@kryptosai/mcp-observatory 0.27.0 → 1.28.1

package/dist/src/utils/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../../../src/utils/url.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,KAAK,GAAG,KAAK;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,MAA8B;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC"}

package/dist/src/validate.js

@@ -38,7 +38,7 @@ function requireStatus(value, label) {
     }
 }
 function requireCheckId(value, label) {
-    const ids = new Set(["tools", "prompts", "resources", "tools-invoke", "security", "security-lite", "conformance", "schema-quality"]);
+    const ids = new Set(["tools", "prompts", "resources", "tools-invoke", "security", "security-lite", "attack-sim", "conformance", "schema-quality"]);
     if (typeof value !== "string" || !ids.has(value)) {
         throw new Error(`${label} has invalid check id '${String(value)}'.`);
     }

package/dist/src/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAEA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,wBAAwB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,2BAA2B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACrI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5F,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,sBAAsB,CAAC,CAAC;IACtE,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAC7D,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uBAAuB,KAAK,cAAc,CAAC,CAAC;IAChF,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAChE,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACpE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACjE,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC;QAC/C,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,IAAI,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,MAAM,GAAG,KAAK;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,GAAG,oBAAoB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAEhE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,MAAM;YACf,GAAG;YACH,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3H,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC;YAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;YAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;YAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,wCAAwC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9D,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC;QACjE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;QAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACrG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7C,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACjE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC3E,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,0BAA0B,CAAC,CAAC;IAC9E,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,OAAO,IAA8B,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAEtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,IAA+B,CAAC;AACzC,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/validate.ts"],"names":[],"mappings":"AAEA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,wBAAwB,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAChF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,2BAA2B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,IAAI,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnJ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC5F,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,sBAAsB,CAAC,CAAC;IACtE,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAC7D,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,uBAAuB,KAAK,cAAc,CAAC,CAAC;IAChF,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IAChE,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACpE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;IACjE,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,KAAK,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,MAAM,KAAK,GACT,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC;QAC/C,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6CAA6C,IAAI,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,MAAM,GAAG,KAAK;IACzE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,GAAG,oBAAoB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAEhE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QACxD,OAAO;YACL,QAAQ;YACR,OAAO,EAAE,MAAM;YACf,GAAG;YACH,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,SAAS;YAC3H,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC;YAC7E,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;YAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;YAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC3D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0CAA0C,OAAO,wCAAwC,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,qBAAqB,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,OAAO;QACP,OAAO;QACP,IAAI;QACJ,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9D,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC;QACjE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAChF,QAAQ,EAAE,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;QAC1E,oBAAoB,EAAE,mBAAmB,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,oCAAoC,CAAC;QAC7G,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACrG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAC7C,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAE5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;IACjE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;IAC3E,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,0BAA0B,CAAC,CAAC;IAC9E,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,+EAA+E;IAC/E,2EAA2E;IAC3E,OAAO,IAA8B,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC;IACtG,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC;IAEtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,IAA+B,CAAC;AACzC,CAAC"}

package/docs/10x-agentic-growth-sprint.md

@@ -0,0 +1,47 @@
+# 10x Agentic Growth Sprint
+
+This sprint turns MCP Observatory from a useful scanner into a receipt engine agents can rerun, cite, and contribute to.
+
+## Goal
+
+Increase latest-version external `attack-sim` and `setup-ci --sarif` sessions by making every successful check lead to a reproducible receipt and a CI gate.
+
+## Operating Loop
+
+1. Pick a public MCP server with a no-secret startup command.
+2. Run a normal check plus safe attack simulation.
+3. Publish the sanitized JSON artifact, Markdown report, action receipt, and CI command.
+4. Send the maintainer a concise note with the reproduction command.
+5. Invite agents to improve the target config, add a receipt, or open a CI PR.
+
+## What Agents Should Do
+
+- Add one safe Safety Index target.
+- Improve a reproduction command that currently fails.
+- Add a missing attack-sim fixture or rule proposal.
+- Turn a passing result into `setup-ci --all --sarif --schedule weekly`.
+- Open a small PR with artifacts and a maintainer note.
+
+## What Counts
+
+- Latest-version `attack-sim` sessions.
+- `setup-ci --sarif` sessions.
+- External CI sessions.
+- Safety Index PRs or target additions.
+- Maintainer replies that clarify safe startup commands.
+- Paid pilot conversations from private MCP users.
+
+## Guardrails
+
+- Use only public commands and sanitized artifacts for public work.
+- Do not run destructive probes.
+- Do not collect or publish secrets, hostnames, private URLs, or raw telemetry rows.
+- Prefer “needs review” over shame language.
+- If a server needs credentials, move it to a private readiness review.
+
+## Default Command Pack
+
+```bash
+npx @kryptosai/mcp-observatory attack-sim npx -y <server-package> --json attack-artifact.json --output attack-report.md --sarif attack-results.sarif
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>" --sarif --schedule weekly
+```

