polygraphso / litmus

来自 GitHub 依赖图的完整解析依赖集合：8 个直接依赖与 233 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

安装 npm:@polygraphso/litmus@0.36.0 会引入 133 个包（直接与传递）：其中 1 个存在已知公告，0 个为直接依赖。

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

{
  "data": {
    "repo": {
      "topics": [
        "agents",
        "mcp-server"
      ],
      "is_fork": false,
      "size_kb": 1249,
      "has_wiki": false,
      "homepage": "https://polygraph.so",
      "languages": {
        "Shell": 800,
        "Dockerfile": 1006,
        "JavaScript": 50895,
        "TypeScript": 897821
      },
      "pushed_at": "2026-07-20T15:52:52Z",
      "created_at": "2026-06-15T13:48:37Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-20T15:51:35Z",
      "description": "Behavioral litmus harness for MCP servers — the open @polygraphso/litmus package (CLI, library, MCP server). ",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://www.polygraph.so/",
      "name": "polygraph.so",
      "type": "Organization",
      "login": "polygraphso",
      "company": null,
      "location": null,
      "followers": 2,
      "avatar_url": "https://avatars.githubusercontent.com/u/285698848?v=4",
      "created_at": "2026-05-18T13:16:22Z",
      "is_verified": null,
      "public_repos": 1,
      "account_age_days": 69
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "litmus-v0.36.0",
          "kind": "other",
          "published_at": "2026-07-20T15:52:49Z"
        },
        {
          "tag": "litmus-v0.35.0",
          "kind": "other",
          "published_at": "2026-07-18T23:34:09Z"
        },
        {
          "tag": "litmus-v0.34.0",
          "kind": "other",
          "published_at": "2026-07-16T10:09:48Z"
        },
        {
          "tag": "litmus-v0.33.1",
          "kind": "other",
          "published_at": "2026-07-10T09:13:31Z"
        },
        {
          "tag": "litmus-v0.33.0",
          "kind": "other",
          "published_at": "2026-07-09T20:38:31Z"
        },
        {
          "tag": "litmus-v0.32.0",
          "kind": "other",
          "published_at": "2026-07-09T15:22:57Z"
        },
        {
          "tag": "litmus-v0.31.0",
          "kind": "other",
          "published_at": "2026-07-08T11:23:02Z"
        },
        {
          "tag": "litmus-v0.30.0",
          "kind": "other",
          "published_at": "2026-07-06T14:33:09Z"
        },
        {
          "tag": "litmus-v0.29.0",
          "kind": "other",
          "published_at": "2026-07-06T09:10:55Z"
        },
        {
          "tag": "litmus-v0.26.0",
          "kind": "other",
          "published_at": "2026-07-03T23:07:20Z"
        },
        {
          "tag": "litmus-v0.25.0",
          "kind": "other",
          "published_at": "2026-07-03T10:50:18Z"
        },
        {
          "tag": "litmus-v0.24.0",
          "kind": "other",
          "published_at": "2026-07-02T22:26:56Z"
        },
        {
          "tag": "litmus-v0.23.0",
          "kind": "other",
          "published_at": "2026-07-02T14:19:16Z"
        },
        {
          "tag": "litmus-v0.22.1",
          "kind": "other",
          "published_at": "2026-07-02T09:09:24Z"
        },
        {
          "tag": "litmus-v0.22.0",
          "kind": "other",
          "published_at": "2026-07-01T07:55:32Z"
        },
        {
          "tag": "litmus-v0.21.1",
          "kind": "other",
          "published_at": "2026-06-30T13:36:36Z"
        },
        {
          "tag": "litmus-v0.21.0",
          "kind": "other",
          "published_at": "2026-06-30T12:04:08Z"
        },
        {
          "tag": "litmus-v0.20.0",
          "kind": "other",
          "published_at": "2026-06-29T15:18:44Z"
        },
        {
          "tag": "litmus-v0.19.1",
          "kind": "other",
          "published_at": "2026-06-26T07:52:59Z"
        },
        {
          "tag": "litmus-v0.19.0",
          "kind": "other",
          "published_at": "2026-06-25T23:31:01Z"
        },
        {
          "tag": "litmus-v0.18.2",
          "kind": "other",
          "published_at": "2026-06-25T22:50:27Z"
        },
        {
          "tag": "litmus-v0.18.1",
          "kind": "other",
          "published_at": "2026-06-25T15:23:28Z"
        },
        {
          "tag": "litmus-v0.18.0",
          "kind": "other",
          "published_at": "2026-06-25T14:23:46Z"
        },
        {
          "tag": "litmus-v0.17.1",
          "kind": "other",
          "published_at": "2026-06-25T13:02:55Z"
        },
        {
          "tag": "litmus-v0.17.0",
          "kind": "other",
          "published_at": "2026-06-24T23:41:22Z"
        },
        {
          "tag": "litmus-v0.16.1",
          "kind": "other",
          "published_at": "2026-06-24T19:26:34Z"
        },
        {
          "tag": "litmus-v0.16.0",
          "kind": "other",
          "published_at": "2026-06-24T15:16:51Z"
        },
        {
          "tag": "litmus-v0.15.0",
          "kind": "other",
          "published_at": "2026-06-24T10:34:52Z"
        },
        {
          "tag": "litmus-v0.14.0",
          "kind": "other",
          "published_at": "2026-06-24T10:22:21Z"
        },
        {
          "tag": "litmus-v0.12.1",
          "kind": "other",
          "published_at": "2026-06-19T14:46:28Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "8e9f9d523e76365695750bd5e464c690030ba934",
          "body": "Ships the litmus-v17 remote-grading hardening to the published package and the\nMCP registry: honest C-03 (skipped, not a silent pass) on remote targets, a\nrealistic client identity presented in the handshake and recorded in the\nbundle, and an advisory same-session surface-consistency check. Plugin 0.7.3\ncarries the 0.36.0 pin.\n\n\nClaude-Session: https://claude.ai/code/session_012Nh13h4LvxWFLDYNQXZfbn\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.36.0 (#123)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-20T15:50:04Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d63d9e343807b6c7d66397f10ef87156419dac98",
          "body": "* feat(core): bump methodology to litmus-v17\n\nRemote (Streamable HTTP) grading gets three hardening measures: C-03\nrecords skipped instead of an unearned pass when no canary could be\nplanted, the harness presents a recorded client identity instead of a\nfixed name in the MCP handshake, and a same-ses\n[…]\nr already maps any category's skipped status to the shared\nsentinel (2) generically, so no encode/decode change was needed; this\nadds an explicit test confirming C-03 flows through it and round-trips.",
          "is_bot": false,
          "headline": "feat: harden remote-server grading (litmus-v17) (#122)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-20T15:47:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "284f58530bfe084e090a774d89098a763d7e93f6",
          "body": "list_servers paging (grade/limit/offset, default 25) in the stdio tools,\nthe hosted endpoint advertised in server.json remotes, and version pins\nheld in lockstep by scripts/check-versions.mjs. Plugin 0.7.2 carries the\n0.35.0 pin.\n\n\nClaude-Session: https://claude.ai/code/session_012Nh13h4LvxWFLDYNQXZfbn\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.35.0 (#121)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-18T23:32:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "dea8164c777f32d25f1af1c2c81b8add0c450882",
          "body": "…checks (#120)\n\n* docs: lead MCP install docs with the hosted lookup endpoint\n\nMost integrations only want a published grade, not a local execution\npath. Add polygraph's hosted Streamable-HTTP endpoint\n(https://polygraph.so/api/mcp) as the first MCP install option in both\nREADMEs, ahead of the stdio\n[…]\nonse.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_012Nh13h4LvxWFLDYNQXZfbn\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: hosted lookup endpoint first, list_servers paging, version-pin …",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-18T22:30:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b5df538b1212d6ac5b4fe121e4b636662868c8b1",
          "body": null,
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.34.0 (#119)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-16T10:06:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "84e690a472210e9059a75fc151848cfe73856e42",
          "body": "* feat(mcp): request_grade surfaces the grading fee and payment links\n\npolygraph.so now charges a $1 one-time fee per grade request (it buys the\nrun, never the grade); grading starts on payment and the grade publishes\nwithin 48h. The API response carries requestId + payment {required,\nusdPrice, payU\n[…]\nn: https://claude.ai/code/session_01QWTrczFrHFWwkrBNXc8tGZ\n\n* chore: revert stray executable bit on bin.ts (pnpm install side effect)\n\n---------\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "request_grade: surface the $1 grading fee and payment links (#118)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-16T09:58:26Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9260d56f86915a4269e43844f0514d18aa1d46e1",
          "body": "action.yml default + plugins/polygraph/.mcp.json npx pin -> 0.33.1; plugin +\nmarketplace manifests 0.7.0 -> 0.7.1 (cache-busts the plugin distribution).\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): pin manifests + action to litmus 0.33.1 (#117)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-10T09:13:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b8a2e422ec5bf6f33f579e9c3310ca19172d6ed1",
          "body": "Patch for the two false positives fixed in #115 (raven-mcp exfil-sink proximity,\ntensorfeed 3.2 reflection). methodologyVersion unchanged (litmus-v16); monotonic\ncorrection that only lifts the two FPs back to A.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.33.1 (litmus-v16 FP fixes) (#116)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-10T09:10:06Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "abe34f8827687fdbdb1b3076879aa43fa69320ac",
          "body": "…run (#115)\n\nBoth surfaced re-grading the published set under v16; both should stay A.\n\n1. raven-mcp A->F (C-01 tool-poisoning). The exfil check fired verb+object on\n   benign form-field copy ('Email', 'Password') because the SINK was tested\n   against the whole document — a 57KB UI-docs surface alw\n[…]\ned. 486 probes tests pass; raven and\ntensorfeed re-grade A end-to-end.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(probes): two litmus-v16 false positives found in the regrade dry-…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-10T09:07:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7fccbc3ea36c7667f413098b289852342cdf18d9",
          "body": "Post-publish pins now that @polygraphso/litmus@0.33.0 is live on npm:\n- action.yml default version → 0.33.0\n- plugins/polygraph/.mcp.json npx pin → 0.33.0\n- plugin + marketplace manifests → 0.7.0 (unifies the claude/cursor plugin\n  versions, which had drifted to 0.6.0/0.4.0, and cache-busts the plugin\n  distribution so clients pick up the 0.33.0 server pin)\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): pin manifests + action to litmus 0.33.0 (#114)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-09T20:40:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6ac80e48011c51466b6883c7977d85f56c65fbc5",
          "body": "Version bump for the v16 methodology release merged in #109: coverage cap\n(write-capable servers keep A under sandbox exercise), live C grade,\ntool-poisoning scanner, indirect/passthrough injection probe 1.4, wider\ncorpora, advisory injection judge. Bundle schema 1.7.0 → 1.9.0.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.33.0 (litmus-v16) (#113)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-09T20:31:07Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9a4b72c0fab8cac615ac5c4dc0ac556d876636b3",
          "body": "…hrough injection, advisory judge (litmus-v16) (#109)\n\n* feat(probes): grading hardening — coverage cap, tool-poisoning, passthrough injection, advisory judge (litmus-v16)\n\nCloses the \"everything grades A\" gap in the litmus MCP-server grade. An A meant only\n\"tripped no HIGH detector\"; the most dange\n[…]\np\nwas hiding.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\n---------\n\nCo-authored-by: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(probes): grading hardening — coverage cap, tool-poisoning, passt…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-09T20:25:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1323b18f634bbd9c10c8bdc02848e59fd8ecf158",
