@kryptosai/mcp-observatory 0.26.1 → 0.28.0

package/COMMERCIAL.md

@@ -4,20 +4,25 @@ MCP Observatory is the CI and security gate for MCP servers before agents depend
 
 The open source CLI and MCP server remain free for local OSS use under the MIT license. Paid pilots are for production use cases where a team needs hosted reporting, private repository CI, security reports, certification, support, or fleet visibility.
 
-## Pilot Pricing
+## MCP Readiness Review
 
-These are starting points for current pilots, not permanent fixed plans.
+The primary paid offer is a fixed-scope MCP Readiness Review starting at `$2,500`.
+
+It includes CI rollout, SARIF/GitHub Code Scanning setup, private readiness reporting, prioritized remediation notes, and maintainer PR support for selected MCP servers.
+
+These are starting points for current pilots, not permanent fixed plans. For public OSS users, the important part is simple: local CLI use remains free, and paid work is for private or production support needs.
 
 | Pilot | Starting Price | Best Fit |
 | --- | ---: | --- |
+| MCP Readiness Review | $2,500 | CI rollout, Code Scanning, private readiness report, and prioritized fixes |
 | Team Pilot | $299/month | Small teams adding MCP regression checks to CI |
 | Business Pilot | $999/month | Private repos, recurring security reports, and shared reporting |
 | Enterprise Pilot | $3k/month | Private MCP readiness reports, support, and fleet visibility |
-| Strategic Accounts | Custom, $250k+/year | Major platforms, AI labs, and companies running MCP in production at scale |
+| Strategic Accounts | Custom | Major platforms, AI labs, and companies running MCP in production at scale |
 
-Contact: william@banksey.com
+Contact: open a pilot request from the GitHub issue chooser.
 
-Primary pilot offer: [Private MCP readiness review + CI rollout + drift/security report](./docs/paid-pilot-offer.md).
+Primary pilot offer: private MCP readiness review + CI rollout + drift/security report.
 
 ## Paid Production Use
 
@@ -73,12 +78,11 @@ For account-level pilot reporting in CI:
 
 ```bash
 MCP_OBSERVATORY_ORG=customer.com
-MCP_OBSERVATORY_CONTACT=mcp-owner@customer.com
+MCP_OBSERVATORY_CONTACT=customer-mcp-owner
 ```
 
-Use the [enterprise outreach playbook](./docs/enterprise-outreach-playbook.md) to route high-confidence company usage to manual pilots without sending generic low-tier pricing to major accounts.
-Use [public proof](./docs/proof.md) and the [project case study](./docs/project-case-study.md) for customer-safe credibility. Do not expose private telemetry rows in outreach.
+Use [public proof](./docs/proof.md) for customer-safe credibility. Do not expose private telemetry rows in outreach.
 
 ## Enterprise Framing
 
-For production MCP usage, private repo CI, compliance/security reporting, or large company deployments, contact us before selecting a plan. Major company usage is routed to Enterprise or Strategic pricing rather than Team or Business pilots.
+For production MCP usage, private repo CI, compliance/security reporting, or large company deployments, contact us before selecting a plan.

package/CONTRIBUTORS.md

@@ -0,0 +1,39 @@
+# Contributors
+
+MCP Observatory uses the [All Contributors](https://allcontributors.org/) spec so code, docs, tests, target research, reviews, security findings, design, and maintainer feedback can all receive visible credit.
+
+Official GitHub profile achievements are platform-controlled; this project does not award them. Instead, contributors get public proof: a role on the recognition page, an All Contributors entry, and a proof card or recognition link they can reference from a README or GitHub profile.
+
+See the full recognition path in [MCP Observatory Contributors](./docs/contributor-recognition.md).
+
+<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
+[![All Contributors](https://img.shields.io/badge/all_contributors-1-orange.svg?style=flat-square)](#contributors-)
+<!-- ALL-CONTRIBUTORS-BADGE:END -->
+
+## Contributors
+
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+<table>
+  <tbody>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/KryptosAI"><img src="https://avatars.githubusercontent.com/u/140749029?s=100" width="100px;" alt="William Weishuhn"/><br /><sub><b>William Weishuhn</b></sub></a><br /><a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Code">💻</a> <a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Documentation">📖</a> <a href="#ideas-KryptosAI" title="Ideas, Planning, & Feedback">🤔</a> <a href="#maintenance-KryptosAI" title="Maintenance">🚧</a> <a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Tests">⚠️</a></td>
+    </tr>
+  </tbody>
+</table>
+
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
+
+<!-- ALL-CONTRIBUTORS-LIST:END -->
+
+## Recognition Requests
+
+After a useful contribution is merged or accepted, request credit in the PR or issue:
+
+```text
+@all-contributors please add @username for code, doc, test, ideas, review
+```
+
+If the bot is unavailable, open a small PR that updates `.all-contributorsrc`, this file, and any relevant proof card under `docs/contributor-proof-cards/`.

