@kryptosai/mcp-observatory 1.28.2 → 1.28.3

package/docs/demo.svg

@@ -1,59 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="820" height="320" viewBox="0 0 820 320">
-  <defs>
-    <style>
-      .bg { fill: #1e1e2e; }
-      .title-bar { fill: #313244; }
-      .dot-red { fill: #f38ba8; }
-      .dot-yellow { fill: #f9e2af; }
-      .dot-green { fill: #a6e3a1; }
-      .text { fill: #cdd6f4; font-family: 'Menlo', 'Monaco', 'Courier New', monospace; font-size: 13px; }
-      .bold { fill: #cdd6f4; font-weight: bold; }
-      .dim { fill: #6c7086; }
-      .green { fill: #a6e3a1; }
-      .yellow { fill: #f9e2af; }
-      .prompt { fill: #89b4fa; }
-      .line { stroke: #45475a; stroke-width: 1; }
-    </style>
-  </defs>
-  <rect class="bg" width="820" height="320" rx="10"/>
-  <rect class="title-bar" width="820" height="36" rx="10"/>
-  <rect class="title-bar" x="0" y="26" width="820" height="10"/>
-  <circle class="dot-red" cx="20" cy="18" r="6"/>
-  <circle class="dot-yellow" cx="40" cy="18" r="6"/>
-  <circle class="dot-green" cx="60" cy="18" r="6"/>
-  <text class="dim" x="350" y="22" text-anchor="middle">mcp-observatory — scan</text>
-
-  <text class="prompt" x="20" y="65">$</text>
-  <text class="text" x="35" y="65">npx @kryptosai/mcp-observatory scan --invoke-tools</text>
-
-  <text class="bold" x="20" y="100">Discovered 2 MCP server(s):</text>
-  <text class="dim" x="30" y="118">github (from ~/.claude.json)</text>
-  <text class="dim" x="30" y="136">filesystem (from ~/.claude.json)</text>
-
-  <text class="bold" x="20" y="170">Scan Results:</text>
-
-  <text class="bold" x="20" y="195">Target</text>
-  <text class="bold" x="230" y="195">Gate</text>
-  <text class="bold" x="300" y="195">Tools</text>
-  <text class="bold" x="400" y="195">Prompts</text>
-  <text class="bold" x="510" y="195">Resources</text>
-  <text class="bold" x="630" y="195">Invoke</text>
-
-  <line class="line" x1="20" y1="203" x2="750" y2="203"/>
-
-  <text class="text" x="20" y="225">github</text>
-  <text class="green" x="230" y="225">pass</text>
-  <text class="green" x="300" y="225">pass</text>
-  <text class="green" x="400" y="225">pass</text>
-  <text class="green" x="510" y="225">pass</text>
-  <text class="yellow" x="630" y="225">partial</text>
-
-  <text class="text" x="20" y="250">filesystem</text>
-  <text class="green" x="230" y="250">pass</text>
-  <text class="green" x="300" y="250">pass</text>
-  <text class="dim" x="400" y="250">unsupported</text>
-  <text class="dim" x="510" y="250">unsupported</text>
-  <text class="green" x="630" y="250">pass</text>
-
-  <text class="dim" x="20" y="295">Checked 2 servers in 3.2s</text>
-</svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="840" height="581.04"><rect width="840" height="581.04" rx="5" ry="5" class="a"/><svg y="0%" x="0%"><circle cx="20" cy="20" r="6" fill="#ff5f58"/><circle cx="40" cy="20" r="6" fill="#ffbd2e"/><circle cx="60" cy="20" r="6" fill="#18c132"/></svg><svg height="521.04" viewBox="0 0 80 52.104" width="800" x="15" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" y="50"><style>@keyframes n{0%{transform:translateX(0)}14.8%{transform:translateX(-80px)}19%{transform:translateX(-160px)}23%{transform:translateX(-320px)}23.1%{transform:translateX(-400px)}26.9%{transform:translateX(-480px)}27.4%{transform:translateX(-560px)}38.8%{transform:translateX(-640px)}93.1%{transform:translateX(-1360px)}99.8%{transform:translateX(-1520px)}}.a{fill:#282d35}.f{fill:#b9c0cb}.f,.g,.i,.j,.l{white-space:pre}.g{fill:#b9c0cb;font-weight:700}.i,.j,.l{fill:#dbab79}.j,.l{fill:#a8cc8c}.l{fill:#66c2cd}</style><g font-family="Monaco,Consolas,Menlo,'Bitstream Vera Sans Mono','Powerline Symbols',monospace" font-size="1.67"><defs><symbol id="1"><text y="1.67" class="f">⠙</text></symbol><symbol id="2"><text y="1.67" class="f">⠹</text></symbol><symbol id="3"><text y="1.67" class="f">⟳</text><text x="2.004" y="1.67" class="f">Scoring</text><text x="10.02" y="1.67" class="g">mcp-server-kubernetes</text><text x="31.062" y="1.67" class="f">...