@kryptosai/mcp-observatory 0.28.0 → 1.28.1

package/docs/examples/nsa-mcp-score.json

@@ -0,0 +1,13 @@
+{
+  "target_id": "insecure-mcp-server",
+  "profile": "nsa-mcp",
+  "score": 0,
+  "status": "critical_risk",
+  "finding_count": 15,
+  "critical": 1,
+  "high": 3,
+  "medium": 3,
+  "low": 1,
+  "info": 7,
+  "generated_at": "2026-07-06T20:08:56.194Z"
+}

package/docs/feishu-lark-mcp.md

@@ -45,7 +45,7 @@ jobs:
       MCP_OBSERVATORY_CONTACT: your-team-contact
     steps:
       - uses: actions/checkout@v4
-      - uses: KryptosAI/mcp-observatory/action@v0.27.0
+      - uses: KryptosAI/mcp-observatory/action@v1.28.0
         with:
           target: feishu-target.json
           security: true

package/docs/github-code-scanning-for-mcp.md

@@ -75,7 +75,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: KryptosAI/mcp-observatory/action@v0.27.0
+      - uses: KryptosAI/mcp-observatory/action@v1.28.0
         with:
           command: npx -y my-mcp-server
           deep: true

package/docs/government-enterprise-pilot.md

@@ -0,0 +1,93 @@
+# Government And Enterprise MCP Readiness Pilot
+
+MCP Observatory is a security release gate for MCP servers before deployment into sensitive, regulated, or mission-critical agentic AI environments.
+
+## Problem Statement
+
+MCP servers are a new security boundary. They expose tools, schemas, prompts, resources, filesystem access, browser automation, command execution, cloud APIs, and internal data paths directly to AI agents. Traditional dependency review catches package risk; it usually does not answer whether an agent-facing tool surface is safe to deploy.
+
+Security teams need reproducible evidence before MCP servers become production dependencies.
+
+## What The Audit Produces
+
+An MCP Observatory pilot produces:
+
+- profile-mapped audit reports using `--profile nsa-mcp`
+- normalized findings with severity, confidence, evidence, recommendations, fingerprints, and control mappings
+- SARIF output for GitHub Code Scanning
+- trust status output: `enterprise_ready`, `scanned`, `needs_review`, `high_risk`, or `critical_risk`
+- CI workflow examples for pull requests, scheduled checks, and security review artifacts
+- remediation tracking across repeated scans
+
+The `nsa-mcp` profile is not an official certification or government authorization. It operationalizes public security guidance into practical automated MCP checks for sensitive environments.
+
+For buyer review, pair this pilot brief with the [public guidance crosswalk](./public-guidance-crosswalk.md), [procurement one-pager](./procurement-one-pager.md), and [security due diligence packet](./security-due-diligence.md).
+
+## 30 Day Pilot
+
+A practical 30 day pilot measures whether MCP Observatory can become the release gate for MCP server adoption.
+
+Week 1:
+- inventory MCP servers and target startup commands
+- run baseline audits
+- upload SARIF to GitHub Code Scanning for selected repos
+
+Week 2:
+- triage critical and high findings with security reviewers
+- tune target configs and suppressions only where risk is accepted
+- enable pull request audit checks for pilot repos
+
+Week 3:
+- remediate top findings
+- rerun audits and compare trust status movement
+- add scheduled weekly checks
+
+Week 4:
+- produce pilot summary with findings, false-positive feedback, remediation rate, and CI adoption status
+- decide whether to expand to more repos or private fleet reporting
+
+## Success Metrics
+
+- number of MCP servers scanned
+- critical and high findings discovered
+- mean time to remediation
+- percentage of findings fixed
+- number of repos with CI gate enabled
+- number of SARIF findings uploaded to GitHub Code Scanning
+- false positive rate from security reviewer feedback
+
+## Required Environment
+
+The pilot needs:
+
+- Node.js 20+
+- reproducible MCP server startup commands or target JSON configs
+- GitHub repository access for CI and SARIF upload when Code Scanning is in scope
+- harmless fixtures for any tool invocation checks
+- security reviewer feedback for false-positive classification
+
+## Data Boundary
+
+Local audit runs do not require hosted services.
+
+By default, MCP Observatory should not collect secrets, environment dumps, file contents, command outputs, or private telemetry payloads. Audit artifacts should redact secret values and include only the evidence needed for security review.
+
+If a hosted pilot is used, customer data boundaries should be documented before upload. The default local workflow can keep audit reports, SARIF, and score JSON inside the customer repository or CI artifact store.
+
+## Workflow Fit
+
+MCP Observatory fits existing security review surfaces:
+
+- GitHub Actions runs the audit on pull requests and schedules
+- SARIF uploads normalized findings to GitHub Code Scanning
+- Markdown reports are published as CI artifacts for reviewer signoff
+- score JSON can drive badges, dashboards, or release policy
+- repeated audits measure remediation and drift
+
+Start with:
+
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format sarif --output mcp-audit.sarif
+npx @kryptosai/mcp-observatory score npx -y my-mcp-server --profile nsa-mcp --format json
+```

