公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-27 15:55 UTC
vinkius-labs / mcpfusion
MCP Fusion - The TypeScript framework for secure MCP servers.
vinkius-labs/mcpfusion 的健康指数为 100 分中的 65 分，处于「中等」区间。 其得分最高的类别是Vitality（86/100），最低的是Security（41/100）。 最近一次更新在今天。 近期的大部分工作由 1 位贡献者完成。
65
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
65
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
86
开发活跃度
77良好
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 0 天前 |
| 13.2/36 | 提交节奏 — 52 周中有 19 周有提交 |
| 18/18 | 提交量 — 最近一年 342 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 342 |
| human_commit_share | 1 |
| days_since_last_push | 0 |
| active_weeks_last_year | 19 |
发布纪律
100优秀
评分方式
| 27/27 | 有发布版本 — 已发布 100 个发布版本 |
| 36/36 | 发布时效 — 最近一次发布版本于 0 天前 |
| 27/27 | 发布节奏 — 约每 7.6 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 100 |
| latest_release_tag | v4.4.1 |
| releases_from_tags | 否 |
| days_since_latest_release | 0 |
| mean_days_between_releases | 7.6 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
70
流行度与采用
52中等
评分方式
| 39.1/60 | 星标 — 257 个星标 |
| 11.2/25 | 复刻 — 23 个复刻 |
| 1.7/15 | 关注者 — 3 位关注者 |
所用输入
| forks | 23 |
| stars | 257 |
| watchers | 3 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
92优秀
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（Apache-2.0） |
| 18/18 | CONTRIBUTING 指南 |
| 13.5/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 6.3/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 是 |
| has_issue_template | 否 |
| has_code_of_conduct | 是 |
| has_pull_request_template | 是 |
生态采用（下载量）
68中等
评分方式
| 54.6/80 | 月度下载量 — npm 合计每月 12,407 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | @mcpfusion/a2a, @mcpfusion/aws, @mcpfusion/jwt, @mcpfusion/n8n, @mcpfusion/core, @mcpfusion/yaml, @mcpfusion/oauth, @mcpfusion/swarm |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 12,407 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
41
维护者韧性（巴士系数）
16危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 6/10 | OpenSSF Scorecard：Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
11危急
评分方式
| 6.7/46.8 | 议题解决 — 14% 的议题已关闭 |
| 0/38.3 | PR 接受 — 没有已裁定的拉取请求或无数据 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 0 |
| open_issues | 6 |
| closed_issues | 1 |
| issue_closed_ratio | 0.143 |
| closed_unmerged_prs | 0 |
已排除计分（无数据或不适用）：PR 接受。 其余权重已重新归一化。
所有权与托管责任
54中等
评分方式
| 30/30 | 所有权背书 — 组织持有 |
| 0/20 | 已验证域名 |
| 8.7/25 | 所有者影响力 — vinkius-labs 有 15 位关注者 |
| 15/25 | 既往记录 — 65 个公开仓库，账户约 1 年 |
所用输入
| followers | 15 |
| owner_type | Organization |
| is_verified | — |
| owner_login | vinkius-labs |
| public_repos | 65 |
| account_age_days | 366 |
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 8 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 0 天前 |
| 20/20 | 版本历史 — 12 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | @mcpfusion/a2a, @mcpfusion/aws, @mcpfusion/jwt, @mcpfusion/n8n, @mcpfusion/core, @mcpfusion/yaml, @mcpfusion/oauth, @mcpfusion/swarm |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 0 |
工程质量
基础的工程与文档实践是否到位？
84
工程实践
80良好
评分方式
| 24/24 | CI 工作流 — 5 个工作流 |
| 24/24 | 存在测试 |
| 16/16 | Linter 配置 — eslint.config.js |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard：CI-Tests — 无数据 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 是 |
| has_precommit_config | 否 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：CI-Tests。 其余权重已重新归一化。
文档
90优秀
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://vinkius.com/open-source |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 7 个主题标签 |
| 0/10 | Wiki |
所用输入
| topics | mcp, mcp-framework, mcp-server, model-context-protocol, chatgpt, claude, mcp-tools |
| has_wiki | 否 |
| homepage | https://vinkius.com/open-source |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
41
安全态势
41存在风险
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 无数据 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 1.5/2.5 | Contributors — project has 2 contributing companies or organizations -- score normalized to 6 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 64 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 4.1 |
已排除计分（无数据或不适用）：ci_tests, signed_releases。 其余权重已重新归一化。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
62
AI 代理上下文与指引
55中等
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 15/15 | 机器可读文档（llms.txt） — 存在 llms.txt |
| 40/40 | 可读的提交历史 — 100 次人类提交中有 84 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 是 |
| legible_history_share | 0.84 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 0/18 | 一条命令的引导启动 |
| 22/22 | 自动化测试 |
| 11/11 | Lint / 格式化配置 — eslint.config.js |
| 11/11 | 静态类型检查 — packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json |
| 10/10 | 可复现环境 — lockfile |
| 0/10 | 已体现的代理实践 — 最近 100 次提交中没有代理编写的提交 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 0/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | package-lock.json |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 是 |
| typecheck_configs | packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
99优秀
评分方式
| 45/45 | 可类型检查的代码 — TypeScript（静态类型） |
| 54.2/55 | 可控的文件大小 — 采样的 659 个源文件中有 10 个超过 60KB |
所用输入
| primary_language | TypeScript |
| largest_source_bytes | 380,375 |
| source_files_sampled | 659 |
| oversized_source_files | 10 |
机器可读接口
60中等
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 20/20 | MCP 服务器 |
| 40/40 | 可运行示例 — cookbook |
所用输入
| example_dirs | cookbook |
| has_mcp_signal | 是 |
| api_schema_files | — |
关键数据
257GitHub 星标
1贡献者
342最近 12 个月提交数
0距最近推送天数
100发布版本数
1巴士系数（bus factor）
6开放议题
npm软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
- deps.dev does not index npm:@mcpfusion/a2a@4.4.1; advisories assessed against the repository dependency graph instead
更多细节
Star 与 Fork 历史 0 ★ / 23 ⇿
0Star
23Fork
97发布
每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。
主版本 1次版本 20修订 76
OpenSSF Scorecard 4.1 / 10
4.1综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 不适用 | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 6 | Contributors | project has 2 contributing companies or organizations -- score normalized to 6 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 10 | Security-Policy | security policy file detected |
| 不适用 | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 64 existing vulnerabilities detected |
直接依赖 21
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | @mcpfusion/core | ^4.4.1 | packages/a2a/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/api-key/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/aws/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/cloudflare/package.json |
| npm | @toon-format/toon | ^2.1.0 | packages/core/package.json |
| npm | zod-to-json-schema | ^3.25.1 | packages/core/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/inspector/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/jwt/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/n8n/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/oauth/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/openapi/package.json |
| npm | yaml | ^2.7.0 | packages/openapi/package.json |
| npm | @prisma/generator-helper | ^6.0.0 | packages/prisma-gen/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/prisma-gen/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/skills/package.json |
| npm | minisearch | ^7.1.1 | packages/skills/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/swarm/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/testing/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/vercel/package.json |
| npm | @mcpfusion/core | ^4.4.1 | packages/yaml/package.json |
| npm | yaml | ^2.7.0 | packages/yaml/package.json |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"mcp",
"mcp-framework",
"mcp-server",
"model-context-protocol",
"chatgpt",
"claude",
"mcp-tools"
],
"is_fork": false,
"size_kb": 10267,
"has_wiki": false,
"homepage": "https://vinkius.com/open-source",
"languages": {
"Shell": 366,
"JavaScript": 27033,
"TypeScript": 6265456
},
"pushed_at": "2026-07-27T00:12:45Z",
"created_at": "2026-02-12T07:39:46Z",
"owner_type": "Organization",
"updated_at": "2026-07-27T00:12:47Z",
"description": "MCP Fusion - The TypeScript framework for secure MCP servers.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "https://vinkius.com/open-source",
"name": "Vinkius",
"type": "Organization",
"login": "vinkius-labs",
"company": null,
"location": null,
"followers": 15,
"avatar_url": "https://avatars.githubusercontent.com/u/222905672?v=4",
"created_at": "2025-07-26T01:10:37Z",
"is_verified": null,
"public_repos": 65,
"account_age_days": 366
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v4.4.1",
"kind": "patch",
"published_at": "2026-07-27T00:13:18Z"
},
{
"tag": "v4.4.0",
"kind": "minor",
"published_at": "2026-07-24T05:58:48Z"
},
{
"tag": "v4.3.2",