</text></symbol><symbol id="4"><text x="2.004" y="1.67" class="g">MCP</text><text x="6.012" y="1.67" class="g">Health</text><text x="13.026" y="1.67" class="g">Score:</text><text x="20.04" y="1.67" style="white-space:pre" fill="#dbab79" font-weight="700">70/100</text><text x="27.054" y="1.67" class="f">(</text><text x="28.056" y="1.67" class="i">C</text><text x="29.058" y="1.67" class="f">)</text></symbol><symbol id="5"><text x="2.004" y="1.67" class="f">Protocol</text><text x="11.022" y="1.67" class="f">Compliance</text><text x="25.05" y="1.67" class="j">████████████████████</text><text x="46.092" y="1.67" class="f">100</text><text x="51.102" y="1.67" class="f">(weight:</text><text x="60.12" y="1.67" class="f">30%)</text></symbol><symbol id="6"><text x="2.004" y="1.67" class="f">Schema</text><text x="9.018" y="1.67" class="f">Quality</text><text x="25.05" y="1.67" class="i">████████████░░░░░░░░</text><text x="47.094" y="1.67" class="f">60</text><text x="51.102" y="1.67" class="f">(weight:</text><text x="60.12" y="1.67" class="f">20%)</text></symbol><symbol id="7"><text x="2.004" y="1.67" class="f">Security</text><text x="25.05" y="1.67" style="white-space:pre" fill="#e88388">░░░░░░░░░░░░░░░░░░░░</text><text x="48.096" y="1.67" class="f">0</text><text x="51.102" y="1.67" class="f">(weight:</text><text x="60.12" y="1.67" class="f">20%)</text></symbol><symbol id="8"><text x="2.004" y="1.67" class="f">Reliability</text><text x="25.05" y="1.67" class="j">██████████████████░░</text><text x="47.094" y="1.67" class="f">90</text><text x="51.102" y="1.67" class="f">(weight:</text><text x="60.12" y="1.67" class="f">20%)</text></symbol><symbol id="9"><text x="2.004" y="1.67" class="f">Performance</text><text x="25.05" y="1.67" class="j">████████████████████</text><text x="46.092" y="1.67" class="f">100</text><text x="51.102" y="1.67" class="f">(weight:</text><text x="60.12" y="1.67" class="f">10%)</text></symbol><symbol id="10"><text x="2.004" y="1.67" class="f">Schema</text><text x="9.018" y="1.67" class="f">Quality:</text></symbol><symbol id="11"><text x="4.008" y="1.67" class="f">→</text><text x="6.012" y="1.67" class="f">schema-quality:</text><text x="22.044" y="1.67" class="f">partial</text><text x="30.06" y="1.67" class="f">(60/100)</text></symbol><symbol id="12"><text x="2.004" y="1.67" class="f">Security:</text></symbol><symbol id="13"><text x="4.008" y="1.67" class="f">→</text><text x="6.012" y="1.67" class="f">security-lite:</text><text x="21.042" y="1.67" class="f">fail</text><text x="26.052" y="1.67" class="f">(0/100)</text></symbol><symbol id="14"><text x="4.008" y="1.67" class="f">→</text><text x="6.012" y="1.67" class="f">security:</text><text x="16.032" y="1.67" class="f">fail</text><text x="21.042" y="1.67" class="f">(0/100)</text></symbol><symbol id="15"><text x="2.004" y="1.67" class="f">Reliability:</text></symbol><symbol id="16"><text x="4.008" y="1.67" class="f">→</text><text x="6.012" y="1.67" class="f">tools:</text><text x="13.026" y="1.67" class="f">pass</text><text x="18.036" y="1.67" class="f">(100/100)</text></symbol><symbol id="17"><text x="4.008" y="1.67" class="f">→</text><text x="6.012" y="1.67" class="f">prompts:</text><text x="15.03" y="1.67" class="f">pass</text><text x="20.04" y="1.67" class="f">(100/100)</text></symbol><symbol id="18"><text x="4.008" y="1.67" class="f">→</text><text x="6.012" y="1.67" class="f">resources:</text><text x="17.034" y="1.67" class="f">pass</text><text x="22.044" y="1.67" class="f">(100/100)</text></symbol><symbol