@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/COMMERCIAL.md

@@ -4,12 +4,37 @@ MCP Observatory is the CI and security gate for MCP servers before agents depend
 
 The open source CLI and MCP server remain free for local OSS use under the MIT license. Paid pilots are for production use cases where a team needs hosted reporting, private repository CI, security reports, certification, support, or fleet visibility.
 
-## Pilot Pricing
+See the [open core and commercial boundary](./docs/commercial-boundary.md) for the explicit line between public evidence surfaces and proprietary intelligence/reporting workflows.
+
+## Open Core Boundary
+
+MCP Observatory intentionally keeps the local evidence engine open: CLI checks, safe attack simulation, audit profiles, SARIF, GitHub Actions setup, artifact schemas, public health scores, and public Safety Index receipts.
+
+Commercial value should stay in the private workflow around that evidence:
+
+- hosted CI history and fleet visibility
+- private repository and internal MCP reporting
+- account/company intelligence derived from private telemetry
+- proprietary portfolio risk ranking and lead prioritization
+- buyer-ready evidence packs, remediation notes, and procurement deliverables
+- runtime/flight-recorder storage, alerting, retention, and SIEM export
+
+The public project should prove the method. Paid pilots should save production teams time and give them a defensible decision record.
+
+## MCP Attack Simulation Evidence Pack
+
+The primary paid offer is a fixed-scope [MCP Attack Simulation Evidence Pack](./docs/attack-simulation-pilot.md) starting at `$15,000`.
+
+It includes safe-mode MCP attack simulation, CI rollout, SARIF/GitHub Code Scanning setup, private evidence reporting, prioritized remediation notes, and maintainer PR support for selected MCP servers.
 
 These are starting points for current pilots, not permanent fixed plans. For public OSS users, the important part is simple: local CLI use remains free, and paid work is for private or production support needs.
 
 | Pilot | Starting Price | Best Fit |
 | --- | ---: | --- |
+| Attack Simulation Quickstart | $15,000 | One high-value MCP server or one team adopting MCP |
+| Attack Simulation Evidence Pack | $25,000 | Up to 10 MCP servers, executive evidence packet, remediation notes, and CI rollout |
+| Platform Attack Simulation Pilot | $50,000 | Multi-team MCP review, fleet inventory, recurring review plan, and stakeholder readout |
+| MCP Readiness Review | $2,500 | Narrow CI rollout, Code Scanning, private readiness report, and prioritized fixes |
 | Team Pilot | $299/month | Small teams adding MCP regression checks to CI |
 | Business Pilot | $999/month | Private repos, recurring security reports, and shared reporting |
 | Enterprise Pilot | $3k/month | Private MCP readiness reports, support, and fleet visibility |
@@ -17,13 +42,14 @@ These are starting points for current pilots, not permanent fixed plans. For pub
 
 Contact: open a pilot request from the GitHub issue chooser.
 
-Primary pilot offer: private MCP readiness review + CI rollout + drift/security report.
+Primary pilot offer: private MCP attack simulation evidence pack + CI rollout + SARIF/Code Scanning + drift/security report.
 
 ## Paid Production Use
 
 Paid pilots can include:
 
 - Hosted CI history and private-repo reporting
+- Safe-mode MCP attack simulation and evidence packs
 - MCP security reports and controlled drift review
 - Fleet inventory across teams, repos, and environments
 - Static enterprise reports generated from existing run artifacts

