@agentscore-xyz/mcp-server 2.1.0 → 2.2.1

package/README.md

@@ -1,12 +1,18 @@
 # @agentscore-xyz/mcp-server
 
-MCP security trust layer. Scan packages, get trust verdicts, inspect repo-wide MCP dependencies, generate Policy Gate setup, check incident exposure, and query the abuse database. Seven tools for MCP security decisions. No API key, zero config.
+**Ask your agent if an npm MCP package is safe to install.** A drop-in MCP server that exposes AgentScore's live security data to Claude, Cursor, ChatGPT, and any MCP-compatible client. No API key, zero config, eight tools.
 
-[![KYA Scan](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/scan?npm=@agentscore-xyz/mcp-server)
+[![AgentScore](https://agentscores.xyz/api/scan/badge?npm=@agentscore-xyz/mcp-server)](https://agentscores.xyz/report/@agentscore-xyz/mcp-server)
 
-> **Scan any MCP package for security issues:** [agentscores.xyz](https://agentscores.xyz)
+> Browse the live data: [agentscores.xyz](https://agentscores.xyz) — 1,600+ monitored MCP packages, continuously updated, public correction loop at [/scanner/precision](https://agentscores.xyz/scanner/precision).
 
-## Quick Start
+## Why it exists
+
+MCP clients install packages from npm without a security gate. Most users have no way to ask, mid-conversation, "is this package safe?" before they wire it into their agent. This server makes that question askable directly inside the same chat where you discover the package.
+
+It is the **machine-readable trust layer** behind agentscores.xyz, packaged as an MCP server so any agent can consume it.
+
+## Quick start
 
 ### Claude Desktop
 
@@ -23,59 +29,64 @@ Add to your `claude_desktop_config.json`:
 }
 ```
 
-### Cursor / Any MCP Client
+### Cursor / VS Code / any MCP client
 
