@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/docs/examples/nsa-mcp-score.json

@@ -0,0 +1,13 @@
+{
+  "target_id": "insecure-mcp-server",
+  "profile": "nsa-mcp",
+  "score": 0,
+  "status": "critical_risk",
+  "finding_count": 15,
+  "critical": 1,
+  "high": 3,
+  "medium": 3,
+  "low": 1,
+  "info": 7,
+  "generated_at": "2026-07-06T20:08:56.194Z"
+}

package/docs/feishu-lark-mcp.md

@@ -45,7 +45,7 @@ jobs:
       MCP_OBSERVATORY_CONTACT: your-team-contact
     steps:
       - uses: actions/checkout@v4
-      - uses: KryptosAI/mcp-observatory/action@v0.26.1
+      - uses: KryptosAI/mcp-observatory/action@v1.28.0
         with:
           target: feishu-target.json
           security: true

package/docs/github-code-scanning-for-mcp.md

@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: KryptosAI/mcp-observatory/action@v0.26.1
+      - uses: KryptosAI/mcp-observatory/action@v1.28.0
         with:
           command: npx -y my-mcp-server
           deep: true

package/docs/government-enterprise-pilot.md

@@ -0,0 +1,93 @@
+# Government And Enterprise MCP Readiness Pilot
+
+MCP Observatory is a security release gate for MCP servers before deployment into sensitive, regulated, or mission-critical agentic AI environments.
+
+## Problem Statement
+
+MCP servers are a new security boundary. They expose tools, schemas, prompts, resources, filesystem access, browser automation, command execution, cloud APIs, and internal data paths directly to AI agents. Traditional dependency review catches package risk; it usually does not answer whether an agent-facing tool surface is safe to deploy.
+
+Security teams need reproducible evidence before MCP servers become production dependencies.
+
+## What The Audit Produces
+
+An MCP Observatory pilot produces:
+
+- profile-mapped audit reports using `--profile nsa-mcp`
+- normalized findings with severity, confidence, evidence, recommendations, fingerprints, and control mappings
+- SARIF output for GitHub Code Scanning
+- trust status output: `enterprise_ready`, `scanned`, `needs_review`, `high_risk`, or `critical_risk`
+- CI workflow examples for pull requests, scheduled checks, and security review artifacts
+- remediation tracking across repeated scans
+
+The `nsa-mcp` profile is not an official certification or government authorization. It operationalizes public security guidance into practical automated MCP checks for sensitive environments.
+
+For buyer review, pair this pilot brief with the [public guidance crosswalk](./public-guidance-crosswalk.md), [procurement one-pager](./procurement-one-pager.md), and [security due diligence packet](./security-due-diligence.md).
+
+## 30 Day Pilot
+
+A practical 30 day pilot measures whether MCP Observatory can become the release gate for MCP server adoption.
+
+Week 1:
+- inventory MCP servers and target startup commands
+- run baseline audits
+- upload SARIF to GitHub Code Scanning for selected repos
+
+Week 2:
+- triage critical and high findings with security reviewers
+- tune target configs and suppressions only where risk is accepted
+- enable pull request audit checks for pilot repos
+
+Week 3:
+- remediate top findings
+- rerun audits and compare trust status movement
+- add scheduled weekly checks
+
+Week 4:
+- produce pilot summary with findings, false-positive feedback, remediation rate, and CI adoption status
+- decide whether to expand to more repos or private fleet reporting
+
+## Success Metrics
+
+- number of MCP servers scanned
+- critical and high findings discovered
+- mean time to remediation
+- percentage of findings fixed
+- number of repos with CI gate enabled
+- number of SARIF findings uploaded to GitHub Code Scanning
+- false positive rate from security reviewer feedback
+
+## Required Environment
+
+The pilot needs:
+
+- Node.js 20+
+- reproducible MCP server startup commands or target JSON configs
+- GitHub repository access for CI and SARIF upload when Code Scanning is in scope
+- harmless fixtures for any tool invocation checks
+- security reviewer feedback for false-positive classification
+
+## Data Boundary
+
+Local audit runs do not require hosted services.
+
+By default, MCP Observatory should not collect secrets, environment dumps, file contents, command outputs, or private telemetry payloads. Audit artifacts should redact secret values and include only the evidence needed for security review.
+
+If a hosted pilot is used, customer data boundaries should be documented before upload. The default local workflow can keep audit reports, SARIF, and score JSON inside the customer repository or CI artifact store.
+
+## Workflow Fit
+
+MCP Observatory fits existing security review surfaces:
+
+- GitHub Actions runs the audit on pull requests and schedules
+- SARIF uploads normalized findings to GitHub Code Scanning
+- Markdown reports are published as CI artifacts for reviewer signoff
+- score JSON can drive badges, dashboards, or release policy
+- repeated audits measure remediation and drift
+
+Start with:
+
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format sarif --output mcp-audit.sarif
+npx @kryptosai/mcp-observatory score npx -y my-mcp-server --profile nsa-mcp --format json
+```