package/CONTRIBUTORS.md

@@ -0,0 +1,39 @@
+# Contributors
+
+MCP Observatory uses the [All Contributors](https://allcontributors.org/) spec so code, docs, tests, target research, reviews, security findings, design, and maintainer feedback can all receive visible credit.
+
+Official GitHub profile achievements are platform-controlled; this project does not award them. Instead, contributors get public proof: a role on the recognition page, an All Contributors entry, and a proof card or recognition link they can reference from a README or GitHub profile.
+
+See the full recognition path in [MCP Observatory Contributors](./docs/contributor-recognition.md).
+
+<!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
+[![All Contributors](https://img.shields.io/badge/all_contributors-1-orange.svg?style=flat-square)](#contributors-)
+<!-- ALL-CONTRIBUTORS-BADGE:END -->
+
+## Contributors
+
+<!-- ALL-CONTRIBUTORS-LIST:START - Do not remove or modify this section -->
+<!-- prettier-ignore-start -->
+<!-- markdownlint-disable -->
+<table>
+  <tbody>
+    <tr>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/KryptosAI"><img src="https://avatars.githubusercontent.com/u/140749029?s=100" width="100px;" alt="William Weishuhn"/><br /><sub><b>William Weishuhn</b></sub></a><br /><a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Code">💻</a> <a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Documentation">📖</a> <a href="#ideas-KryptosAI" title="Ideas, Planning, & Feedback">🤔</a> <a href="#maintenance-KryptosAI" title="Maintenance">🚧</a> <a href="https://github.com/KryptosAI/mcp-observatory/commits?author=KryptosAI" title="Tests">⚠️</a></td>
+    </tr>
+  </tbody>
+</table>
+
+<!-- markdownlint-restore -->
+<!-- prettier-ignore-end -->
+
+<!-- ALL-CONTRIBUTORS-LIST:END -->
+
+## Recognition Requests
+
+After a useful contribution is merged or accepted, request credit in the PR or issue:
+
+```text
+@all-contributors please add @username for code, doc, test, ideas, review
+```
+
+If the bot is unavailable, open a small PR that updates `.all-contributorsrc`, this file, and any relevant proof card under `docs/contributor-proof-cards/`.

package/README.md

@@ -11,41 +11,125 @@
 ```
 
 [![CI](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/codeql.yml)
+[![Coverage](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml/badge.svg)](https://github.com/KryptosAI/mcp-observatory/actions/workflows/coverage.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/KryptosAI/mcp-observatory/badge)](https://securityscorecards.dev/viewer/?uri=github.com/KryptosAI/mcp-observatory)
+[![Dependabot](https://img.shields.io/badge/dependabot-enabled-025e8c?logo=dependabot)](./.github/dependabot.yml)
+[![npm provenance workflow](https://img.shields.io/badge/npm%20provenance-workflow-blue)](./.github/workflows/release.yml)
 [![npm](https://img.shields.io/npm/v/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
-[![npm downloads](https://img.shields.io/npm/dm/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
+[![npm weekly downloads](https://img.shields.io/npm/dw/@kryptosai/mcp-observatory)](https://www.npmjs.com/package/@kryptosai/mcp-observatory)
+[![GitHub stars](https://img.shields.io/github/stars/KryptosAI/mcp-observatory?style=flat)](https://github.com/KryptosAI/mcp-observatory/stargazers)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
 [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-339933)](./package.json)
 [![Smithery](https://smithery.ai/badge/@kryptosai/mcp-observatory)](https://smithery.ai/server/@kryptosai/mcp-observatory)
 [![mcp-observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/score.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
+[![All Contributors](https://img.shields.io/badge/all_contributors-1-orange.svg?style=flat-square)](./CONTRIBUTORS.md)
 
-**The GitHub-native CI and security gate for MCP servers before agents depend on them.**
+**MCP Observatory is a security release gate for MCP servers. It helps teams validate MCP servers before deployment into sensitive, regulated, or mission-critical agentic AI environments.**
 
-Agents should not depend on tools nobody tests. MCP Observatory gives MCP servers the production safety rails every dependency eventually needs: CI checks, security scans, schema drift detection, PR reports, score badges, agent-accessible diagnostics, and GitHub Code Scanning findings.
+Agents should not depend on tools nobody tests. MCP Observatory turns a local MCP check into release-gate evidence maintainers and security teams already understand: profile-mapped audit reports, normalized findings, SARIF for GitHub Code Scanning, GitHub Actions gates, schema drift detection, trust status output, score badges, and agent-accessible diagnostics.
 
-Security launch path:
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md
+```
+
+Sample trust output:
+
+```json
+{
+  "target_id": "my-mcp-server",
+  "profile": "nsa-mcp",
+  "score": 87,
+  "status": "needs_review",
+  "finding_count": 2
+}
+```
+
+The `nsa-mcp` profile is not an official certification. It maps MCP Observatory findings to practical control areas for sensitive environments: trust boundaries, tool permissions, tool description integrity, authentication, secrets exposure, schema validation, input validation, auditability, runtime safety, and supply chain.
+
+## Trust Signals
+
+| Signal | What it means |
+|---|---|
+| CI + coverage | Typecheck, lint, tests, build, packed install, artifact validation, smoke test, and measured coverage run in GitHub Actions. |
+| CodeQL + OpenSSF Scorecard | Static analysis and supply-chain posture are visible in GitHub-native security surfaces. |
+| Dependabot | npm and GitHub Actions dependency updates are monitored weekly. |
+| npm provenance workflow | Release automation is prepared for npm provenance through GitHub OIDC. |
+| Security policy | Vulnerability reports go through private disclosure; see [SECURITY.md](./SECURITY.md). |
+
+## Try It
+
+Run a buyer-ready MCP security audit:
 