package/docs/agent-ecosystem-promotion-plan.md

@@ -0,0 +1,244 @@
+# Agent And MCP Ecosystem Promotion Plan
+
+Use this plan to turn MCP Observatory visibility into agent installs, CI integrations, maintainer conversations, and MCP company relationships.
+
+The campaign position:
+
+> Agents should not depend on tools nobody tests.
+
+The conversion goal is not raw stars. The goal is more `setup-ci`, SARIF/code-scanning, external CI, and agent-accessible `serve` sessions.
+
+## Immediate Moves
+
+1. Leave third-party badge PRs open unless the provider has clear public scan evidence and acceptable badge wording.
+2. Claim or refresh directory listings with neutral listing copy, not unreviewed audit claims.
+3. Publish one short agent-first post or thread per week.
+4. Open five small Observatory CI PRs per week against public MCP server repos.
+5. Track whether each surface converts into `test`, `scan`, `setup-ci`, `serve`, or external CI sessions.
+
+## MseeP Listing
+
+Claim the listing, but do not merge the current badge PR unless the listing exposes reviewed scan evidence and the badge wording is acceptable.
+
+Listing URL:
+
+`https://mseep.ai/app/kryptosai-mcp-observatory`
+
+Claim flow:
+
+1. Open the listing.
+2. Click `Claim Ownership`.
+3. Sign in with the GitHub account or organization that controls `KryptosAI/mcp-observatory`.
+4. Confirm the repo URL is `https://github.com/KryptosAI/mcp-observatory`.
+5. Update the listing copy using the text below.
+6. If MseeP shows security/audit metadata, verify the evidence before linking it from project-owned materials.
+
+Preferred listing copy:
+
+```text
+MCP Observatory is the GitHub-native CI and security gate for MCP servers before agents depend on them.
+```
+
+Short description:
+
+```text
+CI, SARIF, GitHub Code Scanning, schema drift detection, lock files, reports, and agent-accessible diagnostics for MCP servers.
+```
+
+Primary command:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>" --sarif
+```
+
+Agent install command:
+
+```bash
+claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory serve
+```
+
+Badge policy:
+
+- Directory listing: yes.
+- Plain text link: acceptable if the listing is accurate.
+- Badge saying `Audited`, `Certified`, `Verified`, or similar: only after public evidence is reviewed.
+- README placement: keep below first-party CI/npm/license/action signals unless the provider becomes a meaningful trust surface.
+
+## Directory Targets
+
+Refresh these surfaces first because they are already relevant to MCP users:
+
+| Surface | Desired State | CTA |
+| --- | --- | --- |
+| PulseMCP | Claimed/current listing with `server.json` visible | `setup-ci --all` |
+| Smithery | Current install snippet and MCP server mode | `serve` |
+| Glama | Current scorecard and README links | `test` and `serve` |
+| MseeP | Claimed listing with neutral copy | `setup-ci --sarif` |
+| mcpservers.org | Listing present or submitted | `setup-ci --all` |
+| awesome-mcp-servers | Developer tools/security category mention | `setup-ci --all` |
+| agent framework docs/community lists | Agent workflow examples | `serve` |
+| GitHub Action Marketplace | Action example and security framing | `action@v1.28.0` |
+
+Submission snippet:
+
+```text
+MCP Observatory adds CI, compatibility, schema drift, SARIF/GitHub Code Scanning, and lightweight security checks for MCP servers before agents depend on them.
+```
+
+## Agent-First Prompts
+
+Use these in docs, posts, issues, and agent community replies.
+
+Add CI:
+
+```text
+Add MCP Observatory CI to this MCP server. Use a read-only or harmless startup command, enable deep and security checks when safe, and avoid secrets in the workflow.
+```
+
+Audit local config:
+
+```text
+Run MCP Observatory against my MCP config, summarize startup failures, risky tools, schema issues, and which servers should get CI coverage first.
+```
+
+Prepare a safe target:
+
+```text
+Create a CI-safe MCP Observatory target config for this MCP server. Prefer harmless fixtures, no tokens, and no write-capable operations.
+```
+
+Check drift:
+
+```text
+Add an MCP lock file for this server and verify in CI that the tool, prompt, and resource surface does not drift unexpectedly.
+```
+
+## MCP Company Targets
+