package/docs/mcp-receipts.md

@@ -0,0 +1,109 @@
+# MCP Receipts
+
+A scan finds facts.
+
+A report explains facts.
+
+A receipt makes facts portable, reproducible, citable, and actionable.
+
+MCP Observatory receipts are the canonical public trust artifact for MCP servers. A receipt records what was checked, when it was checked, which MCP Observatory version and profile were used, what evidence supports the verdict, what action a downstream system should take, and how another maintainer, agent, CI gate, registry, or buyer can rerun the same evaluation.
+
+## What A Receipt Contains
+
+Each receipt has eight stable sections:
+
+- `subject`: server identity, startup command, package/repo/source, version, resolved identity, URL/path, commit, and package manager when available
+- `run_context`: timestamp, MCP Observatory version, profile, safe-mode statement, environment class, invoked command, config file, OS, and safe working-directory context
+- `evidence`: report paths and SHA-256 hashes, plus schema, tool surface, attack-simulation, and baseline/drift summaries
+- `verdict`: score, trust status, receipt state, receipt action, and reason
+- `findings`: the top findings only, with severity, control area, evidence summary, recommended fix, CI blocking status, and fingerprint
+- `reproduction`: exact rerun command, CI command, SARIF upload hint, and expected artifacts
+- `maintainer_cta`: claim/update receipt, add CI, fix findings, request rerun, and provide safe startup mode
+- `buyer_cta`: request private fleet receipt pack, attack simulation evidence pack, CI/SARIF rollout, or government/enterprise pilot
+
+The full audit report remains the place for every finding. The receipt is the compact trust record people and agents can cite.
+
+## Verdict And Action Mapping
+
+Receipts include both a human-readable state and an action receipt.
+
+States:
+
+- `ready_for_ci`
+- `needs_review`
+- `blocked`
+- `could_not_evaluate`
+
+Actions:
+
+- `allow`
+- `gate`
+- `rerun`
+- `quarantine`
+- `escalate`
+
+Mapping:
+
+| Condition | State | Action |
+|---|---|---|
+| Critical findings | `blocked` | `escalate` |
+| High findings | `blocked` | `gate` |
+| Medium findings | `needs_review` | `gate` |
+| Low/info findings only | `ready_for_ci` | `allow` |
+| Evaluation error | `could_not_evaluate` | `rerun` |
+
+Trust statuses remain compatible with audit output:
+
+- `enterprise_ready`
+- `scanned`
+- `needs_review`
+- `high_risk`
+- `critical_risk`
+
+## Emit A Receipt From Audit
+
+```bash
+mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format json --output report.json --receipt receipt.json
+```
+
+Markdown receipt:
+
+```bash
+mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output report.md --receipt receipt.md
+```
+
+## Standalone Receipt Command
+
+```bash
+mcp-observatory receipt npx -y my-mcp-server --profile nsa-mcp --format json --output receipt.json
+```
+
+Public Safety Index receipt:
+
+```bash
+mcp-observatory receipt npx -y my-mcp-server --profile nsa-mcp --environment-class public_safety_index --format markdown --output receipt.md
+```
+
+Supported `environment_class` values:
+
+- `local`
+- `ci`
+- `public_safety_index`
+- `private_fleet`
+
+## Safe-Mode Guarantee
+
+Receipts inherit the same safe-mode posture as the audit and attack-simulation flow. MCP Observatory inspects metadata, schemas, startup behavior, and inert attack-readiness evidence. It does not execute destructive payloads, exfiltrate secrets, or contact attacker-controlled callbacks.
+
+Receipts also avoid leaking secrets or sensitive local paths. Working directories under the current user home directory are omitted, and private telemetry is not included.
+
+## Why Receipts Matter
+
+Receipts are meant to become the object that directories, agents, CI gates, maintainers, and buyers can pass around:
+
+- a directory can link to the current receipt for a public MCP server
+- a maintainer can claim the receipt and add CI
+- an agent can decide whether to `allow`, `gate`, `rerun`, `quarantine`, or `escalate`
+- a buyer can ask for a private fleet receipt pack before approving internal MCP dependencies
+
+The public receipt proves the method. The private receipt pack turns it into a buyer-ready decision record.