id="19"><text x="4.008" y="1.67" class="f">→</text><text x="6.012" y="1.67" class="f">tools-invoke:</text><text x="20.04" y="1.67" class="f">partial</text><text x="28.056" y="1.67" class="f">(60/100)</text></symbol><symbol id="20"><text x="2.004" y="1.67" class="f">Production</text><text x="13.026" y="1.67" class="f">MCP</text><text x="17.034" y="1.67" class="f">teams:</text><text x="24.048" y="1.67" class="f">hosted</text><text x="31.062" y="1.67" class="f">security</text><text x="40.08" y="1.67" class="f">reports,</text><text x="49.098" y="1.67" class="f">certification,</text><text x="64.128" y="1.67" class="f">and</text><text x="68.136" y="1.67" class="f">controlled</text><text x="79.158" y="1.67" class="f">d</text></symbol><symbol id="21"><text y="1.67" class="f">rift</text><text x="5.01" y="1.67" class="f">review.</text></symbol><symbol id="22"><text x="2.004" y="1.67" class="f">Run</text><text x="6.012" y="1.67" class="l">npx</text><text x="10.02" y="1.67" class="l">@kryptosai/mcp-observatory</text><text x="37.074" y="1.67" class="l">cloud</text><text x="43.086" y="1.67" class="f">or</text><text x="46.092" y="1.67" class="f">contact</text><text x="54.108" y="1.67" class="f">william@banksey.com.</text></symbol><symbol id="a"><path fill="transparent" d="M0 0h80v24H0z"/></symbol></defs><path class="a" d="M0 0h80v52.104H0z"/><g style="animation-duration:2.026s;animation-iteration-count:infinite;animation-name:n;animation-timing-function:steps(1,end)"><svg width="1600"><svg><use xlink:href="#a"/></svg><svg x="80"><use xlink:href="#a"/><use xlink:href="#1"/></svg><svg x="160"><use xlink:href="#a"/><use xlink:href="#2"/></svg><svg x="240"><use xlink:href="#a"/><use xlink:href="#2"/></svg><svg x="320"><use xlink:href="#a"/></svg><svg x="400"><use xlink:href="#a"/><text y="1.67" class="f">⠸</text></svg><svg x="480"><use xlink:href="#a"/><text y="1.67" class="f">⠼</text></svg><svg x="560"><use xlink:href="#a"/></svg><svg x="640"><use xlink:href="#a"/><use xlink:href="#3"/></svg><svg x="720"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/></svg><svg x="800"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/><use xlink:href="#6" y="10.855"/></svg><svg x="880"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/><use xlink:href="#6" y="10.855"/><use xlink:href="#7" y="13.026"/></svg><svg x="960"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/><use xlink:href="#6" y="10.855"/><use xlink:href="#7" y="13.026"/><use xlink:href="#8" y="15.197"/><use xlink:href="#9" y="17.368"/><use xlink:href="#10" y="21.71"/><use xlink:href="#11" y="23.881"/><use xlink:href="#12" y="26.052"/><use xlink:href="#13" y="28.223"/><use xlink:href="#14" y="30.394"/></svg><svg x="1040"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/><use xlink:href="#6" y="10.855"/><use xlink:href="#7" y="13.026"/><use xlink:href="#8" y="15.197"/><use xlink:href="#9" y="17.368"/><use xlink:href="#10" y="21.71"/><use xlink:href="#11" y="23.881"/><use xlink:href="#12" y="26.052"/><use xlink:href="#13" y="28.223"/><use xlink:href="#14" y="30.394"/><use xlink:href="#15" y="32.565"/><use xlink:href="#16" y="34.736"/><use xlink:href="#17" y="36.907"/></svg><svg x="1120"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/><use xlink:href="#6" y="10.855"/><use xlink:href="#7" y="13.026"/><use xlink:href="#8" y="15.197"/><use xlink:href="#9" y="17.368"/><use xlink:href="#10" y="21.71"/><use xlink:href="#11" y="23.881"/><use xlink:href="#12" y="26.052"/><use xlink:href="#13" y="28.223"/><use xlink:href="#14" y="30.394"/><use xlink:href="#15" y="32.565"/><use xlink:href="#16" y="34.736"/><use xlink:href="#17" y="36.907"/><use xlink:href="#18" y="39.078"/></svg><svg x="1200"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/><use