 ```bash
-npx @kryptosai/mcp-observatory test npx -y my-mcp-server --sarif mcp-observatory.sarif
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output report.md
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format sarif --output results.sarif
+npx @kryptosai/mcp-observatory score npx -y my-mcp-server --profile nsa-mcp --format json
 ```
 
-Or install the GitHub Action with Code Scanning upload:
+Or start with the homepage demo: safely simulate MCP attack-readiness for one server, emit an action receipt, and produce SARIF evidence that maintainers can inspect in GitHub Code Scanning.
+
+```bash
+npx @kryptosai/mcp-observatory attack-sim npx -y my-mcp-server --sarif attack-results.sarif
+```
+
+Emit the portable trust record:
+
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format json --output report.json --receipt receipt.json
+npx @kryptosai/mcp-observatory receipt npx -y my-mcp-server --profile nsa-mcp --format markdown --output receipt.md
+```
+
+Then make the evidence repeatable in CI:
 
 ```bash
 npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif
 ```
 
-See [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md).
+See the [government and enterprise pilot brief](./docs/government-enterprise-pilot.md), [public guidance crosswalk](./docs/public-guidance-crosswalk.md), [procurement one-pager](./docs/procurement-one-pager.md), [security due diligence packet](./docs/security-due-diligence.md), [NSA-MCP audit CI guide](./docs/nsa-mcp-audit-ci.md), [example NSA-MCP audit report](./docs/examples/nsa-mcp-audit-report.md), [MCP Receipts](./docs/mcp-receipts.md), [MCP Attack Simulator](./docs/mcp-attack-simulator.md), [Tool-call receipts](./docs/tool-call-receipts.md), [MCP Receipt Graph](./docs/receipt-graph.md), [launch page](./docs/launch.md), [GitHub Code Scanning demo](./docs/code-scanning-demo.md), [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), [sample safety reports](./docs/mcp-server-safety-index.md), and [reference evaluations](./docs/reference-evaluations.md).
+
+Want a receipt for a server your agent depends on? Comment on [Drop an MCP server, get a receipt #146](https://github.com/KryptosAI/mcp-observatory/issues/146) or use the [structured receipt request form](https://github.com/KryptosAI/mcp-observatory/issues/new?template=tool-call-receipt-request.yml). Public requests can become Safety Index entries, delta receipts, SARIF evidence, and maintainer CI conversations.
+
+## Evidence You Can Inspect
+
+| Evidence | Where |
+|---|---|
+| Example GitHub Actions adoption | [`setup-ci --all`](./docs/setup-ci-doctor.md) and the generated workflow docs |
+| NSA-MCP audit example | [Markdown report](./docs/examples/nsa-mcp-audit-report.md), [SARIF](./docs/examples/nsa-mcp-results.sarif), and [score JSON](./docs/examples/nsa-mcp-score.json) |
+| Procurement and pilot packet | [Public guidance crosswalk](./docs/public-guidance-crosswalk.md), [procurement one-pager](./docs/procurement-one-pager.md), and [security due diligence](./docs/security-due-diligence.md) |
+| Attack simulation output | [MCP Attack Simulator](./docs/mcp-attack-simulator.md) |
+| MCP receipts | [Portable trust receipts](./docs/mcp-receipts.md) |
+| Tool-call receipts | [Receipt standard](./docs/tool-call-receipts.md) for reproducible MCP evidence |
+| Receipt graph | [Server-to-evidence map](./docs/receipt-graph.md) for agent trust decisions |
+| SARIF / Code Scanning output | [GitHub Code Scanning demo](./docs/code-scanning-demo.md) |
+| Real MCP server evaluations | [MCP Server Safety Index](./docs/mcp-server-safety-index.md) |
+| Reference reports | [Reference evaluations](./docs/reference-evaluations.md) |
+| Maintainer and contributor proof | [MCP Observatory Contributors](./docs/contributor-recognition.md) |
+| Open core boundary | [What is open vs. commercial](./docs/commercial-boundary.md) |
+| Security disclosure path | [SECURITY.md](./SECURITY.md) |
 
 Two more fast paths:
 
-Cloned this repo? Start here: [`CLONED_THIS.md`](./CLONED_THIS.md). Want to contribute? Add one server to the [MCP Target Registry](./docs/target-registry.md).
+Cloned this repo? Start here: [`CLONED_THIS.md`](./CLONED_THIS.md). Want to contribute? Add one server to the [MCP Target Registry](./docs/target-registry.md), use the [Agent Task Pack](./docs/agent-tasks.md), and get public credit through [MCP Observatory Contributors](./docs/contributor-recognition.md).
+
+AI coding agents, agentic workflows, and rough PRs are welcome. Use the [10x Agentic Growth Sprint](./docs/10x-agentic-growth-sprint.md), [Agentic Contributor Outreach](./docs/agentic-contributor-outreach.md), or open a `Contributor quest`, `Agentic contribution idea`, or [`Drop an MCP server, get a receipt`](./docs/drop-server-get-receipt.md) issue to suggest a target, prompt, docs fix, receipt, or `setup-ci --sarif` integration.
 
-Add MCP CI in one command:
+Add MCP CI and Code Scanning in one command:
 