package/docs/mcp-server-safety-index.md

@@ -1,41 +1,41 @@
-# MCP Server Safety Index
+# MCP Server Safety Index v1
 
 The MCP Server Safety Index is an evidence standard for MCP readiness. It is not a leaderboard and does not rank maintainers.
 
-Each row links to a reproducible command, a JSON run artifact, and a Markdown report generated by MCP Observatory. Entries can also include safe attack-simulation evidence as public artifacts are generated. The goal is to show which failure classes matter before teams let agents depend on MCP servers. In short: MCP servers need [tool-call receipts](./tool-call-receipts.md), not badges.
+Each row links to a reproducible command, an action receipt, a JSON run artifact, and a Markdown report generated by MCP Observatory. The goal is to show which failure classes matter before teams let agents depend on MCP servers.
 
-Future public grades can include [MCP Attack Simulator](./mcp-attack-simulator.md) evidence. Attack Simulator findings add safe, reproducible checks for tool poisoning, exfiltration canaries, permission-boundary risk, and contract drift without executing destructive payloads.
+The safe attack simulation evidence checks metadata, schemas, and controlled canary surfaces only. It does not execute destructive payloads, contact external callback URLs, or claim exploitability from a static finding alone.
 
-For the rules behind this page, see the [Safety Methodology](./methodology.md). For a smaller server-to-evidence map, see the [MCP Receipt Graph](./receipt-graph.md).
+For the rules behind this page, see the [Safety Methodology](./methodology.md) and the [MCP Attack Simulator](./mcp-attack-simulator.md). For a smaller server-to-evidence map, see the [MCP Receipt Graph](./receipt-graph.md).
 
 ## Snapshot
 
 - Evaluated servers: 15
-- Ready for CI: 10
-- Needs review before production: 3
-- Unsafe default posture: 2
+- Ready for CI: 7
+- Needs review before production: 4
+- Unsafe default posture: 4
 - Not reproducible: 0
-- Latest run: 2026-07-06T05:32:58.918Z
+- Latest run: 2026-07-06T19:49:58.878Z
 