          "body": "Ships litmus-v15: the C-02 egress baseline now includes public package-registry\ninfrastructure (pypi.org, files.pythonhosted.org, registry.npmjs.org), so a\nframework's default startup update-check — chiefly FastMCP pinging pypi.org — is\nno longer scored as the server's egress overreach. Cloud instance-metadata stays\nflagged. (#111)\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.32.0 (#112)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-09T15:20:14Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "741f887ce4c29c9b5c4a7ae617606f22d55b8730",
          "body": "…ess overreach (litmus-v15) (#111)\n\nThe C-02 egress baseline was empty, so any outbound connection during probe 2.2\ncounted as the server's overreach. But many MCP frameworks and package tools\nphone a public registry at startup with zero author intent — most notably\nFastMCP, whose stdio run() prints\n[…]\nndpoint is a real SSRF/credential\ntarget, so it stays flagged.\n\nPass/fail semantics change (some framework-only egress moves D→A) → litmus-v15.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(c02): don't score framework package-registry update-checks as egr…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-09T14:53:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "641b95a3d5837feea419499edc6a38f0b3b0dc1f",
          "body": "Ships the non-bare stdio launch knobs (#107): serverArgs, serverEnv, and\nentrySubpath let the harness grade honestly-built servers that need a\nsubcommand, a non-bin entry file, or a startup env var to boot. Optional and\ndefault off, so a backward-compatible minor. No methodology-version change\n(stay\n[…]\nn lockstep so the MCP-registry\nlisting tracks the release.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MNVwNaGUkogBKTtx5KK7X5",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.31.0 (#108)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-08T11:20:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1a49019ffab4f935a37c365dc9445e2e855114af",
          "body": "…subpath) (#107)\n\nAdds three composable, backward-compatible, default-off launch knobs so\nhonestly-built MCP servers that do not boot from a bare declared entry become\ngradeable:\n\n- serverArgs (--server-arg / server_args): appended to the server command\n  (e.g. a `mcp serve` subcommand); recorded in\n[…]\n server is launched, not\npass/fail semantics.\n\nCloses #106\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01MNVwNaGUkogBKTtx5KK7X5",
          "is_bot": false,
          "headline": "feat: launch non-bare stdio servers (server args, startup env, entry …",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-08T11:17:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1b102638d340e3770c4a707995ab2aba8f76fd4a",
          "body": "Ships litmus-v14: the C-04 probe 3.2 fix so a server that safely rejects a\njailbreak-as-argument and echoes it back in an error frame is no longer\nmis-flagged as amplification (#104). server.json bumped in lockstep so the\nMCP-registry listing tracks the release.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.30.0 (#105)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-06T14:22:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1bb6b44894c5b619b30d90160a5c303e36dfda89",
          "body": "…mus-v14) (#104)\n\nC-04 probe 3.2 (jailbreak amplification) masks reflections of our own\ninjected payload before scanning, so an honest echo isn't mistaken for\nserver-generated injection. The mask only caught COMPLETE echoes, so a\nserver that safely REJECTS a jailbreak-as-argument and quotes it back \n[…]\nnt,\nand server-generated injection surviving inside a rejection frame.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(c04): don't false-flag safe rejections that echo the payload (lit…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-06T14:17:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0073462d9a5c739bd86f980072ad52821802219e",
          "body": "The published methodology is now litmus-v13 (0.29.0). Update the CLAUDE.md\nanchor so it points at the current version.\n\n\nClaude-Session: https://claude.ai/code/session_01MNVwNaGUkogBKTtx5KK7X5\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: bump methodology reference to litmus-v13 (#103)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-06T09:50:35Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "28a9544f583b705a176e6807f6b6cddc215de694",
          "body": "Ships the litmus-v13 C-01 recalibration merged in #101: injection false\npositives on angle-bracket placeholders, data:/format examples, and\nzero-width doc artifacts no longer flip honest servers to F. Bumps the\npackage + server.json manifest versions to match the tag.\n\n\nClaude-Session: https://claude.ai/code/session_01MNVwNaGUkogBKTtx5KK7X5\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.29.0 (#102)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-06T09:08:03Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b9bb52fbb2f6daef1508a7aa6b50ae0fd806287b",
          "body": "…ples, and zero-width doc artifacts (litmus-v13) (#101)\n\nThe tool-output-injection scanner (C-01) floored several honest servers on\nbenign structures rather than genuine hijacks:\n\n- Angle-bracket placeholders in usage text — a `<tool>` in a call_tool example,\n  a `<system | client | /group/>` pipe-s\n[…]\n the evil/injecting/second-order fixtures still grade F.\n\n\nClaude-Session: https://claude.ai/code/session_01MNVwNaGUkogBKTtx5KK7X5\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(c01): stop injection false positives on placeholders, format exam…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-06T09:03:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "23f88d1fe7fa73b8ae27b5dff69be0630f69400b",
          "body": "…boxed) (#100)\n\nAdds github as a gradeable server ref alongside npm and pypi. A\ngithub/<owner>/<repo>[@ref] target is cloned at a pinned commit, its deps\ninstalled and — unlike npm/pypi staging — its build run, inside the same\nhardened gVisor container that will run the graded server. The start comm\n[…]\nnew work is one staging function plus removing the\nlaunch-layer guards that rejected github. Validated end-to-end against a real\nNode and a real Python server. Publishes as @polygraphso/litmus 0.28.0.",
          "is_bot": false,
          "headline": "feat(github): grade github/owner/repo servers (clone, build, run sand…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-06T08:45:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bdf31a4207de82ce6c201caeb28aaa3de44a6a8e",
          "body": "polygraph's lookup MCP server is now listed on Smithery; add the badge\nalongside the existing directory badges (also satisfies Smithery's\nbacklink verification).\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add Smithery badge to the README badge row (#99)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-05T10:18:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "33a02720a2862d002b5427a53bd6040154fd8e9d",
          "body": "The release bumped packages/litmus/package.json to 0.27.0 but not server.json,\nso the MCP-registry publish step failed its version-match check. Sync it.",
          "is_bot": false,
          "headline": "chore: sync server.json to 0.27.0 (#98)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-04T23:38:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "150fa7e8e06972f83350424d67247883d29f6bda",
          "body": "Smithery and MCPB-capable clients distribute stdio servers as .mcpb\nbundles. Build one per release — from the published npm version, via a\nchecked-in manifest template — smoke-test it over a real MCP handshake\n(initialize + tools/list, expected tool surface required), and attach\nit to the litmus-v* GitHub Release as an asset.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: build and attach the MCPB bundle on each release (#95)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-04T23:33:12Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f8567109a6819c3d10edfbdb1d48396152099927",
          "body": "A ~12s capture (vhs, 2x) of the one-command grade against\nnpm/@modelcontextprotocol/server-filesystem on litmus-v12 — the five\nprobe steps and the full grade card, unedited.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add a terminal recording of a real grade to the quickstart (#96)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-04T23:32:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d5777648ba1c644c383fe15a19a30c196c7a76d5",
          "body": "The static skill litmus S-04 scanned only bundled executable files, so a\nskill that puts a remote-exec in its prose — a fake \"prerequisites\" step\nrunning `echo '<base64>' | base64 -D | bash` — passed clean. That\nobfuscated-installer shape is a known malicious-skill pattern.\n\nS-04 now also scans the \n[…]\n. The plain\n`curl … | bash` pipe still only floors from a bundled file, so a documented\ninstall line in prose stays clean — 0/96 false-fails on the skill corpus.\n\nMethodology bumps to litmus-skill-v3.",
          "is_bot": false,
          "headline": "feat(skills): S-04 flags dangerous commands in the SKILL.md body (#97)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-04T23:15:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d35f1f0cceff56d78247f0ef62642de4e37630ea",
          "body": "…(#94)\n\nThe first screen was the CI-gate YAML — the right pitch for a CI buyer,\nthe wrong first touch for someone who just wants to grade one server.\nReorder, adding no new claims:\n\n- quickstart: the one-command npx grade, what it does, what it caps\n  without Docker, and the re-run-to-dispute proper\n[…]\n only in packages/litmus/README\n- CI gate section unchanged, now third\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: lead the README with the one-command grade and the agent tools …",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T23:09:45Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f5707cdcf94795a6ebbfc6dc047c5a5aeeed5f98",
          "body": "- 0.25.0 → 0.26.0 (minor: the lookup tools attribute the connected client —\n  agent_id + declared meta — to polygraph.so's aggregate usage counters).\n- server.json ×2, plugin spawn pin, plugin manifests → 0.6.0, action pin —\n  the full lockstep set.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.26.0 (#92)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T23:05:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "726825057c52a4cde2fbed2cfc3282b0cd796703",
          "body": "The registry listing at registry.modelcontextprotocol.io was published once\nmanually and has been stale since (0.12.1 vs the current npm release).\nserver.json is already bumped on every release; this wires it into the\npublish workflow so the listing tracks npm automatically:\n\n- new publish-registry \n[…]\nnt listing without a\n  release; the npm publish step stays tag-guarded\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: publish server.json to the official MCP registry on release (#93)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T23:04:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "316c15f040f4e825d1e2e7889d1f5fbb3f733d34",
          "body": "…#91)\n\nThe lookup tools called polygraph.so anonymously; only request_grade carried\nthe caller's name/version. Now all three (check_server, list_servers,\nrequest_grade) attribute the connected client, so polygraph.so's aggregate\nper-agent usage counters see MCP clients as themselves rather than as a\n[…]\nre optional server-side — older deployments ignore them.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(mcp): send the client's identity on lookups and grade requests (…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T18:04:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ea3593d68d651e5b184273733510c14f5d565ecf",
          "body": "An unpinned `npx -p @polygraphso/litmus` silently reuses whatever old\nversion the npx cache holds — plugin installs were serving builds as old\nas 0.13.0. Pin the spawn to @polygraphso/litmus@0.25.0 so every install\nresolves the intended release deterministically; the release checklist\nnow bumps this pin alongside the action pin. Plugin 0.5.0 → 0.5.1.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(plugin): pin the MCP spawn to the released litmus version (#90)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T13:40:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cc8ee687e56c570283296a8af55fa3cd4b37e71f",
          "body": "Lockstep with the litmus-v0.25.0 release the v1 tag points at (was stale\nat 0.22.0).\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(action): pin @polygraphso/litmus 0.25.0 (#89)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T13:14:45Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d85c593d8c58b6d954413b0c87c3db0e4687f201",
