@kryptosai/mcp-observatory 0.27.0 → 0.28.0

package/dist/src/validate.js

@@ -38,7 +38,7 @@ function requireStatus(value, label) {
     }
 }
 function requireCheckId(value, label) {
-    const ids = new Set(["tools", "prompts", "resources", "tools-invoke", "security", "security-lite", "conformance", "schema-quality"]);
+    const ids = new Set(["tools", "prompts", "resources", "tools-invoke", "security", "security-lite", "attack-sim", "conformance", "schema-quality"]);
     if (typeof value !== "string" || !ids.has(value)) {
         throw new Error(`${label} has invalid check id '${String(value)}'.`);
     }

package/dist/src/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAEA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,wBAAwB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,2BAA2B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5F,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,sBAAsB,CAAC,CAAC;IACtE,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAC7D,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uBAAuB,KAAK,cAAc,CAAC,CAAC;IAChF,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAChE,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACpE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACjE,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC;QAC/C,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,IAAI,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,MAAM,GAAG,KAAK;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,GAAG,oBAAoB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAEhE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,MAAM;YACf,GAAG;YACH,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3H,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC;YAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;YAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;YAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,wCAAwC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9D,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC;QACjE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;QAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACrG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7C,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACjE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC3E,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,0BAA0B,CAAC,CAAC;IAC9E,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,OAAO,IAA8B,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAEtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,IAA+B,CAAC;AACzC,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAEA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,wBAAwB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,2BAA2B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnJ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5F,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,sBAAsB,CAAC,CAAC;IACtE,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAC7D,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uBAAuB,KAAK,cAAc,CAAC,CAAC;IAChF,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAChE,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACpE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACjE,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC;QAC/C,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,IAAI,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,MAAM,GAAG,KAAK;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,GAAG,oBAAoB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAEhE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,MAAM;YACf,GAAG;YACH,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3H,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC;YAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;YAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;YAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,wCAAwC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9D,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC;QACjE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;QAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACrG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7C,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACjE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC3E,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,0BAA0B,CAAC,CAAC;IAC9E,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,OAAO,IAA8B,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAEtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,IAA+B,CAAC;AACzC,CAAC"}

