vsix filename, footer, sigstore/cosign verify lines, body text)\n- Replace remaining 'Kuzu - Schema v2' ASCII diagram label with v3\n- Add 'Whats New in v3.18.0' table section after the language switcher in all four files (Hindi, Japanese, Korean, Simplified Chinese), faithfully translating the English version\n- All other prose preserved as-is from the existing translations",
          "is_bot": false,
          "headline": "docs(i18n): bring localized READMEs (hi/ja/ko/zh) to v3.18.0",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:39:31Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "398be4aec574a564c4787d7425c555e983e6c651",
          "body": "…e URLs, language count\n\n- mcp/README.md: Kuzu schema v2 -> v3 in grasp_graph_schema description (+ TestFile/TESTS/COVERS, 12 edge types)\n- docs/benchmarks/README.md: rename non-existent grasp_query_graph -> graph_query\n- docs/index.html: lowercase 6 ashfordeOU.github.io URLs to ashfordeou.github.io\n[…]\ns, graph-hubs/bridges/surprising/knowledge-gaps/suggested-questions, graph-exporters, tsconfig-resolver, python-resolver, llm-context-tools, parser.js OSV scan); add vulns + org to CLI subcommand list",
          "is_bot": false,
          "headline": "docs: critical fixes from doc audit — schema v3, tool names, lowercas…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:38:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a9b71e447db5a7528f093067c607db867c2f732f",
          "body": "…cs + LLM-context + exports phases",
          "is_bot": false,
          "headline": "docs(readme): expand How It Works diagram for v3.18.0 — graph analyti…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:24:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "409f08dedd01aba791c6a3df85b297e349b095c6",
          "body": "…ion, slash commands, eval harness, schema v3 in arch diagram",
          "is_bot": false,
          "headline": "docs(readme): bring README current to v3.18.0 — 13 new tools, UX sect…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:15:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "37e1d9b181946b783b0b728a13382b5f4b219111",
          "body": null,
          "is_bot": false,
          "headline": "docs: bump tool count 120 to 130 in remaining surfaces",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:06:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cb44fe61b8de21a05c0b6cb8635ccc548c7fb674",
          "body": null,
          "is_bot": false,
          "headline": "docs(help): document new keyboard shortcuts T and ?",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:05:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4a83f1a8f45b7c93e707960fcad0cdad08a8e750",
          "body": null,
          "is_bot": false,
          "headline": "docs(help): document v3.18.0 UX improvements in help modal",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:04:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bf52b7cc973c6f8e50e754bbc4ad70d5f2e2b0a3",
          "body": null,
          "is_bot": false,
          "headline": "docs(help): add 13 v3.18.0 MCP tools to in-app help modals",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T22:04:15Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "118b5f1f3f7169fb013d9891b248e64536d98fca",
          "body": "- IgnoreModal now persists user-added patterns under\n  grasp_ignore_patterns_<owner/repo> in addition to the global list, so\n  that opening the same repo later restores the prior pattern set.\n- Color mode (folder, layer, churn, etc.) is persisted per-repo and\n  re-applied on subsequent analyses of the same owner/repo.\n- IgnoreModal gains a 'Clear all' button that wipes the user list plus all\n  per-repo override entries from localStorage in one action.",
          "is_bot": false,
          "headline": "feat: per-repo persistence for ignore patterns and color mode",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:58:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "61d2877f265e6e83ba86062c7ffc875d110d773b",
          "body": "- New 'Compare two repos' entry in the More menu opens a modal with two URL\n  inputs (defaults to expressjs/express and lodash/lodash placeholders).\n- 'Analyze & compare' runs the existing analyze pipeline sequentially for\n  each URL, waits for sessionCache population, and opens the existing\n  side-by-side CompareModal with both results.\n- Reuses parseUrl validation and the existing analyze flow rather than\n  duplicating the pipeline; restricted to GitHub repos for now.",
          "is_bot": false,
          "headline": "feat: compare two new repos via launch modal",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:57:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3ffa5b7d953e8a03905e7e1bf523d0e61cbfb851",
          "body": "- Floating ? button (bottom-right, beside Help) opens a frosted popover\n  listing the available shortcuts.\n- Bind T to cycle themes and ? to toggle the popover; Esc now closes both\n  the command palette and the popover. Inputs and textareas are exempted.",
          "is_bot": false,
          "headline": "feat: keyboard shortcut hints and bindings",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:56:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "271969ae36996d17576482dfdb2760c0e62a263a",
          "body": "- Apply touch-action:none to all canvas SVGs so d3.zoom pinch-to-zoom and\n  one-finger pan work on iOS and Android without page-level gesture conflicts.\n- Allow up to 5x user-zoom in the viewport meta.\n- Hide the right analysis panel on screens 768px and narrower so the graph\n  uses the full available width on phones.",
          "is_bot": false,
          "headline": "feat: mobile touch gestures and right-panel auto-collapse",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:55:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "87a6f3d2a758f4180d27da49b3100e102fe33561",
          "body": "- Empty-state quickstart chips refreshed to expressjs/express, lodash/lodash\n  and sindresorhus/got with new pill styling.\n- Topbar GitHub auth dropdown now shows a caption: green dot plus\n  'Token loaded - 5,000 req/hr' when credentials are saved, or\n  '60 req/hr - Add token' link otherwise.",
          "is_bot": false,
          "headline": "feat: token indicator and try-it quickstart chips",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:55:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9181e6ad410630e338af14e446d9ca20e50e7702",
          "body": "- Copy Snapshot URL captures the in-memory AnalysisResult, gzip-encodes via\n  CompressionStream when available, and embeds it as #snapshot=<base64>.\n  Loaded back offline without re-hitting the API; gracefully aborts when\n  the encoded payload exceeds 1 MB.\n- Topbar gets a snapshot button; Export modal gets SARIF 2.1.0, GraphML and\n  Copy Snapshot URL alongside the existing JSON/Markdown/SBOM options.",
          "is_bot": false,