          "body": "- 0.24.0 → 0.25.0 (minor: published-grade lookup tools check_server /\n  list_servers / request_grade + remote GitHub skill refs for\n  run_skill_litmus; no grading-semantics change).\n- server.json: both version fields + refresh the POLYGRAPH_API_URL\n  description (the base URL now serves the lookup t\n[…]\n 0.4.0 → 0.5.0 (the bundled server's tool surface grew).\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.25.0 (#88)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T10:45:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d39e486dea94695f0d5b1908541f0910f7f92b91",
          "body": "* feat(mcp): published-grade lookup tools — check_server, list_servers, request_grade\n\nThe MCP server could grade a server (run_litmus) and read the onchain proof\n(verify_attestation), but not answer the everyday question — \"has this server\nbeen graded?\" — without running anything. Add the polygraph\n[…]\ne Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(mcp): published-grade lookup tools + remote GitHub skill refs (#87)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-03T10:42:43Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "59686bc71a4367ea74cb16395e16a9ff97019aa3",
          "body": "Ships the litmus-v12 false-positive fixes (#85): C-04 safe-reject echoes and\nC-02 negated mutation verbs no longer produce a false D. Bumps package.json and\nboth server.json version fields; version-only, so the frozen lockfile stays green.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.24.0 (#86)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-02T22:24:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "07e47817edd594e1d4623ba4e531383576663374",
          "body": "…C-02) as failures (litmus-v12) (#85)\n\nTwo false positives where the harness read a server's correct, defensive behavior\nas a fault. Both are narrow and covered by regression tests; the demo-fixture and\nexisting FP-guard suites confirm genuine cases still trip.\n\nC-04 (probe 3.2, reflection): a valid\n[…]\n1 -> v12\n(kept a string, so older attestations coexist).\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(probes): don't grade safe-reject echoes (C-04) or negated verbs (…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-02T22:19:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "527d65daecfb853411cae6cd22d3b6ef2fde8cf0",
          "body": "Ships the litmus-v11 C-02 expected-upstream inference (#83): honest\nAPI-wrapper egress is disclosed as informational rather than graded as\noverreach. Backward-compatible; methodologyVersion is now litmus-v11.\n\n\nClaude-Session: https://claude.ai/code/session_01MNVwNaGUkogBKTtx5KK7X5\n\nCo-authored-by: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.23.0 (#84)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-02T14:18:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "be17e62f4584f0602a371073dc305840bd450a4f",
          "body": "…-v11) (#83)\n\n* feat(c02): add expected-upstream inference unit\n\n* feat(c02): reclassify inferred first-party egress as informational, not overreach\n\n* feat(c02): compute the expected-upstream signal per run and feed C-02\n\n* feat(c02): disclose inferred upstreams in CLI output; repoint the D-grade f\n[…]\nc02): bump methodology to litmus-v11\n\n* fix(c02): treat multi-part public suffixes as shared-tenant in upstream inference\n\n* fix(c02): gate brand-tier inference to plain-TLD hosts to keep it monotonic",
          "is_bot": false,
          "headline": "fix(c02): stop grading honest API-wrapper egress as overreach (litmus…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-02T13:56:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cdd3e8664a75d0fedd6fc1fbb729782f6340246f",
          "body": null,
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.22.1 (#82)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-02T09:08:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8ed59793df704b1f07b67e7d394ac69e73ac89eb",
          "body": "…verify tools (#81)\n\nA5 — MCP progress forwarding: void sendNotification → .catch(() => {}) so a\nclient disconnect during a run can't kill the server process via an unhandled\nrejection.\n\nA1 — iptables atomicity: prefix the add-op shell script with `set -e` so a\npartial rule insertion (e.g. MASQUERAD\n[…]\n\nB12 — action.yml pin + CONTRIBUTING: version default bumped to 0.22.0; CONTRIBUTING\nrewritten to include all six release steps (server.json double-bump, action pin\nbump, v1 retag, gh release create).",
          "is_bot": false,
          "headline": "fix: close false-pass paths, scan error channel, harden iptables and …",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-02T08:52:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "079cd2be8936abfced2fdfa6f673c3ef063e232e",
          "body": "Ships #78 (C-02 egress D rationale is now actionable — names the undeclared\nhost(s) and points at polygraph.egress; messaging only, grades unchanged) and\n#79 (pypi/uvx MCP servers are now gradeable under the Docker sandbox:\nwheels-only venv staging, offline resolve, venv-python launch). Methodology\n\n[…]\nitmus-v10) — a pypi server is graded by the same rubric.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.22.0 (#80)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-01T07:53:37Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "280fbea17071bafb3305882cd797db8f37aa06b0",
          "body": "Only npm refs could be containerized; a pypi ref under\nLITMUS_STDIO_ISOLATION=docker failed immediately (\"unsupported for pypi\"),\nso Python MCP servers were ungradeable in the safe execution mode.\n\nStage a pypi package the same way as npm, with no target code running during\nstaging: install WHEELS O\n[…]\nme parity is preserved across install, resolve, and run.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(sandbox): grade pypi/uvx MCP servers under the Docker sandbox (#79)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-01T07:50:41Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "96cff1908044867fa5fcc43fc48ad504be5e514c",
          "body": "The C-02 egress check is an overreach test: reaching a host the server\ndid not declare is the finding, not proof of phoning home. But the grade\nrationale and CLI output read like an accusation and never told an author\nhow to clear it — even when the host is plainly the API the tool exists\nto wrap (e\n[…]\n\nbyte-identical; this only changes how a D is explained.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(c02): make the egress D rationale actionable, not accusatory (#78)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-07-01T07:50:10Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "41941a7832768f35e0d8a0631f72c389941d69da",
          "body": "The action's `version` default lagged at 0.20.0 while the published package\nmoved to 0.21.1, so SHA-pinning `uses: polygraphso/litmus@<sha>` silently ran\n0.20.0. Bump the default so a SHA pin is fully reproducible on the current\nrelease without passing `version:` explicitly. (After merge, the v1 tag is\nre-pointed to this commit.)\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(action): pin the action's default litmus version to 0.21.1 (#77)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-30T16:06:33Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "7054db750d9b3ebb9d984ba1d57b7c16b2672750",
          "body": null,
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.21.1 (#76)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-30T13:36:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9a0276ea07b34676f84f4b26cf164e6ba4fdedc",
          "body": "…ase flow (#75)\n\nThe MCP-registry manifest (server.json) was pinned to 0.12.1 while the package\nshipped 0.21.0. Directories that read the manifest (e.g. Glama) install whatever\nversion it names, so the stale value had them building an ancient release. Sync\nboth version fields to 0.21.0, and add serv\n[…]\n version-bump\nstep in CLAUDE.md so it can't drift again.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: sync server.json to the published version + add it to the rele…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-30T13:29:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "bf086fa410098b879b1a90acba5286a0424541fd",
          "body": "…l match word (#74)\n\nTwo fixes to instruction-mimicry:\n\n1. The MEDIUM bare-imperative pattern (\"you must / need to …\") is a skill's\n   normal instructional voice — a skill exists to tell the agent \"you need to\n   fill out the form\" — so it surfaced constantly as S-01 evidence noise. It\n   never floo\n[…]\nodology-version change: grading semantics are unchanged.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(probes): drop the bare-imperative skill finding + capture the ful…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-30T13:29:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0a0ea97280f8b7ba62bb3af20ed5565d00c32c47",
          "body": null,
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.21.0 (#73)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-30T12:01:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "39224cc35420a1582469cdad8f331c40971320bd",
          "body": "…ies on-chain (#72)\n\nTwo changes to the server and skill EAS schemas, registered fresh (new UIDs;\nnothing is minted under the prior schema yet):\n\n1. Reference evidence by `bytes32 evidenceHash` (keccak256 of the canonical\n   bundle — a re-hashable tamper-proof anchor) + `string evidenceURI` (the\n   \n[…]\nw\ncategory means a new schema UID, not an edit to these.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(onchain): reconcile EAS schema — hash/URI evidence + all categor…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-30T11:52:48Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3e443bec4f88bc9bcdb63da0ae2470457d1fa3ec",
          "body": "Ships the gate/action hardening from #70: opt-in GateOptions\n(allowedAttesters, acceptedMethodologyVersions, requireEgressVerified),\nPAYMENT_PASSING, on-chain methodologyVersion + egressVerified surfaced for\nthe read path, discovery off-by-default in the action, and the ci discovery\nwarning. Backward-compatible minor.\n\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.20.0 (#71)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-29T15:14:52Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e0bcefab0f9ed42b095f35f9e809443c942bf4d8",
          "body": "…I (#70)\n\n* harden the agent gate and CI action for value-routing and untrusted CI\n\nTighten the trust surface a behavioral grade is used through, without changing\nthe default decision for read-only/low-value callers.\n\n- agent gate: add opt-in GateOptions (allowedAttesters, acceptedMethodologyVersion\n[…]\ne Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Harden the agent gate and CI action for value-routing and untrusted C…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-29T15:14:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7dbd74456aefe146fabbd0923a69e39774ae6dea",
          "body": "…the install section (#69)\n\nThe action.yml gate is published on the GitHub Marketplace as\npolygraphso/litmus@v1, but neither README pointed at the listing or told a\nreader how to wire it up.\n\n- Root README: the \"Gate your CI\" section now links the Marketplace listing\n  (github.com/marketplace/action\n[…]\npx … polygraphso-litmus ci` fallback for\n  non-GitHub CI.\n\nClaude-Session: https://claude.ai/code/session_011FW3vDMau8UYnNWCanfT4k\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: link the GitHub Marketplace listing and document the action in …",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T11:16:53Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "04ed6c237c3e187e7c930cd5572d296197ad1909",
          "body": "…e line (#68)\n\nThe Marketplace listing for the polygraph-mcp-gate action renders the repo\nREADME under a stylesheet that sets `img { display: block }`, which stacked the\nplain inline badge row into a tall vertical column. Table cells lay out\nhorizontally regardless of the image display, so a single-\n[…]\nline styles, so the cells keep their default 1px border.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: lay the README badges out in a one-row table so they stay on on…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T09:54:57Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2858b553cb7aecc00e73096ab59ed08dfa57535a",