package/PRIVACY.md

@@ -10,7 +10,7 @@ MCP Observatory collects product usage telemetry unless telemetry is disabled. T
 - Counts of tools, prompts, resources, servers, checks, and failures
 - CI environment signals such as provider and GitHub Actions metadata when available, including repository, workflow, run ID, run number, event name, ref, and actor
 - Declared account attribution from `MCP_OBSERVATORY_ORG` and `MCP_OBSERVATORY_CONTACT` when operators set them
-- Git metadata such as `gitEmail` and `gitRemoteUrl` when available
+- Git identity and remote metadata when available
 - Hostname and operating system metadata
 - Session identifiers and timestamps
 - Error categories, check statuses, security finding counts, health scores, and scan outcomes
@@ -35,14 +35,14 @@ Production teams can make account reporting clearer without relying on inferred
 
 ```bash
 MCP_OBSERVATORY_ORG=example.com
-MCP_OBSERVATORY_CONTACT=mcp-owner@example.com
+MCP_OBSERVATORY_CONTACT=mcp-owner
 ```
 
 ## Internal Account Intelligence
 
-We may use telemetry internally to identify likely company or organization usage, including by deriving company domains from git email domains, git remote URLs, CI usage, target names, repeated sessions, and production-looking command patterns.
+We may use telemetry internally to identify likely company or organization usage, including by deriving company domains from git metadata, repository metadata, CI usage, target names, repeated sessions, and production-looking command patterns.
 
-Raw telemetry may include git email addresses, git remote URLs, hostnames, target commands, HTTP target URLs, CI metadata, target IDs, and command outcomes. These fields are retained for internal product analytics, account intelligence, support, and outreach prioritization.
+Raw telemetry may include git identity metadata, repository metadata, hostnames, target commands, HTTP target URLs, CI metadata, target IDs, and command outcomes. These fields are retained for internal product analytics, account intelligence, support, and outreach prioritization.
 
 Raw emails, hostnames, private URLs, target commands, and private telemetry exports are not intended for public reporting. Account intelligence outputs should use company domains, GitHub organizations, aggregate counts, confidence levels, and outreach status rather than raw personal identifiers.
 
@@ -52,4 +52,4 @@ Internal usage reports separate first-party MCP Observatory project activity fro
 
 Enterprise customers can request telemetry review, reduced collection, private deployment, or enterprise-controlled telemetry modes as part of a paid pilot.
 
-Contact: william@banksey.com
+Contact: open an issue or pilot request from the GitHub issue chooser.

