@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/docs/safety-index/artifacts/cyanheads-git-mcp-server.md

@@ -0,0 +1,176 @@
+# MCP Observatory Run Report
+
+Generated at 2026-07-06T19:49:52.194Z
+
+## Target and Environment Metadata
+
+- Target: `cyanheads-git-mcp-server`
+- Adapter: `local-process`
+- Command: `npx -y @cyanheads/git-mcp-server`
+- Server: `@cyanheads/git-mcp-server 2.15.1`
+- Platform: `darwin 25.5.0`
+- Node: `v22.22.1`
+
+## Executive Summary
+
+**Health Score: 84/100 (B)**
+
+| Dimension | Score | Weight |
+| --- | --- | --- |
+| Protocol Compliance | 100/100 | 30% |
+| Schema Quality | 60/100 | 20% |
+| Security | 60/100 | 20% |
+| Reliability | 100/100 | 20% |
+| Performance | 100/100 | 10% |
+
+| Gate | Total | Pass | Fail | Partial | Unsupported | Flaky | Skipped |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| pass | 8 | 4 | 0 | 4 | 0 | 0 | 0 |
+
+## At a Glance
+
+- Safety verdict: **Needs review** — The server is usable, but caveated checks should be reviewed before agents depend on it.
+- Top risks: attack-sim: Safe attack simulation found 19 finding(s): 0 high, 19 medium, 0 low.; schema-quality: Found 17 quality finding(s) across 30 item(s): 0 warnings, 17 info.; security: Found 19 security finding(s): 0 high, 19 medium, 0 low.
+- Regression/schema drift: Run `mcp-observatory diff <previous-run.json> <current-run.json>` to classify regressions and schema drift.
+- Failing checks: none
+- Partial or flaky checks: security-lite, schema-quality, security, attack-sim
+- Skipped checks: none
+- Unsupported checks: none
+- Suggested next step: Review the caveated checks next: security-lite, schema-quality, security, attack-sim.
+- CI next step: `Add CI: npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>"`
+
+## Regressions and Recoveries
+
+_Use the `diff` command against another run artifact to classify regressions and recoveries over time._
+
+## Full Capability Status Table
+
+| Focus | Check | Status | Duration (ms) | Message |
+| --- | --- | --- | --- | --- |
+| healthy | conformance | pass | 35.62 | All 7 conformance checks passed. |
+| healthy | prompts | pass | 0.65 | Advertised capability responded with the minimal expected shape (1 item). |
+| healthy | resources | pass | 0.60 | Advertised capability responded with the minimal expected shape (2 items). |
+| healthy | tools | pass | 27.61 | Advertised capability responded with the minimal expected shape (28 items). |
+| review | attack-sim | partial | 18.08 | Safe attack simulation found 19 finding(s): 0 high, 19 medium, 0 low. |
+| review | schema-quality | partial | 17.43 | Found 17 quality finding(s) across 30 item(s): 0 warnings, 17 info. |
+| review | security | partial | 16.14 | Found 19 security finding(s): 0 high, 19 medium, 0 low. |
+| review | security-lite | partial | 0.08 | Found 19 security finding(s): 0 high, 19 medium, 0 low. |
+
+## Evidence Snippets
+
+### conformance — pass
+
+Summary: All 7 conformance checks passed.
+
+- Endpoint: `conformance/check`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `7`
+  - Identifiers: none
+  - Diagnostics: [pass] capabilities-present: Server returned capabilities object., [pass] server-info: Server provided initialization info., [pass] tools-capability-match: tools/list returned 28 tool(s). (+4 more)
+
+### prompts — pass
+
+Summary: Advertised capability responded with the minimal expected shape (1 item).
+
+- Endpoint: `prompts/list`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `1`
+  - Identifiers: git_wrapup
+  - Diagnostics: {"level":30,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Attempting to connect stdio transport..."}, {"level":20,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Creating StdioServerTransport instance..."}, {"level":20,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Connecting McpServer instance to StdioServerTransport..."} (+2 more)
+
+### resources — pass
+
+Summary: Advertised capability responded with the minimal expected shape (2 items).