xlink:href="#6" y="10.855"/><use xlink:href="#7" y="13.026"/><use xlink:href="#8" y="15.197"/><use xlink:href="#9" y="17.368"/><use xlink:href="#10" y="21.71"/><use xlink:href="#11" y="23.881"/><use xlink:href="#12" y="26.052"/><use xlink:href="#13" y="28.223"/><use xlink:href="#14" y="30.394"/><use xlink:href="#15" y="32.565"/><use xlink:href="#16" y="34.736"/><use xlink:href="#17" y="36.907"/><use xlink:href="#18" y="39.078"/><use xlink:href="#19" y="41.249"/></svg><svg x="1280"><use xlink:href="#a"/><use xlink:href="#3"/><use xlink:href="#4" y="4.342"/><use xlink:href="#5" y="8.684"/><use xlink:href="#6" y="10.855"/><use xlink:href="#7" y="13.026"/><use xlink:href="#8" y="15.197"/><use xlink:href="#9" y="17.368"/><use xlink:href="#10" y="21.71"/><use xlink:href="#11" y="23.881"/><use xlink:href="#12" y="26.052"/><use xlink:href="#13" y="28.223"/><use xlink:href="#14" y="30.394"/><use xlink:href="#15" y="32.565"/><use xlink:href="#16" y="34.736"/><use xlink:href="#17" y="36.907"/><use xlink:href="#18" y="39.078"/><use xlink:href="#19" y="41.249"/></svg><svg x="1360"><use xlink:href="#a"/><use xlink:href="#4"/><use xlink:href="#5" y="4.342"/><use xlink:href="#6" y="6.513"/><use xlink:href="#7" y="8.684"/><use xlink:href="#8" y="10.855"/><use xlink:href="#9" y="13.026"/><use xlink:href="#10" y="17.368"/><use xlink:href="#11" y="19.539"/><use xlink:href="#12" y="21.71"/><use xlink:href="#13" y="23.881"/><use xlink:href="#14" y="26.052"/><use xlink:href="#15" y="28.223"/><use xlink:href="#16" y="30.394"/><use xlink:href="#17" y="32.565"/><use xlink:href="#18" y="34.736"/><use xlink:href="#19" y="36.907"/><use xlink:href="#20" y="41.249"/><use xlink:href="#21" y="43.42"/><use xlink:href="#22" y="45.591"/></svg><svg x="1440"><use xlink:href="#a"/><use xlink:href="#4"/><use xlink:href="#5" y="4.342"/><use xlink:href="#6" y="6.513"/><use xlink:href="#7" y="8.684"/><use xlink:href="#8" y="10.855"/><use xlink:href="#9" y="13.026"/><use xlink:href="#10" y="17.368"/><use xlink:href="#11" y="19.539"/><use xlink:href="#12" y="21.71"/><use xlink:href="#13" y="23.881"/><use xlink:href="#14" y="26.052"/><use xlink:href="#15" y="28.223"/><use xlink:href="#16" y="30.394"/><use xlink:href="#17" y="32.565"/><use xlink:href="#18" y="34.736"/><use xlink:href="#19" y="36.907"/><use xlink:href="#20" y="41.249"/><use xlink:href="#21" y="43.42"/><use xlink:href="#22" y="45.591"/><use xlink:href="#1" y="49.933"/></svg><svg x="1520"><use xlink:href="#a"/><use xlink:href="#4"/><use xlink:href="#5" y="4.342"/><use xlink:href="#6" y="6.513"/><use xlink:href="#7" y="8.684"/><use xlink:href="#8" y="10.855"/><use xlink:href="#9" y="13.026"/><use xlink:href="#10" y="17.368"/><use xlink:href="#11" y="19.539"/><use xlink:href="#12" y="21.71"/><use xlink:href="#13" y="23.881"/><use xlink:href="#14" y="26.052"/><use xlink:href="#15" y="28.223"/><use xlink:href="#16" y="30.394"/><use xlink:href="#17" y="32.565"/><use xlink:href="#18" y="34.736"/><use xlink:href="#19" y="36.907"/><use xlink:href="#20" y="41.249"/><use xlink:href="#21" y="43.42"/><use xlink:href="#22" y="45.591"/></svg></svg></g></g></svg></svg>

package/docs/mcp-receipts.md

@@ -23,6 +23,8 @@ Each receipt has eight stable sections:
 
 The full audit report remains the place for every finding. The receipt is the compact trust record people and agents can cite.
 
+Receipts can also participate in a public or private MCP risk graph. The receipt schema does not need to change for that: `risk-graph` reads receipt artifacts, preserves the source evidence hash, classifies the capability boundary, and renders whether the server should be allowed, gated, rerun, quarantined, or escalated.
+
 ## Verdict And Action Mapping
 
 Receipts include both a human-readable state and an action receipt.