 ## Evaluations
 
-| # | Server | Category | Verdict | Failure Class | Reproduce | Evidence | Notes |
-| ---: | --- | --- | --- | --- | --- | --- | --- |
-| 1 | [Official everything server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | Broad protocol surface | `npx -y @modelcontextprotocol/server-everything` | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | Zero-config official package; useful as a broad protocol baseline. [public proof](https://github.com/modelcontextprotocol/servers/pull/4392) |
-| 2 | [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | Tool schema clarity | `npx -y @modelcontextprotocol/server-sequential-thinking` | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | Zero-config official package. |
-| 3 | [Official memory server](https://github.com/modelcontextprotocol/servers) | Reference / Memory | **Ready for CI** | Persistent state tools | `npx -y @modelcontextprotocol/server-memory` | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | Zero-config official package. |
-| 4 | [Official filesystem server](https://github.com/modelcontextprotocol/servers) | Filesystem | **Needs review before production** | Sandboxed filesystem access | `npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture` | [JSON](./safety-index/artifacts/filesystem-server.json) / [report](./safety-index/artifacts/filesystem-server.md) | Runs against the checked-in harmless fixture directory. |
-| 5 | [Context7](https://github.com/upstash/context7) | Documentation / Search | **Ready for CI** | Prompt-injection-sensitive retrieval | `npx -y @upstash/context7-mcp` | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | Zero-config public package. |
-| 6 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | Prompt/resource contract | `npx -y promptopia-mcp` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
-| 7 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | Prompt/tool inventory | `npx -y ref-tools-mcp` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
-| 8 | [Git MCP Server](https://www.npmjs.com/package/@cyanheads/git-mcp-server) | Developer Tools | **Needs review before production** | Git tool boundary | `npx -y @cyanheads/git-mcp-server` | [JSON](./safety-index/artifacts/cyanheads-git-mcp-server.json) / [report](./safety-index/artifacts/cyanheads-git-mcp-server.md) | Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added. |
-| 9 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Ready for CI** | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
-| 10 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Ready for CI** | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
-| 11 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | Browser-control boundary | `npx -y @browsermcp/mcp` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
-| 12 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | Browser/code execution boundary | `npx -y @playwright/mcp` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
-| 13 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
-| 14 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
-| 15 | [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | Infrastructure / Kubernetes | **Needs review before production** | Command and cluster mutation boundary | `npx -y mcp-server-kubernetes` | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) / [attack-sim](./safety-index/artifacts/kubernetes-server.attack.md) / [SARIF](./safety-index/artifacts/kubernetes-server.attack.sarif) | Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims. |
+| # | Server | Category | Verdict | Action Receipt | Failure Class | Reproduce | CI Gate | Evidence | Notes |
+| ---: | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| 1 | [Official everything server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | `allow` | Broad protocol surface | `npx -y @modelcontextprotocol/server-everything` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-everything" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | Zero-config official package; useful as a broad protocol baseline. [public proof](https://github.com/modelcontextprotocol/servers/pull/4392) |
+| 2 | [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | `allow` | Tool schema clarity | `npx -y @modelcontextprotocol/server-sequential-thinking` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-sequential-thinking" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | Zero-config official package. |
+| 3 | [Official memory server](https://github.com/modelcontextprotocol/servers) | Reference / Memory | **Ready for CI** | `allow` | Persistent state tools | `npx -y @modelcontextprotocol/server-memory` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-memory" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | Zero-config official package. |
+| 4 | [Official filesystem server](https://github.com/modelcontextprotocol/servers) | Filesystem | **Needs review before production** | `gate` | Sandboxed filesystem access | `npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/filesystem-server.json) / [report](./safety-index/artifacts/filesystem-server.md) | Runs against the checked-in harmless fixture directory. |
+| 5 | [Context7](https://github.com/upstash/context7) | Documentation / Search | **Needs review before production** | `gate` | Prompt-injection-sensitive retrieval | `npx -y @upstash/context7-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | Zero-config public package. |
+| 6 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | `allow` | Prompt/resource contract | `npx -y promptopia-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y promptopia-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
+| 7 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | `allow` | Prompt/tool inventory | `npx -y ref-tools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
+| 8 | [Git MCP Server](https://www.npmjs.com/package/@cyanheads/git-mcp-server) | Developer Tools | **Needs review before production** | `gate` | Git tool boundary | `npx -y @cyanheads/git-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @cyanheads/git-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cyanheads-git-mcp-server.json) / [report](./safety-index/artifacts/cyanheads-git-mcp-server.md) | Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added. |
+| 9 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Needs review before production** | `gate` | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
+| 10 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
+| 11 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | `allow` | Browser-control boundary | `npx -y @browsermcp/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
+| 12 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y @playwright/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @playwright/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
+| 13 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | `allow` | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @antv/mcp-server-chart" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
+| 14 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | `quarantine` | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @executeautomation/playwright-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
+| 15 | [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | Infrastructure / Kubernetes | **Unsafe default posture** | `quarantine` | Command and cluster mutation boundary | `npx -y mcp-server-kubernetes` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims. |
 