+
+- Endpoint: `resources/list`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `1`
+  - Identifiers: git://working-directory
+  - Diagnostics: {"level":30,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Attempting to connect stdio transport..."}, {"level":20,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Creating StdioServerTransport instance..."}, {"level":20,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Connecting McpServer instance to StdioServerTransport..."} (+2 more)
+- Endpoint: `resources/templates/list`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `1`
+  - Identifiers: git://working-directory
+  - Diagnostics: {"level":30,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Attempting to connect stdio transport..."}, {"level":20,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Creating StdioServerTransport instance..."}, {"level":20,"time":1783367393061,"env":"development","version":"2.15.1","pid":13590,"transport":"stdio","requestId":"A40P7-B7WJU","timestamp":"2026-07-06T19:49:53.057Z","operation":"connectStdioTransport","transportType":"Stdio","msg":"Connecting McpServer instance to StdioServerTransport..."} (+2 more)
+
+### tools — pass
+
+Summary: Advertised capability responded with the minimal expected shape (28 items).
+
+- Endpoint: `tools/list`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `28`
+  - Identifiers: git_add, git_blame, git_branch, git_changelog_analyze, git_checkout (+23 more)
+  - Diagnostics: none
+
+### attack-sim — partial
+
+Summary: Safe attack simulation found 19 finding(s): 0 high, 19 medium, 0 low.
+
+- Endpoint: `attack-sim/safe`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `19`
+  - Identifiers: git_add, git_branch, git_checkout, git_cherry_pick, git_clean (+14 more)
+  - Diagnostics: [medium] Tool "git_add" combines broad parameters (path) with destructive or non-read-only behavior., [medium] Tool "git_branch" combines broad parameters (path) with destructive or non-read-only behavior., [medium] Tool "git_checkout" combines broad parameters (path) with destructive or non-read-only behavior. (+16 more)
+
+### schema-quality — partial
+
+Summary: Found 17 quality finding(s) across 30 item(s): 0 warnings, 17 info.
+
+- Endpoint: `schema-quality/scan`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `17`
+  - Identifiers: git_add, git_branch, git_clean, git_diff, git_fetch (+12 more)
+  - Diagnostics: [info] tool "git_add": Has properties but no 'required' array declared, [info] tool "git_branch": Has properties but no 'required' array declared, [info] tool "git_clean": Has properties but no 'required' array declared (+14 more)
+
+### security — partial
+
+Summary: Found 19 security finding(s): 0 high, 19 medium, 0 low.
+
+- Endpoint: `security/scan`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `19`
+  - Identifiers: git_add, git_branch, git_checkout, git_cherry_pick, git_clean (+14 more)
+  - Diagnostics: [medium] Tool "git_add" accepts filesystem paths and has destructive capabilities., [medium] Tool "git_branch" accepts filesystem paths and has destructive capabilities., [medium] Tool "git_checkout" accepts filesystem paths and has destructive capabilities. (+16 more)
+
+### security-lite — partial
+
+Summary: Found 19 security finding(s): 0 high, 19 medium, 0 low.