 ```bash
 npx @agentscore-xyz/mcp-server
 ```
 
-## What This Does
+## What you can ask
 
-Your AI can now make security decisions about MCP packages:
+The primary use case: trust questions about packages, answered in conversation.
 
 > **You:** "Is exa-mcp-server safe to install?"
 >
 > **Claude:** *calls get_verdict* "Verdict: ALLOW. Score 90/100, LOW risk. No provenance attestations (published by personal account). 9 tools exposed including web_search_exa and crawling_exa."
 
-> **You:** "The axios package was compromised. Which MCP servers are affected?"
->
-> **Claude:** *calls check_exposure* "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
-
-> **You:** "Scan @azure-devops/mcp for security issues"
+> **You:** "Scan @azure-devops/mcp for security issues."
 >
 > **Claude:** *calls scan_package* "Score 75/100, MODERATE risk. Found: preinstall script modifying npm registry config. No provenance attestations."
 
-> **You:** "Check this repo for MCP dependencies"
+> **You:** "The axios package was compromised. Which MCP servers depend on it?"
 >
-> **Claude:** *calls check_my_repo* "MCP dependencies found: 5. Two are warnings. Run generate_policy_gate_setup to turn these checks into a CI gate."
+> **Claude:** *calls check_exposure* "Multiple monitored MCP servers depend on axios, including exa-mcp-server, tavily-mcp, and figma-mcp."
 
-> **You:** "Set up AgentScore Policy Gate for this repo"
+> **You:** "Is fa-mcp-sdk monitored? What is its history?"
 >
-> **Claude:** *calls generate_policy_gate_setup* "Here is the exact GitHub Actions workflow, the AGENTSCORE_KEY secret name, and the pilot link for your repo."
+> **Claude:** *calls monitor_status* "Yes, under continuous monitoring. Latest scan: HIGH risk. Republished 15+ times since the April 25 disclosure with no maintainer engagement on the open issues."
+
+The agent picks the right tool. You ask the question the way you would ask a colleague.
+
+## CI enforcement (optional, section 2)
 
-## Available Tools
+If you want the same trust data as a merge-time policy gate rather than an in-conversation question, the same MCP server can scaffold a GitHub Actions workflow for you.
 
-| Tool | What it does |
-|------|-------------|
-| `scan_package` | Full security scan: install scripts, prompt injection, source code patterns, provenance posture, MCP tool extraction |
-| `get_verdict` | Trust decision: allow, warn, or block based on scan findings. Also reports monitoring status and publisher posture. |
-| `check_my_repo` | Inspect the current repo for MCP dependencies and summarise verdicts for every package detected locally. |
-| `generate_policy_gate_setup` | Generate the exact GitHub Actions workflow and pilot handoff link needed to enforce Policy Gate in CI. |
-| `check_exposure` | Incident response: which monitored MCP servers depend on a given package? |
-| `check_abuse` | Query the KYA abuse database for reported packages or agents |
-| `monitor_status` | Check if a package is under continuous monitoring and get scan history |
+> **You:** "Check this repo for MCP dependencies and set up a policy gate."
+>
+> **Claude:** *calls check_my_repo, then install_policy_gate* "Found 5 MCP packages in your repo. Workflow written to `.github/workflows/agentscore-policy-gate.yml`. Commit, push, and the first PR will provision the gate via GitHub OIDC."
+
+Three tools support that flow:
 
-## From Ad-Hoc Scans To CI Enforcement
+- `check_my_repo` — inspect the current repo's MCP dependencies.
+- `generate_policy_gate_setup` — preview the OIDC-based GitHub Actions workflow.
+- `install_policy_gate` — write `.github/workflows/agentscore-policy-gate.yml` directly into the repo.
 
-The MCP server now bridges one-off package checks into the sticky product:
+The gate is the same data, just at a different point in the lifecycle. The primary surface is still the question.
 
-1. Run `check_my_repo` to see every MCP package used in a repo.
-2. Run `generate_policy_gate_setup` to get the exact GitHub Actions workflow.
-3. Start the free pilot to receive a repo-scoped `AGENTSCORE_KEY`.
+## Available tools
 
-That turns "is this package safe?" into "this repo now enforces MCP dependency policy on every PR."
+| Tool | Question it answers |
+|------|---------------------|
+| `scan_package` | What does the live scan of this package look like, including install scripts, source patterns, capability surface, and findings? |
+| `get_verdict` | Should I allow, warn, or block this package? |
+| `check_exposure` | Which monitored MCP servers depend on a given package? (Incident response.) |
+| `monitor_status` | Is this package under continuous monitoring? What is its scan history? |
+| `check_abuse` | Has this package been reported in the KYA abuse database? |
+| `check_my_repo` | Inspect the current repo for MCP dependencies and summarise verdicts. |
+| `generate_policy_gate_setup` | Preview the OIDC-based GitHub Actions workflow for CI enforcement. |
+| `install_policy_gate` | Write the workflow file directly into `.github/workflows/`. |
 
-## Risk Levels
+## Risk levels
 
 | Score | Risk | Meaning |
 |-------|------|---------|
@@ -85,25 +96,31 @@ That turns "is this package safe?" into "this repo now enforces MCP dependency p
 | 30-49 | HIGH | Serious issues, not recommended |