 ```bash
-npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server"
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif --schedule weekly
 ```
 
+Repair or upgrade an existing adoption kit:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --doctor --fix
+```
+
+Installing MCP Observatory in an MCP server project also prints the exact CI setup command. Projects can opt into automatic workflow creation during install with [`mcpObservatory.autoSetupCi`](./docs/automatic-ci-integration.md).
+
+Normal `scan` and `test` runs include safe attack-readiness simulation by default. Use `--no-attack-sim` only when you want the older compatibility-only path.
+
 Upload normalized MCP findings to GitHub Code Scanning when you want a security-native release gate:
 
 ```bash
@@ -74,6 +158,8 @@ Use it as a CLI, a GitHub Action, or an MCP server that lets your AI agent scan,
 
 [![Observatory MCP server](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory/badges/card.svg)](https://glama.ai/mcp/servers/KryptosAI/mcp-observatory)
 
+The Glama card is an external MCP directory scorecard. Treat it as directory-level social proof; click through for the underlying category details before using it as a production approval signal.
+
 ## Why MCP Observatory
 
 MCP servers are becoming production dependencies. If agents rely on them, teams need a way to catch broken tools, unsafe schemas, schema drift, slow responses, and security footguns before those failures reach users.
@@ -81,6 +167,9 @@ MCP servers are becoming production dependencies. If agents rely on them, teams
 Observatory gives maintainers and teams:
 
 - **One-command CI setup** with `setup-ci --all`
+- **Profile-mapped audits** with `audit --profile nsa-mcp`
+- **MCP receipts** that package target, evidence, verdict, action, and reproduction commands
+- **Action receipts** that say `allow`, `gate`, `rerun`, `quarantine`, or `escalate`
 - **GitHub PR comments** for compatibility, drift, and security findings
 - **GitHub Code Scanning SARIF** for normalized MCP findings
 - **Health score badges** for public trust signals
@@ -88,19 +177,21 @@ Observatory gives maintainers and teams:
 - **MCP server mode** so agents can inspect other MCP servers directly
 - **Production support path** for hosted history, private repo reporting, certification, support, and fleet visibility
 
-See [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), the [target registry](./docs/target-registry.md), [target contribution guide](./docs/target-contribution-guide.md), [`setup-ci --doctor`](./docs/setup-ci-doctor.md), [MCP server security field guide](./docs/mcp-security-field-guide.md), [Safety Methodology](./docs/methodology.md), [MCP Server Safety Index](./docs/mcp-server-safety-index.md), [June 2026 safety field report](./docs/mcp-safety-field-report-2026-06.md), [reference evaluations](./docs/reference-evaluations.md), [MCP lock files](./docs/mcp-lock-files.md), [public proof](./docs/proof.md), [local metrics dashboard](./docs/metrics-dashboard.md), and [commercial support](./COMMERCIAL.md).
+See the [launch page](./docs/launch.md), [GitHub Code Scanning for MCP servers](./docs/github-code-scanning-for-mcp.md), [Code Scanning demo](./docs/code-scanning-demo.md), [target gallery](./docs/target-gallery.md), [target registry](./docs/target-registry.md), [target contribution guide](./docs/target-contribution-guide.md), [MCP Observatory Contributors](./docs/contributor-recognition.md), [Agent Task Pack](./docs/agent-tasks.md), [MCP Receipts](./docs/mcp-receipts.md), [Tool-call receipts](./docs/tool-call-receipts.md), [MCP Receipt Graph](./docs/receipt-graph.md), [`setup-ci --doctor`](./docs/setup-ci-doctor.md), [MCP server security field guide](./docs/mcp-security-field-guide.md), [Safety Methodology](./docs/methodology.md), [MCP Server Safety Index](./docs/mcp-server-safety-index.md), [June 2026 safety field report](./docs/mcp-safety-field-report-2026-06.md), [reference evaluations](./docs/reference-evaluations.md), [MCP lock files](./docs/mcp-lock-files.md), [public proof](./docs/proof.md), [campaign attribution](./docs/campaign-attribution.md), [local metrics dashboard](./docs/metrics-dashboard.md), [open core boundary](./docs/commercial-boundary.md), [MCP Attack Simulation Evidence Pack](./docs/attack-simulation-pilot.md), and [commercial support](./COMMERCIAL.md).
 