          "headline": "feat: snapshot URLs and SARIF/GraphML exports",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:55:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "91f69143f3d8e56cb316cf8ad5c5b037ded4fbfb",
          "body": "- Catch GitHub 403/429 mid-fetch and replace the spinner with a recovery card\n  showing the reset time, a token input, and Resume now / Retry / Cancel.\n- Token entered on the wall is saved to localStorage, then the analysis\n  retries from the start automatically.\n- 401 / 404 / network errors now return descriptive messages with scope\n  hints, an example, and a Manage tokens link where applicable.\n- Error toast gains a Retry button that re-runs the last analyze call.",
          "is_bot": false,
          "headline": "feat: mid-analysis rate-limit recovery and helpful error copy",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:53:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9063ebd05b8a707da0556a932396b7c8c28b60d6",
          "body": null,
          "is_bot": false,
          "headline": "docs: rewrite v3.18.0 release notes — frame features on their own merits",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:26:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e01e37e087923819c7a06bb00c54777b9b6b1e46",
          "body": "The user's re-analysis flagged \"Same Name: onLine (3 locations)\" — I'd\nfixed two of the three duplicates earlier (the test files), but missed\nthe same pattern in:\n\n  - .github/actions/grasp-pr-impact/analyze.js  (PR impact action)\n  - scripts/eval-mcp-client.mjs                  (eval harness client\n[…]\nnextPrImpactResponse / nextEvalResponse  (test helper\n                          was already nextRpcResponse)\n\nSelf-analysis from repo root now reports 0 duplicate clusters.\n73 suites / 613 tests pass.",
          "is_bot": false,
          "headline": "fix: rename onLine + nextResponse in remaining MCP-stdio clients",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:12:14Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0952c6482da2c1c27f3aa169ffa1c7380929d445",
          "body": "…y threshold\n\nThe v3.18.0 eval harness scripts/eval-token-reduction.mjs scored 32\n(critical) on Grasp's self-analysis. Extracted the MCP-server stdio\nclient (graspMinimalContext + nextResponse helper) into\nscripts/eval-mcp-client.mjs and broke main() into selectRepos /\nrunBench / writeOutputs helper\n[…]\nysis (with the same filter the browser app applies —\nexempt entry points, tests, and /extractors/ + /sources/ paths) now\nshows 0 critical-non-exempt files, 0 duplicate clusters, health 95/100\ngrade A.",
          "is_bot": false,
          "headline": "refactor(scripts): split eval-token-reduction harness below complexit…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T20:03:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "326be444e9ee88a4d29c02eaa2b62e5981951f82",
          "body": "Fixes the 3 architecture issues Grasp's analyzer surfaced when run on\nits own repo: 2 Duplicate Function Names, 1 Similar Code Blocks, 1 High\nComplexity File.\n\nDuplicate function names (nextResponse, onLine):\n  Both lived in mcp/tests/smoke-new-tools.test.ts and\n  mcp/tests/llm-context-tools.test.ts\n[…]\nun-parseable output.\n\nResult: full test suite 73 suites / 613 tests pass. Self-analysis from\nmcp/src shows 0 duplicate clusters and 0 critical-non-exempt complexity\nfiles (browser app filter applied).",
          "is_bot": false,
          "headline": "refactor: clear all 3 ISS-tab findings flagged by Grasp's self-analysis",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T19:40:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "362a30229f4526e1ec83eaf73ca71d381ce3118c",
          "body": "…n't fight\n\nJest parallelises test files. Both smoke-new-tools and llm-context-tools\nspawn an MCP server that writes to ~/.grasp/brain.db (SQLite) and\n~/.grasp/graph (Kuzu). When they run concurrently in CI, one wins the\nfile lock and the other blocks past the per-call response timeout —\nmanifesting\n[…]\nsponse\" failures in\nllm-context-tools after smoke wins the race.\n\nEach suite now creates its own tmp HOME via mkdtempSync, points the\nspawned server at it via the HOME env var, and rms it in afterAll.",
          "is_bot": false,
          "headline": "fix(test): give each smoke test an isolated HOME so brain.db locks do…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T19:13:18Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "9e836db2cfc160df635ccb9a8598aa650d93cd3d",
          "body": "Same root cause as the smoke-test fix in 779d363: in clean CI environments\nthe @xenova/transformers model isn't cached locally, so the first\ngrasp_semantic_search call hangs while downloading ~30MB of weights and\nexceeds the 60s test timeout. Setting the env var forces the keyword\nfallback path so tests don't depend on network/cache state.",
          "is_bot": false,
          "headline": "fix(test): pass GRASP_DISABLE_EMBEDDINGS=1 in llm-context-tools test",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T19:06:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dfdf75fd82a7949ec8acfbf76dcf1421cb909fe8",
          "body": "…rd, docs)",
          "is_bot": false,
          "headline": "docs: bump tool count 121 → 130 across all surfaces (READMEs, dashboa…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T19:02:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f344ab90f51297452358ae89d6573128ca2c4077",
          "body": "Adds 9 new MCP tools, 3 graph exporters, 2 import resolvers,\nslash commands, eval harness, and 4 localized READMEs.",
          "is_bot": false,
          "headline": "chore(release): bump version to v3.18.0",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T18:29:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "27374d32c9eb4d337ddc46f2f0d99e92ea3b1db1",
          "body": "…+ add language switcher",
          "is_bot": false,
          "headline": "docs: localize README to Hindi, Japanese, Korean, Simplified Chinese …",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T18:24:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "881253d982f3547bbfdb2139e7c103de002190c5",
          "body": "…+ hub + question report\n\nComposes hubNodes, surprisingConnections, knowledgeGaps, suggestedQuestions\ninto a single executive overview with: layer breakdown + top-3 hubs per layer,\ncross-layer edge count, top surprising connections, weak communities, and\ntop-5 review questions Grasp would ask. Use after grasp_analyze for a\nsingle-shot architecture summary.",
          "is_bot": false,
          "headline": "feat(mcp): add grasp_architecture_overview tool — combined community …",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T18:08:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "076f491fa5166e7990197c0b188ab096ee532164",
          "body": "scripts/eval-token-reduction.mjs clones 6 OSS repos, computes naive\nall-files token cost, calls grasp_minimal_context, and reports the\nreduction factor. Outputs both markdown and JSON to docs/benchmarks/.\n\nManually verified end-to-end on got@v14.0.0: 113,438 → 35 tokens =\n3,241x. Run with --only <key> for one repo, or no args for all six.",