@@ -84,6 +86,12 @@ Public Safety Index receipt:
 mcp-observatory receipt npx -y my-mcp-server --profile nsa-mcp --environment-class public_safety_index --format markdown --output receipt.md
 ```
 
+Generate a risk graph from one receipt or a directory of receipts and run artifacts:
+
+```bash
+mcp-observatory risk-graph --input receipt.json --json mcp-risk-graph.json --output mcp-risk-graph.md --html mcp-risk-graph.html
+```
+
 Supported `environment_class` values:
 
 - `local`
@@ -102,6 +110,7 @@ Receipts also avoid leaking secrets or sensitive local paths. Working directorie
 Receipts are meant to become the object that directories, agents, CI gates, maintainers, and buyers can pass around:
 
 - a directory can link to the current receipt for a public MCP server
+- a graph can group receipts by capability boundary and recommended action
 - a maintainer can claim the receipt and add CI
 - an agent can decide whether to `allow`, `gate`, `rerun`, `quarantine`, or `escalate`
 - a buyer can ask for a private fleet receipt pack before approving internal MCP dependencies

package/docs/mcp-server-safety-index.md

@@ -10,12 +10,12 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
 
 ## Snapshot
 
-- Evaluated servers: 15
+- Evaluated servers: 18
 - Ready for CI: 7
-- Needs review before production: 4
-- Unsafe default posture: 4
+- Needs review before production: 6
+- Unsafe default posture: 5
 - Not reproducible: 0
-- Latest run: 2026-07-06T19:49:58.878Z
+- Latest run: 2026-07-08T21:36:07.342Z
 
 ## Evaluations
 
@@ -25,21 +25,24 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
 | 2 | [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | Reference | **Ready for CI** | `allow` | Tool schema clarity | `npx -y @modelcontextprotocol/server-sequential-thinking` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-sequential-thinking" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | Zero-config official package. |
 | 3 | [Official memory server](https://github.com/modelcontextprotocol/servers) | Reference / Memory | **Ready for CI** | `allow` | Persistent state tools | `npx -y @modelcontextprotocol/server-memory` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-memory" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | Zero-config official package. |
 | 4 | [Official filesystem server](https://github.com/modelcontextprotocol/servers) | Filesystem | **Needs review before production** | `gate` | Sandboxed filesystem access | `npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-filesystem examples/filesystem-fixture" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/filesystem-server.json) / [report](./safety-index/artifacts/filesystem-server.md) | Runs against the checked-in harmless fixture directory. |
-| 5 | [Context7](https://github.com/upstash/context7) | Documentation / Search | **Needs review before production** | `gate` | Prompt-injection-sensitive retrieval | `npx -y @upstash/context7-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | Zero-config public package. |
-| 6 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | `allow` | Prompt/resource contract | `npx -y promptopia-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y promptopia-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
-| 7 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | `allow` | Prompt/tool inventory | `npx -y ref-tools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
-| 8 | [Git MCP Server](https://www.npmjs.com/package/@cyanheads/git-mcp-server) | Developer Tools | **Needs review before production** | `gate` | Git tool boundary | `npx -y @cyanheads/git-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @cyanheads/git-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cyanheads-git-mcp-server.json) / [report](./safety-index/artifacts/cyanheads-git-mcp-server.md) | Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added. |
-| 9 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Needs review before production** | `gate` | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
-| 10 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
-| 11 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | `allow` | Browser-control boundary | `npx -y @browsermcp/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
-| 12 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y @playwright/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @playwright/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
-| 13 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | `allow` | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @antv/mcp-server-chart" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
-| 14 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | `quarantine` | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @executeautomation/playwright-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
-| 15 | [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | Infrastructure / Kubernetes | **Unsafe default posture** | `quarantine` | Command and cluster mutation boundary | `npx -y mcp-server-kubernetes` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims. |
+| 5 | [Filesystem MCP server](https://github.com/modelcontextprotocol/servers) | Filesystem | **Needs review before production** | `gate` | Temporary directory filesystem access | `npx -y @modelcontextprotocol/server-filesystem <safe-empty-temp-dir>` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-filesystem \"<safe-empty-temp-dir>\"" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/filesystem-mcp-server.json) / [report](./safety-index/artifacts/filesystem-mcp-server.md) | Safety Index generation creates an empty temporary directory for the server root and sanitizes that path from public artifacts. |
+| 6 | [Context7](https://github.com/upstash/context7) | Documentation / Search | **Needs review before production** | `gate` | Prompt-injection-sensitive retrieval | `npx -y @upstash/context7-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | Zero-config public package. |