 ## For Security And Platform Teams
 
 MCP servers are becoming part of the AI software supply chain. Agents need reliable, testable, auditable tools before those tools become dependencies in mission-critical workflows.
 
-MCP Observatory gives security and platform teams MCP server CI, schema drift detection, security findings, SARIF/HTML/Markdown reports, GitHub Code Scanning upload, and a path toward certification or fleet visibility. Local OSS use stays free; production, private repo, and fleet usage can move through a paid pilot.
+MCP Observatory gives security and platform teams MCP server CI, schema drift detection, security findings, SARIF/HTML/Markdown reports, GitHub Code Scanning upload, and a path toward certification or fleet visibility. Local OSS use stays free; production, private repo, and fleet usage can move through a paid MCP Readiness Review.
 
 ## Production Support
 
-Local OSS use stays free under MIT. Teams running MCP in production can use [commercial support](./COMMERCIAL.md) for hosted reporting, private repo CI, recurring security reports, certification review, support, and fleet visibility.
+Local OSS use stays free under MIT. Teams running MCP in production can use the [MCP Attack Simulation Evidence Pack](./docs/attack-simulation-pilot.md) for safe-mode attack simulation, SARIF/Code Scanning setup, CI rollout, private evidence reporting, and owner-ready remediation notes. Attack simulation packages start at `$15,000`; narrow readiness reviews start at `$2,500`.
+
+The open source repo is the public evidence engine. Private telemetry intelligence, company/account prioritization, commercial ranking weights, hosted fleet workflows, and buyer-specific evidence packs stay outside the OSS package; see the [open core boundary](./docs/commercial-boundary.md).
 
-Run `npx @kryptosai/mcp-observatory cloud`, open a pilot request from the issue chooser, or see [COMMERCIAL.md](./COMMERCIAL.md). Also see [privacy and telemetry](./PRIVACY.md) and [terms for production use](./TERMS.md).
+Run `npx @kryptosai/mcp-observatory cloud`, open a pilot request from the issue chooser, or see [COMMERCIAL.md](./COMMERCIAL.md). Also see [privacy and telemetry](./PRIVACY.md), [campaign attribution](./docs/campaign-attribution.md), and [terms for production use](./TERMS.md).
 
 ## Quick Start
 
@@ -145,9 +236,9 @@ Or add it manually to your config:
 
 | Command | What it does |
 |---------|-------------|
-| `scan` | Auto-discover servers from config files and check them all (default) |
-| `scan deep` | Scan and also invoke safe tools to verify they execute |
-| `test <cmd>` / `test --target <file>` | Test a specific server by command or target config |
+| `scan` | Auto-discover servers, check them, and run safe attack-readiness simulation by default |
+| `scan deep` | Scan, run safe attack simulation, and also invoke safe tools to verify they execute |
+| `test <cmd>` / `test --target <file>` | Test one server and emit an action receipt by command or target config |
 | `record <cmd>` | Record a server session to a cassette file for offline replay |
 | `replay <cassette>` | Replay a cassette offline — no live server needed |
 | `verify <cassette> <cmd>` | Verify a live server still matches a recorded cassette |
@@ -161,6 +252,7 @@ Or add it manually to your config:
 | `setup-ci` / `init-ci` | Create a GitHub Action and badge snippet for MCP compatibility/security checks |
 | `setup-ci --sarif` | Generate a workflow that uploads normalized findings to GitHub Code Scanning |
 | `setup-ci --doctor` | Inspect whether the repository has a complete CI adoption kit |
+| `--no-attack-sim` | Opt out of the default safe attack simulation on `scan` or `test` |
 | `ci-report` | Generate CI report for GitHub issue creation |
 | `enterprise-report` | Generate a static production/security report from run artifacts |
 | `score <cmd>` | Score an MCP server's health (0-100) |
@@ -232,7 +324,7 @@ When you run `scan`, it looks for MCP configs in:
 Add Observatory to your MCP server's CI pipeline:
 
 ```bash
-npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server"
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif --schedule weekly
 ```
 