          "body": "…ADME hero (#67)\n\nBring back the Glama score badge alongside npm version, CI status, and Apache-2.0\nlicense badges. Keep every badge on a single physical line so the row renders\ninline on both the GitHub repo page and the Marketplace listing for the\npolygraph-mcp-gate action — the Marketplace render\n[…]\nbadge list would stack vertically and break\nthe listing.\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: restore the Glama badge and add npm/CI/license badges to the RE…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T09:43:34Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "074fee6e74bfb4f69660df40086fd7115e713d05",
          "body": "Bump the documented methodology versions to match the code constants\n(METHODOLOGY_VERSION = litmus-v10, SKILL_METHODOLOGY_VERSION =\nlitmus-skill-v2) across CLAUDE.md, the package and plugin READMEs, the\nskill command examples, and the PR template.\n\n\nClaude-Session: https://claude.ai/code/session_012g8JzoVCmKXCqPRK4yB29z\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: align methodology version references with current code (#66)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T09:40:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4f43a5f48badea38692e998c507e8c90466d2b2d",
          "body": "…#65)\n\n* test(cli): stop runCi unit test leaking an empty gate summary\n\nThe \"runCi exit code\" test calls runCi with no targets, which calls\nemitGitHub — and under GITHUB_ACTIONS that appends an empty \"Polygraph\ngate\" table (headers, zero rows) to the real $GITHUB_STEP_SUMMARY,\nsurfacing as a blank g\n[…]\ne Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: run the polygraph gate as part of CI, grading a bundled skill (…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T08:53:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6997546a47f0a74035e4318ef2f7bf85f91a86bc",
          "body": "actions/checkout@v4 runs on Node 20, which GitHub Actions runners now\nforce onto Node 24 with a deprecation warning. Pin the two CI-gate\nworkflows to the same actions/checkout@v6.0.3 SHA the rest of the repo\nalready uses, and bump the README GitHub Action example to @v5 (both\nrun on Node 24).\n\n\nClaude-Session: https://claude.ai/code/session_01TZcTQCDwyFqdh59fPWDJAr\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci: bump actions/checkout off deprecated Node 20 (#63)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T07:54:13Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "006d05e9d3a07b3df00330517325e0880adaf504",
          "body": "Patches the C-02 transfer pattern (still litmus-v10): the qualifier slot no\nlonger admits prepositions, so 'transfers with/per token' read-only docs are\nnot false-flagged.",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.19.1 (#62)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T07:51:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dacab4e3b1cc7133d45bb2b6ae11378e7349679f",
          "body": "…ard (#61)\n\nThe optional intervening word admitted prepositions, so read-only noun phrases\nlike 'token transfers with token metadata' / 'transfers per token' false-matched\n(kept block-explorer and DeFi-data tools at D). The qualifier slot now accepts\nonly a number or token-standard id ('transfers 5 tokens', 'transfers ERC-20\ntokens'), not an arbitrary word, while still rejecting 'token transfers'.",
          "is_bot": false,
          "headline": "fix(probes): restrict C-02 transfer qualifier to quantity/token-stand…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-26T07:50:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "13d9929a74e1078bb63729b0d79bf2daf2845424",
          "body": "…s (#60)\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "test(cli): stop integration tests emitting fake F-grade CI annotation…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T23:37:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d7e9e486fabb00fb7f27589c64f13d252a2ecc54",
          "body": "Ships litmus-v10: C-02 probe 2.1 no longer false-flags honestly read-only data\ntools (the noun 'transfers' / bare toAddress signals were narrowed).",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.19.0 (#59)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T23:29:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "932e08e82c290ef2d59fd5e3d3ffd99822253988",
          "body": "* fix(probes): narrow C-02 mislabel signals — value-object transfer + drop bare toAddress\n\nThe declared-permission-lie heuristic false-flagged honestly read-only data\ntools: the description pattern matched the noun 'transfers' (history), and a\nbare toAddress param was read as value movement. Require\n[…]\ne Opus 4.8 (1M context) <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_012g8JzoVCmKXCqPRK4yB29z\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(probes): narrow C-02 permission-mislabel signals (litmus-v10) (#58)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T23:28:22Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "30327e2de72f73f6c70a768e4abe800d310337a5",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(gate): dogfood gate against latest published version (#57)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T22:53:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5d9a8ec59c84c0b052ca718b809556db7d88a473",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.18.2 (#56)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T22:49:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "83255925f3a6f67b27e71c7fc75026697be2694b",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(action): correct npx bin invocation + dogfood gate on every PR (#55)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T22:45:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "5c6d5defd820871f5a6389d1bdf81ed59cc004ab",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): single hero badge (#54)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T21:58:54Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "37cf08839266278875eff104f170c35d1e5a5190",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): trim hero badges to three (#53)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T20:00:30Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "cc568a2b780fda5171d97f5b5cccbd5f116a18f9",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): inline-HTML badge row (fixes Marketplace stacking) (#52)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T18:24:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "55a17ae47a267d620cf9c3489bc601ea49f3a4aa",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.18.1 (#51)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T15:21:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "42802dd9e344db21125742ccc775507773576294",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs(readme): action-setup-first README + single-row badges (#50)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T15:18:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "22e04a16d5d8ac8b050f3929faefe231dfd1a667",
          "body": "* docs(readme): cleaner Marketplace hero + award icon\n\nLead the README (which renders on the Marketplace listing) with the polygraph\nlogomark, a one-line tagline, a cohesive badge row (npm · Marketplace · license ·\npolygraph grade — dropping the cryptic out-of-context Glama badge from the hero),\nand\n[…]\nored-By: Claude <noreply@anthropic.com>\n\n* docs(readme): keep the Glama badge in the hero row\n\nCo-Authored-By: Claude <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: Marketplace listing polish — README hero, badges, award icon (#49)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T15:06:09Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d6130b07d96bf8e69f398e03245160d27738636a",
          "body": "Co-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "ci(smoke): gate a known-bad skill via polygraphso/litmus@v1 (#48)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T14:26:09Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0878c121ae2b89d42d9a983d7fa056afea9a8bab",
          "body": "Bump to 0.18.0 (first release with the ci command + GitHub Action) and pin action.yml's version input to 0.18.0.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.18.0 (#47)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T14:17:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "4570213a9cb3423e87863e5bcd3832f0842d9142",
          "body": "…l grades (#44)\n\nAdds a `ci` command to @polygraphso/litmus and a composite GitHub Action that fails a build when an MCP server or an Agent Skill it ships grades D/F. Hybrid lookup→harness for servers; static runSkillLitmus for skills; discovery + explicit targets; D/F gate with --min-grade/--strict; CI-agnostic output.\n\nCo-Authored-By: Claude <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: ci command + GitHub Action gating builds on MCP server and skil…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T14:14:40Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "df6c396ec6fed6c4e1fd5eb349a18a5ed878c554",
          "body": "… (litmus-v9) (#46)\n\n* feat(probes): context-aware whole-pool reflection check for C-04 3.2\n\nAdds isReflectedEcho: a finding is a reflected echo of an injected payload only\nwhen its bounded output context carries a >=24-char verbatim run of that payload\ncovering the matched token. A server emitting \n[…]\nUpperCase() uses on ECHO tripped\nTS18048. Non-null assertion at the declaration (the pool is a fixed, non-empty\nconst).\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(probes): mask complete payload echoes before scanning in C-04 3.2…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T14:09:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5678e1b65ce6ca337071aaef977c6c8fd859ad6d",
          "body": "Ships the skill-litmus false-positive fix from #43 (litmus-skill-v2): S-01 no\nlonger floors a quoted/referenced attack phrase, and S-03 no longer floors a\ndefensive or onboarding sentence. Patch — a precision fix, no API change.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.17.1 (#45)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T13:00:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ffdcd4521adcdeaa90fde4fade6746247c0f84d7",
          "body": "…s-skill-v2) (#43)\n\nTwo over-broad signals flipped honest skills to F:\n\n- S-01 flagged a QUOTED attack phrase. A security/defensive skill that documents\n  \"ignore previous instructions\" in a detection table or example list reads as if\n  it ISSUED the directive. Drop an instruction-mimicry finding wh\n[…]\nrl|sh\ninstaller still grades D). Pass/fail-semantics change, so bump\nSKILL_METHODOLOGY_VERSION litmus-skill-v1 -> litmus-skill-v2.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(skills): cut S-01/S-03 false positives in the skill litmus (litmu…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-25T08:19:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b1f8f462371d808be367984f674738b9f72e083f",
          "body": "Ships the bounded `context` evidence window on text-scan findings (#41):\nBUNDLE_SCHEMA_VERSION 1.6.0, additive and backward-compatible.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.17.0 (#42)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T23:39:27Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "be2944adce9f343811c7bea6dbc4a73f61341d77",
          "body": "A text-scan finding recorded only the matched substring + offset — enough to\nknow a pattern fired, but not to classify it. A `<assistant>` tag could be a\ngenuine injected instruction or benign content that merely contains the tag\n(a help string, a templated config value, a bot-challenge page); telli\n[…]\nSCHEMA_VERSION 1.5.0 -> 1.6.0 (older bundles\nstay valid). No methodologyVersion change: no pass/fail-semantics change.\n\nCloses #40\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(probes): bounded context window on text-scan findings (#41)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T23:30:08Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6cd41030d20bf99b04fa32313334aa15fe10c6ea",
          "body": "Ships the litmus-v8 false-positive fix (#38): narrows the tool-call-JSON,\nsystem:, and data:-URI signatures so honest tool listings, indented config\nexamples, and inline raster images no longer floor C-01/C-04.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.16.1 (#39)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T19:24:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a39911ce6dd40eceaa71b2a00f522b2d1814647f",