 ## Patterns Observed
 
@@ -57,6 +57,7 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md).
 ## Publication Rules
 
 - Use only public repositories, public package commands, public PRs, and generated sanitized artifacts.
+- Include the action receipt and CI gate command so maintainers can rerun the evidence.
 - Treat findings as reproducible evidence, not public shaming.
 - Prefer “needs review” language unless there is clear artifact-backed proof of a dangerous default.
 - Keep raw telemetry, emails, hostnames, private URLs, tokens, and customer claims out of public materials.

package/docs/nsa-mcp-audit-ci.md

@@ -0,0 +1,88 @@
+# NSA-MCP Audit CI Guide
+
+Use this workflow when a repository needs MCP Observatory as a security release gate for an MCP server.
+
+The `nsa-mcp` profile is not an official certification. It maps MCP Observatory findings to practical control areas for sensitive environments.
+
+## Pull Request Audit
+
+```yaml
+name: MCP Observatory Audit
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 9 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - run: npm ci
+      - run: npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md --fail-on-high
+      - run: npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format sarif --output mcp-audit.sarif
+      - uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: mcp-audit.sarif
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: mcp-observatory-audit
+          path: |
+            mcp-audit.md
+            mcp-audit.sarif
+```
+
+## Failing Policy
+
+Use one of these gates:
+
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md --fail-on-critical
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md --fail-on-high
+```
+
+`--fail-on-critical` is appropriate while onboarding noisy repos. `--fail-on-high` is appropriate once maintainers have accepted the release gate.
+
+## Badge Ready Score
+
+The score command returns compact JSON for badge generators or dashboards:
+
+```bash
+npx @kryptosai/mcp-observatory score npx -y my-mcp-server --profile nsa-mcp --format json
+```
+
+Example:
+
+```json
+{
+  "target_id": "my-mcp-server",
+  "profile": "nsa-mcp",
+  "score": 87,
+  "status": "needs_review",
+  "finding_count": 2
+}
+```
+
+## Local Fixture Demo
+
+This repository includes an intentionally insecure inert fixture:
+
+```bash
+npx tsx src/cli.ts audit examples/insecure-mcp-server --profile nsa-mcp --format markdown --output /tmp/nsa-mcp-audit-report.md
+npx tsx src/cli.ts audit examples/insecure-mcp-server --profile nsa-mcp --format sarif --output /tmp/nsa-mcp-results.sarif
+npx tsx src/cli.ts score examples/insecure-mcp-server --profile nsa-mcp --format json
+```
+
+Generated examples are checked in under [`docs/examples`](./examples/).