"kind": "patch",
"published_at": "2026-07-19T03:57:09Z"
},
{
"tag": "v4.3.0",
"kind": "minor",
"published_at": "2026-06-18T17:57:55Z"
},
{
"tag": "v4.2.0",
"kind": "minor",
"published_at": "2026-05-27T06:23:08Z"
},
{
"tag": "v4.1.0",
"kind": "minor",
"published_at": "2026-05-26T20:28:55Z"
},
{
"tag": "v4.0.4",
"kind": "patch",
"published_at": "2026-05-26T17:10:30Z"
},
{
"tag": "v4.0.3",
"kind": "patch",
"published_at": "2026-05-26T16:51:41Z"
},
{
"tag": "v4.0.1",
"kind": "patch",
"published_at": "2026-05-20T07:57:25Z"
},
{
"tag": "v4.0.0",
"kind": "major",
"published_at": "2026-05-20T00:37:08Z"
},
{
"tag": "v3.19.6",
"kind": "patch",
"published_at": "2026-05-11T23:15:05Z"
},
{
"tag": "v3.19.5",
"kind": "patch",
"published_at": "2026-05-07T01:53:07Z"
},
{
"tag": "v3.19.4",
"kind": "patch",
"published_at": "2026-05-07T01:30:55Z"
},
{
"tag": "v3.19.3",
"kind": "patch",
"published_at": "2026-05-01T20:40:43Z"
},
{
"tag": "v3.19.2",
"kind": "patch",
"published_at": "2026-05-01T20:30:24Z"
},
{
"tag": "v3.19.1",
"kind": "patch",
"published_at": "2026-05-01T18:24:38Z"
},
{
"tag": "v3.19.0",
"kind": "minor",
"published_at": "2026-05-01T09:55:55Z"
},
{
"tag": "v3.18.0",
"kind": "minor",
"published_at": "2026-05-01T08:59:47Z"
},
{
"tag": "v3.17.3",
"kind": "patch",
"published_at": "2026-04-30T10:46:52Z"
},
{
"tag": "v3.17.2",
"kind": "patch",
"published_at": "2026-04-23T08:03:02Z"
},
{
"tag": "v3.17.1",
"kind": "patch",
"published_at": "2026-04-21T05:19:18Z"
},
{
"tag": "v3.17.0",
"kind": "minor",
"published_at": "2026-04-21T04:18:22Z"
},
{
"tag": "v3.16.0",
"kind": "minor",
"published_at": "2026-04-21T00:54:46Z"
},
{
"tag": "v3.15.3",
"kind": "patch",
"published_at": "2026-04-20T15:27:06Z"
},
{
"tag": "v3.15.2",
"kind": "patch",
"published_at": "2026-04-11T19:02:54Z"
},
{
"tag": "v3.15.1",
"kind": "patch",
"published_at": "2026-04-10T05:33:57Z"
},
{
"tag": "v3.15.0",
"kind": "minor",
"published_at": "2026-04-07T06:24:30Z"
},
{
"tag": "v3.14.8",
"kind": "patch",
"published_at": "2026-03-31T23:21:14Z"
},
{
"tag": "v3.14.5",
"kind": "patch",
"published_at": "2026-03-31T13:59:42Z"
},
{
"tag": "v3.14.4",
"kind": "patch",
"published_at": "2026-03-31T05:04:47Z"
},
{
"tag": "v3.14.0",
"kind": "minor",
"published_at": "2026-03-29T17:01:55Z"
},
{
"tag": "v3.13.1",
"kind": "patch",
"published_at": "2026-03-28T21:54:07Z"
},
{
"tag": "v3.13.0",
"kind": "minor",
"published_at": "2026-03-28T07:05:29Z"
},
{
"tag": "v3.12.8",
"kind": "patch",
"published_at": "2026-03-28T06:09:32Z"
},
{
"tag": "v3.12.7",
"kind": "patch",
"published_at": "2026-03-28T04:28:10Z"
},
{
"tag": "v3.12.6",
"kind": "patch",
"published_at": "2026-03-28T03:28:11Z"
},
{
"tag": "v3.12.5",
"kind": "patch",
"published_at": "2026-03-28T03:11:24Z"
},
{
"tag": "v3.12.4",
"kind": "patch",
"published_at": "2026-03-28T02:58:58Z"
},
{
"tag": "v3.12.3",
"kind": "patch",
"published_at": "2026-03-28T02:45:57Z"
},
{
"tag": "v3.12.2",
"kind": "patch",
"published_at": "2026-03-28T02:33:52Z"
},
{
"tag": "v3.12.1",
"kind": "patch",
"published_at": "2026-03-28T02:15:04Z"
},
{
"tag": "v3.12.0",
"kind": "minor",
"published_at": "2026-03-28T01:55:29Z"
},
{
"tag": "v3.11.1",
"kind": "patch",
"published_at": "2026-03-28T00:57:30Z"
},
{
"tag": "v3.11.0",
"kind": "minor",
"published_at": "2026-03-27T22:42:59Z"
},
{
"tag": "v3.10.0",
"kind": "minor",
"published_at": "2026-03-27T17:05:55Z"
},
{
"tag": "v3.9.0",
"kind": "minor",
"published_at": "2026-03-27T02:05:44Z"
},
{
"tag": "v3.8.3",
"kind": "patch",
"published_at": "2026-03-26T13:49:40Z"
},
{
"tag": "v3.8.2",
"kind": "patch",
"published_at": "2026-03-26T05:58:23Z"
},
{
"tag": "v3.8.1",
"kind": "patch",
"published_at": "2026-03-25T22:34:13Z"
},
{
"tag": "v3.8.0",
"kind": "minor",
"published_at": "2026-03-22T13:57:56Z"
},
{
"tag": "v3.7.13",
"kind": "patch",
"published_at": "2026-03-21T10:01:41Z"
},
{
"tag": "v3.7.12",
"kind": "patch",
"published_at": "2026-03-20T18:24:06Z"
},
{
"tag": "v3.7.11",
"kind": "patch",
"published_at": "2026-03-20T13:51:55Z"
},
{
"tag": "v3.7.10",
"kind": "patch",
"published_at": "2026-03-20T10:36:34Z"
},
{
"tag": "v3.7.9",
"kind": "patch",
"published_at": "2026-03-19T17:20:56Z"
},
{
"tag": "v3.7.8",
"kind": "patch",
"published_at": "2026-03-19T14:23:24Z"
},
{
"tag": "v3.7.7",
"kind": "patch",
"published_at": "2026-03-19T10:30:13Z"
},
{
"tag": "v3.7.6",
"kind": "patch",
"published_at": "2026-03-19T10:16:20Z"
},
{
"tag": "v3.7.5",
"kind": "patch",
"published_at": "2026-03-19T09:52:39Z"
},
{
"tag": "v3.7.4",
"kind": "patch",
"published_at": "2026-03-19T01:17:23Z"
},
{
"tag": "v3.7.3",
"kind": "patch",
"published_at": "2026-03-19T01:02:16Z"
},
{
"tag": "v3.7.2",
"kind": "patch",
"published_at": "2026-03-19T00:51:17Z"
},
{
"tag": "v3.7.1",
"kind": "patch",
"published_at": "2026-03-19T00:47:32Z"
},
{
"tag": "v3.7.0",
"kind": "minor",
"published_at": "2026-03-19T00:16:39Z"
},
{
"tag": "v3.6.10",
"kind": "patch",
"published_at": "2026-03-18T22:35:29Z"
},
{
"tag": "v3.6.9",
"kind": "patch",
"published_at": "2026-03-18T22:13:15Z"
},
{
"tag": "v3.6.8",
"kind": "patch",
"published_at": "2026-03-18T21:17:45Z"
},
{
"tag": "v3.6.7",
"kind": "patch",
"published_at": "2026-03-18T20:21:18Z"
},
{
"tag": "v3.6.6",
"kind": "patch",
"published_at": "2026-03-17T18:40:24Z"
},
{
"tag": "v3.6.5",
"kind": "patch",
"published_at": "2026-03-17T10:43:49Z"
},
{
"tag": "v3.6.4",
"kind": "patch",
"published_at": "2026-03-17T10:18:20Z"
},
{
"tag": "v3.6.3",
"kind": "patch",
"published_at": "2026-03-17T09:41:18Z"
},
{
"tag": "v3.6.2",
"kind": "patch",
"published_at": "2026-03-17T09:11:26Z"
},
{
"tag": "v3.6.0",
"kind": "minor",
"published_at": "2026-03-16T01:12:28Z"
},
{
"tag": "v3.5.0",
"kind": "minor",
"published_at": "2026-03-14T00:53:12Z"
},
{
"tag": "v3.3.4",
"kind": "patch",
"published_at": "2026-03-13T08:57:11Z"
},
{
"tag": "v3.3.3",
"kind": "patch",
"published_at": "2026-03-12T18:18:17Z"
},
{
"tag": "v3.3.2",
"kind": "patch",
"published_at": "2026-03-12T17:31:03Z"
},
{
"tag": "v3.3.1",
"kind": "patch",
"published_at": "2026-03-12T16:52:47Z"
},
{
"tag": "v3.3.0",
"kind": "minor",
"published_at": "2026-03-12T16:19:05Z"
},
{
"tag": "v3.2.3",
"kind": "patch",
"published_at": "2026-03-11T07:52:28Z"
},
{
"tag": "v3.2.2",
"kind": "patch",
"published_at": "2026-03-11T06:44:35Z"
},
{
"tag": "v3.2.1",
"kind": "patch",
"published_at": "2026-03-09T11:29:37Z"
},
{
"tag": "v3.2.0",
"kind": "minor",
"published_at": "2026-03-09T10:11:41Z"
},
{
"tag": "v3.1.31",
"kind": "patch",
"published_at": "2026-03-06T06:03:03Z"
},
{
"tag": "v3.1.30",
"kind": "patch",
"published_at": "2026-03-06T05:42:53Z"
},
{
"tag": "v3.1.29",
"kind": "patch",
"published_at": "2026-03-06T05:28:29Z"
},
{
"tag": "v3.1.28",
"kind": "patch",
"published_at": "2026-03-06T04:57:50Z"
},
{
"tag": "v3.1.27",
"kind": "patch",
"published_at": "2026-03-06T04:41:50Z"
},
{
"tag": "v3.1.26",
"kind": "patch",
"published_at": "2026-03-06T04:06:00Z"
},
{
"tag": "v3.1.25",
"kind": "patch",
"published_at": "2026-03-06T03:52:26Z"
},
{
"tag": "v3.1.24",
"kind": "patch",
"published_at": "2026-03-06T02:49:04Z"
},
{
"tag": "v3.1.23",
"kind": "patch",
"published_at": "2026-03-06T02:35:36Z"
},
{
"tag": "v3.1.22",
"kind": "patch",
"published_at": "2026-03-06T02:09:18Z"
},
{
"tag": "v3.1.21",
"kind": "patch",
"published_at": "2026-03-06T01:43:59Z"
},
{
"tag": "v3.1.20",
"kind": "patch",
"published_at": "2026-03-06T01:20:21Z"
},
{
"tag": "v3.1.19",
"kind": "patch",
"published_at": "2026-03-06T01:02:18Z"
},
{
"tag": "v3.1.18",
"kind": "patch",
"published_at": "2026-03-05T23:37:26Z"
},
{
"tag": "v3.1.17",
"kind": "patch",
"published_at": "2026-03-05T23:17:13Z"
},
{
"tag": "v3.1.16",
"kind": "patch",
"published_at": "2026-03-05T22:55:26Z"
}
],
"recent_commits": [
{
"oid": "5616a2de3b8bbb6181c202362fb8cab4f57c7ba3",
"body": "…n tools (4.4.1)\n\nThe auto-generated Workflow block (DescriptionGenerator) and the TOON action-metadata table (ToonDescriptionGenerator) are now emitted only for grouped tools or flat tools with 2+ actions. A flat single-action tool (e.g. defineTool with a single 'default' action) no longer carries a redundant per-action block. Destructive/readOnly/idempotent hints (annotations) and required params (inputSchema) are unaffected. Bumps monorepo to 4.4.1 and cross-deps to ^4.4.1.",
"is_bot": false,
"headline": "fix(core): omit Workflow section and TOON table for flat single-actio…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-07-27T00:10:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cd4c867161e4b39e9072008fae7599b716b267b",
"body": "… for MCP 2026-07-28 (4.4.0)",
"is_bot": false,
"headline": "feat(core): return-based elicitation (requireInput) + deprecate ask()…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-07-24T05:22:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c20c5e5fc486ac23e05ed94f441513263b7971e",