package/docs/launch.md

@@ -0,0 +1,64 @@
+# MCP Observatory Launch Page
+
+```
+  ███╗   ███╗ ██████╗██████╗
+  ████╗ ████║██╔════╝██╔══██╗
+  ██╔████╔██║██║     ██████╔╝
+  ██║╚██╔╝██║██║     ██╔═══╝
+  ██║ ╚═╝ ██║╚██████╗██║
+  ╚═╝     ╚═╝ ╚═════╝╚═╝
+     O B S E R V A T O R Y
+```
+
+MCP Observatory is the GitHub-native CI and security gate for MCP servers before agents depend on them.
+
+It turns a local MCP check into evidence maintainers already understand: GitHub Actions, SARIF, Code Scanning findings, score badges, reproducible run artifacts, and maintainer-ready PR copy.
+
+## The Fast Path
+
+1. Test one MCP server locally.
+
+```bash
+npx @kryptosai/mcp-observatory test npx -y my-mcp-server --campaign launch-proof
+```
+
+2. Convert the passing check into CI.
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y my-mcp-server" --sarif --campaign launch-proof
+```
+
+3. Verify the adoption kit.
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+
+## Why Maintainers Use It
+
+- Catch MCP startup, tool listing, prompt, resource, schema, and drift failures before agents rely on a server.
+- Convert a one-off local check into a repeatable GitHub Action without hand-writing workflow YAML.
+- Emit normalized SARIF so MCP findings can appear in GitHub Code Scanning.
+- Share reproducible JSON and Markdown evidence without exposing private telemetry.
+- Let coding agents run Observatory as an MCP server and inspect other MCP tools autonomously.
+
+## Public Proof
+
+- [GitHub Code Scanning for MCP servers](./github-code-scanning-for-mcp.md)
+- [Code Scanning demo](./code-scanning-demo.md)
+- [MCP Server Safety Index](./mcp-server-safety-index.md)
+- [Target gallery](./target-gallery.md)
+- [Public proof log](./proof.md)
+- [Agent task pack](./agent-tasks.md)
+
+## For Teams Running MCP In Production
+
+If MCP servers are becoming production dependencies, use the same evidence model privately:
+
+- CI rollout for selected MCP servers
+- SARIF and GitHub Code Scanning setup
+- private readiness review
+- prioritized fixes and owner-ready next steps
+- Safety Index-style report for internal agent dependencies
+
+See the [MCP Readiness Review](./paid-pilot-offer.md). The default package starts at `$2,500`.