package/docs/agent-ecosystem-promotion-plan.md

@@ -0,0 +1,244 @@
+# Agent And MCP Ecosystem Promotion Plan
+
+Use this plan to turn MCP Observatory visibility into agent installs, CI integrations, maintainer conversations, and MCP company relationships.
+
+The campaign position:
+
+> Agents should not depend on tools nobody tests.
+
+The conversion goal is not raw stars. The goal is more `setup-ci`, SARIF/code-scanning, external CI, and agent-accessible `serve` sessions.
+
+## Immediate Moves
+
+1. Leave third-party badge PRs open unless the provider has clear public scan evidence and acceptable badge wording.
+2. Claim or refresh directory listings with neutral listing copy, not unreviewed audit claims.
+3. Publish one short agent-first post or thread per week.
+4. Open five small Observatory CI PRs per week against public MCP server repos.
+5. Track whether each surface converts into `test`, `scan`, `setup-ci`, `serve`, or external CI sessions.
+
+## MseeP Listing
+
+Claim the listing, but do not merge the current badge PR unless the listing exposes reviewed scan evidence and the badge wording is acceptable.
+
+Listing URL:
+
+`https://mseep.ai/app/kryptosai-mcp-observatory`
+
+Claim flow:
+
+1. Open the listing.
+2. Click `Claim Ownership`.
+3. Sign in with the GitHub account or organization that controls `KryptosAI/mcp-observatory`.
+4. Confirm the repo URL is `https://github.com/KryptosAI/mcp-observatory`.
+5. Update the listing copy using the text below.
+6. If MseeP shows security/audit metadata, verify the evidence before linking it from project-owned materials.
+
+Preferred listing copy:
+
+```text
+MCP Observatory is the GitHub-native CI and security gate for MCP servers before agents depend on them.
+```
+
+Short description:
+
+```text
+CI, SARIF, GitHub Code Scanning, schema drift detection, lock files, reports, and agent-accessible diagnostics for MCP servers.
+```
+
+Primary command:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>" --sarif
+```
+
+Agent install command:
+
+```bash
+claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory serve
+```
+
+Badge policy:
+
+- Directory listing: yes.
+- Plain text link: acceptable if the listing is accurate.
+- Badge saying `Audited`, `Certified`, `Verified`, or similar: only after public evidence is reviewed.
+- README placement: keep below first-party CI/npm/license/action signals unless the provider becomes a meaningful trust surface.
+
+## Directory Targets
+
+Refresh these surfaces first because they are already relevant to MCP users:
+
+| Surface | Desired State | CTA |
+| --- | --- | --- |
+| PulseMCP | Claimed/current listing with `server.json` visible | `setup-ci --all` |
+| Smithery | Current install snippet and MCP server mode | `serve` |
+| Glama | Current scorecard and README links | `test` and `serve` |
+| MseeP | Claimed listing with neutral copy | `setup-ci --sarif` |
+| mcpservers.org | Listing present or submitted | `setup-ci --all` |
+| awesome-mcp-servers | Developer tools/security category mention | `setup-ci --all` |
+| agent framework docs/community lists | Agent workflow examples | `serve` |
+| GitHub Action Marketplace | Action example and security framing | `action@v0.27.0` |
+
+Submission snippet:
+
+```text
+MCP Observatory adds CI, compatibility, schema drift, SARIF/GitHub Code Scanning, and lightweight security checks for MCP servers before agents depend on them.
+```
+
+## Agent-First Prompts
+
+Use these in docs, posts, issues, and agent community replies.
+
+Add CI:
+
+```text
+Add MCP Observatory CI to this MCP server. Use a read-only or harmless startup command, enable deep and security checks when safe, and avoid secrets in the workflow.
+```
+
+Audit local config:
+
+```text
+Run MCP Observatory against my MCP config, summarize startup failures, risky tools, schema issues, and which servers should get CI coverage first.
+```
+
+Prepare a safe target:
+
+```text
+Create a CI-safe MCP Observatory target config for this MCP server. Prefer harmless fixtures, no tokens, and no write-capable operations.
+```
+
+Check drift:
+
+```text
+Add an MCP lock file for this server and verify in CI that the tool, prompt, and resource surface does not drift unexpectedly.
+```
+
+## MCP Company Targets
+
+Start with companies and projects whose users already care about agent reliability:
+
+| Target Type | Examples | Ask |
+| --- | --- | --- |
+| MCP directories | PulseMCP, Smithery, Glama, MseeP | Keep listing current; add CI/security category placement |
+| Agent browsers/scrapers | Browserbase, Firecrawl, Exa, BrowserStack | Publish a safe Observatory target or sample workflow |
+| Agent runtimes | Cline, Continue, Goose, Cursor/Windsurf ecosystem | Add Observatory to recommended MCP preflight docs |
+| Dev platform MCPs | Sentry, Notion, Stripe, Cloudflare, GitHub ecosystem | Add optional read-only CI checks or issue-first safe target guidance |
+| Gateways/proxies | MCP gateway and registry projects | Support Observatory reports as compatibility evidence |
+
+First outreach message:
+
+```md
+Hi, I maintain MCP Observatory, an open source CI/security gate for MCP servers before agents depend on them.
+
+I noticed your team is in the MCP ecosystem. Would a small, read-only Observatory target or GitHub Action example be useful for your server/docs?
+
+The goal is simple: give agent users a reproducible startup/schema/security check they can run before installing or upgrading an MCP dependency.
+
+Command shape:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>" --sarif
+```
+
+Happy to open a tiny docs PR or start with an issue asking for the safest CI command.
+```
+
+## Certification PR Shape
+
+Prefer a small, reversible PR:
+
+- Adds one workflow or docs snippet.
+- Uses a harmless command or fixture.
+- Does not require secrets.
+- Does not add a third-party badge by default.
+- Sets write permissions only when the maintainer explicitly wants PR comments/statuses.
+- Links to the generated run artifact or safety-index report when available.
+
+PR title:
+
+```text
+Add optional MCP Observatory CI check
+```
+
+PR body:
+
+```md
+This adds an optional MCP Observatory workflow so maintainers can verify MCP startup, tool discovery, schema quality, and basic security findings in CI before agents depend on the server.
+
+It is intentionally read-only and does not require secrets. If this is useful, maintainers can later opt into PR comments, commit statuses, SARIF upload, or a README badge.
+```
+
+## Weekly Operating Loop
+
+Run this once per week:
+
+1. Refresh metrics:
+
+```bash
+npm run metrics:refresh
+```
+
+2. Record:
+
+- GitHub views/clones
+- npm downloads
+- `serve` sessions
+- `setup-ci` sessions
+- external CI sessions
+- directory referrals when visible
+- accepted/closed certification PRs
+
+3. Ship:
+
+- 3 refreshed listings
+- 5 certification PRs or maintainer issues
+- 1 short public post
+- 3 company/community replies
+
+4. Review conversion after 48 hours.
+
+Prioritize the channels that create `setup-ci`, SARIF, or external CI events. Deprioritize channels that only create stars or low-intent clones.
+
+## Public Posts
+
+Short post:
+
+```text
+MCP servers are becoming agent dependencies.
+
+Before an agent depends on one, ask:
+
+- does it start in CI?
+- did tools or schemas drift?
+- are write/destructive tools obvious?
+- can findings land in GitHub Code Scanning?
+
+That is what MCP Observatory is for:
+
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>" --sarif
+```
+
+Agent post:
+
+```text
+If your coding agent can install MCP servers, it should also be able to test them.
+
+MCP Observatory runs as an MCP server, so agents can scan, test, record, replay, diff, and verify other MCP servers before relying on them.
+
+claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory serve
+```
+
+Company-facing post:
+
+```text
+For teams adding MCP to production agent workflows: treat MCP servers like AI supply-chain dependencies.
+
+MCP Observatory gives you CI checks, SARIF/GitHub Code Scanning, schema drift, lock files, reports, and agent-accessible diagnostics before tools reach production workflows.
+```
+
+## Tracking Hygiene
+
+- Use one campaign link or one command per outreach surface.
+- Do not publish private telemetry, emails, hostnames, target commands, private repo names, or customer claims.
+- Treat anonymous stars, forks, and clone spikes as interest, not adoption.
+- Treat external CI, `setup-ci`, SARIF, and maintainer replies as adoption.