+
+- Endpoint: `security/scan-lite`
+  - Advertised: `true`
+  - Responded: `true`
+  - Minimal shape present: `true`
+  - Item count: `19`
+  - Identifiers: git_add, git_branch, git_checkout, git_cherry_pick, git_clean (+14 more)
+  - Diagnostics: [medium] Tool "git_add" accepts filesystem paths and has destructive capabilities., [medium] Tool "git_branch" accepts filesystem paths and has destructive capabilities., [medium] Tool "git_checkout" accepts filesystem paths and has destructive capabilities. (+16 more)
+
+## Reproduction Commands
+
+```bash
+npm run cli -- run --target <path-to-target-config.json>
+npm run cli -- report --run <path-to-run-artifact.json> --format markdown
+```
+
+## Artifact Provenance
+
+- Artifact type: `run`
+- Schema version: `1.0.0`
+- Run ID: `run_2026-07-06T194952194Z_80b1e6dd`
+- Gate: `pass`

package/docs/safety-index/artifacts/everything-server.json

@@ -2,9 +2,9 @@
   "artifactType": "run",
   "schemaVersion": "1.0.0",
   "gate": "pass",
-  "runId": "run_2026-06-24T020721281Z_c337e720",
-  "createdAt": "2026-06-24T02:07:21.282Z",
-  "toolVersion": "0.24.0",
+  "runId": "run_2026-07-06T194944859Z_dd0288c3",
+  "createdAt": "2026-07-06T19:49:44.860Z",
+  "toolVersion": "0.28.0",
   "target": {
     "targetId": "everything-server",
     "adapter": "local-process",
@@ -29,8 +29,8 @@
     "nodeVersion": "v22.22.1"
   },
   "summary": {
-    "total": 7,
-    "pass": 6,
+    "total": 8,
+    "pass": 7,
     "fail": 0,
     "partial": 1,
     "unsupported": 0,
@@ -43,7 +43,7 @@
       "id": "tools",
       "capability": "tools",
       "status": "pass",
-      "durationMs": 7.354332999999997,
+      "durationMs": 6.7089169999999285,
       "message": "Advertised capability responded with the minimal expected shape (13 items).",
       "evidence": [
         {
@@ -82,7 +82,6 @@
               "required": [
                 "message"
               ],
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "get-annotated-message": {
@@ -98,15 +97,14 @@
                   "description": "Type of message to demonstrate different annotation patterns"
                 },
                 "includeImage": {
-                  "type": "boolean",
                   "default": false,
-                  "description": "Whether to include an example image"
+                  "description": "Whether to include an example image",
+                  "type": "boolean"
                 }
               },
               "required": [
                 "messageType"
               ],
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "get-env": {
@@ -118,34 +116,32 @@
               "type": "object",
               "properties": {
                 "count": {
+                  "default": 3,
+                  "description": "Number of resource links to return (1-10)",
                   "type": "number",
                   "minimum": 1,
-                  "maximum": 10,
-                  "default": 3,
-                  "description": "Number of resource links to return (1-10)"
+                  "maximum": 10
                 }
               },
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "get-resource-reference": {
               "type": "object",
               "properties": {
                 "resourceType": {
+                  "default": "Text",
                   "type": "string",
                   "enum": [
                     "Text",
                     "Blob"
-                  ],
-                  "default": "Text"
+                  ]
                 },
                 "resourceId": {
-                  "type": "number",
                   "default": 1,
-                  "description": "ID of the text resource to fetch"
+                  "description": "ID of the text resource to fetch",
+                  "type": "number"
                 }
               },
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "get-structured-content": {
@@ -164,7 +160,6 @@
               "required": [
                 "location"
               ],
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "get-sum": {
@@ -183,7 +178,6 @@
                 "a",
                 "b"
               ],
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "get-tiny-image": {
@@ -195,27 +189,26 @@
               "type": "object",
               "properties": {
                 "name": {
+                  "default": "README.md.gz",
                   "type": "string",
-                  "description": "Name of the output file",
-                  "default": "README.md.gz"
+                  "description": "Name of the output file"
                 },
                 "data": {
+                  "default": "https://raw.githubusercontent.com/modelcontextprotocol/servers/refs/heads/main/README.md",
                   "type": "string",
                   "format": "uri",
-                  "description": "URL or data URI of the file content to compress",
-                  "default": "https://raw.githubusercontent.com/modelcontextprotocol/servers/refs/heads/main/README.md"
+                  "description": "URL or data URI of the file content to compress"
                 },
                 "outputType": {
+                  "default": "resourceLink",
+                  "description": "How the resulting gzipped file should be returned. 'resourceLink' returns a link to a resource that can be read later, 'resource' returns a full resource object.",
                   "type": "string",
                   "enum": [
                     "resourceLink",
                     "resource"
-                  ],
-                  "default": "resourceLink",
-                  "description": "How the resulting gzipped file should be returned. 'resourceLink' returns a link to a resource that can be read later, 'resource' returns a full resource object."