          "body": "… (#38)\n\nThree over-broad signatures flipped honest servers to D/F:\n\n- the tool-call-JSON signature matched the honest field names \"tool_name\" and\n  \"function\" (a tool listing, a contract ABI), not just the execute shapes\n  \"tool_call\"/\"function_call\";\n- the system: role label tripped on an INDENTED\n[…]\nhtml, SVG, and\nevery javascript: URI still flag. A pass/fail-semantics change, so bump\nMETHODOLOGY_VERSION litmus-v7 -> litmus-v8.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(probes): cut three injection/markdown false positives (litmus-v8)…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T19:22:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "9c6985a7e2b1af3413bfbf4b5d0cfb5493fd2dc2",
          "body": "Ships the litmus-v7 C-01 false-positive fix (#36).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.16.0 (#37)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T15:15:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "40956acc6d0f401cc2d198db24a594ba7002bdf8",
          "body": "…and prose (#36)\n\nThe C-01 static scan stringified each tool's inputSchema, so a parameter\nnamed `function` surfaced as the substring `\"function\":` and tripped the\ntool-call-JSON signature — a HIGH that fails the category. An honest schema\n(a parameter literally named `function`, common in browser-a\n[…]\nression tests for each false-positive shape and\nfor the no-false-negative guards (injection in a key name, role blocks in\noutput).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(c01): stop instruction-mimicry false positives on honest schemas …",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T15:13:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4f5795f030e38f3002b3bd233ab1cfe405775cff",
          "body": "Releases the osv.dev advisory links (#34): each dependency advisory now\nlinks to its osv.dev page in the CLI, and the run_litmus MCP advisory\npayload carries an `osv` field. Minor bump: backward-compatible additive\noutput only.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.15.0 (#35)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T10:32:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ca07c8cd4dde346e7890d230bc5ebcbafdfa35c0",
          "body": "Render a clickable osv.dev vulnerability link under each advisory in the\nCLI (https://osv.dev/vulnerability/<id>), and add the same as an `osv`\nfield on the run_litmus MCP advisory payload. The id resolves directly to\nits osv.dev page, so a reader can click through to the full record (source,\naffected ranges, references) from the grade output.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(deps): link each advisory to its osv.dev page (#34)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T10:30:22Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "3b4888cb485f1d62b9ff4f447afd86682c9be7d5",
          "body": "* chore(release): @polygraphso/litmus 0.14.0\n\nReleases the advisory npm dependency audit (#32) — an osv.dev scan of an\nnpm target's dependency tree, surfaced beside the grade with CVSS scores,\nadvisory-only and out of the evidence bundle — plus the Dependabot fixes\n(#31). Minor bump: backward-compat\n[…]\nbut the GitHub Release is a separate manual step.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.14.0 (#33)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T10:19:51Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "03a5608cd58eb04bad33eda716ec6ace30710c98",
          "body": "* feat(deps): advisory npm dependency-vulnerability audit\n\nAlongside the A–F behavioral grade, litmus now checks an npm target's\nresolved dependency tree against the osv.dev vulnerability database and\nreports any vulnerable dependencies as advisories.\n\nThis is deliberately kept OUTSIDE the grade and\n[…]\nv run shows\nws@8.17.1 as HIGH 7.5 / MODERATE 4.4.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(deps): advisory npm dependency-vulnerability audit (#32)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-24T08:44:33Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f92921588ab624f17309926db0ebc8088c7ef325",
          "body": "Move every flagged dependency to a patched version, resolving the 19\nopen Dependabot alerts.\n\nDirect devDependency (all six workspace packages):\n- vitest ^2.1.0 -> ^3.2.6 — GHSA-5xrq-8626-4rwp (critical: Vitest UI\n  arbitrary file read/exec)\n\nTransitive, pinned via pnpm.overrides:\n- hono >=4.12.25 —\n[…]\ns and leave anything already patched untouched.\n\ntypecheck, build (tsup bundle), and the full test suite pass on the new\nversions.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(deps): clear all Dependabot security alerts (#31)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-23T16:32:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1d2a773a0b5ded00be981da423d4ba47033b2e06",
          "body": "Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(release): @polygraphso/litmus 0.13.0 (#30)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-23T10:26:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1b7b354640d7dfd13cff0c6045b1e3c439cb707b",
          "body": "* feat(cli): add OAuth token-acquisition module (loopback + SDK auth client)\n\nacquireOAuthToken drives the MCP OAuth authorization-code + PKCE flow via the\nSDK's own client: a single-use 127.0.0.1 loopback listener captures the redirect,\nthe browser is opened natively, and the access token is read f\n[…]\nOAuth-gated grading (browser flow, per-run token)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Fetch a token via the browser for an OAuth-gated MCP server (#29)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-23T10:22:21Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5b0537f25329b461548be1cd0a387269303cdeb7",
          "body": "…) (#27)\n\n* feat(probes): add unsafeToExerciseToolNames (skip tools that lie about read-only)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n* feat(probes): broaden state-changing verbs so more mutators are skipped by default\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <nor\n[…]\ndology to litmus-v6 (tool-safety skip-set change)\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Never actively call a tool that lies about being read-only (litmus-v6…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-23T10:18:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "d0061a4c005e275d28731770d453e347aecd1270",
          "body": "* feat(cli): add MCP client-config credential resolver helpers\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n* test(cli): cover config file-walk precedence and auth-error detection\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n* feat(cli): reuse a co\n[…]\ncit creds always\nwin; read-only and never logged.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "Reuse a configured token for a gated server on auth failure (#26)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-23T10:14:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6cc69d3f05b670dcf2c6927754a652b6a20dcd14",
          "body": "Show the package's current polygraph behavioral grade as a live badge (it reads the published grade and links to the reproducible report) in the repo README, next to the Glama badge, and in the npm package README.\n\nCo-authored-by: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add the polygraph grade badge to the READMEs (#28)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-23T10:12:53Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6de001de590aaf0cbf574fee7e69f857096f6071",
          "body": "…ver (#25)\n\nWhen run_litmus hits an auth error on an https:// target, the grade command\nnow looks for a bearer token the user already has in their MCP client config\n(matched by server URL) and reuses it after confirmation, instead of asking\nthem to paste one. Names the source, never prints the token\n[…]\nsking — with the reason — when none is found. State-changing calls\nand host exec stay off.\n\nBumps the plugin/marketplace to 0.2.0.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(plugin): reuse a configured token when grading a token-gated ser…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-23T09:25:32Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f562b34b24b6e6dcc624374dd902d541dc684f9e",
          "body": "Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add Glama score badge to the README (#24)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-19T14:59:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6dfb0d6ac1e90584434dce97ef332c89096b9926",
          "body": "Lists the maintainers so Glama can verify ownership of the org-owned server\n(github.com/polygraphso/litmus) via \"Login with GitHub to claim\".\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(glama): add glama.json to claim the server (maintainers) (#23)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-19T14:43:25Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d661c2a591fc71b12bbe3f55eaa307200849e209",
          "body": "The official MCP registry rejects descriptions over 100 (byte length, and the\nem/en dashes are 3 bytes each). Trim to a one-line blurb that validates.\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(registry): shorten server.json description to <=100 bytes (#22)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-19T14:42:19Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "66ebb7220852029745a40a3bc73083c62c364a21",
          "body": "…, Cursor plugin (#21)\n\n* feat(distribution): Cursor one-click, Smithery, MCP registry, Cursor plugin\n\nMake the MCP server discoverable/installable beyond hand-editing mcp.json:\n\n- README: \"Add to Cursor\" one-click deeplink button\n- smithery.yaml: list on Smithery (stdio/npx; runs locally)\n- server.\n[…]\nso a republish + mcp-publisher publish validates.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>\n\n---------\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(distribution): 0.12.1 — Cursor one-click, Smithery, MCP registry…",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-19T13:04:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "85d2cf95b2746750215c4f041adf059d2a630706",
          "body": "Version bump so clients pick up the clearer not-connected guidance from #19\nvia /plugin update (a same-version update can be reported as already up to date).\n\nCo-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(plugin): bump polygraph plugin to 0.1.1 (#20)",
          "author_name": "Rúben Sousa Dinis",
          "author_login": "RubenSousaDinis",
          "committed_at": "2026-06-19T11:38:12Z",
          "body_truncated": false,
          "is_coding_agent": true
        }
      ],
      "releases_count": 30,
      "commits_last_year": 185,
      "latest_release_at": "2026-07-20T15:52:49Z",
      "latest_release_tag": "litmus-v0.36.0",
      "releases_from_tags": false,
      "days_since_last_push": 6,
      "active_weeks_last_year": 8,
      "days_since_latest_release": 6,
      "mean_days_between_releases": 1.9
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": true,
      "health_percentage": 87,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": true
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@polygraphso/litmus",
          "exists": true,
          "license": "Apache-2.0",
          "keywords": [
            "polygraph",
            "mcp",
            "model-context-protocol",
            "trust",
            "ai-agents",
            "security",
            "litmus"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@polygraphso/litmus",
          "is_deprecated": false,
          "latest_version": "0.36.0",
          "repository_url": "https://github.com/polygraphso/litmus",
          "versions_count": 48,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 5734,
          "first_published_at": "2026-06-16T11:16:38.998000Z",
          "latest_published_at": "2026-07-20T15:51:36.676000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 6
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 7,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": null,
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": true,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/agent/tsconfig.json",
        "packages/cli/tsconfig.json",
        "packages/core/tsconfig.json",
        "packages/demo-evil-mcp/tsconfig.json",
        "packages/demo-good-mcp/tsconfig.json",
        "packages/demo-injecting-mcp/tsconfig.json",
        "packages/demo-leaky-mcp/tsconfig.json",
        "packages/demo-malformed-mcp/tsconfig.json",
        "packages/demo-mislabel-mcp/tsconfig.json",