          "is_bot": false,
          "headline": "feat(bench): add token-reduction eval harness vs 6 OSS repos",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T18:06:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7d24ade04421f755e3ac6a893bc7eb569e7b0750",
          "body": "…w-delta, grasp-review-pr",
          "is_bot": false,
          "headline": "feat: add Claude Code slash commands — grasp-build-graph, grasp-revie…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T17:54:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "01fbdef2697a92900d84560d885baff6782a0f61",
          "body": "- New graph-exporters.ts module with exportGraphML, exportCypher and\n  exportObsidianCanvas functions. All accept an AnalysisResult and\n  return a string in the target format.\n- Three new MCP tools registered in index.ts:\n  - grasp_export_graphml — yEd / Gephi / Cytoscape XML\n  - grasp_export_cypher\n[…]\nthe artefact in both content[].text (truncated) and\n  structuredContent.content (full).\n- 4 unit tests in graph-exporters.test.ts + 3 smoke tests appended to\n  smoke-new-tools.test.ts (61/61 passing).",
          "is_bot": false,
          "headline": "feat(mcp): add 3 graph export formats — GraphML, Cypher, Obsidian Canvas",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T17:50:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "438b9f30a156e6edb4b75a5691bae2be9948289c",
          "body": "…n import resolution\n\n- New tsconfig-resolver.ts: parses tsconfig.json (with comments + trailing\n  commas) and resolves '@/*'-style aliases against compilerOptions.paths.\n- New python-resolver.ts: Jedi-style relative + package resolver that\n  understands 'from .utils import x', 'from ..core import y\n[…]\n for both languages\n  and python imports also produce structural connections.\n- AnalysisResult gains optional tsconfigs[] for downstream tools.\n- 16 new unit tests across both resolvers (all passing).",
          "is_bot": false,
          "headline": "feat(resolvers): add TS-config path-alias resolver and improved Pytho…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T17:50:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "779d3631f51118393b0fd60b2c76755ced84a444",
          "body": "…tic_search, apply_refactor\n\n- grasp_minimal_context: sub-100-token repo orientation, intended as the\n  LLM's first call before deeper queries.\n- grasp_traverse: BFS with token-budget control, walks file/function\n  graph until budget or depth exhausted, returns truncated view.\n- grasp_semantic_searc\n[…]\nn preview by default. dry_run=false writes files back to disk.\n\nAlso: GRASP_DISABLE_EMBEDDINGS=1 env var to force fallback (used by smoke\ntest to avoid first-time model download blowing past timeout).",
          "is_bot": false,
          "headline": "feat(mcp): add 4 LLM-context tools — minimal_context, traverse, seman…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T17:42:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "885fe64997a5a959ca8f540c2fdcbd94a44b4730",
          "body": "…nnections, knowledge gaps, suggested questions",
          "is_bot": false,
          "headline": "feat(mcp): add 5 graph analytics tools — hubs, bridges, surprising co…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-05-03T16:24:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c1aa7a7dfe6d38710cc199f16f24fc3832834af4",
          "body": "The grasp_vulnerabilities MCP tool and grasp vulns CLI shipped in\nv3.17.0 but were missing from three doc surfaces:\n\n1. mcp/README.md — added grasp_vulnerabilities to the Code Quality\n   tools table (alongside grasp_security, grasp_coverage etc.). Also\n   expanded the CLI section with grasp vulns / \n[…]\n17.1' table row and needed no further change.\n\nThe browser-extension, github-action, gitlab-app etc. READMEs are\nthin distribution wrappers that don't document individual tools, so\nthey need no edits.",
          "is_bot": false,
          "headline": "docs: surface OSV vulnerability scanner in every help section",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T21:31:09Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "49f6d34cf76241877671ace13d5ea9352e7ecd8f",
          "body": "The outer .sidebar (now the scrollable container after the previous\nfix) was showing the OS-default scrollbar. Use the same invisible-\nscrollbar pattern already adopted by .viz-scroll and .panel-tabs:\n\n  .sidebar { scrollbar-width: none; -ms-overflow-style: none; }\n  .sidebar::-webkit-scrollbar { display: none; }\n\nResult: scroll behaviour unchanged (mouse wheel + drag still work),\nbut the white scrollbar track and thumb are gone — clean edge-to-edge\nsidebar on every browser.",
          "is_bot": false,
          "headline": "fix(web): hide sidebar scrollbar (match .viz-scroll / .panel-tabs)",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T21:22:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3a6b3719000804f834c1c7aab4b5b13d1e67963",
          "body": "The earlier sidebar-scroll fix made the outer .sidebar div scrollable\n(overflow-x:clip, overflow-y:auto), but the inner .sidebar-scroll\nwrapping the Explorer tree still had 'flex:1; overflow-y:auto'. With\nall the upper sections (Health, Ask Grasp, Color By, Package Impact,\n5 stat cards, languages ba\n[…]\nnested-scroll weirdness\n\nResult: with big repos and tall sidebars, the user scrolls the whole\nsidebar. The Explorer tree's natural full height is preserved, no\ndouble scrollbar, no collapsed sections.",
          "is_bot": false,
          "headline": "fix(web): explorer was 0px when outer sidebar scrolled",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T19:47:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1b5763e50834e3ea486942d525c64ff59bf2db7a",
          "body": "Two edits surfaced by user-question deep-audit:\n\n1) AI providers: was '12' but the chat dropdown actually has 11 distinct\n   entries (index.html:6202-6238 — Anthropic, OpenAI, Google Gemini,\n   Mistral, Groq, DeepSeek, OpenRouter, Together AI, Ollama, LM Studio,\n   Custom). Azure OpenAI was listed p\n[…]\n Actions/Custom GPTs, Aider/Sweep).\n   Distinguishes the two directions clearly:\n   - Grasp as model consumer (chat panel) → 11 providers\n   - Grasp as a service called by AI tools → many integrations",
          "is_bot": false,
          "headline": "docs: AI providers — accurate count + Copilot integration visible",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T19:41:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "25b17e44244e99fd51fa98f184a377fe8705f7ea",
          "body": "A deep audit of the hero badges/tables surfaced these inaccuracies:\n\n- 'MCP tools'   was 120 → actual 121 (added grasp_vulnerabilities in v3.17.0)\n- 'graph views' was 9 → actual 10 (heatmap was missing from the count)\n- 'languages'   was 34 → actual 35 (Parser.codeExts buckets to 35 distinct\n       \n[…]\nRust, C/C++, C#, Ruby, Swift, Kotlin, Scala, Dart, Elixir,\nErlang, Haskell, OCaml, F#, Clojure, Julia, Lua, R, Perl, Shell,\nPowerShell, Groovy, Zig, V, Nim, Crystal, VBA, Ada/SPARK, Vue,\nSvelte, PHP'.",