+                  ]
                 }
               },
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "toggle-simulated-logging": {
@@ -232,17 +225,16 @@
               "type": "object",
               "properties": {
                 "duration": {
-                  "type": "number",
                   "default": 10,
-                  "description": "Duration of the operation in seconds"
+                  "description": "Duration of the operation in seconds",
+                  "type": "number"
                 },
                 "steps": {
-                  "type": "number",
                   "default": 5,
-                  "description": "Number of steps in the operation"
+                  "description": "Number of steps in the operation",
+                  "type": "number"
                 }
               },
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             },
             "simulate-research-query": {
@@ -253,15 +245,14 @@
                   "description": "The research topic to investigate"
                 },
                 "ambiguous": {
-                  "type": "boolean",
                   "default": false,
-                  "description": "Simulate an ambiguous query that requires clarification (triggers input_required status)"
+                  "description": "Simulate an ambiguous query that requires clarification (triggers input_required status)",
+                  "type": "boolean"
                 }
               },
               "required": [
                 "topic"
               ],
-              "additionalProperties": false,
               "$schema": "http://json-schema.org/draft-07/schema#"
             }
           }
@@ -272,7 +263,7 @@
       "id": "prompts",
       "capability": "prompts",
       "status": "pass",
-      "durationMs": 0.74087499999996,
+      "durationMs": 0.6612079999999878,
       "message": "Advertised capability responded with the minimal expected shape (4 items).",
       "evidence": [
         {
@@ -297,7 +288,7 @@
       "id": "resources",
       "capability": "resources",
       "status": "pass",
-      "durationMs": 1.0068340000000262,
+      "durationMs": 1.076082999999926,
       "message": "Advertised capability responded with the minimal expected shape (9 items).",
       "evidence": [
         {
@@ -339,15 +330,37 @@
       "id": "security-lite",
       "capability": "security-lite",
       "status": "pass",
-      "durationMs": 0.47954200000003766,
-      "message": "No security issues detected (lightweight scan).",
+      "durationMs": 0.5017080000000078,
+      "message": "Found 2 security finding(s): 0 high, 0 medium, 2 low.",
       "evidence": [
         {
           "endpoint": "security/scan-lite",
           "advertised": true,
           "responded": true,
           "minimalShapePresent": true,
-          "itemCount": 0
+          "itemCount": 2,
+          "identifiers": [
+            "toggle-simulated-logging",
+            "toggle-subscriber-updates"
+          ],
+          "diagnostics": [
+            "[low] Tool \"toggle-simulated-logging\" has an empty schema but is marked as destructive.",
+            "[low] Tool \"toggle-subscriber-updates\" has an empty schema but is marked as destructive."
+          ],
+          "findings": [
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "toggle-simulated-logging",
+              "message": "Tool \"toggle-simulated-logging\" has an empty schema but is marked as destructive."
+            },
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "toggle-subscriber-updates",
+              "message": "Tool \"toggle-subscriber-updates\" has an empty schema but is marked as destructive."