 Check the adoption kit:
@@ -241,6 +333,8 @@ Check the adoption kit:
 npx @kryptosai/mcp-observatory setup-ci --doctor
 ```
 
+Successful `test`, `run`, and single-target `scan` checks also offer to convert the passing result into a CI adoption kit. That automatic conversion enables SARIF/Code Scanning and weekly scheduled checks by default; pass `--no-ci-sarif` when you only want a conservative workflow without Code Scanning upload.
+
 Or create the workflow manually:
 
 ```yaml
@@ -256,7 +350,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: KryptosAI/mcp-observatory/action@v0.26.1
+      - uses: KryptosAI/mcp-observatory/action@v1.28.0
         with:
           command: npx -y my-mcp-server
           deep: true
@@ -362,9 +456,7 @@ Your agent gets 10 tools:
 | `get_last_run` | Retrieve previous check results for a server |
 | `suggest_servers` | Discover MCP servers that match your project stack |
 
-An AI tool that checks other AI tools. It's a tool testing tools that serve tools.*
-
-<sub>* I'm a dude playing a dude disguised as another dude.</sub>
+An AI tool that checks other AI tools. It is a tool testing tools that serve tools.
 
 ### Security
 

package/dist/src/action-receipt.d.ts

@@ -0,0 +1,20 @@
+import { type ObservatoryFindingSeverity } from "./findings.js";
+import type { RunArtifact } from "./types.js";
+export type ReceiptAction = "allow" | "gate" | "rerun" | "quarantine" | "escalate";
+export declare function recommendedActionForFinding(input: {
+    attackClass?: string;
+    category?: string;
+    ruleId?: string;
+    severity?: ObservatoryFindingSeverity | "warning" | "error";
+}): ReceiptAction;
+export interface ActionReceipt {
+    action: ReceiptAction;
+    reason: string;
+    topFindings: Array<{
+        severity: ObservatoryFindingSeverity;
+        ruleId: string;
+        message: string;
+    }>;
+}
+export declare function buildActionReceipt(artifact: RunArtifact): ActionReceipt;
+export declare function renderActionReceipt(artifact: RunArtifact): string;