"body": null,
"is_bot": false,
"headline": "fix(core): inherit builder description for actions without their own",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-07-19T03:55:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2990dddf03976d599ea28f61a2adecc48847a899",
"body": null,
"is_bot": false,
"headline": "bump",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-06-25T00:45:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d61a5929463bbc790176393998ddbdbb0777fec7",
"body": null,
"is_bot": false,
"headline": "fix: remove auto-gitignore on .MCPFusionrc (v4.3.1)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-06-25T00:18:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb10fe95ca0486775f50c4ee67ad072be5c5a410",
"body": "…e compatibility (4.3.0)",
"is_bot": false,
"headline": "fix(core): architecture audit — type safety, security hardening & edg…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-06-18T17:55:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16dd88d0a45197fd15ed924da4a981fb9ef28499",
"body": "…e (4.2.0)",
"is_bot": false,
"headline": "feat(core): marketplace SEO metadata - structured product intelligenc…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-27T06:22:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c9e7a836c4932239d1d0ddbcc850681057fc380",
"body": "… context window optimization",
"is_bot": false,
"headline": "feat(core): FSM Progressive Disclosure — compactDescription() API for…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T20:25:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea64432129e7fcc9c654ed9e3304cb1f193c53ac",
"body": "…er scanner compatibility (v4.0.4)",
"is_bot": false,
"headline": "fix(edge): sanitizer replaces process.env in string literals for serv…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T17:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "081929b056b263764fcc82b5ef89e7d8c9bc90ac",
"body": null,
"is_bot": false,
"headline": "docs: fix duplicate SEO key and dead SKILL.md links in VitePress build",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T16:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88eb63dc5b49fe22f688a99b464093513a6efdac",
"body": "…yntaxError — v4.0.3\n\nThe process.env regex in sanitizeBundleForEdge() was corrupting string literals in minified bundles, causing SyntaxError: missing ) after argument list at V8 Isolate compile time. Replaced with a context-aware callback that detects string boundaries via double-quote counting, skipping replacement inside string literals.\n\nAffects: deploy.ts (CLI), sanitizer.ts (runtime)\n\nAll monorepo packages bumped to 4.0.3.",
"is_bot": false,
"headline": "fix(core): context-aware process.env sanitizer prevents isolated-vm S…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-26T16:47:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0325ae1fd093e908b47442b75f8511de7527d5a2",
"body": null,
"is_bot": false,
"headline": "release: v4.0.1 - stabilize core pipeline and bump workspace packages",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-20T07:55:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c45a918d6cb7dcc8b7ccf909dbb7ae7bda0560ec",
"body": "The Vurb-to-mcpfusion rename accidentally corrupted /tmp/ to /tm./ in the Unix socket path (same pattern as the Vercel scaffold bug). This caused EACCES on all 6 inspector e2e tests in CI.\n\nFixed: TelemetryBus.ts (source), 5 test files in packages/inspector/tests/",
"is_bot": false,
"headline": "fix: socket path /tm./ → /tmp/ in TelemetryBus and inspector tests",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-20T00:30:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e052a4a9e863533de9e90211a8c525b2d81a08c",
"body": "Full rebrand from Vurb to MCP Fusion. All source code, documentation, CLI, workflows, and npm packages now use the @mcpfusion scope. Security-first TypeScript framework for MCP servers powering 4,000+ connectors on Vinkius.\n\n- Version bump: 3.19.6 → 4.0.0 (root + 16 packages)\n\n- Internal cross-deps:\n[…]\ncore ^3.19.6 → ^4.0.0\n\n- Git remote: vinkius-labs/mcpfusion\n\n- CHANGELOG: 4.0.0 entry with governance stack and ecosystem table\n\n- Fix: Vercel scaffold path src/mc./mcpfusion.ts → src/mcp/mcpfusion.ts",
"is_bot": false,
"headline": "4.0.0 — Welcome to MCP Fusion",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-20T00:21:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "18a5dfc0aef88c0b0354bc8bb1cb7329dbcf104b",
"body": "… hygiene — v3.19.6\n\n- Session close O(n) → O(1) via WeakMap reverse-lookup\n- Hot-path URL constructor replaced with string-based pathname extraction\n- Reaper-integrated rate limiter pruning (zero extra Set allocation)\n- Single Date.now() capture in telemetry emit for timestamp coherence\n- Finalizat\n[…]\n leak detector for SandboxEngine\n- 24 auto-fixable ESLint problems resolved across 7 files\n- 22 new regression tests (331 files, 6,827 tests passing)\n- All @vurb/* cross-dependencies bumped to ^3.19.6",
"is_bot": false,
"headline": "perf(core): HTTP transport optimizations, telemetry coherence, ESLint…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T23:13:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1b349491f62e006f5d624073723ea0a22b736ad1",
"body": null,
"is_bot": false,
"headline": "fix: add User-Agent to bypass Cloudflare 1010 on Discord webhook",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T01:43:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e223490101c8804baf2c714995ab351cf2914c3",
"body": null,
"is_bot": false,
"headline": "fix: export STAT so Python can read it in Discord notify workflow",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:51:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52dca786e7f038615251cd89d71848e4a423cbd8",
"body": null,
"is_bot": false,
"headline": "fix: correct Discord notification env interpolation in heredoc",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:43:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "174a5f7d663daedf1a41b3822c2bb9b9d9650150",
"body": null,
"is_bot": false,
"headline": "ci: richer Discord commit notifications with file stats and avatar",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:40:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "85fcbb909c3e4abe6bf2be4fb3b3f6ac2641e6d2",
"body": null,
"is_bot": false,
"headline": "ci: add Discord notifications for commits and releases",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:37:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07f4eb83e5fc606907904deefc61b8903bf399df",
"body": "- Add Discord CTA above badges for immediate visibility\n- Add Discord to navigation links row\n- Remove standalone Community section (redundant)",
"is_bot": false,
"headline": "docs: consolidate Discord link into header and nav bar",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:26:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f67971c334118a3138b06714fb0240494a967b7",
"body": null,
"is_bot": false,
"headline": "docs: add prominent Discord CTA at top of README",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:23:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df070f935e06d4415617b8aead70ce26b19c741e",
"body": null,
"is_bot": false,
"headline": "docs: add Discord community section",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-11T00:21:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17b3a50ab74f2ea48464f059e6cd039ffc5d7e15",
"body": null,
"is_bot": false,
"headline": "chore(release): v3.19.5",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-07T01:51:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8a5d814264cdb38bedb2837af2bc2f0a6c136b2",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-07T01:41:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bb038e2e0bd6151cab2622bd6bb71da52770b5d",
"body": null,
"is_bot": false,
"headline": "chore(release): v3.19.4",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-07T01:27:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "db8ce9378579724b18ac36fdead19a2bc906953d",
"body": "…e table",
"is_bot": false,
"headline": "docs: add withJson and withOptionalJson to FluentToolBuilder referenc…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-02T19:58:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d2f91939582089b77ca97de5de87f543c0df3f7",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T22:39:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50f3779022160d5a6b89df8d425e63adcbae4e88",
"body": "…— v3.19.3",
"is_bot": false,
"headline": "fix(core): externalize isolated-vm from introspection esbuild builds …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T20:38:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02d0129b43c56d69d1fe6cc030d5a01b5b86e663",