package/README.md

@@ -11,25 +11,84 @@
 ```
 
 [![CI](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml)
+[![Coverage](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/KryptosAI/mcp-observatory/badge)](https://securityscorecards.dev/viewer/?uri=github.com/KryptosAI/mcp-observatory)
+[![Dependabot](https://img.shields.io/badge/dependabot-enabled-025e8c?logo=dependabot)](./.github/dependabot.yml)
+[![npm provenance workflow](https://img.shields.io/badge/npm%20provenance-workflow-blue)](./.github/workflows/release.yml)
 [![npm](https://img.shields.io/npm/v/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
-[![npm downloads](https://img.shields.io/npm/dm/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
+[![npm weekly downloads](https://img.shields.io/npm/dw/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
+[![GitHub stars](https://img.shields.io/github/stars/KryptosAI/mcp-observatory?style=flat)](https://github.com/KryptosAI/mcp-observatory/stargazers)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
 [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-339933)](./package.json)
 [![Smithery](https://smithery.ai/badge/@kryptosai/mcp-observatory)](https://smithery.ai/server/@kryptosai/mcp-observatory)
 [![mcp-observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/score.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
+[![All Contributors](https://img.shields.io/badge/all_contributors-1-orange.svg?style=flat-square)](./CONTRIBUTORS.md)
 
-**The CI and security gate for MCP servers before agents depend on them.**
+**The GitHub-native CI, SARIF, and security-readiness gate for MCP servers before agents depend on them.**
 
-Agents should not depend on tools nobody tests. MCP Observatory gives MCP servers the production safety rails every dependency eventually needs: CI checks, security scans, schema drift detection, PR reports, score badges, and agent-accessible diagnostics.
+Agents should not depend on tools nobody tests. MCP Observatory turns a local MCP check into release-gate evidence maintainers already understand: GitHub Actions, security findings, schema drift detection, PR reports, score badges, agent-accessible diagnostics, and GitHub Code Scanning SARIF.
 
-Two fast paths:
+## Trust Signals
 
-Cloned this repo? Start here: [`CLONED_THIS.md`](./CLONED_THIS.md).
+| Signal | What it means |
+|---|---|
+| CI + coverage | Typecheck, lint, tests, build, packed install, artifact validation, smoke test, and measured coverage run in GitHub Actions. |
+| CodeQL + OpenSSF Scorecard | Static analysis and supply-chain posture are visible in GitHub-native security surfaces. |
+| Dependabot | npm and GitHub Actions dependency updates are monitored weekly. |
+| npm provenance workflow | Release automation is prepared for npm provenance through GitHub OIDC. |
+| Security policy | Vulnerability reports go through private disclosure; see [SECURITY.md](./SECURITY.md). |
 
-Add MCP CI in one command:
+## Try It
+
+Start with the homepage demo: safely simulate MCP attack-readiness for one server and emit SARIF evidence that maintainers can inspect in GitHub Code Scanning.
 
 ```bash
-npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server"
+npx @kryptosai/mcp-observatory attack-sim npx -y my-mcp-server --sarif attack-results.sarif
+```
+
+Then make the evidence repeatable in CI:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif
+```
+
+See the [MCP Attack Simulator](./docs/mcp-attack-simulator.md), [Tool-call receipts](./docs/tool-call-receipts.md), [MCP Receipt Graph](./docs/receipt-graph.md), [launch page](./docs/launch.md), [GitHub Code Scanning demo](./docs/code-scanning-demo.md), [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), [sample safety reports](./docs/mcp-server-safety-index.md), and [reference evaluations](./docs/reference-evaluations.md).
+
+Want a receipt for a server your agent depends on? Comment on [Drop an MCP server, get a receipt #146](https://github.com/KryptosAI/mcp-observatory/issues/146) or use the [structured receipt request form](https://github.com/KryptosAI/mcp-observatory/issues/new?template=tool-call-receipt-request.yml). Public requests can become Safety Index entries, delta receipts, SARIF evidence, and maintainer CI conversations.
+
+## Evidence You Can Inspect
+
+| Evidence | Where |
+|---|---|
+| Example GitHub Actions adoption | [`setup-ci --all`](./docs/setup-ci-doctor.md) and the generated workflow docs |
+| Attack simulation output | [MCP Attack Simulator](./docs/mcp-attack-simulator.md) |
+| Tool-call receipts | [Receipt standard](./docs/tool-call-receipts.md) for reproducible MCP evidence |
+| Receipt graph | [Server-to-evidence map](./docs/receipt-graph.md) for agent trust decisions |
+| SARIF / Code Scanning output | [GitHub Code Scanning demo](./docs/code-scanning-demo.md) |
+| Real MCP server evaluations | [MCP Server Safety Index](./docs/mcp-server-safety-index.md) |
+| Reference reports | [Reference evaluations](./docs/reference-evaluations.md) |
+| Maintainer and contributor proof | [MCP Observatory Contributors](./docs/contributor-recognition.md) |
+| Security disclosure path | [SECURITY.md](./SECURITY.md) |
+
+Two more fast paths:
+
+Cloned this repo? Start here: [`CLONED_THIS.md`](./CLONED_THIS.md). Want to contribute? Add one server to the [MCP Target Registry](./docs/target-registry.md), use the [Agent Task Pack](./docs/agent-tasks.md), and get public credit through [MCP Observatory Contributors](./docs/contributor-recognition.md).
+
+AI coding agents, agentic workflows, and rough PRs are welcome. Use the [10x Agentic Growth Sprint](./docs/10x-agentic-growth-sprint.md), [Agentic Contributor Outreach](./docs/agentic-contributor-outreach.md), or open a `Contributor quest`, `Agentic contribution idea`, or [`Drop an MCP server, get a receipt`](./docs/drop-server-get-receipt.md) issue to suggest a target, prompt, docs fix, receipt, or `setup-ci --sarif` integration.
+
+Add MCP CI and Code Scanning in one command:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif
+```
+
+Installing MCP Observatory in an MCP server project also prints the exact CI setup command. Projects can opt into automatic workflow creation during install with [`mcpObservatory.autoSetupCi`](./docs/automatic-ci-integration.md).
+
+Upload normalized MCP findings to GitHub Code Scanning when you want a security-native release gate:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif
 ```
 
 Add Observatory as an agent-accessible MCP server:
@@ -38,6 +97,8 @@ Add Observatory as an agent-accessible MCP server:
 claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory serve
 ```
 