package/dist/src/action-receipt.js

@@ -0,0 +1,85 @@
+import { extractObservatoryFindings } from "./findings.js";
+const ACTION_RANK = {
+    allow: 0,
+    rerun: 1,
+    gate: 2,
+    quarantine: 3,
+    escalate: 4,
+};
+function stronger(a, b) {
+    return ACTION_RANK[a] >= ACTION_RANK[b] ? a : b;
+}
+function normalizeReceiptAction(value) {
+    return value === "allow" || value === "gate" || value === "rerun" || value === "quarantine" || value === "escalate"
+        ? value
+        : undefined;
+}
+export function recommendedActionForFinding(input) {
+    const severity = input.severity === "error" ? "high"
+        : input.severity === "warning" ? "medium"
+            : input.severity;
+    const ruleId = input.ruleId ?? "";
+    const attackClass = input.attackClass ?? "";
+    if (severity === "high" && (attackClass === "exfiltration-canary" ||
+        ruleId.includes("credential") ||
+        ruleId.includes("canary") ||
+        ruleId.includes("secret"))) {
+        return "escalate";
+    }
+    if (severity === "high" && input.category === "runtime")
+        return "rerun";
+    if (severity === "high" && (input.category === "attack-sim" || ruleId.includes("attack-sim")))
+        return "quarantine";
+    if (severity === "high")
+        return "gate";
+    if (severity === "medium" && attackClass === "contract-drift")
+        return "rerun";
+    if (severity === "medium")
+        return "gate";
+    if (severity === "low")
+        return "allow";
+    return "allow";
+}
+export function buildActionReceipt(artifact) {
+    if (artifact.fatalError) {
+        return {
+            action: "rerun",
+            reason: "The MCP server did not complete startup/readiness checks.",
+            topFindings: [{ severity: "high", ruleId: "mcp-observatory/run/fatal-error", message: artifact.fatalError.split("\n")[0] ?? artifact.fatalError }],
+        };
+    }
+    const findings = extractObservatoryFindings(artifact);
+    let action = artifact.gate === "pass" ? "allow" : "gate";
+    for (const finding of findings) {
+        const storedAction = normalizeReceiptAction(finding.recommendedAction);
+        const computedAction = recommendedActionForFinding({
+            attackClass: typeof finding.evidence?.["attackClass"] === "string" ? finding.evidence["attackClass"] : undefined,
+            category: finding.category,
+            ruleId: finding.ruleId,
+            severity: finding.severity,
+        });
+        action = stronger(action, storedAction ?? computedAction);
+    }
+    const severityRank = { high: 3, medium: 2, low: 1, info: 0 };
+    const topFindings = findings
+        .sort((a, b) => severityRank[b.severity] - severityRank[a.severity])
+        .slice(0, 3)
+        .map((finding) => ({ severity: finding.severity, ruleId: finding.ruleId, message: finding.message }));
+    const reason = topFindings[0]?.message ?? "No blocking MCP readiness findings were detected.";
+    return { action, reason, topFindings };
+}
+export function renderActionReceipt(artifact) {
+    const receipt = buildActionReceipt(artifact);
+    const lines = [
+        `Action Receipt: ${receipt.action}`,
+        `Reason: ${receipt.reason}`,
+    ];
+    if (receipt.topFindings.length > 0) {
+        lines.push("Top evidence:");
+        for (const finding of receipt.topFindings) {
+            lines.push(`- [${finding.severity}] ${finding.ruleId}: ${finding.message}`);
+        }
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=action-receipt.js.map

package/dist/src/action-receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-receipt.js","sourceRoot":"","sources":["../../src/action-receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAmC,MAAM,eAAe,CAAC;AAK5F,MAAM,WAAW,GAAkC;IACjD,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,UAAU,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,SAAS,QAAQ,CAAC,CAAgB,EAAE,CAAgB;IAClD,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,UAAU;QACjH,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAK3C;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM;QAClD,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ;YACzC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAC5C,IAAI,QAAQ,KAAK,MAAM,IAAI,CACzB,WAAW,KAAK,qBAAqB;QACrC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC7B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC1B,EAAE,CAAC;QACF,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACxE,IAAI,QAAQ,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAAE,OAAO,YAAY,CAAC;IACnH,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACvC,IAAI,QAAQ,KAAK,QAAQ,IAAI,WAAW,KAAK,gBAAgB;QAAE,OAAO,OAAO,CAAC;IAC9E,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,MAAM,UAAU,kBAAkB,CAAC,QAAqB;IACtD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,2DAA2D;YACnE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iCAAiC,EAAE,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;SACnJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,GAAkB,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACxE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,2BAA2B,CAAC;YACjD,WAAW,EAAE,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;YAChH,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,IAAI,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,YAAY,GAA+C,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACzG,MAAM,WAAW,GAAG,QAAQ;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;SACnE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,mDAAmD,CAAC;IAE9F,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAqB;IACvD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG;QACZ,mBAAmB,OAAO,CAAC,MAAM,EAAE;QACnC,WAAW,OAAO,CAAC,MAAM,EAAE;KAC5B,CAAC;IACF,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/adapters/http.js

@@ -18,8 +18,6 @@ export class HttpAdapter {
             throw new Error(`Unsupported protocol "${url.protocol}" — only http: and https: are allowed.`);
         }
         const timeoutMs = target.timeoutMs ?? 15_000;
-        // Try streamable-http first, fall back to SSE
-        let connected = false;
         let activeTransport;
         try {
             let transport = new StreamableHTTPClientTransport(url, { requestInit: { headers } });
@@ -27,19 +25,17 @@ export class HttpAdapter {
                 transport = new RecordingTransport(transport);
             await client.connect(transport, { timeout: timeoutMs });
             activeTransport = transport;
-            connected = true;
         }
         catch {
             stderrLines.push("Streamable HTTP failed, falling back to SSE.");
         }
-        if (!connected) {
+        if (!activeTransport) {
             try {
                 let transport = new SSEClientTransport(url, { requestInit: { headers } });
                 if (options?.record)
                     transport = new RecordingTransport(transport);
                 await client.connect(transport, { timeout: timeoutMs });
                 activeTransport = transport;
-                connected = true;
             }
             catch (error) {
                 const rawMessage = errorMessage(error);