"body": "…o tmpdir — v3.19.2",
"is_bot": false,
"headline": "fix(core): autoDiscover fails during introspection — bundle written t…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T20:28:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ef052ec550868068b0c5460eec2b7babf316a02",
"body": "- fix: SSE parser multi-line data concatenation (silent data loss)\n- fix: streaming path missing tool existence check before executeStream\n- fix: streaming path skipped message.kind validation\n- fix: non-text artifact content silently dropped as empty TextPart\n- refactor: extract shared message-util\n[…]\n.0+ types)\n- fix: pagination cursor NaN guard in TaskManager.listTasks\n- fix: UUID fallback entropy improved for collision resistance\n- test: 35 regression tests in bug-regressions.test.ts (245 total)",
"is_bot": false,
"headline": "fix(a2a): remediate 8 bugs from protocol audit — v3.19.1",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T18:21:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a17c25d7a54f2e0c046b294a7725464c9b269cc0",
"body": null,
"is_bot": false,
"headline": "feat(@vurb/a2a): A2A Protocol Bridge with SSE streaming — v3.19.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T09:53:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "27140b34b2940fc6ffd7a7cea4e8124f05646b8b",
"body": "Standard /.well-known/mcp/server-card.json endpoint for AI agent auto-discovery.\n\n- compileServerCard() pure-function compiler with duck-typed interfaces\n\n- startServer({ serverCard }) integration with zero per-request overhead\n\n- ServerCardConfig, ServerCardPayload, ServerCardToolEntry types\n\n- 55 tests (adversarial, scale, idempotency, JSON compliance)\n\n- llms.txt updated with feature docs and API reference\n\n- All @vurb/* packages bumped to 3.18.0",
"is_bot": false,
"headline": "feat: MCP Server Card auto-discovery (SEP-1649) — v3.18.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-05-01T08:57:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eeadea5f87972d33a21207c81a2268a8adbf3b3",
"body": "…es TypeError crash in V8 isolates\n\nedge-stub.ts did not export AsyncLocalStorage, but ask.ts executes\nnew AsyncLocalStorage() at module load time. The Proxy fallback\nreturned an arrow function (not constructable), causing:\n TypeError: Va.AsyncLocalStorage is not a constructor\n\nAdded AsyncLocalStorage class (synchronous stack-based store) to\nedge-stub.ts alongside EventEmitter, Readable, Writable, Server.\n\nBump: 3.17.2 -> 3.17.3 (all 16 packages)",
"is_bot": false,
"headline": "fix(edge-stub): add AsyncLocalStorage as Tier 1 structural stub — fix…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-30T10:45:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6eea45f8868cef71cc7f04ad1795ed743805c795",
"body": "…tion errors, response transform key collisions — v3.17.2",
"is_bot": false,
"headline": "feat(yaml): loadFromParsedSpec export, connection timeouts, interpola…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-23T08:01:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0269c7ba887fc3a4c465b58b0ce19a879c771d4",
"body": "…, add @vurb/core/cli export — v3.17.1",
"is_bot": false,
"headline": "fix(yaml): crypto.randomUUID → node:crypto import, export MCP helpers…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-21T05:18:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d76d1d213194924a0e85def4860baad514b43b0c",
"body": null,
"is_bot": false,
"headline": "feat: @vurb/yaml declarative MCP server engine + CLI plugin (3.17.0)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-21T04:18:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e97730cf6acffeb48768776b18445042accb10a4",
"body": "…#3.16.0)\n\n- ask() callable namespace with typed field factories (string, number, boolean, enum)\n\n- AskResponse with fail-fast .data getter and boolean guards\n\n- .interactive() on FluentToolBuilder and FluentRouter\n\n- Zero-overhead AsyncLocalStorage transport binding in ServerAttachment\n\n- Multi-step wizard support and URL redirect mode\n\n- 72 new tests, full documentation, llms.txt updated\n\n- All packages bumped to 3.16.0",
"is_bot": false,
"headline": "feat: MCP Elicitation — human-in-the-loop DSL for agentic workflows (…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-21T00:51:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a8855887647f534f23badfac1f242d765813ae75",
"body": null,
"is_bot": false,
"headline": "fix: correct package name @vurb/openapi-gen",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:46:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf66e8202da374c414afc36373d85403c67cf439",
"body": null,
"is_bot": false,
"headline": "fix: cron expression requires 5 fields (add day-of-week)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:37:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc7cf250711a8d3864a9934ed9d6d8170e0bf103",
"body": null,
"is_bot": false,
"headline": "release: v3.15.3",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:24:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8738df880cc939887150bab4b666bef32497dce",
"body": "…ellite packages\n\nFixes installation failures when installing adapter packages standalone (e.g. @vurb/inspector). Core is now auto-installed as a transitive dependency.",
"is_bot": false,
"headline": "fix: move @vurb/core from peerDependencies to dependencies in all sat…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:21:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cad2a643ce07b693385207327b470d4a44aa0c63",
"body": null,
"is_bot": false,
"headline": "ci: add ecosystem health smoke tests and scheduled CI",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-20T15:16:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "123a7c19601f8b1a9e2735e9d39802c48347e217",
"body": null,
"is_bot": false,
"headline": "chore: release v3.15.2",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-11T19:00:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f2182578da0b12336e68513ff1cb76c85a83045",
"body": "…ache invalidation [3.15.1]\n\n- PostProcessor.isToolResponse() migrated from shape-based to TOOL_RESPONSE_BRAND symbol detection\n- ResponseBuilder.build() now stamps TOOL_RESPONSE_BRAND (was missing, causing MVA layer corruption)\n- GroupedToolBuilder.invalidateCache() replaces duck-type private field\n[…]\nreateAuthTool ok()/fail() aligned with brand-based detection\n- Updated tests to use success()/error() helpers instead of manual ToolResponse construction\n- Bumped all 15 packages from 3.15.0 to 3.15.1",
"is_bot": false,
"headline": "fix(core): unified brand-based ToolResponse detection, encapsulated c…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-10T05:32:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9f864bb814bf02d6949bc8096ea5e67368324758",
"body": null,
"is_bot": false,
"headline": "feat(core): add withJson/withOptionalJson to FluentToolBuilder — v3.15.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-07T06:20:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25ad34f91c0ed67518066c15ecec4f75940aa19e",
"body": null,
"is_bot": false,
"headline": "optionalCredential",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-04-05T03:11:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "87b0d7cc20067fe4508c341c401dc1c1bc420d10",
"body": "zodToJsonSchema (v3.x) silently returns empty schemas for Zod 4 types,\ncausing all MCP tool parameters to disappear from inputSchema.\n\nAdded ZodCompat.ts layer that detects Zod version at runtime:\n- Zod 4: uses native z.toJSONSchema()\n- Zod 3: delegates to zod-to-json-schema (backward compatible)\n\nMigrated SchemaGenerator, ExpositionCompiler, and JsonSerializer.\nAdded 13 regression tests in ZodCompat.test.ts.",
"is_bot": false,
"headline": "fix(core): Zod 4 JSON Schema compatibility — v3.14.8",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-31T23:15:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "214b1b02f9a765500f5c78adabad5a89e1e5191e",
"body": "- __vinkius_edge_dispatch now returns JSON string instead of raw object\n\n- Eliminates DataCloneError when handlers return Promise/Function/Symbol\n\n- JSON.stringify inside isolate, JSON.parse on host side\n\n- Patch bump all packages 3.14.4 → 3.14.5",
"is_bot": false,
"headline": "fix: edge dispatch structured clone boundary protection (v3.14.5)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-31T13:53:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d8feabaa9f1446b4f837f5c003a6b5ede54f99a6",
"body": "…ubs (v3.14.4)",
"is_bot": false,
"headline": "fix(edge): V8 isolate boot failures — __proto__ sanitizer, os/path st…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-31T05:02:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31bbc1de9e94d39d4d01a8ad8fb9222f34d203b5",