+Start with companies and projects whose users already care about agent reliability:
+
+| Target Type | Examples | Ask |
+| --- | --- | --- |
+| MCP directories | PulseMCP, Smithery, Glama, MseeP | Keep listing current; add CI/security category placement |
+| Agent browsers/scrapers | Browserbase, Firecrawl, Exa, BrowserStack | Publish a safe Observatory target or sample workflow |
+| Agent runtimes | Cline, Continue, Goose, Cursor/Windsurf ecosystem | Add Observatory to recommended MCP preflight docs |
+| Dev platform MCPs | Sentry, Notion, Stripe, Cloudflare, GitHub ecosystem | Add optional read-only CI checks or issue-first safe target guidance |
+| Gateways/proxies | MCP gateway and registry projects | Support Observatory reports as compatibility evidence |
+
+First outreach message:
+
+```md
+Hi, I maintain MCP Observatory, an open source CI/security gate for MCP servers before agents depend on them.
+
+I noticed your team is in the MCP ecosystem. Would a small, read-only Observatory target or GitHub Action example be useful for your server/docs?
+
+The goal is simple: give agent users a reproducible startup/schema/security check they can run before installing or upgrading an MCP dependency.
+
+Command shape:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>" --sarif
+```
+
+Happy to open a tiny docs PR or start with an issue asking for the safest CI command.
+```
+
+## Certification PR Shape
+
+Prefer a small, reversible PR:
+
+- Adds one workflow or docs snippet.
+- Uses a harmless command or fixture.
+- Does not require secrets.
+- Does not add a third-party badge by default.
+- Sets write permissions only when the maintainer explicitly wants PR comments/statuses.
+- Links to the generated run artifact or safety-index report when available.
+
+PR title:
+
+```text
+Add optional MCP Observatory CI check
+```
+
+PR body:
+
+```md
+This adds an optional MCP Observatory workflow so maintainers can verify MCP startup, tool discovery, schema quality, and basic security findings in CI before agents depend on the server.
+
+It is intentionally read-only and does not require secrets. If this is useful, maintainers can later opt into PR comments, commit statuses, SARIF upload, or a README badge.
+```
+
+## Weekly Operating Loop
+
+Run this once per week:
+
+1. Refresh metrics:
+
+```bash
+npm run metrics:refresh
+```
+
+2. Record:
+
+- GitHub views/clones
+- npm downloads
+- `serve` sessions
+- `setup-ci` sessions
+- external CI sessions
+- directory referrals when visible
+- accepted/closed certification PRs
+
+3. Ship:
+
+- 3 refreshed listings
+- 5 certification PRs or maintainer issues
+- 1 short public post
+- 3 company/community replies
+
+4. Review conversion after 48 hours.
+
+Prioritize the channels that create `setup-ci`, SARIF, or external CI events. Deprioritize channels that only create stars or low-intent clones.
+
+## Public Posts
+
+Short post:
+
+```text
+MCP servers are becoming agent dependencies.
+
+Before an agent depends on one, ask:
+
+- does it start in CI?
+- did tools or schemas drift?
+- are write/destructive tools obvious?
+- can findings land in GitHub Code Scanning?
+
+That is what MCP Observatory is for:
+
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y <server-package>" --sarif
+```
+
+Agent post:
+
+```text
+If your coding agent can install MCP servers, it should also be able to test them.
+
+MCP Observatory runs as an MCP server, so agents can scan, test, record, replay, diff, and verify other MCP servers before relying on them.
+
+claude mcp add mcp-observatory -- npx -y @kryptosai/mcp-observatory serve
+```
+
+Company-facing post:
+
+```text
+For teams adding MCP to production agent workflows: treat MCP servers like AI supply-chain dependencies.
+
+MCP Observatory gives you CI checks, SARIF/GitHub Code Scanning, schema drift, lock files, reports, and agent-accessible diagnostics before tools reach production workflows.
+```
+
+## Tracking Hygiene
+
+- Use one campaign link or one command per outreach surface.
+- Do not publish private telemetry, emails, hostnames, target commands, private repo names, or customer claims.
+- Treat anonymous stars, forks, and clone spikes as interest, not adoption.
+- Treat external CI, `setup-ci`, SARIF, and maintainer replies as adoption.