+Building an autonomous agent, OpenClaw-style productivity machine, MCP gateway, or bot runtime? Start with the [agent runtime quickstart](./docs/agent-runtime-quickstart.md), copy the [OpenClaw MCP reliability agent template](./docs/openclaw-agent-template/SOUL.md), or point your agent at [`llms.txt`](./llms.txt) and [`AGENTS.md`](./AGENTS.md).
+
 Or test a server immediately:
 
 ```bash
@@ -52,6 +113,8 @@ Use it as a CLI, a GitHub Action, or an MCP server that lets your AI agent scan,
 
 [![Observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/card.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
 
+The Glama card is an external MCP directory scorecard. Treat it as directory-level social proof; click through for the underlying category details before using it as a production approval signal.
+
 ## Why MCP Observatory
 
 MCP servers are becoming production dependencies. If agents rely on them, teams need a way to catch broken tools, unsafe schemas, schema drift, slow responses, and security footguns before those failures reach users.
@@ -60,34 +123,25 @@ Observatory gives maintainers and teams:
 
 - **One-command CI setup** with `setup-ci --all`
 - **GitHub PR comments** for compatibility, drift, and security findings
+- **GitHub Code Scanning SARIF** for normalized MCP findings
 - **Health score badges** for public trust signals
 - **Record/replay/verify** workflows for regression testing
 - **MCP server mode** so agents can inspect other MCP servers directly
-- **Production pilot path** for hosted history, private repo reporting, certification, support, and fleet visibility
+- **Production support path** for hosted history, private repo reporting, certification, support, and fleet visibility
 
-See the [clone-to-CI campaign](./docs/clone-to-ci-campaign.md), [`setup-ci --doctor`](./docs/setup-ci-doctor.md), [MCP server security field guide](./docs/mcp-security-field-guide.md), [Safety Methodology](./docs/methodology.md), [MCP Server Safety Index](./docs/mcp-server-safety-index.md), [June 2026 safety field report](./docs/mcp-safety-field-report-2026-06.md), [reference evaluations](./docs/reference-evaluations.md), [MCP lock files](./docs/mcp-lock-files.md), [public proof](./docs/proof.md), the [certification PR campaign](./docs/certification-pr-campaign.md), [ecosystem distribution kit](./docs/ecosystem-distribution-kit.md), [local metrics dashboard](./docs/metrics-dashboard.md), and [commercial pilots](./COMMERCIAL.md).
+See the [launch page](./docs/launch.md), [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), [Code Scanning demo](./docs/code-scanning-demo.md), [target gallery](./docs/target-gallery.md), [target registry](./docs/target-registry.md), [target contribution guide](./docs/target-contribution-guide.md), [MCP Observatory Contributors](./docs/contributor-recognition.md), [Agent Task Pack](./docs/agent-tasks.md), [Tool-call receipts](./docs/tool-call-receipts.md), [MCP Receipt Graph](./docs/receipt-graph.md), [`setup-ci --doctor`](./docs/setup-ci-doctor.md), [MCP server security field guide](./docs/mcp-security-field-guide.md), [Safety Methodology](./docs/methodology.md), [MCP Server Safety Index](./docs/mcp-server-safety-index.md), [June 2026 safety field report](./docs/mcp-safety-field-report-2026-06.md), [reference evaluations](./docs/reference-evaluations.md), [MCP lock files](./docs/mcp-lock-files.md), [public proof](./docs/proof.md), [campaign attribution](./docs/campaign-attribution.md), [local metrics dashboard](./docs/metrics-dashboard.md), and [commercial support](./COMMERCIAL.md).
 
 ## For Security And Platform Teams
 
 MCP servers are becoming part of the AI software supply chain. Agents need reliable, testable, auditable tools before those tools become dependencies in mission-critical workflows.
 
-MCP Observatory gives security and platform teams MCP server CI, schema drift detection, security findings, SARIF/HTML/Markdown reports, and a path toward certification or fleet visibility. Local OSS use stays free; production, private repo, and fleet usage can move through a paid pilot.