"body": null,
"is_bot": false,
"headline": "chore(release): v3.14.1",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-29T23:06:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de655847fc30829ae0e43b121b23e67e0a6a156c",
"body": "- Add 'oauth2' to CredentialType union\n- Add OAuthConfig interface (provider, grant_type, authorize_url, token_url, scopes, client_id_field, client_secret_field, user_info_url, extra_params)\n- Add oauth? field to CredentialDef\n- Bump all packages to 3.14.0",
"is_bot": false,
"headline": "feat(core): OAuth 2.0 BYOA credential type — v3.14.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-29T16:54:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3a3c1f4443ff81488b7f1d53d306281b92aa853",
"body": "…13.1)",
"is_bot": false,
"headline": "fix(core): inject credential_schema into deploy manifest payload (v3.…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T21:51:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9bfd1078776c673ff1dde0f886df2a1778ebb5aa",
"body": null,
"is_bot": false,
"headline": "v3.13.0 - Marketplace Prompt Examples",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T07:03:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4e46668df897da27176571d646c4f44627b345f",
"body": "…_event fix",
"is_bot": false,
"headline": "v3.12.8 — contract-driven HTTP method classification, Calendly cancel…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T06:08:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "075c49f9a367fe7418ec4d7f34b58198a4e11268",
"body": null,
"is_bot": false,
"headline": "v3.12.7 — graceful changelog file reference fallback",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T04:26:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f4da067ddfecc2313bfeeca0682ca4b2145da538",
"body": null,
"is_bot": false,
"headline": "v3.12.6 - Resilient esbuild Discovery (4-Strategy Resolution)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T03:26:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d5a136f45b06c6323991baa1c3d90ee1a5f90618",
"body": null,
"is_bot": false,
"headline": "v3.12.5 - esbuild Auto-install ESM Resolution Cache Bypass",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T03:09:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f735e53226048a80b680eca852b880e09ef3a10",
"body": null,
"is_bot": false,
"headline": "v3.12.4 - esbuild Auto-install Uses Project Root",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T02:57:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b7d25e7b7455a964aa78107010297996c80a52b",
"body": null,
"is_bot": false,
"headline": "v3.12.3 - Introspection Pipeline Auto-installs esbuild",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T02:43:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca23870569f9f14de1bd0e1717f70e74523b6c9e",
"body": null,
"is_bot": false,
"headline": "v3.12.1 - Edge Deploy Bundle Sanitizer Fix",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T02:11:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abf1b40b65619a84c0484cc61358964cfecda604",
"body": "- vurb version: CLI version + installed @vurb/* packages table\n- vurb update: detect outdated packages + auto npm install\n- vurb doctor: 8-check diagnostic suite (node, config, token, entrypoint, esbuild, lockfile)\n- vurb validate: live server smoke test with tool analysis + lockfile drift detection\n- Shared modules: npm-registry.ts, introspect.ts\n- 119 new tests across 5 test files (639 total CLI tests passing)\n- Bump all packages 3.11.1 → 3.12.0",
"is_bot": false,
"headline": "feat(cli): add version, update, doctor, validate commands (v3.12.0)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T01:49:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc5076c5b1319b1d475b481dd58a4fef45e49583",
"body": null,
"is_bot": false,
"headline": "v3.11.1 — bundle size limit 500KB→1.5MB, MCP SDK dedup",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-28T00:55:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "21a11c78f07e523e0752efd6e586b6bc740631d5",
"body": "…lity",
"is_bot": false,
"headline": "feat: v3.11.0 — SaaS integration identity, deploy warnings, compatibi…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T22:40:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f15ed529694149406d70d500997a0e914cbb38dd",
"body": "…Passport, i18n, Publisher Type",
"is_bot": false,
"headline": "v3.10.0 — Marketplace Behavioral Transparency, Trust Score, Security …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T17:00:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba2e929abb0dc9cc143bfeb3af3047763a79e777",
"body": null,
"is_bot": false,
"headline": "docs: add credentials BYOC section to llms.txt and skills.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T01:52:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a254cc6040c731f15cfdfb5bb34ce5a69fa4b80d",
"body": null,
"is_bot": false,
"headline": "docs: add credentials BYOC documentation and v3.9.0 changelog",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T01:32:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b1c959d0c20878659f07b962b9ad485a84a850a",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 3.9.0",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-27T01:25:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a98ab9054a632eca99f689102dd54ef81c99044e",
"body": "…r fix",
"is_bot": false,
"headline": "chore: bump to v3.8.3 — introspection action expansion + deploy banne…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T13:47:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc1b7e933e9ff6a555fd4d44dec2d3bc48a1d82e",
"body": "…r fix",
"is_bot": false,
"headline": "chore: bump to v3.8.2 — introspection action expansion + deploy banne…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T13:37:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02afda1e3cd55f8fb34ea5219a311092a99a031d",
"body": null,
"is_bot": false,
"headline": "fix: restore res.json() try/catch in deploy — bug #81 regression",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T06:37:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ccbb8c3dfcd864b844d03eca686063219e2e614d",
"body": "- Rewrote README headers for all 14 packages with MCP-first keywords\n- Added MCP-compatible and Vurb.ts badges to all sub-packages\n- Bumped patch version: 3.8.1 -> 3.8.2",
"is_bot": false,
"headline": "chore: bump all packages to v3.8.2 — MCP-first SEO for npmjs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-26T05:54:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cdbf912af9fa27ccfac136f700383aa6d6125f1c",
"body": "…tiveHandoff connecting bypass",
"is_bot": false,
"headline": "fix: patch 3.8.1 — resources/list stale handler, signal shadow, hasAc…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-25T21:55:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b67ef2da072e8d9ff0c1fcca8e19a58cdda5dbeb",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-22T21:53:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53eec75d248f505647cdd20a4dfff50e7bdee043",
"body": "- New package @vurb/swarm: SwarmGateway B2BUA, UpstreamMcpClient,\n NamespaceRewriter, ReturnTripInjector (anti-IPI sanitiser)\n- FHP: zero-trust HMAC-SHA256 delegation tokens, Claim-Check pattern,\n W3C traceparent distributed tracing, session lifecycle management\n- core: EXPIRED_DELEGATION_TOKEN on\n[…]\n: test script added, tests now run in CI\n- All 14 packages bumped to 3.8.0\n- README.md + packages/core/README.md: Swarm/FHP sections added\n- CHANGELOG.md: [3.8.0] entry with Added/Fixed/Security/Tests",
"is_bot": false,
"headline": "release: v3.8.0 — Federated Handoff Protocol (@vurb/swarm)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-22T13:48:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b17be65ea982c83d677a269f689877303af95f71",
"body": "- StateMachineGate.transition() race with XState subscriber: added\n await Promise.resolve() after actor.send() so the subscribe()\n callback updates _currentState before it is read (Bug #1)\n\n- SandboxEngine abort handler context undefined race: introduced\n ctxRef mutable wrapper so onAbort always \n[…]\nh registry.size (Map.size, O(1)); added readonly size\n to RegistryDelegate interface to remove the unsafe cast (Bug #4)\n\nTests: 7 FSM transition-race, 5 SandboxAbortContextRef, 13 BuildPipeline brand",
"is_bot": false,
"headline": "fix: resolve 4 core bugs and add 25 regression tests (v3.7.13)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-21T09:39:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7f33efe74511038863c10b6431eeed105dc3d6b2",
"body": "…#129) - v3.7.12",
"is_bot": false,
"headline": "fix: autoDiscover name-based dedup blocks router action merging (Bug …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-20T18:22:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a286513f13ec7004c1d7e6a86339c4786c08877",