package/docs/agent-tasks.md

@@ -0,0 +1,95 @@
+# Agent Task Pack
+
+This page is written for coding agents, bot maintainers, autonomous productivity systems, and maintainers who want small useful MCP Observatory contributions.
+
+Useful merged work can receive public credit through [MCP Observatory Contributors](./contributor-recognition.md), [CONTRIBUTORS.md](../CONTRIBUTORS.md), and target proof cards. Recognition is based on merged public evidence, not private telemetry.
+
+Rough agentic contribution ideas are welcome too. Use the [Agentic Contributor Outreach](./agentic-contributor-outreach.md) playbook or open an `Agentic contribution idea` issue when a task is promising but not ready for a focused PR.
+
+The core standard is a [tool-call receipt](./tool-call-receipts.md): public source, safe startup command, run artifact, attack-sim evidence, SARIF when useful, and a clear capability envelope showing what the run could not access. The public map is the [MCP Receipt Graph](./receipt-graph.md).
+
+## Task 1: Add MCP Observatory CI To A Repo
+
+```text
+Add MCP Observatory CI for this MCP server.
+
+Use the safest no-secret startup command available in the repo. Generate the full adoption kit with SARIF enabled, verify it with setup-ci --doctor, and open a focused PR that explains the check is read-only.
+
+Commands:
+npx @kryptosai/mcp-observatory test <safe startup command> --campaign agent-ci
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --campaign agent-ci
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+
+## Task 2: Add One Safety Index Target
+
+```text
+Add one public MCP server target to MCP Observatory's Safety Index.
+
+Requirements:
+- public repo or public package
+- no secrets
+- no paid service dependency
+- safe startup command
+- generated JSON and Markdown evidence
+- attack-sim evidence or a note explaining why attack-sim is not applicable
+- maintainer-friendly wording
+
+Use docs/target-contribution-guide.md and docs/target-registry.md.
+```
+
+## Task 3: Generate SARIF For A Maintainer
+
+```text
+Run MCP Observatory against this MCP server and produce a SARIF artifact suitable for GitHub Code Scanning.
+
+Command:
+npx @kryptosai/mcp-observatory test <safe startup command> --sarif mcp-observatory.sarif --campaign agent-sarif
+
+Summarize only the normalized findings and avoid publishing private telemetry, hostnames, tokens, or local paths beyond generated artifact paths.
+```
+
+## Task 4: Open A Useful Maintainer PR
+
+```text
+Open a small PR that adds read-only MCP Observatory checks.
+
+Do:
+- keep the PR focused on CI and evidence
+- pin the action ref
+- include setup-ci --doctor output
+- say findings are review prompts, not public shaming
+
+Do not:
+- require private credentials
+- add destructive tool calls
+- include private telemetry
+- change unrelated project code
+```
+
+## Task 5: Evaluate A Bot Runtime
+
+```text
+Find the MCP servers this agent or bot runtime depends on. For each server, identify a no-secret startup command, run MCP Observatory, and report whether the server is ready for CI, needs review before production, or is not reproducible.
+
+Use:
+npx @kryptosai/mcp-observatory test <safe startup command> --campaign bot-runtime-review
+```
+
+## Task 6: Prepare A Contributor Proof Card
+
+```text
+After a target, CI integration, or SARIF improvement is merged, prepare a public proof card.
+
+Use docs/contributor-proof-cards/README.md.
+
+Include:
+- contributor GitHub profile
+- role
+- merged PR
+- generated artifact or upstream workflow
+- verdict
+- Observatory version
+
+Do not include private telemetry, local paths, secrets, or unpublished maintainer data.
+```