package/docs/agent-tasks.md

@@ -0,0 +1,95 @@
+# Agent Task Pack
+
+This page is written for coding agents, bot maintainers, autonomous productivity systems, and maintainers who want small useful MCP Observatory contributions.
+
+Useful merged work can receive public credit through [MCP Observatory Contributors](./contributor-recognition.md), [CONTRIBUTORS.md](../CONTRIBUTORS.md), and target proof cards. Recognition is based on merged public evidence, not private telemetry.
+
+Rough agentic contribution ideas are welcome too. Use the [Agentic Contributor Outreach](./agentic-contributor-outreach.md) playbook or open an `Agentic contribution idea` issue when a task is promising but not ready for a focused PR.
+
+The core standard is a [tool-call receipt](./tool-call-receipts.md): public source, safe startup command, run artifact, attack-sim evidence, SARIF when useful, and a clear capability envelope showing what the run could not access. The public map is the [MCP Receipt Graph](./receipt-graph.md).
+
+## Task 1: Add MCP Observatory CI To A Repo
+
+```text
+Add MCP Observatory CI for this MCP server.
+
+Use the safest no-secret startup command available in the repo. Generate the full adoption kit with SARIF enabled, verify it with setup-ci --doctor, and open a focused PR that explains the check is read-only.
+
+Commands:
+npx @kryptosai/mcp-observatory test <safe startup command> --campaign agent-ci
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --campaign agent-ci
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+
+## Task 2: Add One Safety Index Target
+
+```text
+Add one public MCP server target to MCP Observatory's Safety Index.
+
+Requirements:
+- public repo or public package
+- no secrets
+- no paid service dependency
+- safe startup command
+- generated JSON and Markdown evidence
+- attack-sim evidence or a note explaining why attack-sim is not applicable
+- maintainer-friendly wording
+
+Use docs/target-contribution-guide.md and docs/target-registry.md.
+```
+
+## Task 3: Generate SARIF For A Maintainer
+
+```text
+Run MCP Observatory against this MCP server and produce a SARIF artifact suitable for GitHub Code Scanning.
+
+Command:
+npx @kryptosai/mcp-observatory test <safe startup command> --sarif mcp-observatory.sarif --campaign agent-sarif
+
+Summarize only the normalized findings and avoid publishing private telemetry, hostnames, tokens, or local paths beyond generated artifact paths.
+```
+
+## Task 4: Open A Useful Maintainer PR
+
+```text
+Open a small PR that adds read-only MCP Observatory checks.
+
+Do:
+- keep the PR focused on CI and evidence
+- pin the action ref
+- include setup-ci --doctor output
+- say findings are review prompts, not public shaming
+
+Do not:
+- require private credentials
+- add destructive tool calls
+- include private telemetry
+- change unrelated project code
+```
+
+## Task 5: Evaluate A Bot Runtime
+
+```text
+Find the MCP servers this agent or bot runtime depends on. For each server, identify a no-secret startup command, run MCP Observatory, and report whether the server is ready for CI, needs review before production, or is not reproducible.
+
+Use:
+npx @kryptosai/mcp-observatory test <safe startup command> --campaign bot-runtime-review
+```
+
+## Task 6: Prepare A Contributor Proof Card
+
+```text
+After a target, CI integration, or SARIF improvement is merged, prepare a public proof card.
+
+Use docs/contributor-proof-cards/README.md.
+
+Include:
+- contributor GitHub profile
+- role
+- merged PR
+- generated artifact or upstream workflow
+- verdict
+- Observatory version
+
+Do not include private telemetry, local paths, secrets, or unpublished maintainer data.
+```