"body": "New implementation modules, 68 edge-case tests (ConcurrencyGuard, MutationSerializer, EgressGuard, PolicyEngine, ProxyHandler, defineModel), CHANGELOG update, version bump 3.7.10->3.7.11 across all packages.",
"is_bot": false,
"headline": "chore(release): v3.7.11",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-20T13:44:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f1e8544011ccc382358cc2e24151edb4adb84c20",
"body": "refactor(defineModel): extract fieldTypeToZod + labelFor helpers\n- Eliminated ~50 lines of duplicated switch/case between compileField\n and compileFieldForInput; both now delegate to a shared base compiler\n\nrefactor(FluentToolBuilder): introduce withDesc() schema helper\n- Replaced repeated ternary \n[…]\nype-safe buildTruncationSuffix() function\n- Replaced implicit {limit} placeholder string with a typed function\n that takes formattedLimit as a required argument\n\nchore: bump all 13 packages to 3.7.10",
"is_bot": false,
"headline": "chore(release): v3.7.10",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-20T10:36:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c558b66089ac857815ebe8577302c227201c4e51",
"body": "Update README and many docs to strengthen AI-facing prompt text: replace existing \"Open in Claude/ChatGPT\" links and copy-prompt content with explicit, mandatory instructions to use the Vurb.ts framework and follow the MVA patterns (createPresenter, f.query/f.mutation/f.action, .redactPII(), .return\n[…]\nndlers) and updates the example prompt block to reflect the enforcement language. Multiple documentation pages and the core README were updated to ensure consistent prompt enforcement across the site.",
"is_bot": false,
"headline": "Add mandatory Vurb.ts enforcement to docs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T23:26:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9bfd9399bc9d5564b5105f593e179d373f3e49aa",
"body": "Normalize the 'Open in Claude/ChatGPT' links and copy-button prompt text across the README and docs by removing a trailing period from the llms.txt URL and standardizing the query string encoding. This prevents the '.' from being included in the fetched architecture URL and ensures prompts are passed correctly to external AI tools. Files updated include README.md, many docs/*.md, and packages/core/README.md.",
"is_bot": false,
"headline": "Fix AI 'Open' links and prompt query strings",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T18:14:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2eb040c412e9b93de097ef61c295837bd3a393e",
"body": "Introduce Prompt Deep Linking and llms.txt integration across the site. README: update tagline, add llms.txt badge/link, safety callouts, a Raw SDK vs Vurb.ts comparison, architect checklists, many example \"Tell your AI agent\" snippets, and a new \"How Prompt Deep Linking Works\" section explaining Op\n[…]\n) so agents receive the llms.txt super-prompt before visible instructions. Overall: enhance developer UX for AI-driven code generation and enforce correct MVA patterns via machine-readable spec links.",
"is_bot": false,
"headline": "Add prompt deep-linking action bars and docs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T17:30:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5a790c5f02201d71194828c33d300f3e9b84b195",
"body": "…n token set (v3.7.9)",
"is_bot": false,
"headline": "fix(cli): preserve remote URL on --server-id, auto-resolve serverId o…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T17:03:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "497d26d6e06bda9c28b8181b8e45fae442b2a6cc",
"body": "- #1 Rate limiting per session (token bucket, 600 req/min default)\n- #2 Session ID format validation (UUID v4)\n- #3 JSON.parse safety with HTTP 400\n- #4 Max concurrent sessions (1000 default, HTTP 503)\n- #5 HMAC secret strength validation (warn dev, throw prod)\n- #6 CORS configuration with preflight support\n- #7 Auth failure telemetry (onAuthFailure callback)\n- #8 Prototype pollution guard on edge setState\n- #9 SandboxGuard security model documentation\n\n50 new tests, 0 regressions.",
"is_bot": false,
"headline": "security: hardening audit items #1-#9 + bump v3.7.8",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T13:50:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16071719933e2f4ff8e4027ac9f9f6a32471067d",
"body": "…orkers.\n\n\"One command. Your MCP server is live on Vinkius Edge, Vercel Functions, or Cloudflare Workers.\"",
"is_bot": false,
"headline": "MCP server is live on Vinkius Edge, Vercel Functions, or Cloudflare W…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:58:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efaa8619e401d5ab7e6c4dd6531c806d561d0a02",
"body": "Supported targets (Vinkius Edge, Vercel Functions, Cloudflare Workers)",
"is_bot": false,
"headline": "Highlight deployment targets in READMEs",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:34:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a7fc331b6bd187fb60fd4c1cfc1fb0eac24e52f5",
"body": "Update README.md and packages/core/README.md to mention opening the scaffold in Cursor, Claude Code, or GitHub Copilot and show a sample prompt. Reword the agent sentence from \"Your AI agent...\" to \"The agent...\" for clarity, and add a new \"Scaffold Options\" section with the `vurb create my-server` example in both files.",
"is_bot": false,
"headline": "Mention Copilot and add scaffold options",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:31:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "217e678708a26423f35704f28b7e0066112d8af3",
"body": null,
"is_bot": false,
"headline": "fix: TS2352 build error in action expansion (v3.7.7)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:27:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb55a86d33576a9bdd1738a955b16cf2a7611b76",
"body": "…f lockfile (v3.7.7)",
"is_bot": false,
"headline": "fix: TS2352 build error in action expansion — use contracts instead o…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:23:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4a4cd21c7bdc280de2bb3ad4f4642d5d9bea517",
"body": "…ut (v3.7.6)",
"is_bot": false,
"headline": "fix: expand grouped tool actions in introspection + clean deploy outp…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T10:14:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9286bd9018f974ff78112a3968a43b50dd551127",
"body": null,
"is_bot": false,
"headline": "fix: node-compatible introspection build (v3.7.5)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T09:10:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4415d1863055d5f238679dfd0324ed303aeed7ed",
"body": null,
"is_bot": false,
"headline": "fix: IIFE introspection via vm.runInThisContext (v3.7.4)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T01:14:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffc3b425eec7cfd0cc4e57fb7822a00ca7f6dfeb",
"body": "…introspection (v3.7.3)",
"is_bot": false,
"headline": "fix: align test assertions with namespace merge, vm.runInThisContext …",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T01:14:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd6057cb3735ea2a52e6c43d5dce2f3d6e2a54a5",
"body": null,
"is_bot": false,
"headline": "fix: align test assertions with namespace merge (v3.7.3)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T01:01:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ef03fb1c0c4849ec42d6928e37434356a565fbc",
"body": null,
"is_bot": false,
"headline": "fix: namespace merge + bundle introspection (v3.7.2)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T00:50:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25b95d325f95d9e6e257b4b073c81abf54293d3b",
"body": null,
"is_bot": false,
"headline": "fix: ToolRegistry namespace merge, bundle-based introspection (v3.7.1)",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T00:43:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b51e2e16a823fe245d05a0bda9ac6ca21c5b1d67",
"body": "… (v3.7.0)",
"is_bot": false,
"headline": "feat: deploy manifest — real introspection, tool sync, premium output…",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-19T00:14:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "811c3a43a642fb1d0304624999d9631eb0f2c218",
"body": null,
"is_bot": false,
"headline": "fix(deploy): bundle sanitizer for edge static analysis — v3.6.10",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-18T22:27:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e82edb91346987a5cb944987b4cc164c61c88023",
"body": "Re-release: v3.6.8 was published by CI before force-push landed.\nThis is the correct code with the esbuild plugin fix.",