package/docs/agentic-contributor-outreach.md

@@ -0,0 +1,52 @@
+# Agentic Contributor Outreach
+
+MCP Observatory is useful to AI coding agents because it produces receipts: commands, artifacts, findings, and CI gates that another agent can rerun.
+
+## Contributor Offer
+
+Bring one MCP server and leave one receipt.
+
+Useful contributions include:
+
+- a safe target config for a real MCP server
+- a generated JSON/Markdown report
+- safe attack-sim evidence
+- a SARIF example
+- a maintainer note or CI PR
+- a docs fix that makes a reproduction command clearer
+
+Rough PRs are welcome when they include a reproducible command and do not add secrets.
+
+## Post Template
+
+```text
+Agents: if your workflow depends on an MCP server, drop the server package or repo.
+
+I am collecting reproducible MCP safety receipts:
+- command used
+- JSON artifact
+- safe attack-sim result
+- action receipt: allow / gate / rerun / quarantine / escalate
+- setup-ci --sarif command maintainers can copy
+
+No destructive probes, no credential harvesting, no private telemetry in public artifacts.
+Useful receipts can become Safety Index entries with contributor credit.
+```
+
+## Maintainer Reply Template
+
+```text
+I ran MCP Observatory against this MCP server as a safe readiness check, not as a vulnerability claim.
+
+Reproduce:
+<command>
+
+CI gate:
+npx @kryptosai/mcp-observatory setup-ci --all --command "<server command>" --sarif --schedule weekly
+
+If there is a safer local startup command, I can update the receipt and rerun it.
+```
+
+## Review Standard
+
+Accept small contributor PRs when they improve public reproducibility, docs, target coverage, or safe attack-sim evidence. Ask for changes when a PR includes secrets, private data, destructive commands, unverifiable claims, or misleading badge/certification language.

package/docs/automatic-ci-integration.md

@@ -0,0 +1,33 @@
+# Automatic CI Integration
+
+MCP Observatory includes an install-time CI helper for MCP server projects.
+
+By default, the helper is safe and non-mutating: when it detects a likely MCP project, it prints the exact `setup-ci` command to add GitHub Actions. It does not create files unless the project explicitly opts in.
+
+To let installs create the workflow automatically, add this to the MCP server project's `package.json`:
+
+```json
+{
+  "mcpObservatory": {
+    "autoSetupCi": true,
+    "command": "npm run mcp",
+    "sarif": true
+  }
+}
+```
+
+Then installing MCP Observatory creates `.github/workflows/mcp-observatory.yml` if it does not already exist:
+
+```bash
+npm install -D @kryptosai/mcp-observatory
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+
+Environment controls:
+
+- `MCP_OBSERVATORY_AUTO_SETUP_CI=1` creates CI during install for detected MCP projects.
+- `MCP_OBSERVATORY_TARGET_COMMAND="npm run mcp"` provides the startup command.
+- `MCP_OBSERVATORY_AUTO_SETUP_SARIF=1` enables SARIF upload in the generated workflow.
+- `MCP_OBSERVATORY_POSTINSTALL=0` or `MCP_OBSERVATORY_DISABLE_POSTINSTALL=1` disables the helper.
+
+The helper skips CI environments and skips MCP Observatory's own repository. Existing workflows are never overwritten.