          "is_bot": false,
          "headline": "docs: hero stats audit — counts now match the actual code",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T19:17:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a332c984245cb6ca22eb98a3f401f81dfb8f6227",
          "body": "Five stale version refs found by deep audit, all now updated:\n\n- README.md: footer-version display, sigstore-verify and cosign-verify\n  example commands, and the .vsix install instruction in the VS Code\n  Extension section\n- mcp/README.md: 'Current version' line now mentions the v3.17.1 fixes\n  (per\n[…]\ns' to\n  the listed commands\n\nHistorical 'feature added in v3.16.0' attributions throughout README.md\nand mcp/README.md are correctly preserved — those are accurate\nprovenance markers, not stale state.",
          "is_bot": false,
          "headline": "docs: catch up stragglers to v3.17.1",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T17:57:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "86c3e1c9d645bc477c6acfe82a890eee9d226902",
          "body": "Patch release rolling up six bug fixes since v3.17.0:\n\n- Per-directory lockfile scoping (no more cross-contamination of\n  resolved versions between sibling packages)\n- Test-fixture manifests skipped by vuln scanner\n- CI helper scripts exempt from console.log low-severity warning\n- Left sidebar scrol\n[…]\n\n  into a missed GitHub Release\n\nSelf-analysis on the live app reports 100/100 score, 0 architecture\nissues, 0 security findings, 0 vulnerabilities, all four CI workflows\ngreen. Ready for tag/release.",
          "is_bot": false,
          "headline": "chore: bump v3.17.1 — vuln-scanner accuracy + saas uuid CVE fix",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T17:49:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "38a614b761912607e9ac6c58e732d85380cd40c7",
          "body": "uuid 9.x and earlier had a missing-buffer-bounds-check vulnerability\nin v3/v5/v6 codepaths when buf was provided (GHSA-w5hq-g745-h8pq,\nCVSS:4.0 Medium). saas only uses uuidv4 (no buf argument) so it was\nnot actually exploitable, but the OSV scanner correctly flagged the\npackage version as vulnerable\n[…]\n^11.0.0 (latest, matches the\nruntime API). Lockfile regenerated; pre-existing unrelated TS errors\nin src/cache.ts and src/routes.ts (Redis namespace, rateLimit type)\nare not introduced by this change.",
          "is_bot": false,
          "headline": "fix(saas): upgrade uuid 9.0.1 → 14.0.0 to clear GHSA-w5hq-g745-h8pq",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T17:42:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "341570d0848791f4f0057c3ef3450bfe48314208",
          "body": "Self-analysis on Grasp was reporting 6 CVEs (lodash 4.17.21, express\n4.18.0, uuid 9.0.1) all pointing at mcp/tests/fixtures/simple-project/\npackage.json — a deliberately-frozen test fixture used to verify the\nSBOM/vuln scanners themselves. These are not real production deps; they\nexist to make the s\n[…]\nquirements.txt,\npyproject.toml, go.mod, Cargo.toml, pom.xml) inherit the exclusion.\n\nNew unit test covers four representative fixture paths plus one real\nnon-fixture path to guard against regressions.",
          "is_bot": false,
          "headline": "fix(scanner): skip test-fixture manifests in vuln scan",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T17:11:03Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "038f2376ecf4dae37ca1aad75dd76c0f8561e19d",
          "body": "…sion\n\nTwo grasp-self-analysis findings, both false positives:\n\n1) FALSE-POSITIVE VULNERABILITY: saas/package.json declares uuid ^9.0.0\n   and saas/package-lock.json resolves it to 9.0.1 (clean). But the OSV\n   scanner reported uuid@8.3.2 in saas/package.json — because the lockMap\n   in parseManifes\n[…]\nce output\n   in the GitHub Actions log. Extended the existing isCliOrServer\n   exclusion to also skip .github/actions/, .github/workflows/, and\n   /scripts/ paths plus build.mjs/build.ts entry points.",
          "is_bot": false,
          "headline": "fix: per-directory lockfile scoping + CI-script debug-statement exclu…",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T17:05:40Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "838fdf9273ee800af775de123141161f9cfc0720",
          "body": "The left sidebar's content has grown enough (Health Score, Ask Grasp,\nColor By with 14 swatches, Package Impact, 5 stat cards, language bar,\nExplorer header + tree) that on shorter viewports the Explorer section\ndisappears below the fold. The Explorer header was visible but the file\ntree itself was \n[…]\ntion; vertical now\nscrolls naturally. The inner .sidebar-scroll wrapping the file tree\nstill has its own scroll for very large trees, giving two-level scroll\nthat degrades cleanly on either dimension.",
          "is_bot": false,
          "headline": "fix(web): make left sidebar vertically scrollable",
          "author_name": "ashfordeOU",
          "author_login": "ashfordeOU",
          "committed_at": "2026-04-28T16:50:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 53,
      "commits_last_year": 782,
      "latest_release_at": "2026-07-17T13:33:28Z",
      "latest_release_tag": "v3.21.0",
      "releases_from_tags": false,
      "days_since_last_push": 9,
      "active_weeks_last_year": 7,
      "days_since_latest_release": 9,
      "mean_days_between_releases": 9.2
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 57,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "grasp-mcp-server",
          "exists": true,
          "license": "Elastic-2.0",
          "keywords": [
            "mcp",
            "grasp",
            "code-analysis",
            "dependency-graph",
            "architecture",
            "llm",
            "agents",
            "cli",
            "refactor",
            "duplicate-detection",
            "monorepo",
            "git-timeline",
            "live-watch",
            "health-score",
            "gitlab",
            "self-hosted"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/grasp-mcp-server",
          "is_deprecated": false,
          "latest_version": "3.21.0",
          "repository_url": "https://github.com/ashfordeOU/grasp",
          "versions_count": 71,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 1162,
          "first_published_at": "2026-04-17T21:51:35.048000Z",
          "latest_published_at": "2026-07-17T13:31:46.614000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 9
        }
      ]
    },
    "popularity": {
      "forks": 1,
      "stars": 10,
      "watchers": 0,
      "fork_history": {
        "days": [
          {
            "date": "2026-07-14",
            "count": 1
          }
        ],
        "complete": true,
        "collected": 1,
        "total_forks": 1
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [
        "gpt-actions/openapi.yaml"
      ],
      "has_devcontainer": false,
      "typecheck_configs": [
        "ai-tools/claude-code/tsconfig.json",
        "ai-tools/cline/tsconfig.json",
        "ai-tools/codex-cli/tsconfig.json",
        "ai-tools/cursor/tsconfig.json",
        "ai-tools/droid/tsconfig.json",
        "ai-tools/grok-cli/tsconfig.json",
        "ai-tools/kilo-code/tsconfig.json",
        "ai-tools/opencode/tsconfig.json",
        "ai-tools/roo-code/tsconfig.json",
        "ai-tools/trae/tsconfig.json",
        "amazon-q-plugin/tsconfig.json",
        "browser-extension/tsconfig.json",
        "continue-provider/tsconfig.json",
        "copilot-extension/tsconfig.json",
        "discord-bot/tsconfig.json",
        "github-action/tsconfig.json",
        "github-app/tsconfig.json",
        "gitlab-app/tsconfig.json",
        "gitlab-ci-component/tsconfig.json",
        "gpt-actions/tsconfig.json",
        "jira-integration/tsconfig.json",
        "linear-integration/tsconfig.json",
        "mcp/tsconfig.json",
        "raycast-grasp/tsconfig.json",
        "saas/tsconfig.json",
        "shared/digest-engine/tsconfig.json",
        "shared/test-utils/tsconfig.json",
        "slack-bot/tsconfig.json",
        "teams-bot/tsconfig.json",
        "vscode-extension/tsconfig.json"
      ],
      "toolchain_manifests": [
        "eclipse-plugin/pom.xml",
        "gitlab-agent/go.mod",
        "jenkins-plugin/pom.xml",
        "jetbrains-plugin/build.gradle.kts",
        "zed-extension/Cargo.toml"
      ],
      "largest_source_bytes": 476875,
      "source_files_sampled": 347,
      "oversized_source_files": 2,
      "agent_instruction_files": [
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 9625
    },
    "dependencies": {
      "manifests": [
        "amazon-q-plugin/package.json",
        "browser-extension/package.json",
        "continue-provider/package.json",
        "copilot-extension/package.json",
        "discord-bot/package.json",
        "eclipse-plugin/pom.xml",
        "github-action/package.json",
        "github-app/package.json",
        "gitlab-agent/go.mod",
        "gitlab-app/package.json",
        "gitlab-ci-component/package.json",
        "gpt-actions/package.json",
        "jenkins-plugin/pom.xml",
        "jetbrains-plugin/build.gradle.kts",
        "jira-integration/package.json",
        "linear-integration/package.json",
        "mcp/package.json",
        "raycast-grasp/package.json",
        "saas/package.json",
        "slack-bot/package.json",
        "teams-bot/package.json",
        "vscode-extension/package.json",
        "zed-extension/Cargo.toml"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [
          {
            "name": "protobufjs",
            "direct": false,
            "version": "6.11.6",
            "severity": "critical",
            "ecosystem": "npm",
            "cvss_score": 9.8,
            "advisory_ids": [
              "GHSA-2pr8-phx7-x9h3",
              "GHSA-66ff-xgx4-vchm",
              "GHSA-685m-2w69-288q",
              "GHSA-75px-5xx7-5xc7",
              "GHSA-f38q-mgvj-vph7",
              "GHSA-fx83-v9x8-x52w",
              "GHSA-jggg-4jg4-v7c6",
              "GHSA-jvwf-75h9-cwgg",
              "GHSA-q6x5-8v7m-xcrf",
              "GHSA-wcpc-wj8m-hjx6"
            ],
            "fixed_version": "8.6.0",
            "advisory_count": 11,
            "oldest_advisory_days": 101
          },
          {
            "name": "sharp",
            "direct": false,
            "version": "0.32.6",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.3,
            "advisory_ids": [
              "GHSA-f88m-g3jw-g9cj"
            ],
            "fixed_version": "0.35.0",
            "advisory_count": 1,
            "oldest_advisory_days": 5
          },
          {
            "name": "tar",
            "direct": false,
            "version": "6.2.1",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 8.8,
            "advisory_ids": [
              "GHSA-23hp-3jrh-7fpw",
              "GHSA-34x7-hfp2-rc4v",
              "GHSA-83g3-92jg-28cx",
              "GHSA-8qq5-rm4j-mr97",
              "GHSA-8x88-c5mf-7j5w",
              "GHSA-9ppj-qmqm-q256",
              "GHSA-gvwx-54wh-qm9j",
              "GHSA-qffp-2rhf-9h96",
              "GHSA-r292-9mhp-454m",
              "GHSA-r6q2-hw4h-h46w"
            ],
            "fixed_version": "7.5.21",
            "advisory_count": 12,
            "oldest_advisory_days": 191
          },
          {
            "name": "@hono/node-server",
            "direct": false,
            "version": "1.19.15",
            "severity": "moderate",
            "ecosystem": "npm",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-frvp-7c67-39w9"
            ],
            "fixed_version": "2.0.5",
            "advisory_count": 1,
            "oldest_advisory_days": 5
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 2,
          "critical": 1,
          "moderate": 1
        },
        "advisory_count": 25,
        "affected_count": 4,
        "assessed_count": 275,
        "malicious_count": 0,
        "assessed_package": "npm:grasp-mcp-server@3.21.0",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "crates",
        "go",
        "maven",
        "npm"
      ],
      "dependencies": [
        {
          "name": "@actions/core",
          "manifest": "github-action/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.10.1"
        },
        {
          "name": "@actions/github",
          "manifest": "github-action/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.0.0"
        },
        {
          "name": "@octokit/rest",
          "manifest": "github-app/package.json",
          "ecosystem": "npm",
          "version_constraint": "^21.0.2"
        },
        {
          "name": "@octokit/webhooks",
          "manifest": "github-app/package.json",
          "ecosystem": "npm",
          "version_constraint": "^13.3.0"
        },
        {
          "name": "grasp-mcp-server",
          "manifest": "github-app/package.json",
          "ecosystem": "npm",
          "version_constraint": "*"
        },
        {
          "name": "nhooyr.io/websocket",
          "manifest": "gitlab-agent/go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.10"
        },
        {
          "name": "express",
          "manifest": "gitlab-app/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.18.2"
        },
        {
          "name": "express",
          "manifest": "gpt-actions/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.18.2"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.6.1"
        },
        {
          "name": "@octokit/rest",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^21.0.2"
        },
        {
          "name": "@types/better-sqlite3",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^7.6.13"
        },
        {
          "name": "@xenova/transformers",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.17.2"
        },
        {