"is_bot": false,
"headline": "fix(deploy): esbuild plugin with CJS Proxy — v3.6.9",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-18T21:35:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc1ab65f79fc8926578ad994dcccbce4cb56043d",
"body": "The deploy command edge-stub resolution had 3 cascading bugs:\n1. require.resolve('vurb') — package is @vurb/core\n2. require.resolve('@vurb/core') — exports map is ESM-only, CJS fails\n3. esbuild alias — prefix matching turns fs/promises into edge-stub.js/promises\n\nFix: esbuild plugin with onResolve (\n[…]\ns from edge-stub.js work normally,\n unknown names (readFile, createServer, connect, etc.) return CRASH fn\n- 19 regression tests including 2 real esbuild integration tests\n- Bump all packages to 3.6.8",
"is_bot": false,
"headline": "fix(deploy): esbuild plugin with CJS Proxy for edge-stub resolution",
"author_name": "Renato Marinho",
"author_login": "renatomarinho",
"committed_at": "2026-03-18T21:29:55Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 100,
"commits_last_year": 342,
"latest_release_at": "2026-07-27T00:13:18Z",
"latest_release_tag": "v4.4.1",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 19,
"days_since_latest_release": 0,
"mean_days_between_releases": 7.6
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 100,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"ecosystem": {
"packages": [
{
"name": "@mcpfusion/a2a",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"a2a",
"agent-to-agent",
"mcpfusion",
"agent-card",
"json-rpc",
"protocol-bridge",
"multi-agent",
"ai",
"llm",
"task-delegation"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/a2a",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 405,
"first_published_at": "2026-05-20T00:55:45.528000Z",
"latest_published_at": "2026-07-27T00:17:11.892000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/aws",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"aws",
"lambda",
"step-functions",
"mcpfusion",
"serverless",
"ai",
"llm",
"connector"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/aws",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1428,
"first_published_at": "2026-05-20T00:55:03.629000Z",
"latest_published_at": "2026-07-27T00:16:30.209000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/jwt",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"jwt",
"json-web-token",
"authentication",
"middleware",
"ai",
"llm"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/jwt",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1331,
"first_published_at": "2026-05-20T00:55:11.020000Z",
"latest_published_at": "2026-07-27T00:16:39.824000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/n8n",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"n8n",
"mcpfusion",
"workflow",
"automation",
"ai",
"llm",
"connector"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/n8n",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1463,
"first_published_at": "2026-05-20T00:55:00.236000Z",
"latest_published_at": "2026-07-27T00:16:25.607000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/core",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"model-context-protocol",
"ai",
"llm",
"tools",
"typescript",
"framework",
"middleware",
"zod",
"mva",
"model-view-agent",
"presenter",
"guardrails",
"agentic",
"structured-data",
"action-consolidation",
"dlp",
"compliance",
"pii-redaction",
"fsm",
"state-machine",
"anti-hallucination"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/core",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 12,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4344,
"first_published_at": "2026-05-20T00:54:36.916000Z",
"latest_published_at": "2026-07-27T00:16:07.308000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/yaml",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"yaml",
"declarative",
"mcp-server",
"docker-compose",
"ai",
"llm",
"model-context-protocol",
"tools",
"resources",
"prompts"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/yaml",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 9,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 570,
"first_published_at": "2026-05-20T00:55:50.358000Z",
"latest_published_at": "2026-07-27T00:17:17.427000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/oauth",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"oauth",
"device-flow",
"rfc-8628",
"authentication",
"token-manager",
"ai",
"llm"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/oauth",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1545,
"first_published_at": "2026-05-20T00:55:07.022000Z",
"latest_published_at": "2026-07-27T00:16:34.879000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
},
{
"name": "@mcpfusion/swarm",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"mcp",
"mcpfusion",
"swarm",
"multi-agent",
"handoff",
"gateway",
"b2bua",
"federation",
"ai",
"llm",
"delegation",
"zero-trust"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@mcpfusion/swarm",
"is_deprecated": false,
"latest_version": "4.4.1",
"repository_url": "https://github.com/vinkius-labs/mcpfusion",
"versions_count": 8,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1321,
"first_published_at": "2026-05-20T00:55:42.197000Z",
"latest_published_at": "2026-07-27T00:17:07.540000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 23,
"stars": 257,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2026-02-21",
"count": 2
},
{
"date": "2026-02-22",
"count": 8
},
{
"date": "2026-02-23",
"count": 3
},
{
"date": "2026-03-10",
"count": 1
},
{
"date": "2026-03-20",
"count": 1
},
{
"date": "2026-03-21",
"count": 1
},
{
"date": "2026-03-26",
"count": 1
},
{
"date": "2026-03-27",
"count": 1
},
{
"date": "2026-03-28",
"count": 1
},
{
"date": "2026-04-04",
"count": 1
},
{
"date": "2026-04-28",
"count": 1
},
{
"date": "2026-06-17",
"count": 1
},
{
"date": "2026-06-20",
"count": 1
}
],
"complete": true,
"collected": 23,
"total_forks": 23
},
"star_history": null,
"open_issues_and_prs": 8
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"cookbook"
],
"has_llms_txt": true,
"has_dockerfile": false,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"packages/a2a/tsconfig.json",
"packages/api-key/tsconfig.json",
"packages/aws/tsconfig.json",
"packages/cloudflare/tsconfig.json",
"packages/core/tsconfig.json",
"packages/inspector/tsconfig.json",
"packages/jwt/tsconfig.json",
"packages/n8n/tsconfig.json",
"packages/oauth/tsconfig.json",
"packages/openapi/tsconfig.json",
"packages/prisma-gen/tsconfig.json",
"packages/skills/tsconfig.json",
"packages/swarm/tsconfig.json",
"packages/testing/tsconfig.json",
"packages/vercel/tsconfig.json",
"packages/yaml/tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 380375,
"source_files_sampled": 659,
"oversized_source_files": 10,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@mcpfusion/core",
"manifest": "packages/a2a/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/api-key/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/aws/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/cloudflare/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@toon-format/toon",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^2.1.0"
},
{
"name": "zod-to-json-schema",
"manifest": "packages/core/package.json",
"ecosystem": "npm",
"version_constraint": "^3.25.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/inspector/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/jwt/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/n8n/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/oauth/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/openapi/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "yaml",
"manifest": "packages/openapi/package.json",
"ecosystem": "npm",
"version_constraint": "^2.7.0"
},
{
"name": "@prisma/generator-helper",
"manifest": "packages/prisma-gen/package.json",
"ecosystem": "npm",
"version_constraint": "^6.0.0"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/prisma-gen/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/skills/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "minisearch",
"manifest": "packages/skills/package.json",
"ecosystem": "npm",
"version_constraint": "^7.1.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/swarm/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/testing/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/vercel/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "@mcpfusion/core",
"manifest": "packages/yaml/package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.1"
},
{
"name": "yaml",
"manifest": "packages/yaml/package.json",
"ecosystem": "npm",
"version_constraint": "^2.7.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 2,
"merged_prs": 0,
"open_issues": 6,