        "packages/demo-passthrough-mcp/tsconfig.json",
        "packages/demo-phonehome-mcp/tsconfig.json",
        "packages/demo-secondorder-mcp/tsconfig.json",
        "packages/demo-toolpoison-mcp/tsconfig.json",
        "packages/litmus/tsconfig.json",
        "packages/mcp/tsconfig.json",
        "packages/onchain/tsconfig.json",
        "packages/probes/tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 36191,
      "source_files_sampled": 164,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 7235
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [
          {
            "name": "@hono/node-server",
            "direct": false,
            "version": "1.19.15",
            "severity": "moderate",
            "ecosystem": "npm",
            "cvss_score": 5.9,
            "advisory_ids": [
              "GHSA-frvp-7c67-39w9"
            ],
            "fixed_version": "2.0.5",
            "advisory_count": 1,
            "oldest_advisory_days": 5
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "moderate": 1
        },
        "advisory_count": 1,
        "affected_count": 1,
        "assessed_count": 133,
        "malicious_count": 0,
        "assessed_package": "npm:@polygraphso/litmus@0.36.0",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@polygraph/core",
          "manifest": "packages/agent/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@polygraph/onchain",
          "manifest": "packages/agent/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@polygraph/probes",
          "manifest": "packages/agent/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "@polygraph/core",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@polygraph/probes",
          "manifest": "packages/cli/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-evil-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-evil-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-good-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-good-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-injecting-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-injecting-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-leaky-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-leaky-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-malformed-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-malformed-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-mislabel-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-mislabel-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-passthrough-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-passthrough-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-phonehome-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-phonehome-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-secondorder-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-secondorder-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/demo-toolpoison-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/demo-toolpoison-mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/litmus/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "ethers",
          "manifest": "packages/litmus/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.16.0"
        },
        {
          "name": "zod",
          "manifest": "packages/litmus/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "tsx",
          "manifest": "packages/litmus/package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.19.0"
        },
        {
          "name": "@polygraph/core",
          "manifest": "packages/mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@polygraph/onchain",
          "manifest": "packages/mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/mcp/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        },
        {
          "name": "@polygraph/core",
          "manifest": "packages/onchain/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "ethers",
          "manifest": "packages/onchain/package.json",
          "ecosystem": "npm",
          "version_constraint": "^6.16.0"
        },
        {
          "name": "@polygraph/core",
          "manifest": "packages/probes/package.json",
          "ecosystem": "npm",
          "version_constraint": "workspace:*"
        },
        {
          "name": "@modelcontextprotocol/sdk",
          "manifest": "packages/probes/package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.29.0"
        },
        {
          "name": "zod",
          "manifest": "packages/probes/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.23.8"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "@modelcontextprotocol/sdk",
            "direct": true,
            "version": "1.29.0",
            "ecosystem": "npm"
          },
          {
            "name": "@modelcontextprotocol/sdk",
            "direct": true,
            "version": "^1.29.0",
            "ecosystem": "npm"
          },
          {
            "name": "ethers",
            "direct": true,
            "version": "6.16.0",
            "ecosystem": "npm"
          },
          {
            "name": "ethers",
            "direct": true,
            "version": "^6.16.0",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": true,
            "version": "4.22.4",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": true,
            "version": "^4.19.0",
            "ecosystem": "npm"
          },
          {
            "name": "zod",
            "direct": true,
            "version": "3.25.76",
            "ecosystem": "npm"
          },
          {
            "name": "zod",
            "direct": true,
            "version": "^3.23.8",
            "ecosystem": "npm"
          },
          {
            "name": "@adraffy/ens-normalize",
            "direct": false,
            "version": "1.10.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/aix-ppc64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ia32",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-loong64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-mips64el",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ppc64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-riscv64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-s390x",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openharmony-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/sunos-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-arm64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-ia32",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-x64",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "@hono/node-server",
            "direct": false,
            "version": "1.19.14",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/gen-mapping",
            "direct": false,
            "version": "0.3.13",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/resolve-uri",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/sourcemap-codec",
            "direct": false,
            "version": "1.5.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/trace-mapping",
            "direct": false,
            "version": "0.3.31",
            "ecosystem": "npm"
          },
          {
            "name": "@noble/curves",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "@noble/hashes",
            "direct": false,
            "version": "1.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-android-arm-eabi",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-android-arm64",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-darwin-arm64",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-darwin-x64",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-freebsd-arm64",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-freebsd-x64",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm-gnueabihf",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm-musleabihf",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm64-gnu",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm64-musl",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-loong64-gnu",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-loong64-musl",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-ppc64-gnu",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-ppc64-musl",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-riscv64-gnu",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-riscv64-musl",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-s390x-gnu",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-x64-gnu",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-x64-musl",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-openbsd-x64",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-openharmony-arm64",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-arm64-msvc",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-ia32-msvc",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-x64-gnu",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-x64-msvc",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "@types/chai",
            "direct": false,
            "version": "5.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/deep-eql",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@types/estree",
            "direct": false,
            "version": "1.0.9",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "20.19.41",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "22.7.5",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "^20.16.0",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/expect",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/mocker",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/pretty-format",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/runner",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/snapshot",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/spy",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/utils",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "accepts",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "acorn",
            "direct": false,
            "version": "8.16.0",
            "ecosystem": "npm"
          },
          {
            "name": "aes-js",
            "direct": false,
            "version": "4.0.0-beta.5",
            "ecosystem": "npm"
          },
          {
            "name": "ajv",
            "direct": false,
            "version": "8.20.0",
            "ecosystem": "npm"
          },
          {
            "name": "ajv-formats",
            "direct": false,
            "version": "3.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "any-promise",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "assertion-error",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "body-parser",
            "direct": false,
            "version": "2.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "bundle-require",
            "direct": false,
            "version": "5.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "bytes",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "cac",
            "direct": false,
            "version": "6.7.14",
            "ecosystem": "npm"
          },
          {
            "name": "call-bind-apply-helpers",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "call-bound",
            "direct": false,
            "version": "1.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "chai",
            "direct": false,
            "version": "5.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "check-error",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "chokidar",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "commander",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "confbox",
            "direct": false,
            "version": "0.1.8",
            "ecosystem": "npm"
          },
          {
            "name": "consola",
            "direct": false,
            "version": "3.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "content-disposition",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "content-type",
            "direct": false,
            "version": "1.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "content-type",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "cookie",
            "direct": false,
            "version": "0.7.2",
            "ecosystem": "npm"
          },
          {
            "name": "cookie-signature",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "cors",
            "direct": false,
            "version": "2.8.6",
            "ecosystem": "npm"
          },
          {