+| 7 | [Promptopia](https://www.npmjs.com/package/promptopia-mcp) | Prompts | **Ready for CI** | `allow` | Prompt/resource contract | `npx -y promptopia-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y promptopia-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/promptopia-server.json) / [report](./safety-index/artifacts/promptopia-server.md) | Uses the checked-in prompt fixture through package defaults. |
+| 8 | [Ref tools](https://www.npmjs.com/package/ref-tools-mcp) | Developer Tools | **Ready for CI** | `allow` | Prompt/tool inventory | `npx -y ref-tools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y ref-tools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/ref-tools-server.json) / [report](./safety-index/artifacts/ref-tools-server.md) | Zero-config public package. |
+| 9 | [Git MCP Server](https://www.npmjs.com/package/@cyanheads/git-mcp-server) | Developer Tools | **Needs review before production** | `gate` | Git tool boundary | `npx -y @cyanheads/git-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @cyanheads/git-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/cyanheads-git-mcp-server.json) / [report](./safety-index/artifacts/cyanheads-git-mcp-server.md) | Zero-config public package. Keep tool invocation read-only unless a harmless fixture repository is added. |
+| 10 | [Official GitHub MCP server](https://github.com/modelcontextprotocol/servers) | Developer Tools | **Needs review before production** | `gate` | Write/merge tool boundary | `npx -y @modelcontextprotocol/server-github` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @modelcontextprotocol/server-github" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/github-mcp-server.json) / [report](./safety-index/artifacts/github-mcp-server.md) | Zero-config package; tool listing succeeds without a real GitHub token, so this check is safe to run in CI. Note: npm currently flags this package as deprecated/no longer supported by the publisher — treat this target as compatibility evidence, not an endorsement of the package's maintenance status. |
+| 11 | [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | Infrastructure | **Needs review before production** | `gate` | Infrastructure tool surface | `npx -y @opentofu/opentofu-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | Zero-config public package. |
+| 12 | [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y puppeteer-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | Intentional browser evaluation is suppressed so remaining findings stay readable. |
+| 13 | [BrowserMCP](https://github.com/BrowserMCP/mcp) | Browser Automation | **Ready for CI** | `allow` | Browser-control boundary | `npx -y @browsermcp/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @browsermcp/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | Zero-config public package. [public proof](https://github.com/BrowserMCP/mcp/pull/189) |
+| 14 | [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | Browser Automation | **Unsafe default posture** | `quarantine` | Browser/code execution boundary | `npx -y @playwright/mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @playwright/mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | Zero-config public package; security findings represent policy-review prompts, not a vulnerability claim. |
+| 15 | [AntV chart MCP server](https://github.com/antvis/mcp-server-chart) | Visualization | **Ready for CI** | `allow` | Artifact-producing tools | `npx -y @antv/mcp-server-chart` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @antv/mcp-server-chart" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/antv-chart-server.json) / [report](./safety-index/artifacts/antv-chart-server.md) | Zero-config public package. [public proof](https://github.com/antvis/mcp-server-chart/pull/312) |
+| 16 | [ExecuteAutomation Playwright MCP](https://github.com/executeautomation/mcp-playwright) | Browser Automation | **Unsafe default posture** | `quarantine` | Startup/listing reproducibility | `npx -y @executeautomation/playwright-mcp-server` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y @executeautomation/playwright-mcp-server" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/executeautomation-playwright-server.json) / [report](./safety-index/artifacts/executeautomation-playwright-server.md) | Evaluated as a public package; current result should be treated as a maintainer conversation starter. [public proof](https://github.com/executeautomation/mcp-playwright/pull/225) |
+| 17 | [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | Infrastructure / Kubernetes | **Unsafe default posture** | `quarantine` | Command and cluster mutation boundary | `npx -y mcp-server-kubernetes` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | Zero-config public package. Evaluated without cluster credentials; findings are metadata and schema boundary prompts, not exploit claims. |
+| 18 | [Chrome DevTools MCP](https://github.com/ChromeDevTools/chrome-devtools-mcp) | Browser Automation | **Unsafe default posture** | `gate` | Browser/code execution boundary | `npx -y chrome-devtools-mcp` | `npx @kryptosai/mcp-observatory setup-ci --all --command "npx -y chrome-devtools-mcp" --sarif --schedule weekly` | [JSON](./safety-index/artifacts/chrome-devtools-mcp-server.json) / [report](./safety-index/artifacts/chrome-devtools-mcp-server.md) | Zero-config public package; browser-control findings should be treated as policy-review prompts, not vulnerability claims. |
 
 ## Patterns Observed
 
-- Browser/code execution boundary: 2 server(s)
+- Browser/code execution boundary: 3 server(s)
 - Artifact-producing tools: 1 server(s)
 - Broad protocol surface: 1 server(s)
 - Browser-control boundary: 1 server(s)
@@ -52,7 +55,9 @@ For the rules behind this page, see the [Safety Methodology](./methodology.md) a
 - Prompt/tool inventory: 1 server(s)
 - Sandboxed filesystem access: 1 server(s)
 - Startup/listing reproducibility: 1 server(s)
+- Temporary directory filesystem access: 1 server(s)
 - Tool schema clarity: 1 server(s)
+- Write/merge tool boundary: 1 server(s)
 
 ## Publication Rules
 

package/docs/metrics-dashboard.md

@@ -13,7 +13,7 @@ The layout follows an App Store Connect-style breakdown:
 - Usage
 - Reliability
 
-The Strategy section turns raw telemetry into operator decisions: command funnel, clone/download-to-CI conversion, version adoption, account/domain drilldown, CI/local source mix, and release-spike context.