"closed_ratio": 0.143,
"closed_issues": 1,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "renatomarinho",
"commits": 343,
"avatar_url": "https://avatars.githubusercontent.com/u/26571?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"discord-notify.yml",
"ecosystem-health.yml",
"gh-pages.yml",
"publish-npm.yml"
],
"has_docs_dir": true,
"linter_configs": [
"eslint.config.js"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 6,
"reason": "project has 2 contributing companies or organizations -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "64 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "5616a2de3b8bbb6181c202362fb8cab4f57c7ba3",
"ran_at": "2026-07-27T15:55:10Z",
"aggregate_score": 4.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-27T11:47:26Z",
"oldest_open_prs": [
{
"number": 10,
"created_at": "2026-04-28T12:31:46Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 12,
"created_at": "2026-06-17T18:23:20Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 1,
"created_at": "2026-02-12T18:16:47Z",
"last_comment_at": "2026-02-13T00:33:44Z",
"last_comment_author": "renatomarinho"
},
{
"number": 3,
"created_at": "2026-02-17T21:38:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 4,
"created_at": "2026-02-17T21:40:22Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 5,
"created_at": "2026-02-17T21:41:29Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 6,
"created_at": "2026-02-17T21:42:53Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 11,
"created_at": "2026-05-04T05:16:40Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/vinkius-labs/mcpfusion",
"host": "github.com",
"name": "mcpfusion",
"owner": "vinkius-labs"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"security": 41,
"vitality": 86,
"community": 70,
"governance": 41,
"engineering": 84
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 86,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"commits_last_year": 342,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 19
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "19/52 weeks with commits",
"points": 13.2,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 19
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "342 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 342
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 100,
"latest_release_tag": "v4.4.1",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 7.6
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "100 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 100
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~7.6 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 7.6
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "good",
"name": "Community & Adoption",
"value": 70,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 52,
"inputs": {
"forks": 23,
"stars": 257,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "257 stars",
"points": 39.1,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 257
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "23 forks",
"points": 11.2,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 23
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 92,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 6.3,
"status": "met",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 68,
"inputs": {
"packages": [
"@mcpfusion/a2a",
"@mcpfusion/aws",
"@mcpfusion/jwt",
"@mcpfusion/n8n",
"@mcpfusion/core",
"@mcpfusion/yaml",
"@mcpfusion/oauth",
"@mcpfusion/swarm"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 12407
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "12,407 downloads/month across npm",
"points": 54.6,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 12407,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 41,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 16,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 6,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 11,
"inputs": {
"merged_prs": 0,
"open_issues": 6,
"closed_issues": 1,
"issue_closed_ratio": 0.143,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "14% of issues closed",
"points": 6.7,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 14
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"followers": 15,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "vinkius-labs",
"public_repos": 65,
"account_age_days": 366
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "15 followers of vinkius-labs",
"points": 8.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 15,
"login": "vinkius-labs"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "65 public repos, account ~1 yr old",
"points": 15,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 65
}
},
{
"code": "account_age_years",
"params": {
"years": 1
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@mcpfusion/a2a",
"@mcpfusion/aws",
"@mcpfusion/jwt",
"@mcpfusion/n8n",
"@mcpfusion/core",
"@mcpfusion/yaml",
"@mcpfusion/oauth",
"@mcpfusion/swarm"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "8 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 8,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "12 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 12
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 84,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 80,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "5 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 5
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "eslint.config.js",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [
"mcp",
"mcp-framework",
"mcp-server",
"model-context-protocol",
"chatgpt",
"claude",
"mcp-tools"
],
"has_wiki": false,
"homepage": "https://vinkius.com/open-source",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://vinkius.com/open-source",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "7 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 7
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 41,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 41,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 4.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 2 contributing companies or organizations -- score normalized to 6",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "64 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "moderate",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"has_llms_txt": true,
"legible_history_share": 0.84,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": "llms.txt present",
"points": 15,
"status": "met",
"details": [
{
"code": "llms_txt_present",
"params": {}
}
],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "84 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 84,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"packages/a2a/tsconfig.json",
"packages/api-key/tsconfig.json",
"packages/aws/tsconfig.json",
"packages/cloudflare/tsconfig.json",
"packages/core/tsconfig.json",
"packages/inspector/tsconfig.json",
"packages/jwt/tsconfig.json",
"packages/n8n/tsconfig.json",
"packages/oauth/tsconfig.json",
"packages/openapi/tsconfig.json",
"packages/prisma-gen/tsconfig.json",
"packages/skills/tsconfig.json",
"packages/swarm/tsconfig.json",
"packages/testing/tsconfig.json",
"packages/vercel/tsconfig.json",
"packages/yaml/tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "eslint.config.js",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "packages/a2a/tsconfig.json, packages/api-key/tsconfig.json, packages/aws/tsconfig.json, packages/cloudflare/tsconfig.json, packages/core/tsconfig.json, packages/inspector/tsconfig.json, packages/jwt/tsconfig.json, packages/n8n/tsconfig.json, packages/oauth/tsconfig.json, packages/openapi/tsconfig.json, packages/prisma-gen/tsconfig.json, packages/skills/tsconfig.json, packages/swarm/tsconfig.json, packages/testing/tsconfig.json, packages/vercel/tsconfig.json, packages/yaml/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 380375,
"source_files_sampled": 659,
"oversized_source_files": 10
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "10/659 source files over 60KB",
"points": 54.2,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 659,
"oversized": 10
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "moderate",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"example_dirs": [
"cookbook"
],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "cookbook",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "cookbook"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@mcpfusion/a2a@4.4.1; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-27T15:55:17.510555Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/v/vinkius-labs/mcpfusion.svg",
"full_name": "vinkius-labs/mcpfusion",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}