+MCP Observatory gives security and platform teams MCP server CI, schema drift detection, security findings, SARIF/HTML/Markdown reports, GitHub Code Scanning upload, and a path toward certification or fleet visibility. Local OSS use stays free; production, private repo, and fleet usage can move through a paid MCP Readiness Review.
 
-## Production / Enterprise
+## Production Support
 
-Free for local OSS use. Paid pilots are available for hosted reporting, private repo CI, recurring security reports, certification, support, and MCP fleet visibility.
+Local OSS use stays free under MIT. Teams running MCP in production can use the [MCP Readiness Review](./docs/paid-pilot-offer.md) for CI rollout, SARIF/Code Scanning setup, private repo review, recurring security reports, certification review, support, and fleet visibility. The default package starts at `$2,500`.
 
-| Pilot | Starts At | Best Fit |
-|-------|----------:|----------|
-| Team Pilot | $299/month | Small teams adding MCP checks to CI |
-| Business Pilot | $999/month | Private repos and recurring security reports |
-| Enterprise Pilot | $3k/month | Private MCP readiness reports, support, and fleet visibility |
-| Strategic Accounts | Custom, $250k+/year | Major companies running MCP in production |
-
-Run `npx @kryptosai/mcp-observatory cloud` or contact `william@banksey.com` for production MCP usage. The primary paid pilot is a [private MCP readiness review](./docs/paid-pilot-offer.md).
-
-See [commercial pilots](./COMMERCIAL.md), [privacy and telemetry](./PRIVACY.md), and [terms for production use](./TERMS.md).
-For a fuller narrative, see the [project case study](./docs/project-case-study.md).
+Run `npx @kryptosai/mcp-observatory cloud`, open a pilot request from the issue chooser, or see [COMMERCIAL.md](./COMMERCIAL.md). Also see [privacy and telemetry](./PRIVACY.md), [campaign attribution](./docs/campaign-attribution.md), and [terms for production use](./TERMS.md).
 
 ## Quick Start
 
@@ -146,6 +200,7 @@ Or add it manually to your config:
 | `lock verify` | Verify live servers match the lock file |
 | `history` | Show health score trends for your MCP servers |
 | `setup-ci` / `init-ci` | Create a GitHub Action and badge snippet for MCP compatibility/security checks |
+| `setup-ci --sarif` | Generate a workflow that uploads normalized findings to GitHub Code Scanning |
 | `setup-ci --doctor` | Inspect whether the repository has a complete CI adoption kit |
 | `ci-report` | Generate CI report for GitHub issue creation |
 | `enterprise-report` | Generate a static production/security report from run artifacts |
@@ -242,7 +297,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: KryptosAI/mcp-observatory/action@v0.26.1
+      - uses: KryptosAI/mcp-observatory/action@v0.27.0
         with:
           command: npx -y my-mcp-server
           deep: true
@@ -268,7 +323,7 @@ Action inputs:
 
 The action can comment on PRs and set commit statuses when the workflow grants write permissions. `setup-ci` generates read-only third-party-friendly workflows by default and lets maintainers opt into comments/statuses later. `init-ci` remains available as a backward-compatible alias. See [`action/README.md`](./action/README.md) for all options.
 
-Production teams can add hosted CI history, private-repo reporting, recurring security reports, certification review, support, and fleet visibility. Run `npx @kryptosai/mcp-observatory cloud` for pilot options, email `william@banksey.com`, or open a pilot request from the issue chooser.
+Production teams can add hosted CI history, private-repo reporting, recurring security reports, certification review, support, and fleet visibility. Run `npx @kryptosai/mcp-observatory cloud`, see [COMMERCIAL.md](./COMMERCIAL.md), or open a pilot request from the issue chooser.
 
 ### Certified by MCP Observatory
 
@@ -299,7 +354,7 @@ For clearer internal account attribution in CI, set:
 