package/dist/src/adapters/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,MAAwB,EAAE,OAA+B;QACrE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QAEF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAE7C,8CAA8C;QAC9C,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,eAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,SAAS,GAAc,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAChG,IAAI,OAAO,EAAE,MAAM;gBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,eAAe,GAAG,SAAS,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,SAAS,GAAc,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE,MAAM;oBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxD,eAAe,GAAG,SAAS,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;gBAC5E,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAEhD,OAAO;YACL,MAAM;YACN,kBAAkB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YAClD,UAAU,EAAE,aAAa,EAAE,IAAI;YAC/B,aAAa,EAAE,aAAa,EAAE,OAAO;YACrC,WAAW;YACX,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/adapters/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAInG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,OAAO,WAAW;IACtB,KAAK,CAAC,OAAO,CAAC,MAAwB,EAAE,OAA+B;QACrE,MAAM,OAAO,GAA2B,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,EAClD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;QAEF,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,QAAQ,wCAAwC,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAE7C,IAAI,eAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,IAAI,SAAS,GAAc,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAChG,IAAI,OAAO,EAAE,MAAM;gBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YACxD,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,SAAS,GAAc,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrF,IAAI,OAAO,EAAE,MAAM;oBAAE,SAAS,GAAG,IAAI,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBACnE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxD,eAAe,GAAG,SAAS,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B;gBAC5E,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAEhD,OAAO;YACL,MAAM;YACN,kBAAkB,EAAE,MAAM,CAAC,qBAAqB,EAAE;YAClD,UAAU,EAAE,aAAa,EAAE,IAAI;YAC/B,aAAa,EAAE,aAAa,EAAE,OAAO;YACrC,WAAW;YACX,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACxD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/src/audit.d.ts

@@ -0,0 +1,64 @@
+import { type SecurityControlArea, type SecurityProfile } from "./security-profiles.js";
+import type { RunArtifact, TargetConfig } from "./types.js";
+export type AuditSeverity = "info" | "low" | "medium" | "high" | "critical";
+export type TrustStatus = "enterprise_ready" | "scanned" | "needs_review" | "high_risk" | "critical_risk";
+export interface NormalizedSecurityFinding {
+    id: string;
+    check_id: string;
+    rule_id: string;
+    title: string;
+    description: string;
+    severity: AuditSeverity;
+    category: string;
+    target: {
+        target_id: string;
+        subject_type: string;
+        subject_name?: string;
+    };
+    evidence: Record<string, unknown>;
+    recommendation: string;
+    confidence: "low" | "medium" | "high";
+    fingerprint: string;
+    control_mappings: SecurityControlArea[];
+    generated_at: string;
+}
+export interface AuditSummary {
+    profile: string;
+    generated_at: string;
+    target_id: string;
+    score: number;
+    trust_status: TrustStatus;
+    finding_count: number;
+    pass_count: number;
+    warning_count: number;
+    fail_count: number;
+    severity_counts: Record<AuditSeverity, number>;
+    control_counts: Record<SecurityControlArea, number>;
+}
+export interface AuditReport {
+    report_type: "mcp-observatory-audit";
+    schema_version: "1.0.0";
+    profile: Pick<SecurityProfile, "id" | "title" | "description" | "disclaimer" | "controlAreas">;
+    artifact: RunArtifact;
+    summary: AuditSummary;
+    findings: NormalizedSecurityFinding[];
+}
+export interface AuditScore {
+    target_id: string;
+    profile: string;
+    score: number;
+    status: TrustStatus;
+    finding_count: number;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    info: number;
+    generated_at: string;
+}
+export declare function buildAuditReport(artifact: RunArtifact, target: TargetConfig, profileId?: string): AuditReport;
+export declare function runAudit(target: TargetConfig, profileId?: string): Promise<AuditReport>;
+export declare function auditScore(report: AuditReport): AuditScore;
+export declare function renderAuditMarkdown(report: AuditReport): string;
+export declare function renderAuditSarif(report: AuditReport, artifactUri?: string): string;
+export declare function resolveAuditTarget(input: string[]): Promise<TargetConfig>;