package/docs/mcp-attack-simulator.md

@@ -0,0 +1,57 @@
+# MCP Attack Simulator
+
+MCP Attack Simulator runs safe, inert simulation checks over MCP server metadata, schemas, captured evidence, and optional baselines. It produces reproducible Safety Index evidence without executing destructive payloads.
+
+## Quick Start
+
+```bash
+npx @kryptosai/mcp-observatory attack-sim --target ./target.json --output attack-report.md --json attack-artifact.json
+```
+
+Or run directly against a server command:
+
+```bash
+npx @kryptosai/mcp-observatory attack-sim npx -y my-mcp-server
+```
+
+For GitHub Code Scanning:
+
+```bash
+npx @kryptosai/mcp-observatory attack-sim \
+  --target ./target.json \
+  --json attack-artifact.json \
+  --sarif attack-results.sarif \
+  --fail-on-high
+```
+
+## What It Tests
+
+- **Tool poisoning:** suspicious hidden or behavioral instructions in tool, prompt, resource, and schema metadata.
+- **Exfiltration canaries:** fake Observatory canaries and credential-like values in captured evidence.
+- **Permission boundaries:** broad path, command, network, or payload parameters combined with destructive or non-read-only behavior.
+- **Contract drift:** when `--baseline <run-artifact>` is supplied, new destructive tools, broadened schemas, and removed required fields.
+
+## Safe Simulation Only
+
+The simulator does not run exploit payloads, contact attacker infrastructure, write or delete files, or exfiltrate data. It uses metadata, schema, drift, and already-captured response evidence.
+
+If safe tool invocation is needed, run normal Observatory checks with existing deep invocation behavior and review the captured artifact. The simulator inspects captured evidence; it does not invent new dangerous calls.
+
+## Outputs
+
+- JSON: a normal MCP Observatory run artifact with an `attack-sim` check.
+- Markdown: an attack simulation report with verdict, findings, reproduction command, and maintainer fixes.
+- SARIF: Code Scanning findings for high and medium risk results.
+
+## Baseline Drift
+
+Use a prior run artifact as the baseline:
+
+```bash
+npx @kryptosai/mcp-observatory attack-sim \
+  --target ./target.json \
+  --baseline .mcp-observatory/runs/previous.json \
+  --output attack-report.md
+```
+
+This flags agent-contract changes that can turn a previously acceptable MCP dependency into a review item.

package/docs/mcp-receipts.md

@@ -0,0 +1,109 @@
+# MCP Receipts
+
+A scan finds facts.
+
+A report explains facts.
+
+A receipt makes facts portable, reproducible, citable, and actionable.
+
+MCP Observatory receipts are the canonical public trust artifact for MCP servers. A receipt records what was checked, when it was checked, which MCP Observatory version and profile were used, what evidence supports the verdict, what action a downstream system should take, and how another maintainer, agent, CI gate, registry, or buyer can rerun the same evaluation.
+
+## What A Receipt Contains
+
+Each receipt has eight stable sections:
+
+- `subject`: server identity, startup command, package/repo/source, version, resolved identity, URL/path, commit, and package manager when available
+- `run_context`: timestamp, MCP Observatory version, profile, safe-mode statement, environment class, invoked command, config file, OS, and safe working-directory context
+- `evidence`: report paths and SHA-256 hashes, plus schema, tool surface, attack-simulation, and baseline/drift summaries
+- `verdict`: score, trust status, receipt state, receipt action, and reason
+- `findings`: the top findings only, with severity, control area, evidence summary, recommended fix, CI blocking status, and fingerprint
+- `reproduction`: exact rerun command, CI command, SARIF upload hint, and expected artifacts
+- `maintainer_cta`: claim/update receipt, add CI, fix findings, request rerun, and provide safe startup mode
+- `buyer_cta`: request private fleet receipt pack, attack simulation evidence pack, CI/SARIF rollout, or government/enterprise pilot
+
+The full audit report remains the place for every finding. The receipt is the compact trust record people and agents can cite.
+
+## Verdict And Action Mapping
+
+Receipts include both a human-readable state and an action receipt.
+
+States:
+
+- `ready_for_ci`
+- `needs_review`
+- `blocked`
+- `could_not_evaluate`
+
+Actions:
+
+- `allow`
+- `gate`
+- `rerun`
+- `quarantine`
+- `escalate`
+
+Mapping:
+
+| Condition | State | Action |
+|---|---|---|
+| Critical findings | `blocked` | `escalate` |
+| High findings | `blocked` | `gate` |
+| Medium findings | `needs_review` | `gate` |
+| Low/info findings only | `ready_for_ci` | `allow` |
+| Evaluation error | `could_not_evaluate` | `rerun` |
+
+Trust statuses remain compatible with audit output:
+
+- `enterprise_ready`
+- `scanned`
+- `needs_review`
+- `high_risk`
+- `critical_risk`
+
+## Emit A Receipt From Audit
+
+```bash
+mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format json --output report.json --receipt receipt.json
+```
+
+Markdown receipt:
+
+```bash
+mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output report.md --receipt receipt.md
+```
+
+## Standalone Receipt Command
+
+```bash
+mcp-observatory receipt npx -y my-mcp-server --profile nsa-mcp --format json --output receipt.json
+```
+
+Public Safety Index receipt:
+
+```bash
+mcp-observatory receipt npx -y my-mcp-server --profile nsa-mcp --environment-class public_safety_index --format markdown --output receipt.md
+```
+
+Supported `environment_class` values:
+
+- `local`
+- `ci`
+- `public_safety_index`
+- `private_fleet`
+
+## Safe-Mode Guarantee
+
+Receipts inherit the same safe-mode posture as the audit and attack-simulation flow. MCP Observatory inspects metadata, schemas, startup behavior, and inert attack-readiness evidence. It does not execute destructive payloads, exfiltrate secrets, or contact attacker-controlled callbacks.
+
+Receipts also avoid leaking secrets or sensitive local paths. Working directories under the current user home directory are omitted, and private telemetry is not included.
+
+## Why Receipts Matter
+
+Receipts are meant to become the object that directories, agents, CI gates, maintainers, and buyers can pass around:
+
+- a directory can link to the current receipt for a public MCP server
+- a maintainer can claim the receipt and add CI
+- an agent can decide whether to `allow`, `gate`, `rerun`, `quarantine`, or `escalate`
+- a buyer can ask for a private fleet receipt pack before approving internal MCP dependencies
+
+The public receipt proves the method. The private receipt pack turns it into a buyer-ready decision record.