 ```bash
 MCP_OBSERVATORY_ORG=your-company.com
-MCP_OBSERVATORY_CONTACT=mcp-owner@your-company.com
+MCP_OBSERVATORY_CONTACT=your-team-contact
 ```
 
 Testing Feishu/Lark integrations? See the [Feishu/Lark MCP guide](./docs/feishu-lark-mcp.md).
@@ -348,9 +403,7 @@ Your agent gets 10 tools:
 | `get_last_run` | Retrieve previous check results for a server |
 | `suggest_servers` | Discover MCP servers that match your project stack |
 
-An AI tool that checks other AI tools. It's a tool testing tools that serve tools.*
-
-<sub>* I'm a dude playing a dude disguised as another dude.</sub>
+An AI tool that checks other AI tools. It is a tool testing tools that serve tools.
 
 ### Security
 
@@ -409,7 +462,7 @@ npx @kryptosai/mcp-observatory run --target ./target.json
 {
   "targetId": "my-remote-server",
   "adapter": "http",
-  "url": "http://localhost:3000/mcp",
+  "url": "https://mcp.example.com/mcp",
   "authToken": "${MCP_SERVER_TOKEN}",
   "headers": {
     "X-Api-Key": "$MCP_SERVER_API_KEY"

package/TERMS.md

@@ -27,4 +27,4 @@ Starting pilot pricing:
 
 For production MCP usage, private repo CI, enterprise support, or strategic partnerships:
 
-william@banksey.com
+the GitHub issue chooser

package/dist/src/adapters/http.js

@@ -18,8 +18,6 @@ export class HttpAdapter {
             throw new Error(`Unsupported protocol "${url.protocol}" — only http: and https: are allowed.`);
         }
         const timeoutMs = target.timeoutMs ?? 15_000;
-        // Try streamable-http first, fall back to SSE
-        let connected = false;
         let activeTransport;
         try {
             let transport = new StreamableHTTPClientTransport(url, { requestInit: { headers } });
@@ -27,19 +25,17 @@ export class HttpAdapter {
                 transport = new RecordingTransport(transport);
             await client.connect(transport, { timeout: timeoutMs });
             activeTransport = transport;
-            connected = true;
         }
         catch {
             stderrLines.push("Streamable HTTP failed, falling back to SSE.");
         }
-        if (!connected) {
+        if (!activeTransport) {
             try {
                 let transport = new SSEClientTransport(url, { requestInit: { headers } });
                 if (options?.record)
                     transport = new RecordingTransport(transport);
                 await client.connect(transport, { timeout: timeoutMs });
                 activeTransport = transport;
-                connected = true;
             }
             catch (error) {
                 const rawMessage = errorMessage(error);

package/dist/src/adapters/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,MAAwB,EAAE,OAA+B;QACrE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QAEF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAE7C,8CAA8C;QAC9C,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,eAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,SAAS,GAAc,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAChG,IAAI,OAAO,EAAE,MAAM;gBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,eAAe,GAAG,SAAS,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,SAAS,GAAc,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE,MAAM;oBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxD,eAAe,GAAG,SAAS,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;gBAC5E,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAEhD,OAAO;YACL,MAAM;YACN,kBAAkB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YAClD,UAAU,EAAE,aAAa,EAAE,IAAI;YAC/B,aAAa,EAAE,aAAa,EAAE,OAAO;YACrC,WAAW;YACX,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,MAAwB,EAAE,OAA+B;QACrE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QAEF