+            }
+          ]
         }
       ]
     },
@@ -355,7 +368,7 @@
       "id": "conformance",
       "capability": "conformance",
       "status": "pass",
-      "durationMs": 3.849082999999837,
+      "durationMs": 3.4615420000000086,
       "message": "All 7 conformance checks passed.",
       "evidence": [
         {
@@ -381,27 +394,67 @@
       "id": "schema-quality",
       "capability": "schema-quality",
       "status": "partial",
-      "durationMs": 1.885542000000214,
-      "message": "Found 5 quality finding(s) across 24 item(s): 0 warnings, 5 info.",
+      "durationMs": 1.3427919999999176,
+      "message": "Found 6 quality finding(s) across 24 item(s): 0 warnings, 6 info.",
       "evidence": [
         {
           "endpoint": "schema-quality/scan",
           "advertised": true,
           "responded": true,
           "minimalShapePresent": true,
-          "itemCount": 5,
+          "itemCount": 6,
           "identifiers": [
             "get-resource-links",
             "get-resource-reference",
             "gzip-file-as-resource",
-            "trigger-long-running-operation"
+            "trigger-long-running-operation",
+            "args-prompt"
           ],
           "diagnostics": [
             "[info] tool \"get-resource-links\": Has properties but no 'required' array declared",
             "[info] tool \"get-resource-reference\": Has properties but no 'required' array declared",
             "[info] tool \"get-resource-reference\": Property 'resourceType' missing description",
             "[info] tool \"gzip-file-as-resource\": Has properties but no 'required' array declared",
-            "[info] tool \"trigger-long-running-operation\": Has properties but no 'required' array declared"
+            "[info] tool \"trigger-long-running-operation\": Has properties but no 'required' array declared",
+            "[info] prompt \"args-prompt\": Argument 'state' missing description"
+          ],
+          "findings": [
+            {
+              "itemType": "tool",
+              "itemName": "get-resource-links",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "get-resource-reference",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "get-resource-reference",
+              "issue": "Property 'resourceType' missing description",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "gzip-file-as-resource",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            },
+            {
+              "itemType": "tool",
+              "itemName": "trigger-long-running-operation",
+              "issue": "Has properties but no 'required' array declared",
+              "severity": "info"
+            },
+            {
+              "itemType": "prompt",
+              "itemName": "args-prompt",
+              "issue": "Argument 'state' missing description",
+              "severity": "info"
+            }
           ]
         }
       ]
@@ -410,15 +463,54 @@
       "id": "security",
       "capability": "security",
       "status": "pass",
-      "durationMs": 0.8814159999999447,
-      "message": "No security issues detected.",
+      "durationMs": 0.8974590000000262,
+      "message": "Found 2 security finding(s): 0 high, 0 medium, 2 low.",
       "evidence": [
         {
           "endpoint": "security/scan",
           "advertised": true,
           "responded": true,
           "minimalShapePresent": true,
-          "itemCount": 0
+          "itemCount": 2,
+          "identifiers": [
+            "toggle-simulated-logging",
+            "toggle-subscriber-updates"
+          ],
+          "diagnostics": [
+            "[low] Tool \"toggle-simulated-logging\" has an empty schema but is marked as destructive.",
+            "[low] Tool \"toggle-subscriber-updates\" has an empty schema but is marked as destructive."
+          ],
+          "findings": [
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "toggle-simulated-logging",
+              "message": "Tool \"toggle-simulated-logging\" has an empty schema but is marked as destructive."
+            },
+            {
+              "ruleId": "permissive-schema",
+              "severity": "low",
+              "toolName": "toggle-subscriber-updates",
+              "message": "Tool \"toggle-subscriber-updates\" has an empty schema but is marked as destructive."
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "id": "attack-sim",
+      "capability": "attack-sim",
+      "status": "pass",
+      "durationMs": 2.646041999999852,
+      "message": "Safe attack simulation found no high-risk MCP attack-readiness findings.",
+      "evidence": [
+        {
+          "endpoint": "attack-sim/safe",
+          "advertised": true,
+          "responded": true,
+          "minimalShapePresent": true,
+          "itemCount": 0,
+          "identifiers": []
         }
       ]
     }
@@ -449,7 +541,8 @@
         "score": 100,
         "details": [
           "security-lite: pass (100/100)",
-          "security: pass (100/100)"
+          "security: pass (100/100)",
+          "attack-sim: pass (100/100)"
         ]
       },
       {
@@ -467,16 +560,16 @@
         "weight": 0.1,
         "score": 100,
         "details": [
-          "Connect: 846ms",
+          "Connect: 891ms",
           "p95 latency: 7ms (3 operations)"
         ]
       }
     ]
   },
   "performanceMetrics": {
-    "connectMs": 845.9128340000001,
-    "toolsListMs": 7.354332999999997,
-    "promptsListMs": 0.74087499999996,
-    "resourcesListMs": 1.0068340000000262
+    "connectMs": 890.503833,
+    "toolsListMs": 6.7089169999999285,
+    "promptsListMs": 0.6612079999999878,
+    "resourcesListMs": 1.076082999999926
   }
 }