+The Strategy section turns raw telemetry into operator decisions: command funnel, receipt-to-risk-graph conversion, clone/download-to-CI conversion, version adoption, account/domain drilldown, CI/local source mix, and release-spike context.
 
 Daily rows are shown newest to oldest so the most recent project activity is always at the top.
 
@@ -45,6 +45,22 @@ The collector stores each source independently. If one source fails, the dashboa
 
 GitHub traffic APIs have a limited visible window, so the collector stores snapshots locally going forward. npm daily buckets can lag; the dashboard labels npm data as complete public days rather than assuming current-day zero.
 
+## Growth Command Center
+
+The dashboard tracks the Wiz-style evidence funnel:
+
+- latest-version adoption
+- stale-version sessions
+- receipt sessions
+- risk-graph sessions
+- attack-sim sessions
+- setup-ci/SARIF sessions
+- external CI sessions
+- paid-intent commands
+- sanitized account/domain signals
+
+`risk-graph` telemetry stores command-level aggregates such as invocation, output format, input count, node count, highest graph risk, and whether graph output was generated. It does not collect raw artifacts, file contents, secrets, private URLs, command output, hostnames, or unapproved customer names.
+
 ## Credentials
 
 GitHub collection uses either:

package/docs/private-mcp-fleet-risk-graph.md

@@ -0,0 +1,69 @@
+# Private MCP Fleet Risk Graph
+
+Public MCP receipts prove the method. A private MCP fleet risk graph turns the method into a buyer-ready operating picture.
+
+## Offer
+
+**Private MCP Dependency Safety Report + CI Gate + Attack Simulation Evidence Pack**
+
+What the buyer gets:
+
+- private MCP dependency inventory across repos, agents, gateways, and automation projects
+- MCP risk graph grouped by filesystem, browser, command execution, infrastructure/cloud, memory, data/API, and identity/auth boundaries
+- safe-mode attack simulation evidence for selected dependencies
+- receipt pack with rerun commands, artifact hashes, verdicts, and recommended actions
+- CI/SARIF rollout plan with owner-ready pull request guidance
+- top risky MCP dependencies and remediation backlog
+- procurement/security appendix that explains scope, safe-mode guarantees, limitations, and evidence custody
+
+## Safe-Mode Scope
+
+The pilot does not run destructive attacks, exfiltrate secrets, contact external callback infrastructure, mutate production systems, or require customer credentials in public artifacts.
+
+Evidence is generated from safe startup commands, metadata, schemas, tool descriptions, allowed fixture modes, run artifacts, safe attack-readiness simulation, drift comparison, SARIF, and maintainer-provided context.
+
+## Pricing Anchors
+
+| Package | Starting point | Best for |
+| --- | ---: | --- |
+| Narrow readiness review | `$2,500+` | One team, one repo, or one high-priority MCP dependency. |
+| Attack simulation evidence pack | `$15,000+` | Security teams that need safe attack-readiness proof and owner-ready remediation. |
+| Private fleet risk graph pilot | `$50,000+` | Organizations adopting MCP across multiple agents, repos, teams, or gateways. |
+
+## Pilot Timeline
+
+| Phase | Output |
+| --- | --- |
+| Day 0-1 | Scope, safe startup commands, target inventory, evidence handling rules. |
+| Day 2-4 | Run artifacts, receipts, attack-sim evidence, SARIF, initial risk graph. |
+| Day 5-7 | Owner-ready remediation list, CI rollout plan, executive verdict, procurement appendix. |
+| Optional ongoing | Weekly drift review, CI gate tuning, hosted retention, alerting, and SIEM export roadmap. |
+
+## Sample Deliverable
+
+See the [sanitized sample private fleet risk graph](./sample-private-fleet-risk-graph.md).
+
+## Proprietary Layer
+
+The public CLI, receipts, attack simulator, and risk graph format stay open because they create trust and distribution. These commercial surfaces should stay private unless a customer agreement says otherwise:
+
+- raw telemetry, private account signals, emails, hostnames, and lead intelligence
+- private fleet inventory and buyer-specific risk interpretation
+- commercial scoring weights and prioritization models
+- hosted review workflow, retention, alerting, SIEM export, and incident timelines
+- customer-specific reports, remediation ownership, and procurement packets
+
+## Request A Pilot
+
+Run:
+
+```bash
+npx @kryptosai/mcp-observatory cloud
+```
+
+Or send the buyer this short ask:
+
+```text
+We can map your private MCP fleet into a risk graph, generate safe attack-simulation evidence, and ship CI/SARIF gates without running destructive probes or collecting secrets. The first pilot produces an executive verdict, dependency graph, receipt pack, SARIF evidence, and owner-ready remediation list.