package/docs/mcp-server-safety-index.md

@@ -2,36 +2,40 @@
 
 The MCP Server Safety Index is an evidence standard for MCP readiness. It is not a leaderboard and does not rank maintainers.
 
-Each row links to a reproducible command, a JSON run artifact, and a Markdown report generated by MCP Observatory. The goal is to show which failure classes matter before teams let agents depend on MCP servers.
+Each row links to a reproducible command, an action receipt, a JSON run artifact, and a Markdown report generated by MCP Observatory. The goal is to show which failure classes matter before teams let agents depend on MCP servers.
 
-For the rules behind this page, see the [Safety Methodology](./methodology.md).
+The safe attack simulation evidence checks metadata, schemas, and controlled canary surfaces only. It does not execute destructive payloads, contact external callback URLs, or claim exploitability from a static finding alone.
+
+For the rules behind this page, see the [Safety Methodology](./methodology.md) and the [MCP Attack Simulator](./mcp-attack-simulator.md). For a smaller server-to-evidence map, see the [MCP Receipt Graph](./receipt-graph.md).
 
 ## Snapshot
 
-- Evaluated servers: 13
-- Ready for CI: 10
-- Needs review before production: 1
-- Unsafe default posture: 2
+- Evaluated servers: 15
+- Ready for CI: 7
+- Needs review before production: 4
+- Unsafe default posture: 4
 - Not reproducible: 0
-- Latest run: 2026-06-24T02:07:44.894Z
+- Latest run: 2026-07-06T19:49:58.878Z
 