            "name": "cross-spawn",
            "direct": false,
            "version": "7.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "debug",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "deep-eql",
            "direct": false,
            "version": "5.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "depd",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "dunder-proto",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "ee-first",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "encodeurl",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-define-property",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "es-errors",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-module-lexer",
            "direct": false,
            "version": "1.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "es-object-atoms",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "esbuild",
            "direct": false,
            "version": "0.28.1",
            "ecosystem": "npm"
          },
          {
            "name": "escape-html",
            "direct": false,
            "version": "1.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "estree-walker",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "etag",
            "direct": false,
            "version": "1.8.1",
            "ecosystem": "npm"
          },
          {
            "name": "eventsource",
            "direct": false,
            "version": "3.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "eventsource-parser",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "expect-type",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "express",
            "direct": false,
            "version": "5.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "express-rate-limit",
            "direct": false,
            "version": "8.5.2",
            "ecosystem": "npm"
          },
          {
            "name": "fast-deep-equal",
            "direct": false,
            "version": "3.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "fast-uri",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "fdir",
            "direct": false,
            "version": "6.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "finalhandler",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "fix-dts-default-cjs-exports",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "forwarded",
            "direct": false,
            "version": "0.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "fresh",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "fsevents",
            "direct": false,
            "version": "2.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "function-bind",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "get-intrinsic",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "get-proto",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "gopd",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "has-symbols",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "hasown",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "hono",
            "direct": false,
            "version": "4.12.27",
            "ecosystem": "npm"
          },
          {
            "name": "http-errors",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "iconv-lite",
            "direct": false,
            "version": "0.7.2",
            "ecosystem": "npm"
          },
          {
            "name": "inherits",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "ip-address",
            "direct": false,
            "version": "10.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "ipaddr.js",
            "direct": false,
            "version": "1.9.1",
            "ecosystem": "npm"
          },
          {
            "name": "is-promise",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "isexe",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "jose",
            "direct": false,
            "version": "6.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "joycon",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "js-tokens",
            "direct": false,
            "version": "9.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "json-schema-traverse",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "json-schema-typed",
            "direct": false,
            "version": "8.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "lilconfig",
            "direct": false,
            "version": "3.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "lines-and-columns",
            "direct": false,
            "version": "1.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "load-tsconfig",
            "direct": false,
            "version": "0.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "loupe",
            "direct": false,
            "version": "3.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "magic-string",
            "direct": false,
            "version": "0.30.21",
            "ecosystem": "npm"
          },
          {
            "name": "math-intrinsics",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "media-typer",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "merge-descriptors",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "mime-db",
            "direct": false,
            "version": "1.54.0",
            "ecosystem": "npm"
          },
          {
            "name": "mime-types",
            "direct": false,
            "version": "3.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "mlly",
            "direct": false,
            "version": "1.8.2",
            "ecosystem": "npm"
          },
          {
            "name": "ms",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "mz",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.12",
            "ecosystem": "npm"
          },
          {
            "name": "negotiator",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "object-assign",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "object-inspect",
            "direct": false,
            "version": "1.13.4",
            "ecosystem": "npm"
          },
          {
            "name": "on-finished",
            "direct": false,
            "version": "2.4.1",
            "ecosystem": "npm"
          },
          {
            "name": "once",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "parseurl",
            "direct": false,
            "version": "1.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "path-key",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "path-to-regexp",
            "direct": false,
            "version": "8.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "pathe",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "pathval",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "pirates",
            "direct": false,
            "version": "4.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "pkce-challenge",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "pkg-types",
            "direct": false,
            "version": "1.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "postcss",
            "direct": false,
            "version": "8.5.15",
            "ecosystem": "npm"
          },
          {
            "name": "postcss-load-config",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "proxy-addr",
            "direct": false,
            "version": "2.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "qs",
            "direct": false,
            "version": "6.15.2",
            "ecosystem": "npm"
          },
          {
            "name": "range-parser",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "raw-body",
            "direct": false,
            "version": "3.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "readdirp",
            "direct": false,
            "version": "4.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "require-from-string",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "rollup",
            "direct": false,
            "version": "4.61.0",
            "ecosystem": "npm"
          },
          {
            "name": "router",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "safer-buffer",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "send",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "serve-static",
            "direct": false,
            "version": "2.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "setprototypeof",
            "direct": false,
            "version": "1.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-command",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "shebang-regex",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel-list",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel-map",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "side-channel-weakmap",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "siginfo",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "source-map",
            "direct": false,
            "version": "0.7.6",
            "ecosystem": "npm"
          },
          {
            "name": "source-map-js",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "stackback",
            "direct": false,
            "version": "0.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "statuses",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "std-env",
            "direct": false,
            "version": "3.10.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-literal",
            "direct": false,
            "version": "3.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "sucrase",
            "direct": false,
            "version": "3.35.1",
            "ecosystem": "npm"
          },
          {
            "name": "thenify",
            "direct": false,
            "version": "3.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "thenify-all",
            "direct": false,
            "version": "1.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "tinybench",
            "direct": false,
            "version": "2.9.0",
            "ecosystem": "npm"
          },
          {
            "name": "tinyexec",
            "direct": false,
            "version": "0.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "tinyglobby",
            "direct": false,
            "version": "0.2.17",
            "ecosystem": "npm"
          },
          {
            "name": "tinypool",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "tinyrainbow",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "tinyspy",
            "direct": false,
            "version": "4.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "toidentifier",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "tree-kill",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "ts-interface-checker",
            "direct": false,
            "version": "0.1.13",
            "ecosystem": "npm"
          },
          {
            "name": "tslib",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "tsup",
            "direct": false,
            "version": "8.5.1",
            "ecosystem": "npm"
          },
          {
            "name": "tsup",
            "direct": false,
            "version": "^8.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "type-is",
            "direct": false,
            "version": "2.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "5.9.3",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "^5.9.3",
            "ecosystem": "npm"
          },
          {
            "name": "ufo",
            "direct": false,
            "version": "1.6.4",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "6.19.8",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "6.21.0",
            "ecosystem": "npm"
          },
          {
            "name": "unpipe",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "vary",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "vite",
            "direct": false,
            "version": "6.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "vite-node",
            "direct": false,
            "version": "3.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "vitest",
            "direct": false,
            "version": "3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "vitest",
            "direct": false,
            "version": "^3.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "which",
            "direct": false,
            "version": "2.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "why-is-node-running",
            "direct": false,