package/docs/automatic-ci-integration.md

@@ -0,0 +1,33 @@
+# Automatic CI Integration
+
+MCP Observatory includes an install-time CI helper for MCP server projects.
+
+By default, the helper is safe and non-mutating: when it detects a likely MCP project, it prints the exact `setup-ci` command to add GitHub Actions. It does not create files unless the project explicitly opts in.
+
+To let installs create the workflow automatically, add this to the MCP server project's `package.json`:
+
+```json
+{
+  "mcpObservatory": {
+    "autoSetupCi": true,
+    "command": "npm run mcp",
+    "sarif": true
+  }
+}
+```
+
+Then installing MCP Observatory creates `.github/workflows/mcp-observatory.yml` if it does not already exist:
+
+```bash
+npm install -D @kryptosai/mcp-observatory
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+
+Environment controls:
+
+- `MCP_OBSERVATORY_AUTO_SETUP_CI=1` creates CI during install for detected MCP projects.
+- `MCP_OBSERVATORY_TARGET_COMMAND="npm run mcp"` provides the startup command.
+- `MCP_OBSERVATORY_AUTO_SETUP_SARIF=1` enables SARIF upload in the generated workflow.
+- `MCP_OBSERVATORY_POSTINSTALL=0` or `MCP_OBSERVATORY_DISABLE_POSTINSTALL=1` disables the helper.
+
+The helper skips CI environments and skips MCP Observatory's own repository. Existing workflows are never overwritten.

package/docs/campaign-attribution.md

@@ -0,0 +1,58 @@
+# Campaign Attribution
+
+Campaign attribution helps the maintainer understand which launch, maintainer, bot, or paid-readiness paths lead to real MCP Observatory usage.
+
+Telemetry remains opt-out and private to the project owner. Campaign values are safe slugs only and are not written into public reports, SARIF artifacts, or generated adoption kit files.
+
+## CLI Flag
+
+```bash
+npx @kryptosai/mcp-observatory test npx -y my-mcp-server --campaign maintainer-pr
+```
+
+The flag is supported by:
+
+- `test`
+- `scan`
+- `scan deep`
+- `run`
+- `setup-ci`
+- `init-ci`
+
+For `test`, `--campaign` can appear after the MCP command and is stripped before launching the target server.
+
+## Environment Variable
+
+```bash
+MCP_OBSERVATORY_CAMPAIGN=bot-runtime-review npx @kryptosai/mcp-observatory scan
+```
+
+Use the environment variable when a bot, CI workflow, or documentation snippet cannot safely add another CLI flag.
+
+## Slug Rules
+
+Campaign slugs must be 2-64 characters and use only:
+
+- letters
+- numbers
+- `.`
+- `_`
+- `-`
+
+Examples:
+
+- `maintainer-pr`
+- `code-scanning-demo`
+- `agent-ci`
+- `paid-readiness`
+
+## Suggested Campaigns
+
+| Campaign | Use |
+| --- | --- |
+| `maintainer-pr` | Read-only CI PRs to existing MCP projects |
+| `code-scanning-demo` | SARIF and GitHub Code Scanning launch snippets |
+| `agent-ci` | Bot or coding-agent generated CI adoption |
+| `safety-index` | Target Gallery and Safety Index contribution flow |
+| `paid-readiness` | MCP Readiness Review CTA |
+