package/docs/procurement-one-pager.md

@@ -0,0 +1,74 @@
+# MCP Observatory Procurement One-Pager
+
+## Positioning
+
+MCP Observatory is an open source security release gate for MCP servers before deployment into sensitive, regulated, or mission-critical agentic AI environments.
+
+It helps platform and security teams answer a concrete procurement question:
+
+> Can this MCP server be safely introduced into an agent workflow, and what evidence supports that decision?
+
+## What It Does
+
+- runs MCP server startup, conformance, schema, security, and safe attack-readiness checks
+- maps findings to the `nsa-mcp` public-guidance profile
+- produces Markdown audit reports for reviewers
+- emits SARIF for GitHub Code Scanning
+- emits compact trust score JSON for CI gates, badges, or dashboards
+- supports recurring GitHub Actions checks and remediation tracking
+
+## Buyer Value
+
+| Buyer concern | MCP Observatory answer |
+|---|---|
+| Tool boundary risk | Detects shell, filesystem, browser, network, secrets, and destructive tool surfaces. |
+| Agent manipulation risk | Flags hidden instructions and unsafe autonomous behavior in tool metadata. |
+| Security review workflow | Produces SARIF, Markdown, JSON, and CI artifacts. |
+| Procurement evidence | Provides a public-guidance crosswalk and repeatable audit commands. |
+| Adoption risk | Runs locally with no hosted dependency required. |
+| Remediation tracking | Supports repeatable audits, CI gates, and future baseline diffing. |
+
+## Pilot Package
+
+A 30 day pilot should include:
+
+- 5 to 25 MCP servers scanned
+- baseline `nsa-mcp` audit reports
+- SARIF uploaded to GitHub Code Scanning for selected repos
+- CI gate enabled on at least 3 repos
+- weekly scheduled audit runs
+- reviewer false-positive feedback
+- final remediation and adoption summary
+
+## Example Commands
+
+```bash
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format markdown --output mcp-audit.md
+npx @kryptosai/mcp-observatory audit npx -y my-mcp-server --profile nsa-mcp --format sarif --output mcp-audit.sarif
+npx @kryptosai/mcp-observatory score npx -y my-mcp-server --profile nsa-mcp --format json
+```
+
+## Security And Data Boundary
+
+Local audits do not require sending artifacts to a hosted service. Reports can stay inside the customer repository, CI logs, artifact store, or security tooling.
+
+MCP Observatory should not collect secrets, environment dumps, file contents, or raw command outputs for audit reporting. Secret-like values are reported by name or pattern with values redacted.
+
+## Procurement Notes
+
+- License: MIT
+- Runtime: Node.js 20+
+- Integration points: CLI, GitHub Actions, SARIF, Markdown, JSON
+- Hosted service: optional, not required for local audit evidence
+- Certification claim: none
+- Government endorsement claim: none
+- Best fit: AI platform, AppSec, DevSecOps, AI assurance, software supply chain, and agent runtime security teams
+
+## Useful Links
+
+- [Government and enterprise pilot brief](./government-enterprise-pilot.md)
+- [Public guidance crosswalk](./public-guidance-crosswalk.md)
+- [NSA-MCP audit CI guide](./nsa-mcp-audit-ci.md)
+- [Example audit report](./examples/nsa-mcp-audit-report.md)
+- [Example SARIF](./examples/nsa-mcp-results.sarif)
+- [Example score JSON](./examples/nsa-mcp-score.json)

package/docs/proof.md

@@ -5,8 +5,8 @@ MCP Observatory is early, but it is already a working MCP testing/security stack
 ## Current Public Surface
 
 - npm package: `@kryptosai/mcp-observatory`
-- GitHub Action: `KryptosAI/mcp-observatory/action@v0.27.0`
-- Latest release: `v0.27.0`
+- GitHub Action: `KryptosAI/mcp-observatory/action@v1.28.0`
+- Latest release: `v1.28.0`
 - CLI command count: scan, test, record, replay, verify, diff, watch, suggest, serve, lock, history, setup-ci, init-ci, ci-report, enterprise-report, score, badge, cloud
 - Test suite: 348 passing tests across 45 test files as of July 1, 2026
 - GitHub traffic snapshot: 745 clones and 232 unique cloners in the visible June 2026 traffic window