          "name": "acorn",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.16.0"
        },
        {
          "name": "better-sqlite3",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^12.9.0"
        },
        {
          "name": "kuzu",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.6.0"
        },
        {
          "name": "tree-sitter",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.22.0"
        },
        {
          "name": "tree-sitter-bash",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.3"
        },
        {
          "name": "tree-sitter-c",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.0"
        },
        {
          "name": "tree-sitter-c-sharp",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.21.3"
        },
        {
          "name": "tree-sitter-cpp",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.0"
        },
        {
          "name": "tree-sitter-elixir",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.3.5"
        },
        {
          "name": "tree-sitter-go",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.0"
        },
        {
          "name": "tree-sitter-java",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.0"
        },
        {
          "name": "tree-sitter-javascript",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.23.1"
        },
        {
          "name": "tree-sitter-julia",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.1"
        },
        {
          "name": "tree-sitter-kotlin",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.3.0"
        },
        {
          "name": "tree-sitter-php",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.11"
        },
        {
          "name": "tree-sitter-python",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.0"
        },
        {
          "name": "tree-sitter-ruby",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.21.0"
        },
        {
          "name": "tree-sitter-rust",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.23.0"
        },
        {
          "name": "tree-sitter-scala",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.24.0"
        },
        {
          "name": "tree-sitter-swift",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.7.1"
        },
        {
          "name": "tree-sitter-typescript",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "0.23.2"
        },
        {
          "name": "tree-sitter-zig",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.1.0"
        },
        {
          "name": "ws",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.18.0"
        },
        {
          "name": "yaml",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.8.3"
        },
        {
          "name": "zod",
          "manifest": "mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "cors",
          "manifest": "saas/package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.8.5"
        },
        {
          "name": "dotenv",
          "manifest": "saas/package.json",
          "ecosystem": "npm",
          "version_constraint": "^16.3.1"
        },
        {
          "name": "express",
          "manifest": "saas/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.18.2"
        },
        {
          "name": "ioredis",
          "manifest": "saas/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.3.2"
        },
        {
          "name": "uuid",
          "manifest": "saas/package.json",
          "ecosystem": "npm",
          "version_constraint": "^14.0.0"
        },
        {
          "name": "node-cron",
          "manifest": "slack-bot/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.0.3"
        },
        {
          "name": "dotenv",
          "manifest": "slack-bot/package.json",
          "ecosystem": "npm",
          "version_constraint": "^16.3.1"
        },
        {
          "name": "grasp-mcp-server",
          "manifest": "vscode-extension/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.13.0"
        },
        {
          "name": "zed_extension_api",
          "manifest": "zed-extension/Cargo.toml",
          "ecosystem": "crates",
          "version_constraint": "0.7.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 1,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "ashfordeOU",
          "commits": 782,
          "avatar_url": "https://avatars.githubusercontent.com/u/236818772?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "grasp-health.yml",
        "grasp-pr-impact.yml",
        "grasp-sarif.yml",
        "integrations-core.yml",
        "integrations-plugins.yml",
        "pages.yml",
        "publish.yml",
        "update-homebrew.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum",
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 9,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "1 out of 1 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/29 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 3,
            "reason": "project has 1 contributing companies or organizations -- score normalized to 3",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 9,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 4,
            "reason": "dependency not pinned by hash detected -- score normalized to 4",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "149 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "bf0397b19af8234ca4775d75e8030146a05d925c",
        "ran_at": "2026-07-27T03:11:04Z",
        "aggregate_score": 4,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-20T09:03:29Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-06-18T20:52:33Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/ashfordeOU/grasp",
    "host": "github.com",
    "name": "grasp",
    "owner": "ashfordeOU"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 59,
      "inputs": {
        "security": 45,
        "vitality": 73,
        "community": 42,
        "governance": 49,
        "engineering": 81
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 73,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 62,
            "inputs": {
              "commits_last_year": 782,
              "human_commit_share": 1,
              "days_since_last_push": 9,
              "active_weeks_last_year": 7
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 9 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "7/52 weeks with commits",
                "points": 4.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 7
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "782 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 782
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 53,
              "latest_release_tag": "v3.21.0",
              "releases_from_tags": false,
              "days_since_latest_release": 9,
              "mean_days_between_releases": 9.2
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "53 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 53