package/docs/code-scanning-demo.md

@@ -0,0 +1,57 @@
+# GitHub Code Scanning Demo
+
+Use this page when a maintainer or agent asks, "What does MCP Observatory actually add to my repo?"
+
+## One-Command Local Demo
+
+```bash
+npx @kryptosai/mcp-observatory test npx -y @modelcontextprotocol/server-everything --sarif mcp-observatory.sarif --campaign code-scanning-demo
+```
+
+Expected result:
+
+- normal terminal output still appears
+- `.mcp-observatory/runs/` receives a run artifact
+- `mcp-observatory.sarif` contains normalized MCP findings
+- the command exits the same way it would without `--sarif`
+
+## Turn It Into A GitHub Release Gate
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-everything" --sarif --campaign code-scanning-demo
+```
+
+Then verify:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+
+The generated workflow requests `security-events: write` only when `--sarif` is used. Standard `setup-ci` stays conservative and does not upload SARIF by default.
+
+## What Code Scanning Gets
+
+MCP Observatory emits one SARIF result per normalized finding. Results include:
+
+- stable rule IDs
+- severity mapping
+- target/check properties
+- lightweight control tags
+- partial fingerprints
+- artifact locations that point back to the Observatory run evidence
+
+Passing artifacts with no findings still produce valid empty SARIF.
+
+## Maintainer PR Snippet
+
+~~~markdown
+This adds a read-only MCP Observatory CI gate for the server.
+
+It checks startup, MCP capability listing, schema quality, and security-oriented findings. The SARIF path is enabled so normalized MCP findings can appear in GitHub Code Scanning.
+
+Verification:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+~~~

package/docs/contributor-proof-cards/README.md

@@ -0,0 +1,33 @@
+# Contributor Proof Cards
+
+Contributor proof cards are small Markdown records for accepted MCP Observatory contributions. They are designed to be linked from the contributor page, target gallery, GitHub profile badges, and maintainer PRs.
+
+Each proof card must point to public proof only: a merged PR, generated Safety Index artifact, public report, upstream workflow, or maintainer-visible issue. Do not include private telemetry, secrets, local paths, unpublished maintainer data, or private repo details.
+
+## Proof Card Template
+
+Copy this template into a new file named after the target or contribution:
+
+```md
+# MCP Observatory Proof: <target or contribution name>
+
+| Field | Value |
+| --- | --- |
+| Contributor | [@username](https://github.com/username) |
+| Role | Target Verifier |
+| Target | Example MCP Server |
+| Date | YYYY-MM-DD |
+| Observatory Version | v0.27.0 or later |
+| Verdict | Ready for CI / Needs maintainer review / Not reproducible yet |
+| Merged PR | https://github.com/KryptosAI/mcp-observatory/pull/000 |
+| Generated Evidence | docs/safety-index/artifacts/example-server.md |
+| Public Report | docs/mcp-server-safety-index.md |
+```
+
+## Badge Link Pattern
+
+After the proof card is merged, contributors can link a badge directly to the proof card:
+
+```md
+[![MCP Observatory Safety Index Contributor](https://img.shields.io/badge/MCP%20Observatory-Safety%20Index%20Contributor-16a34a)](https://github.com/KryptosAI/mcp-observatory/blob/main/docs/contributor-proof-cards/example-server.md)
+```