package/docs/campaign-attribution.md

@@ -0,0 +1,58 @@
+# Campaign Attribution
+
+Campaign attribution helps the maintainer understand which launch, maintainer, bot, or paid-readiness paths lead to real MCP Observatory usage.
+
+Telemetry remains opt-out and private to the project owner. Campaign values are safe slugs only and are not written into public reports, SARIF artifacts, or generated adoption kit files.
+
+## CLI Flag
+
+```bash
+npx @kryptosai/mcp-observatory test npx -y my-mcp-server --campaign maintainer-pr
+```
+
+The flag is supported by:
+
+- `test`
+- `scan`
+- `scan deep`
+- `run`
+- `setup-ci`
+- `init-ci`
+
+For `test`, `--campaign` can appear after the MCP command and is stripped before launching the target server.
+
+## Environment Variable
+
+```bash
+MCP_OBSERVATORY_CAMPAIGN=bot-runtime-review npx @kryptosai/mcp-observatory scan
+```
+
+Use the environment variable when a bot, CI workflow, or documentation snippet cannot safely add another CLI flag.
+
+## Slug Rules
+
+Campaign slugs must be 2-64 characters and use only:
+
+- letters
+- numbers
+- `.`
+- `_`
+- `-`
+
+Examples:
+
+- `maintainer-pr`
+- `code-scanning-demo`
+- `agent-ci`
+- `paid-readiness`
+
+## Suggested Campaigns
+
+| Campaign | Use |
+| --- | --- |
+| `maintainer-pr` | Read-only CI PRs to existing MCP projects |
+| `code-scanning-demo` | SARIF and GitHub Code Scanning launch snippets |
+| `agent-ci` | Bot or coding-agent generated CI adoption |
+| `safety-index` | Target Gallery and Safety Index contribution flow |
+| `paid-readiness` | MCP Readiness Review CTA |
+

package/docs/code-scanning-demo.md

@@ -0,0 +1,57 @@
+# GitHub Code Scanning Demo
+
+Use this page when a maintainer or agent asks, "What does MCP Observatory actually add to my repo?"
+
+## One-Command Local Demo
+
+```bash
+npx @kryptosai/mcp-observatory test npx -y @modelcontextprotocol/server-everything --sarif mcp-observatory.sarif --campaign code-scanning-demo
+```
+
+Expected result:
+
+- normal terminal output still appears
+- `.mcp-observatory/runs/` receives a run artifact
+- `mcp-observatory.sarif` contains normalized MCP findings
+- the command exits the same way it would without `--sarif`
+
+## Turn It Into A GitHub Release Gate
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-everything" --sarif --schedule weekly --campaign code-scanning-demo
+```
+
+Then verify:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+
+The generated workflow requests `security-events: write` when SARIF upload is enabled. Direct `setup-ci` stays conservative unless `--sarif` is passed; automatic CI conversion after a passing `test`, `run`, or single-target `scan` enables SARIF and weekly scheduled checks by default and can be reduced with `--no-ci-sarif`.
+
+## What Code Scanning Gets
+
+MCP Observatory emits one SARIF result per normalized finding. Results include:
+
+- stable rule IDs
+- severity mapping
+- target/check properties
+- lightweight control tags
+- partial fingerprints
+- artifact locations that point back to the Observatory run evidence
+
+Passing artifacts with no findings still produce valid empty SARIF.
+
+## Maintainer PR Snippet
+
+~~~markdown
+This adds a read-only MCP Observatory CI gate for the server.
+
+It checks startup, MCP capability listing, schema quality, and security-oriented findings. The SARIF path is enabled so normalized MCP findings can appear in GitHub Code Scanning.
+
+Verification:
+
+```bash
+npx @kryptosai/mcp-observatory setup-ci --doctor
+```
+~~~