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 9 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~9.2 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 9.2
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 42,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 16,
            "inputs": {
              "forks": 1,
              "stars": 10,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "10 stars",
                "points": 15.5,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 10
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "1 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 64,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file present, not a recognized license",
                "points": 16.9,
                "status": "partial",
                "details": [
                  {
                    "code": "license_custom",
                    "params": {}
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 51,
            "inputs": {
              "packages": [
                "grasp-mcp-server"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 1162
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "1,162 downloads/month across npm",
                "points": 40.9,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 1162,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 49,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 3,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "merged_prs": 1,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "1/1 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 1,
                      "decided": 1
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "critical",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 27,
            "inputs": {
              "followers": 2,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "ashfordeOU",
              "public_repos": 7,
              "account_age_days": 291
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "2 followers of ashfordeOU",
                "points": 3.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 2,
                      "login": "ashfordeOU"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "7 public repos, account ~0 yr old",
                "points": 8.2,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 7
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "grasp-mcp-server"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 9
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 9 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 9
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "71 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 71
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 81,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "9 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 9
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "1 out of 1 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "topics": [
                "architecture",
                "code-analysis",
                "dependency-graph",
                "mcp",
                "ai",
                "browser-extension",
                "developer-tools",
                "github-action",
                "llm",
                "mcp-server",
                "security-scanner",
                "static-analysis",
                "visualization",
                "claude-code",
                "code-architecture",
                "jetbrains-plugin",
                "vscode-extension",
                "code-intelligence",
                "cursor",
                "dora-metrics"
              ],
              "has_wiki": true,
              "homepage": "https://ashfordeou.github.io/grasp",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://ashfordeou.github.io/grasp",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "20 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 20
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 45,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 4
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 6.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "1 out of 1 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/29 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 1 contributing companies or organizations -- score normalized to 3",
                "points": 0.8,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.2,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 2,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "149 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "moderate",
            "name": "Dependency advisories",
            "note": "Matched the npm:grasp-mcp-server@3.21.0 runtime dependency closure — what installing the published package pulls in — 275 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:grasp-mcp-server@3.21.0",
                  "assessed": 275
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 66,
            "inputs": {
              "source": "osv",
              "advisories": 25,
              "affected_packages": 4,
              "assessed_packages": 275,
              "unassessed_packages": 0,
              "affected_by_severity": "critical 1, high 2, moderate 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "4 affected: protobufjs 6.11.6 (critical 9.8), sharp 0.32.6 (high 7.3), tar 6.2.1 (high 8.8), +1 more",
                "points": 3.5,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 4,
                      "packages": "protobufjs 6.11.6 (critical 9.8), sharp 0.32.6 (high 7.3), tar 6.2.1 (high 8.8)"
                    }
                  },
                  {
                    "code": "advisories_affected_more",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "2 advisory-carrying package(s) unaddressed past 90 days; oldest published 191 days ago",
                "points": 27.3,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 2,
                      "oldest": 191
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 275,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 77,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 9625
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum",
                "package-lock.json"
              ],
              "has_dockerfile": true,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "ai-tools/claude-code/tsconfig.json",
                "ai-tools/cline/tsconfig.json",
                "ai-tools/codex-cli/tsconfig.json",
                "ai-tools/cursor/tsconfig.json",
                "ai-tools/droid/tsconfig.json",
                "ai-tools/grok-cli/tsconfig.json",
                "ai-tools/kilo-code/tsconfig.json",
                "ai-tools/opencode/tsconfig.json",
                "ai-tools/roo-code/tsconfig.json",
                "ai-tools/trae/tsconfig.json",
                "amazon-q-plugin/tsconfig.json",
                "browser-extension/tsconfig.json",
                "continue-provider/tsconfig.json",
                "copilot-extension/tsconfig.json",
                "discord-bot/tsconfig.json",