package/docs/contributor-recognition.md

@@ -0,0 +1,92 @@
+# MCP Observatory Contributors
+
+MCP Observatory recognizes useful public evidence, not vanity activity. A good contribution helps maintainers and agents trust one more MCP server: a safe startup command, a reproducible target, a CI adoption PR, a SARIF/Code Scanning improvement, a review, or a better agent prompt.
+
+Official GitHub profile achievements are platform-controlled; this project does not award them. The project-level substitute is public proof: contributor roles, All Contributors credit, proof cards, recognition links, and links to merged PRs or generated artifacts.
+
+## Recognition Roles
+
+| Role | What Counts | Public Proof |
+| --- | --- | --- |
+| Target Scout | Finds a public MCP server with a no-secret, non-destructive startup command | Issue, PR, or target suggestion linked to the command |
+| Target Verifier | Adds a Safety Index target and generated evidence | Merged PR plus JSON/Markdown artifacts |
+| CI Integrator | Adds Observatory CI, `setup-ci --doctor`, or SARIF upload to a repo | Upstream PR, workflow file, or adoption artifact |
+| SARIF Fixer | Improves normalized findings, GitHub Code Scanning output, or docs that help a maintainer reproduce SARIF | Merged PR, SARIF sample, or Code Scanning demo artifact |
+| Maintainer Partner | Confirms safe startup behavior, reviews evidence, or accepts an integration PR for their MCP server | Maintainer comment, merged upstream PR, or issue acceptance |
+| Docs/Agent Prompt Contributor | Improves docs, `llms.txt`, `AGENTS.md`, or copy-paste tasks agents can run safely | Merged docs PR or prompt artifact |
+
+## Contribution Ladder
+
+| Level | Name | How To Earn It | Typical Reward |
+| --- | --- | --- | --- |
+| 1 | Target Scout | Submit one safe startup command for a public MCP server | Role mention and badge snippet |
+| 2 | Target Verifier | Add a target PR with generated Safety Index evidence | Proof card and All Contributors credit |
+| 3 | CI Integrator | Help an upstream repo add Observatory CI/SARIF | CI Integrator badge and proof link |
+| 4 | Maintainer Partner | Help another maintainer review, merge, or tune adoption | Maintainer Partner role and proof card |
+| 5 | Ecosystem Maintainer | Repeatedly help targets, docs, reviews, or agent tasks stay current | Featured recognition on this page |
+
+## What One Target PR Gets You
+
+One merged target PR may result in after maintainer review:
+
+- an All Contributors entry in [CONTRIBUTORS.md](../CONTRIBUTORS.md)
+- a role on this page
+- a proof card under [`docs/contributor-proof-cards/`](./contributor-proof-cards/)
+- a badge snippet you can place in your GitHub profile or project README
+- links to the merged PR and generated public evidence
+
+Recognition links to public proof only. Do not include private telemetry, local machine paths, secrets, unpublished maintainer data, or private repo details.
+
+## Badge Snippets
+
+Replace the link target with the merged proof card or PR for your contribution.
+
+### Target Scout
+
+```md
+[![MCP Observatory Target Scout](https://img.shields.io/badge/MCP%20Observatory-Target%20Scout-2563eb)](https://github.com/KryptosAI/mcp-observatory/blob/main/docs/contributor-proof-cards/README.md)
+```
+
+### Safety Index Contributor
+
+```md
+[![MCP Observatory Safety Index Contributor](https://img.shields.io/badge/MCP%20Observatory-Safety%20Index%20Contributor-16a34a)](https://github.com/KryptosAI/mcp-observatory/blob/main/docs/contributor-proof-cards/README.md)
+```
+
+### CI Integrator
+
+```md
+[![MCP Observatory CI Integrator](https://img.shields.io/badge/MCP%20Observatory-CI%20Integrator-7c3aed)](https://github.com/KryptosAI/mcp-observatory/blob/main/docs/contributor-proof-cards/README.md)
+```
+
+### Maintainer Partner
+
+```md
+[![MCP Observatory Maintainer Partner](https://img.shields.io/badge/MCP%20Observatory-Maintainer%20Partner-f97316)](https://github.com/KryptosAI/mcp-observatory/blob/main/docs/contributor-proof-cards/README.md)
+```
+
+## Current Recognition
+
+| Contributor | Role | Public Proof |
+| --- | --- | --- |
+| [William Weishuhn](https://github.com/KryptosAI) | Founding maintainer, CI Integrator, SARIF Fixer, Docs/Agent Prompt Contributor | [All Contributors entry](../CONTRIBUTORS.md), [Code Scanning demo](./code-scanning-demo.md), [Agent Task Pack](./agent-tasks.md) |
+
+External contributors are added after a merged PR, an accepted target artifact, or maintainer-confirmed upstream adoption.
+
+## Request Credit
+
+For bot-assisted recognition, comment on the merged PR or issue:
+
+```text
+@all-contributors please add @username for code, doc, test, ideas, review
+```
+
+For Observatory-specific recognition, include:
+
+- GitHub username
+- contribution role
+- merged PR or accepted issue
+- generated artifact or proof-card link
+- badge type requested
+
+Useful contributions are evidence-first. Spammy issues, vanity stars, and unsafe target commands do not count.

package/docs/feishu-lark-mcp.md

@@ -45,7 +45,7 @@ jobs:
       MCP_OBSERVATORY_CONTACT: your-team-contact
     steps:
       - uses: actions/checkout@v4
-      - uses: KryptosAI/mcp-observatory/action@v0.26.1
+      - uses: KryptosAI/mcp-observatory/action@v0.27.0
         with:
           target: feishu-target.json
           security: true