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAE7C,IAAI,eAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,SAAS,GAAc,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAChG,IAAI,OAAO,EAAE,MAAM;gBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,SAAS,GAAc,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE,MAAM;oBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxD,eAAe,GAAG,SAAS,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;gBAC5E,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAEhD,OAAO;YACL,MAAM;YACN,kBAAkB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YAClD,UAAU,EAAE,aAAa,EAAE,IAAI;YAC/B,aAAa,EAAE,aAAa,EAAE,OAAO;YACrC,WAAW;YACX,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/cassette.js

@@ -1,6 +1,7 @@
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { ensureDirectory } from "./storage.js";
+import { writeTextFileAtomic } from "./utils/files.js";
 import { slugify } from "./utils/ids.js";
 // ── I/O ──────────────────────────────────────────────────────────────────────
 export function defaultCassettesDirectory(cwd = process.cwd()) {
@@ -11,7 +12,7 @@ export async function saveCassette(cassette, outDir) {
     const timestamp = new Date().toISOString().replaceAll(":", "-");
     const fileName = `${timestamp}--${slugify(cassette.targetId)}.cassette.json`;
     const filePath = path.join(outDir, fileName);
-    await writeFile(filePath, JSON.stringify(cassette, null, 2) + "\n", "utf8");
+    await writeTextFileAtomic(filePath, JSON.stringify(cassette, null, 2) + "\n");
     return filePath;
 }
 export async function loadCassette(filePath) {

package/dist/src/cassette.js.map

@@ -1 +1 @@
-{"version":3,"file":"cassette.js","sourceRoot":"","sources":["../../src/cassette.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAqBzC,gFAAgF;AAEhF,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAAc;IAEd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAAgC,CAAC,SAAS,CAAC,KAAK,CAAC;QAClD,CAAC,KAAK,CAAC,OAAO,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,4CAA4C,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAgB,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"cassette.js","sourceRoot":"","sources":["../../src/cassette.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAqBzC,gFAAgF;AAEhF,MAAM,UAAU,yBAAyB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAkB,EAClB,MAAc;IAEd,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE1C,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,IAAI;QACZ,IAAgC,CAAC,SAAS,CAAC,KAAK,CAAC;QAClD,CAAC,KAAK,CAAC,OAAO,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC,EAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0BAA0B,QAAQ,4CAA4C,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,IAAgB,CAAC;AAC1B,CAAC"}

package/dist/src/checks/attack-sim.d.ts

@@ -0,0 +1,18 @@
+import type { CheckResult, RunArtifact } from "../types.js";
+import { type CheckContext, type ObservedCheck } from "./base.js";
+export type AttackClass = "tool-poisoning" | "exfiltration-canary" | "permission-boundary" | "contract-drift";
+export type AttackFindingSeverity = "high" | "medium" | "low";
+export interface AttackSimulationFinding {
+    ruleId: string;
+    attackClass: AttackClass;
+    severity: AttackFindingSeverity;
+    itemType: "target" | "tool" | "prompt" | "resource" | "schema" | "response";
+    itemName: string;
+    message: string;
+    evidence: Record<string, unknown>;
+    recommendation: string;
+}
+export interface AttackSimulationOptions {
+    baseline?: RunArtifact;
+}
+export declare function runAttackSimulationCheck(context: CheckContext, previousChecks: CheckResult[], options?: AttackSimulationOptions): Promise<ObservedCheck>;