package/docs/public-guidance-crosswalk.md

@@ -0,0 +1,48 @@
+# Public Guidance Crosswalk For MCP Security Audits
+
+MCP Observatory maps MCP server evidence to public security guidance so security teams can review agent tool dependencies with familiar language.
+
+This crosswalk is not a certification, endorsement, authorization to operate, or claim of compliance with any government program. It is a practical mapping from MCP Observatory checks to public guidance themes.
+
+## Sources
+
+Primary public sources used for this crosswalk:
+
+- NSA, **Model Context Protocol (MCP): Security Design Considerations for Organizations Adopting MCP** (May 2026)
+- NSA and partners, **Deploying AI Systems Securely: Best Practices for Deploying Secure and Resilient AI Systems** (April 2024)
+- NSA, NCSC-UK, CISA, and partners, **Guidelines for Secure AI System Development** (November 2023)
+- CISA and partners, **Careful Adoption of Agentic AI Services** (May 2026)
+- NIST, **AI Risk Management Framework 1.0** and **Generative AI Profile NIST AI 600-1**
+- OMB, **M-25-21 Accelerating Federal Use of AI through Innovation, Governance, and Public Trust**
+- OMB, **M-25-22 Driving Efficient Acquisition of Artificial Intelligence in Government**
+
+## Crosswalk
+
+| MCP Observatory control | What Observatory checks | Public guidance theme | Audit evidence |
+|---|---|---|---|
+| `trust_boundaries` | Whether a server exposes risky tools, prompt/resource surfaces, or agent-steering metadata without clear boundaries. | Agentic AI systems need explicit governance, accountability, and threat-model-aware deployment. | Tool inventory, attack simulation findings, profile trust status. |
+| `tool_permissions` | Command, filesystem, browser, network, database, secrets, and broad destructive tool surfaces. | MCP servers create new execution and permission boundaries that should be constrained and reviewed. | Security findings, permission-boundary findings, schema evidence. |
+| `tool_description_integrity` | Hidden instructions, unsafe autonomous behavior, exfiltration language, and tool poisoning patterns in metadata. | AI system components should be secure by design and resistant to manipulation across the lifecycle. | Attack simulator findings with evidence excerpts. |
+| `authentication` | Missing authentication on HTTP targets and target-level auth configuration gaps. | AI services and integrations should enforce identity and access controls appropriate to deployment context. | Target config evidence, normalized finding `mcp-observatory/security/no-auth-http`. |
+| `secrets_exposure` | Secret-like environment variables and credential-like tool output. | Sensitive data used by AI systems needs protection throughout collection, processing, storage, and operation. | Redacted env-var evidence, canary/credential findings, SARIF results. |
+| `schema_validation` | Weak, missing, broad, or permissive schemas and contract drift. | AI system inputs and interfaces should be validated, monitored, and constrained. | Schema quality findings, lock/diff evidence, contract-drift findings. |
+| `input_validation` | Arbitrary command/code/file/path parameters and unconstrained additional properties. | Secure development guidance emphasizes input validation and least privilege. | Security findings and SARIF rule metadata. |
+| `auditability` | Whether audit logging, structured event output, and review artifacts are present. | Government and enterprise adoption needs traceability, monitoring, and evidence for risk management. | Markdown report, JSON report, SARIF, CI artifacts, score JSON. |
+| `runtime_safety` | Startup reliability, conformance, safe tool invocation behavior, and high-risk runtime boundaries. | Secure deployment guidance emphasizes resilient operation, monitoring, incident response, and recovery. | Run artifacts, check statuses, fatal errors, performance evidence. |
+| `supply_chain` | Added destructive tools, broadened schemas, removed required fields, and future dependency indicators. | AI systems inherit software supply-chain risk and need continuous review of updates. | Drift findings, lock files, repeatable CI gates. |
+
+## Why This Matters For MCP
+
+MCP servers are not just libraries. They are agent-facing tool endpoints. A server can expose command execution, filesystem access, browser automation, database operations, cloud APIs, or internal business workflows through tool descriptions and schemas. That makes MCP server review a practical release-gate problem.
+
+MCP Observatory turns that review into:
+
+- one command a maintainer can run locally
+- normalized findings a security reviewer can triage
+- SARIF results GitHub Code Scanning can display
+- trust status JSON a CI gate or badge generator can consume
+- repeatable evidence for remediation tracking
+
+## Review Boundary
+
+MCP Observatory does not prove semantic safety and does not replace human authorization decisions. A passing audit means the tested target produced reproducible evidence for the mapped checks under the tested command and profile.