 ## Evaluations
 
-| # | Server | Category | Verdict | Failure Class | Reproduce | Evidence | Notes |
-| ---: | --- | --- | --- | --- | --- | --- | --- |
-| 1 | [Official everything server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | Broad protocol surface | `npx -y @modelcontextprotocol/server-everything` | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | Zero-config official package; useful as a broad protocol baseline. [public proof](https://github.com/modelcontextprotocol/servers/pull/4392) |
-| 2 | [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | Tool schema clarity | `npx -y @modelcontextprotocol/server-sequential-thinking` | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | Zero-config official package. |
-| 3 | [Official memory server](https://github.com/modelcontextprotocol/servers) | Reference / Memory | **Ready for CI** | Persistent state tools | `npx -y @modelcontextprotocol/server-memory` | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | Zero-config official package. |
-| 4 | [Official filesystem server](https://github.com/modelcontextprotocol/servers) | Filesystem | **Needs review before production** | Sandboxed filesystem access | `npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture` | [JSON](./safety-index/artifacts/filesystem-server.json) / [report](./safety-index/artifacts/filesystem-server.md) | Runs against the checked-in harmless fixture directory. |
-| 5 | [Context7](https://github.com/upstash/context7) | Documentation / Search | **Ready for CI** | Prompt-injection-sensitive retrieval | `npx -y @upstash/context7-mcp` | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | Zero-config public package. |
-| 6 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | Prompt/resource contract | `npx -y promptopia-mcp` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
-| 7 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | Prompt/tool inventory | `npx -y ref-tools-mcp` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
-| 8 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Ready for CI** | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
-| 9 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Ready for CI** | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
-| 10 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | Browser-control boundary | `npx -y @browsermcp/mcp` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
-| 11 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | Browser/code execution boundary | `npx -y @playwright/mcp` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
-| 12 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
-| 13 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
+| # | Server | Category | Verdict | Action Receipt | Failure Class | Reproduce | CI Gate | Evidence | Notes |
+| ---: | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 1 | [Official everything server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | `allow` | Broad protocol surface | `npx -y @modelcontextprotocol/server-everything` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-everything" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | Zero-config official package; useful as a broad protocol baseline. [public proof](https://github.com/modelcontextprotocol/servers/pull/4392) |
+| 2 | [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | `allow` | Tool schema clarity | `npx -y @modelcontextprotocol/server-sequential-thinking` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-sequential-thinking" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | Zero-config official package. |
+| 3 | [Official memory server](https://github.com/modelcontextprotocol/servers) | Reference / Memory | **Ready for CI** | `allow` | Persistent state tools | `npx -y @modelcontextprotocol/server-memory` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-memory" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | Zero-config official package. |
+| 4 | [Official filesystem server](https://github.com/modelcontextprotocol/servers) | Filesystem | **Needs review before production** | `gate` | Sandboxed filesystem access | `npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/filesystem-server.json) / [report](./safety-index/artifacts/filesystem-server.md) | Runs against the checked-in harmless fixture directory. |
+| 5 | [Context7](https://github.com/upstash/context7) | Documentation / Search | **Needs review before production** | `gate` | Prompt-injection-sensitive retrieval | `npx -y @upstash/context7-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | Zero-config public package. |
+| 6 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | `allow` | Prompt/resource contract | `npx -y promptopia-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y promptopia-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
+| 7 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | `allow` | Prompt/tool inventory | `npx -y ref-tools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
+| 8 | [Git MCP Server](https://www.npmjs.com/package/@cyanheads/git-mcp-server) | Developer Tools | **Needs review before production** | `gate` | Git tool boundary | `npx -y @cyanheads/git-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @cyanheads/git-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cyanheads-git-mcp-server.json) / [report](./safety-index/artifacts/cyanheads-git-mcp-server.md) | Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added. |
+| 9 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Needs review before production** | `gate` | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
+| 10 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
+| 11 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | `allow` | Browser-control boundary | `npx -y @browsermcp/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
+| 12 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y @playwright/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @playwright/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
+| 13 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | `allow` | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @antv/mcp-server-chart" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
+| 14 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | `quarantine` | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @executeautomation/playwright-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
+| 15 | [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | Infrastructure / Kubernetes | **Unsafe default posture** | `quarantine` | Command and cluster mutation boundary | `npx -y mcp-server-kubernetes` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims. |
 