            "version": "2.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "wrappy",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "ws",
            "direct": false,
            "version": "8.21.0",
            "ecosystem": "npm"
          },
          {
            "name": "zod-to-json-schema",
            "direct": false,
            "version": "3.25.2",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 241,
        "direct_count": 8,
        "indirect_count": 233
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 118,
        "open_issues": 0,
        "closed_ratio": 1,
        "closed_issues": 3,
        "closed_unmerged_prs": 2
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "RubenSousaDinis",
          "commits": 185,
          "avatar_url": "https://avatars.githubusercontent.com/u/8901722?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "mcpb.yml",
        "publish.yml",
        "secret-scan.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "pnpm-lock.yaml"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 6,
            "reason": "project has 2 contributing companies or organizations -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 7,
            "reason": "dependency not pinned by hash detected -- score normalized to 7",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool is run on all commits",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 10,
            "reason": "security policy file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 5,
            "reason": "5 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "8e9f9d523e76365695750bd5e464c690030ba934",
        "ran_at": "2026-07-27T04:20:28Z",
        "aggregate_score": 5.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": true,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-26T07:53:50Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-20T15:50:05Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/polygraphso/litmus",
    "host": "github.com",
    "name": "litmus",
    "owner": "polygraphso"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 58,
        "vitality": 72,
        "community": 53,
        "governance": 55,
        "engineering": 77
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 72,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 60,
            "inputs": {
              "commits_last_year": 185,
              "human_commit_share": 1,
              "days_since_last_push": 6,
              "active_weeks_last_year": 8
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "8/52 weeks with commits",
                "points": 5.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "185 commits in the last year",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 185
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 30,
              "latest_release_tag": "litmus-v0.36.0",
              "releases_from_tags": false,
              "days_since_latest_release": 6,
              "mean_days_between_releases": 1.9
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "30 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 30
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 6 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~1.9 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 1.9
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "moderate",
        "name": "Community & Adoption",
        "value": 53,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 13,
            "inputs": {
              "forks": 0,
              "stars": 7,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "7 stars",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 7
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 92,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 6.3,
                "status": "met",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 63,
            "inputs": {
              "packages": [
                "@polygraphso/litmus"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 5734
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "5,734 downloads/month across npm",
                "points": 50.1,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 5734,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 55,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 16,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": null,
            "notes": [],
            "value": 84,
            "inputs": {
              "merged_prs": 118,
              "open_issues": 0,
              "closed_issues": 3,
              "issue_closed_ratio": 1,
              "closed_unmerged_prs": 2
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "100% of issues closed",
                "points": 46.8,
                "status": "met",
                "details": [
                  {
                    "code": "issues_closed_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "118/120 decided PRs merged",
                "points": 37.6,
                "status": "partial",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 118,
                      "decided": 120
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 36,
            "inputs": {
              "followers": 2,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "polygraphso",
              "public_repos": 1,
              "account_age_days": 69
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "2 followers of polygraphso",
                "points": 3.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 2,
                      "login": "polygraphso"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "1 public repos, account ~0 yr old",
                "points": 2.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 1
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@polygraphso/litmus"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 6
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 6 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 6
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "48 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 48
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 77,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "moderate",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 68,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "4 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 4
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "excellent",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "topics": [
                "agents",
                "mcp-server"
              ],
              "has_wiki": false,
              "homepage": "https://polygraph.so",
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": "https://polygraph.so",
                "points": 15,
                "status": "met",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": "2 topics",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "topics_count",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "moderate",
        "name": "Security",
        "value": 58,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "moderate",
            "name": "Security posture",
            "note": null,
            "notes": [],
            "value": 51,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 18,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 0,
              "scorecard_aggregate": 5.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "30 out of 30 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 7",
                "points": 3.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is run on all commits",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "5 existing vulnerabilities detected",
                "points": 3.8,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Matched the npm:@polygraphso/litmus@0.36.0 runtime dependency closure — what installing the published package pulls in — 133 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@polygraphso/litmus@0.36.0",
                  "assessed": 133
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "source": "osv",
              "advisories": 1,
              "affected_packages": 1,
              "assessed_packages": 133,
              "unassessed_packages": 0,
              "affected_by_severity": "moderate 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "1 affected: @hono/node-server 1.19.15 (moderate 5.9)",
                "points": 13.2,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "@hono/node-server 1.19.15 (moderate 5.9)"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory has been public longer than 90 days",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "advisories_none_stale",
                    "params": {
                      "days": 90
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 133,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 70,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 7235
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 100,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 65,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "pnpm-lock.yaml"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [
                "packages/agent/tsconfig.json",
                "packages/cli/tsconfig.json",
                "packages/core/tsconfig.json",
                "packages/demo-evil-mcp/tsconfig.json",
                "packages/demo-good-mcp/tsconfig.json",
                "packages/demo-injecting-mcp/tsconfig.json",
                "packages/demo-leaky-mcp/tsconfig.json",
                "packages/demo-malformed-mcp/tsconfig.json",
                "packages/demo-mislabel-mcp/tsconfig.json",
                "packages/demo-passthrough-mcp/tsconfig.json",
                "packages/demo-phonehome-mcp/tsconfig.json",
                "packages/demo-secondorder-mcp/tsconfig.json",
                "packages/demo-toolpoison-mcp/tsconfig.json",
                "packages/litmus/tsconfig.json",
                "packages/mcp/tsconfig.json",
                "packages/onchain/tsconfig.json",
                "packages/probes/tsconfig.json"
              ],
              "agent_commit_share": 0.87,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/agent/tsconfig.json, packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/demo-evil-mcp/tsconfig.json, packages/demo-good-mcp/tsconfig.json, packages/demo-injecting-mcp/tsconfig.json, packages/demo-leaky-mcp/tsconfig.json, packages/demo-malformed-mcp/tsconfig.json, packages/demo-mislabel-mcp/tsconfig.json, packages/demo-passthrough-mcp/tsconfig.json, packages/demo-phonehome-mcp/tsconfig.json, packages/demo-secondorder-mcp/tsconfig.json, packages/demo-toolpoison-mcp/tsconfig.json, packages/litmus/tsconfig.json, packages/mcp/tsconfig.json, packages/onchain/tsconfig.json, packages/probes/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/agent/tsconfig.json, packages/cli/tsconfig.json, packages/core/tsconfig.json, packages/demo-evil-mcp/tsconfig.json, packages/demo-good-mcp/tsconfig.json, packages/demo-injecting-mcp/tsconfig.json, packages/demo-leaky-mcp/tsconfig.json, packages/demo-malformed-mcp/tsconfig.json, packages/demo-mislabel-mcp/tsconfig.json, packages/demo-passthrough-mcp/tsconfig.json, packages/demo-phonehome-mcp/tsconfig.json, packages/demo-secondorder-mcp/tsconfig.json, packages/demo-toolpoison-mcp/tsconfig.json, packages/litmus/tsconfig.json, packages/mcp/tsconfig.json, packages/onchain/tsconfig.json, packages/probes/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "87 of the last 100 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 87,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "dependency automation configured, none observed in the sampled commits",
                "points": 5,
                "status": "partial",
                "details": [
                  {
                    "code": "dependency_bot_config_only",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 7",
                "points": 7,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 36191,
              "source_files_sampled": 164,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/164 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 164,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "critical",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 20,
            "inputs": {
              "example_dirs": [],
              "has_mcp_signal": true,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-27T04:20:44.594668Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/polygraphso/litmus.svg",
  "full_name": "polygraphso/litmus",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}