 | 0-29 | CRITICAL | Do not use |
 
-## What the Scanner Checks
+## What the scanner checks
 
 - Install scripts (postinstall/preinstall hooks with network calls or code execution)
 - Prompt injection patterns in package metadata
 - Suspicious URLs (sketchy TLDs, ngrok, raw IPs)
-- Source code patterns (command injection, unsafe eval, hardcoded secrets)
+- Source code patterns (command injection, unsafe eval, hardcoded secrets) with context-aware mitigators
 - Publisher provenance (trusted publishing, attestations)
 - Dependency count and metadata completeness
 - MCP tool definitions extracted from published source
 
-## Monitoring
+The scanner changelog and false-positive mitigator lineage are public at [agentscores.xyz/scanner/precision](https://agentscores.xyz/scanner/precision). Findings get corrected when maintainers raise valid false-positive challenges. The correction history is part of the record, not buried.
+
+## Continuous monitoring
 
-AgentScore continuously monitors hundreds of MCP packages. The `check_exposure` and `monitor_status` tools use this live dataset. When a package like axios gets compromised, you can instantly find which MCP servers are affected.
+AgentScore monitors 1,600+ MCP packages on npm. `check_exposure` and `monitor_status` query this live dataset. When a package like axios gets compromised, you can ask mid-conversation which of your MCP servers are affected.
 
 ## Links
 
-- **Website:** [agentscores.xyz](https://agentscores.xyz)
-- **API Docs:** [agentscores.xyz/docs](https://agentscores.xyz/docs)
+- **Live data:** [agentscores.xyz](https://agentscores.xyz)
+- **Per-package reports:** [agentscores.xyz/report/<package>](https://agentscores.xyz/report)
+- **Advisory feed:** [agentscores.xyz/security/advisories](https://agentscores.xyz/security/advisories) (also RSS)
+- **API docs:** [agentscores.xyz/docs](https://agentscores.xyz/docs)
 - **Methodology:** [agentscores.xyz/methodology](https://agentscores.xyz/methodology)
+- **Scanner precision changelog:** [agentscores.xyz/scanner/precision](https://agentscores.xyz/scanner/precision)
+- **Embed a badge:** [agentscores.xyz/badge](https://agentscores.xyz/badge)
 
 ## Licence
 

package/dist/api.js

@@ -1,5 +1,6 @@
 const BASE_URL = "https://www.agentscores.xyz";
 const TIMEOUT_MS = 8000;
+const CLIENT_ID = "@agentscore-xyz/mcp-server/2.2.1";
 export class ApiError extends Error {
     status;
     code;
@@ -22,7 +23,10 @@ export async function fetchApi(path, params = {}) {
     try {
         const res = await fetch(url.toString(), {
             signal: controller.signal,
-            headers: { Accept: "application/json" },
+            headers: {
+                Accept: "application/json",
+                "X-AgentScore-Client": CLIENT_ID,
+            },
             redirect: "follow",
         });
         clearTimeout(timer);

package/dist/index.js

@@ -5,7 +5,7 @@ import { z } from "zod";
 import { handleTool } from "./tools.js";
 const server = new McpServer({
     name: "agentscore",
-    version: "2.1.0",
+    version: "2.2.0",
 });
 // --- Tools ---
 server.tool("scan_package", "Scan an npm package for MCP security issues. Checks install scripts, prompt injection patterns, suspicious URLs, source code patterns, dependency count, metadata completeness, and publisher provenance. Returns score (0-100), risk level, and detailed findings.", {
@@ -26,15 +26,19 @@ server.tool("monitor_status", "Check if an MCP package is under continuous monit
 server.tool("check_my_repo", "Inspect the current repo for MCP dependencies, look up AgentScore verdicts for each package, and summarise what should be gated in CI. Use this when a developer wants to understand all MCP packages in a repo instead of scanning one package at a time.", {
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
 }, async (args) => handleTool("check_my_repo", args));
-server.tool("generate_policy_gate_setup", "Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the YAML, secret name, and pilot link needed for setup.", {
+server.tool("generate_policy_gate_setup", "Generate the exact GitHub Actions workflow needed to enforce AgentScore Policy Gate for a repo. Detects MCP dependencies locally and returns the OIDC-based YAML needed for setup. No API key or secret is required.", {
     path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
     repo_url: z.string().optional().describe("Optional repository URL override for the pilot handoff link."),
 }, async (args) => handleTool("generate_policy_gate_setup", args));
+server.tool("install_policy_gate", "Write the AgentScore Policy Gate workflow file to this repo. Creates .github/workflows/agentscore-policy-gate.yml with OIDC authentication (no API key needed). Detects MCP dependencies and includes them in the workflow. The gate will auto-provision the repo on first push.", {
+    path: z.string().optional().describe("Optional path to the repo root. Defaults to the current working directory."),
+    repo_url: z.string().optional().describe("Optional repository URL override."),
+}, async (args) => handleTool("install_policy_gate", args));
 // --- Start ---
 async function main() {
     const transport = new StdioServerTransport();
     await server.connect(transport);