 ## Patterns Observed
 
@@ -39,6 +43,8 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md).
 - Artifact-producing tools: 1 server(s)
 - Broad protocol surface: 1 server(s)
 - Browser-control boundary: 1 server(s)
+- Command and cluster mutation boundary: 1 server(s)
+- Git tool boundary: 1 server(s)
 - Infrastructure tool surface: 1 server(s)
 - Persistent state tools: 1 server(s)
 - Prompt-injection-sensitive retrieval: 1 server(s)
@@ -51,6 +57,7 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md).
 ## Publication Rules
 
 - Use only public repositories, public package commands, public PRs, and generated sanitized artifacts.
+- Include the action receipt and CI gate command so maintainers can rerun the evidence.
 - Treat findings as reproducible evidence, not public shaming.
 - Prefer “needs review” language unless there is clear artifact-backed proof of a dangerous default.
 - Keep raw telemetry, emails, hostnames, private URLs, tokens, and customer claims out of public materials.

package/docs/nsa-mcp-audit-ci.md

@@ -0,0 +1,88 @@
+# NSA-MCP Audit CI Guide
+
+Use this workflow when a repository needs MCP Observatory as a security release gate for an MCP server.
+
+The `nsa-mcp` profile is not an official certification. It maps MCP Observatory findings to practical control areas for sensitive environments.
+
+## Pull Request Audit
+
+```yaml
+name: MCP Observatory Audit
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 9 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - run: npm ci
+      - run: npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md --fail-on-high
+      - run: npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format sarif --output mcp-audit.sarif
+      - uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: mcp-audit.sarif
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: mcp-observatory-audit
+          path: |
+            mcp-audit.md
+            mcp-audit.sarif
+```
+
+## Failing Policy
+
+Use one of these gates:
+
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md --fail-on-critical
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md --fail-on-high
+```
+
+`--fail-on-critical` is appropriate while onboarding noisy repos. `--fail-on-high` is appropriate once maintainers have accepted the release gate.
+
+## Badge Ready Score
+
+The score command returns compact JSON for badge generators or dashboards:
+
+```bash
+npx @kryptosai/mcp-observatory score npx -y my-mcp-server --profile nsa-mcp --format json
+```
+
+Example:
+
+```json
+{
+  "target_id": "my-mcp-server",
+  "profile": "nsa-mcp",
+  "score": 87,
+  "status": "needs_review",
+  "finding_count": 2
+}
+```
+
+## Local Fixture Demo
+
+This repository includes an intentionally insecure inert fixture:
+
+```bash
+npx tsx src/cli.ts audit examples/insecure-mcp-server --profile nsa-mcp --format markdown --output /tmp/nsa-mcp-audit-report.md
+npx tsx src/cli.ts audit examples/insecure-mcp-server --profile nsa-mcp --format sarif --output /tmp/nsa-mcp-results.sarif
+npx tsx src/cli.ts score examples/insecure-mcp-server --profile nsa-mcp --format json
+```
+
+Generated examples are checked in under [`docs/examples`](./examples/).