                "github-action/tsconfig.json",
                "github-app/tsconfig.json",
                "gitlab-app/tsconfig.json",
                "gitlab-ci-component/tsconfig.json",
                "gpt-actions/tsconfig.json",
                "jira-integration/tsconfig.json",
                "linear-integration/tsconfig.json",
                "mcp/tsconfig.json",
                "raycast-grasp/tsconfig.json",
                "saas/tsconfig.json",
                "shared/digest-engine/tsconfig.json",
                "shared/test-utils/tsconfig.json",
                "slack-bot/tsconfig.json",
                "teams-bot/tsconfig.json",
                "vscode-extension/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "eclipse-plugin/pom.xml",
                "gitlab-agent/go.mod",
                "jenkins-plugin/pom.xml",
                "jetbrains-plugin/build.gradle.kts",
                "zed-extension/Cargo.toml"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "eclipse-plugin/pom.xml, gitlab-agent/go.mod, jenkins-plugin/pom.xml (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "eclipse-plugin/pom.xml, gitlab-agent/go.mod, jenkins-plugin/pom.xml"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "ai-tools/claude-code/tsconfig.json, ai-tools/cline/tsconfig.json, ai-tools/codex-cli/tsconfig.json, ai-tools/cursor/tsconfig.json, ai-tools/droid/tsconfig.json, ai-tools/grok-cli/tsconfig.json, ai-tools/kilo-code/tsconfig.json, ai-tools/opencode/tsconfig.json, ai-tools/roo-code/tsconfig.json, ai-tools/trae/tsconfig.json, amazon-q-plugin/tsconfig.json, browser-extension/tsconfig.json, continue-provider/tsconfig.json, copilot-extension/tsconfig.json, discord-bot/tsconfig.json, github-action/tsconfig.json, github-app/tsconfig.json, gitlab-app/tsconfig.json, gitlab-ci-component/tsconfig.json, gpt-actions/tsconfig.json, jira-integration/tsconfig.json, linear-integration/tsconfig.json, mcp/tsconfig.json, raycast-grasp/tsconfig.json, saas/tsconfig.json, shared/digest-engine/tsconfig.json, shared/test-utils/tsconfig.json, slack-bot/tsconfig.json, teams-bot/tsconfig.json, vscode-extension/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "ai-tools/claude-code/tsconfig.json, ai-tools/cline/tsconfig.json, ai-tools/codex-cli/tsconfig.json, ai-tools/cursor/tsconfig.json, ai-tools/droid/tsconfig.json, ai-tools/grok-cli/tsconfig.json, ai-tools/kilo-code/tsconfig.json, ai-tools/opencode/tsconfig.json, ai-tools/roo-code/tsconfig.json, ai-tools/trae/tsconfig.json, amazon-q-plugin/tsconfig.json, browser-extension/tsconfig.json, continue-provider/tsconfig.json, copilot-extension/tsconfig.json, discord-bot/tsconfig.json, github-action/tsconfig.json, github-app/tsconfig.json, gitlab-app/tsconfig.json, gitlab-ci-component/tsconfig.json, gpt-actions/tsconfig.json, jira-integration/tsconfig.json, linear-integration/tsconfig.json, mcp/tsconfig.json, raycast-grasp/tsconfig.json, saas/tsconfig.json, shared/digest-engine/tsconfig.json, shared/test-utils/tsconfig.json, slack-bot/tsconfig.json, teams-bot/tsconfig.json, vscode-extension/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 4",
                "points": 4,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "good",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 82,
            "inputs": {
              "primary_language": "HTML",
              "largest_source_bytes": 476875,
              "source_files_sampled": 347,
              "oversized_source_files": 2
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "HTML with type-check config (ai-tools/claude-code/tsconfig.json, ai-tools/cline/tsconfig.json, ai-tools/codex-cli/tsconfig.json, ai-tools/cursor/tsconfig.json, ai-tools/droid/tsconfig.json, ai-tools/grok-cli/tsconfig.json, ai-tools/kilo-code/tsconfig.json, ai-tools/opencode/tsconfig.json, ai-tools/roo-code/tsconfig.json, ai-tools/trae/tsconfig.json, amazon-q-plugin/tsconfig.json, browser-extension/tsconfig.json, continue-provider/tsconfig.json, copilot-extension/tsconfig.json, discord-bot/tsconfig.json, github-action/tsconfig.json, github-app/tsconfig.json, gitlab-app/tsconfig.json, gitlab-ci-component/tsconfig.json, gpt-actions/tsconfig.json, jira-integration/tsconfig.json, linear-integration/tsconfig.json, mcp/tsconfig.json, raycast-grasp/tsconfig.json, saas/tsconfig.json, shared/digest-engine/tsconfig.json, shared/test-utils/tsconfig.json, slack-bot/tsconfig.json, teams-bot/tsconfig.json, vscode-extension/tsconfig.json)",
                "points": 27,
                "status": "partial",
                "details": [
                  {
                    "code": "typecheck_config_language",
                    "params": {
                      "files": "ai-tools/claude-code/tsconfig.json, ai-tools/cline/tsconfig.json, ai-tools/codex-cli/tsconfig.json, ai-tools/cursor/tsconfig.json, ai-tools/droid/tsconfig.json, ai-tools/grok-cli/tsconfig.json, ai-tools/kilo-code/tsconfig.json, ai-tools/opencode/tsconfig.json, ai-tools/roo-code/tsconfig.json, ai-tools/trae/tsconfig.json, amazon-q-plugin/tsconfig.json, browser-extension/tsconfig.json, continue-provider/tsconfig.json, copilot-extension/tsconfig.json, discord-bot/tsconfig.json, github-action/tsconfig.json, github-app/tsconfig.json, gitlab-app/tsconfig.json, gitlab-ci-component/tsconfig.json, gpt-actions/tsconfig.json, jira-integration/tsconfig.json, linear-integration/tsconfig.json, mcp/tsconfig.json, raycast-grasp/tsconfig.json, saas/tsconfig.json, shared/digest-engine/tsconfig.json, shared/test-utils/tsconfig.json, slack-bot/tsconfig.json, teams-bot/tsconfig.json, vscode-extension/tsconfig.json",
                      "language": "HTML"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "2/347 source files over 60KB",
                "points": 54.7,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 347,
                      "oversized": 2
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "excellent",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": true,
              "api_schema_files": [
                "gpt-actions/openapi.yaml"
              ]
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": "gpt-actions/openapi.yaml",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "gpt-actions/openapi.yaml"
                    }
                  }
                ],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
    "Could not fetch go package 'github.com/ashfordeou/grasp-agent' from its registry",
    "Could not fetch maven package 'com.ashforde:grasp-eclipse' from its registry",
    "Could not fetch maven package 'com.ashforde:grasp' from its registry",
    "Could not fetch npm package 'grasp-github-app' from its registry",
    "Could not fetch crates package 'grasp-zed' from its registry",
    "Could not fetch npm package 'grasp-vscode' from its registry",
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-27T03:11:30.443570Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/a/ashfordeOU/grasp.svg",
  "full_name": "ashfordeOU/grasp",
  "license_state": "custom",
  "license_spdx": null
}