-    console.error("AgentScore MCP server v2.1 running on stdio");
+    console.error("AgentScore MCP server v2.2 running on stdio");
 }
 main().catch((err) => {
     console.error("Fatal error:", err);

package/dist/tools.js

@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import path from "node:path";
 import { fetchApi, ApiError } from "./api.js";
 import { inspectRepoForMcpDependencies, } from "./repo.js";
 const WEBSITE_BASE = "https://www.agentscores.xyz";
@@ -34,7 +36,8 @@ function policyGateHint(options) {
         "",
         "Policy Gate:",
         "  Run check_my_repo to inspect every MCP dependency used by this repo.",
-        "  Run generate_policy_gate_setup to turn the same checks into a CI gate.",
+        "  Run generate_policy_gate_setup to preview the CI workflow.",
+        "  Run install_policy_gate to write the workflow file directly into the repo.",
     ];
     if (options.repoUrl) {
         lines.push(`  Start a free pilot: ${buildIntentUrl("pilot", options.repoUrl)}`);
@@ -221,10 +224,10 @@ function formatRepoSummary(repoPath, repoUrl, checkedFiles, results) {
         const reasons = item.reasons.length > 0 ? ` | reasons: ${item.reasons.join(", ")}` : "";
         lines.push(`  ${item.name}@${version} - ${item.verdict.toUpperCase()} (${score}/100, ${risk}) [source: ${item.source}]${reasons}`);
     }
-    lines.push("", "Next step:", "  Run generate_policy_gate_setup to get the exact GitHub Actions workflow for this repo.", `  Start a free pilot: ${buildIntentUrl("pilot", repoUrl)}`);
+    lines.push("", "Next step:", "  Run generate_policy_gate_setup to preview the OIDC-based GitHub Actions workflow for this repo.", "  Run install_policy_gate to write .github/workflows/agentscore-policy-gate.yml directly.");
     return lines.join("\n");
 }
-function buildWorkflowYaml(packages) {
+function buildOidcWorkflowYaml(packages) {
     const lines = [
         "name: AgentScore Policy Gate",
         "",
@@ -233,6 +236,10 @@ function buildWorkflowYaml(packages) {
         "  push:",
         "    branches: [main]",
         "",
+        "permissions:",
+        "  id-token: write",
+        "  contents: read",
+        "",
         "jobs:",
         "  mcp-policy:",
         "    runs-on: ubuntu-latest",
@@ -240,17 +247,16 @@ function buildWorkflowYaml(packages) {
         "      - uses: actions/checkout@v4",
         "      - uses: Thezenmonster/mcp-verdict-action@v1",
         "        with:",
-        "          api-key: ${{ secrets.AGENTSCORE_KEY }}",
-        '          fail-open: "false"',
+        '          fail-on: block',
     ];
     if (packages.length > 0) {
         lines.push(`          packages: "${packages.join(",")}"`);
     }
+    lines.push("");
     return lines.join("\n");
 }
 function formatPolicyGateSetup(repoPath, repoUrl, dependencies, checkedFiles) {
     const explicitPackages = dependencies.map((dep) => dep.name);
-    const pilotUrl = buildIntentUrl("pilot", repoUrl);
     const lines = [
         `Repo path: ${repoPath}`,
         `Repository: ${repoUrl || "not detected"}`,
@@ -258,17 +264,17 @@ function formatPolicyGateSetup(repoPath, repoUrl, dependencies, checkedFiles) {
         `Detected MCP dependencies: ${explicitPackages.length > 0 ? explicitPackages.join(", ") : "none"}`,
         "",
         "Next steps:",
-        `1. Start a free Policy Gate pilot to get a repo-scoped key: ${pilotUrl}`,
-        "2. Add a GitHub Actions secret named AGENTSCORE_KEY to the repo.",
-        "3. Save this workflow as .github/workflows/agentscore-policy-gate.yml:",
+        "1. Save this workflow as .github/workflows/agentscore-policy-gate.yml.",
+        "2. Commit and push. The first run will authenticate with GitHub OIDC and auto-provision the repo.",
+        "3. If you want the MCP server to write the file for you, run install_policy_gate.",
         "",
-        buildWorkflowYaml(explicitPackages),
+        buildOidcWorkflowYaml(explicitPackages),
     ];
     if (explicitPackages.length === 0) {
         lines.push("", "Note:", "  No MCP packages were detected locally. The Action can still auto-detect root package.json dependencies,", "  but if this repo uses MCP packages via config files only, add them explicitly to the packages input.");
     }
     else {
-        lines.push("", "Why this workflow uses an explicit package list:", "  It keeps CI aligned with the MCP dependencies detected in this repo, even when they come from config files", "  and not just the root package.json.");
+        lines.push("", "Why this workflow uses OIDC:", "  GitHub Actions proves repo identity directly to AgentScore on each run.", "  No API key, no secret distribution, and no manual provisioning step are required.", "", "Why this workflow uses an explicit package list:", "  It keeps CI aligned with the MCP dependencies detected in this repo, even when they come from config files", "  and not just the root package.json.");
     }
     return lines.join("\n");
 }
@@ -326,6 +332,36 @@ export async function handleTool(name, args) {
                 const repoUrl = normaliseRepositoryUrl(repoUrlArg || repo.repoUrl);
                 return text(formatPolicyGateSetup(repo.repoPath, repoUrl, repo.dependencies, repo.checkedFiles));
             }
+            case "install_policy_gate": {