package/docs/procurement-one-pager.md

@@ -0,0 +1,74 @@
+# MCP Observatory Procurement One-Pager
+
+## Positioning
+
+MCP Observatory is an open source security release gate for MCP servers before deployment into sensitive, regulated, or mission-critical agentic AI environments.
+
+It helps platform and security teams answer a concrete procurement question:
+
+> Can this MCP server be safely introduced into an agent workflow, and what evidence supports that decision?
+
+## What It Does
+
+- runs MCP server startup, conformance, schema, security, and safe attack-readiness checks
+- maps findings to the `nsa-mcp` public-guidance profile
+- produces Markdown audit reports for reviewers
+- emits SARIF for GitHub Code Scanning
+- emits compact trust score JSON for CI gates, badges, or dashboards
+- supports recurring GitHub Actions checks and remediation tracking
+
+## Buyer Value
+
+| Buyer concern | MCP Observatory answer |
+|---|---|
+| Tool boundary risk | Detects shell, filesystem, browser, network, secrets, and destructive tool surfaces. |
+| Agent manipulation risk | Flags hidden instructions and unsafe autonomous behavior in tool metadata. |
+| Security review workflow | Produces SARIF, Markdown, JSON, and CI artifacts. |
+| Procurement evidence | Provides a public-guidance crosswalk and repeatable audit commands. |
+| Adoption risk | Runs locally with no hosted dependency required. |
+| Remediation tracking | Supports repeatable audits, CI gates, and future baseline diffing. |
+
+## Pilot Package
+
+A 30 day pilot should include:
+
+- 5 to 25 MCP servers scanned
+- baseline `nsa-mcp` audit reports
+- SARIF uploaded to GitHub Code Scanning for selected repos
+- CI gate enabled on at least 3 repos
+- weekly scheduled audit runs
+- reviewer false-positive feedback
+- final remediation and adoption summary
+
+## Example Commands
+
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format sarif --output mcp-audit.sarif
+npx @kryptosai/mcp-observatory score npx -y my-mcp-server --profile nsa-mcp --format json
+```
+
+## Security And Data Boundary
+
+Local audits do not require sending artifacts to a hosted service. Reports can stay inside the customer repository, CI logs, artifact store, or security tooling.
+
+MCP Observatory should not collect secrets, environment dumps, file contents, or raw command outputs for audit reporting. Secret-like values are reported by name or pattern with values redacted.
+
+## Procurement Notes
+
+- License: MIT
+- Runtime: Node.js 20+
+- Integration points: CLI, GitHub Actions, SARIF, Markdown, JSON
+- Hosted service: optional, not required for local audit evidence
+- Certification claim: none
+- Government endorsement claim: none
+- Best fit: AI platform, AppSec, DevSecOps, AI assurance, software supply chain, and agent runtime security teams
+
+## Useful Links
+
+- [Government and enterprise pilot brief](./government-enterprise-pilot.md)
+- [Public guidance crosswalk](./public-guidance-crosswalk.md)
+- [NSA-MCP audit CI guide](./nsa-mcp-audit-ci.md)
+- [Example audit report](./examples/nsa-mcp-audit-report.md)
+- [Example SARIF](./examples/nsa-mcp-results.sarif)
+- [Example score JSON](./examples/nsa-mcp-score.json)

package/docs/proof.md

@@ -5,8 +5,8 @@ MCP Observatory is early, but it is already a working MCP testing/security stack
 ## Current Public Surface
 
 - npm package: `@kryptosai/mcp-observatory`
-- GitHub Action: `KryptosAI/mcp-observatory/action@v0.26.1`
-- Latest release: `v0.26.1`
+- GitHub Action: `KryptosAI/mcp-observatory/action@v1.28.0`
+- Latest release: `v1.28.0`
 - CLI command count: scan, test, record, replay, verify, diff, watch, suggest, serve, lock, history, setup-ci, init-ci, ci-report, enterprise-report, score, badge, cloud
 - Test suite: 348 passing tests across 45 test files as of July 1, 2026
 - GitHub traffic snapshot: 745 clones and 232 unique cloners in the visible June 2026 traffic window
@@ -76,6 +76,9 @@ Open and accepted third-party integrations are tracked here:
 
 GitHub code search shows public references outside the main repo. These are discovery/listing signals, not customer claims:
 
+- PulseMCP has a maintainer-recognized `io.github.KryptosAI/mcp-observatory` listing with `server.json` visibility.
+- Smithery, Glama, LobeHub, Yarn/Vibehackers, and other MCP catalogs surface MCP Observatory install or scorecard pages.
+- MseeP has an unclaimed listing for MCP Observatory. Treat it as a directory opportunity until ownership, scan evidence, and badge wording are reviewed.
 - `punkpeye/awesome-mcp-devtools` lists MCP Observatory in an MCP developer-tools index.
 - `linny006/mcp-servers-live` mirrors a public MCP Observatory listing page.
 - `gabrielmoreira/awesome-ai-rabbit-holes` catalogs the GitHub project.