+                const inputPath = typeof args.path === "string" ? args.path : undefined;
+                const repoUrlArg = typeof args.repo_url === "string" ? args.repo_url : undefined;
+                const repo = inspectRepoForMcpDependencies(inputPath);
+                const repoUrl = normaliseRepositoryUrl(repoUrlArg || repo.repoUrl);
+                const packages = repo.dependencies.map((d) => d.name);
+                const yaml = buildOidcWorkflowYaml(packages);
+                const workflowDir = path.join(repo.repoPath, ".github", "workflows");
+                const workflowPath = path.join(workflowDir, "agentscore-policy-gate.yml");
+                fs.mkdirSync(workflowDir, { recursive: true });
+                fs.writeFileSync(workflowPath, yaml, "utf8");
+                const pilotUrl = buildIntentUrl("pilot", repoUrl);
+                const lines = [
+                    `Workflow written to: ${workflowPath}`,
+                    "",
+                    `Detected ${packages.length} MCP ${packages.length === 1 ? "dependency" : "dependencies"}: ${packages.join(", ") || "none"}`,
+                    "",
+                    "This workflow uses GitHub OIDC for authentication. No API key or secret needed.",
+                    "On first push, AgentScore will auto-provision your repo and return verdicts.",
+                    "",
+                    "Next steps:",
+                    "  1. Review the workflow file",
+                    "  2. Commit and push",
+                    "  3. The gate runs automatically on every PR and push to main",
+                ];
+                if (pilotUrl) {
+                    lines.push("", `If you want a managed pilot with custom thresholds and exceptions: ${pilotUrl}`);
+                }
+                return text(lines.join("\n"));
+            }
             default:
                 return text(`Unknown tool: ${name}`, true);
         }

package/package.json

@@ -1,60 +1,61 @@
-{
-  "name": "@agentscore-xyz/mcp-server",
-  "version": "2.1.0",
-  "mcpName": "io.github.Thezenmonster/agentscore",
-  "description": "MCP security trust layer. Scan packages, inspect repo MCP dependencies, generate Policy Gate setup, check exposure, and query abuse data.",
-  "type": "module",
-  "bin": {
-    "agentscore-mcp": "./dist/index.js"
-  },
-  "main": "./dist/index.js",
-  "scripts": {
-    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
-    "build": "npm run clean && tsc",
-    "dev": "tsc --watch",
-    "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "zod": "^3.22.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20.0.0",
-    "typescript": "^5.4.0"
-  },
-  "keywords": [
-    "mcp",
-    "mcp-server",
-    "mcp-security",
-    "agentscore",
-    "kya",
-    "know-your-agent",
-    "trust",
-    "ai-agents",
-    "ai-security",
-    "reputation",
-    "verification",
-    "agent-trust",
-    "agent-verification",
-    "model-context-protocol",
-    "security",
-    "scanner",
-    "abuse-detection"
-  ],
-  "author": "AgentScore <hello@agentscores.xyz>",
-  "license": "MIT",
-  "homepage": "https://agentscores.xyz",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/Thezenmonster/agentscore-mcp-server"
-  },
-  "files": [
-    "dist/",
-    "README.md",
-    "smithery.yaml"
-  ],
-  "engines": {
-    "node": ">=18"
-  }
-}
+{
+  "name": "@agentscore-xyz/mcp-server",
+  "version": "2.2.1",
+  "mcpName": "io.github.Thezenmonster/agentscore",
+  "description": "MCP security trust layer. Scan packages, inspect repo MCP dependencies, generate Policy Gate setup, install the workflow directly, check exposure, and query abuse data.",
+  "type": "module",
+  "bin": {
+    "agentscore-mcp": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "scripts": {
+    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "zod": "^3.22.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0"
+  },
+  "keywords": [
+    "mcp",
+    "mcp-server",
+    "mcp-security",
+    "agentscore",
+    "kya",
+    "know-your-agent",
+    "trust",
+    "ai-agents",
+    "ai-security",
+    "reputation",
+    "verification",
+    "agent-trust",
+    "agent-verification",
+    "model-context-protocol",
+    "security",
+    "scanner",
+    "abuse-detection"
+  ],
+  "author": "AgentScore <hello@agentscores.xyz>",
+  "license": "MIT",
+  "homepage": "https://agentscores.xyz",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Thezenmonster/agentscores.git",
+    "directory": "packages/mcp-server"
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "smithery.yaml"
+  ],
+  "engines": {
+    "node": ">=18"
+  }
+}

package/smithery.yaml

@@ -1,11 +1,11 @@
-startCommand:
-  type: stdio
-  configSchema:
-    type: object
-    properties: {}
-    required: []
-  commandFunction: |-
-    (config) => ({
-      command: "npx",
-      args: ["-y", "@agentscore-xyz/mcp-server"]
-    })
+startCommand:
+  type: stdio
+  configSchema:
+    type: object
+    properties: {}
+    required: []
+  commandFunction: |-
+    (config) => ({
+      command: "npx",
+      args: ["-y", "@agentscore-xyz/mcp-server"]
+    })

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Janus Compliance Limited
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.