+```
+

package/docs/receipt-graph.md

@@ -1,35 +1,107 @@
-# MCP Receipt Graph
+# MCP Risk Graph
 
-Agent trust should be a receipt graph, not a follower graph.
+Agent trust should be a risk graph, not a follower graph.
 
-A social graph says who is popular. A receipt graph says what was verified, what could not happen during the run, which artifact can be rerun, and what changed since the last trusted state.
+A follower graph says who is popular. An MCP risk graph says which agent toolchains were evaluated, what capability boundary each server exposes, what receipts support the verdict, which evidence can be rerun, where CI/SARIF should be added, and what changed since the last trusted state.
 
-Use this page as the first public map from MCP servers to reproducible evidence. It is intentionally small: a receipt graph should start with high-quality, rerunnable receipts before it tries to become a giant directory.
+MCP Observatory maps the risk graph of agent toolchains before agents depend on them.
 
-## Receipt Graph Fields
+## Generate A Graph
+
+Use `risk-graph` to merge run artifacts, receipt artifacts, or a Safety Index artifact directory into JSON, Markdown, and HTML outputs:
+
+```bash
+npx @kryptosai/mcp-observatory risk-graph --input docs/safety-index/artifacts --json mcp-risk-graph.json --output mcp-risk-graph.md --html mcp-risk-graph.html
+```
+
+Supported inputs:
+
+- one JSON run artifact
+- one JSON receipt
+- an audit report JSON with an embedded `artifact`
+- a directory containing any mix of supported artifacts
+- repeated `--input` paths
+
+The JSON output is intended for agents and tooling. The Markdown output is intended for GitHub and docs. The HTML output is intended for demos, buyer review, and internal security conversations.
+
+## Graph Fields
 
 | Field | Meaning |
 | --- | --- |
-| Server | Public MCP server, package, or repo. |
-| Receipt | JSON/Markdown evidence generated by MCP Observatory. |
-| Attack evidence | Safe `attack-sim` command, report, or SARIF. |
-| CI/SARIF path | Whether the next step is a maintainer CI gate, Code Scanning, or both. |
-| Capability envelope | What the run was allowed to access. |
-| Last verified | Timestamp of the latest public Safety Index refresh. |
-
-## Seed Graph
-
-| Server | Receipt | Attack evidence | CI/SARIF path | Capability envelope | Last verified |
-| --- | --- | --- | --- | --- | --- |
-| [Official everything server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | `attack-sim npx -y @modelcontextprotocol/server-everything` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
-| [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | `attack-sim npx -y @modelcontextprotocol/server-sequential-thinking` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
-| [Official memory server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | `attack-sim npx -y @modelcontextprotocol/server-memory` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
-| [Context7](https://github.com/upstash/context7) | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | `attack-sim npx -y @upstash/context7-mcp` | Maintainer CI conversation candidate. | Public package, no secrets, no production data. | 2026-07-06 |
-| [BrowserMCP](https://github.com/BrowserMCP/mcp) | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | `attack-sim npx -y @browsermcp/mcp` | Browser boundary candidate for CI/SARIF. | Public package, no secrets, no production credentials. | 2026-07-06 |
-| [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | `attack-sim npx -y @playwright/mcp` | High-capability browser boundary; Code Scanning useful. | Public package, no secrets, no production credentials. | 2026-07-06 |
-| [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | `attack-sim npx -y puppeteer-mcp-server` | Browser boundary candidate for review before production. | Public package, no secrets, no production credentials. | 2026-07-06 |
-| [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | `attack-sim npx -y @opentofu/opentofu-mcp-server` | Infrastructure tool surface; CI/SARIF recommended. | Public package, no secrets, no production infrastructure. | 2026-07-06 |
-| [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | [attack-sim](./safety-index/artifacts/kubernetes-server.attack.md) / [SARIF](./safety-index/artifacts/kubernetes-server.attack.sarif) | Kubernetes command and cluster mutation boundary; CI/SARIF recommended before agent dependency. | Public package, no secrets, no kubeconfig, no cluster tool invocation. | 2026-07-06 |
+| Server | Public MCP server, package, repo, or private fleet dependency. |
+| Capability boundary | Filesystem, browser, command execution, infrastructure/cloud, memory, data/API, identity/auth, or unknown. |
+| Receipt state | Whether the current evidence is ready for CI, needs review, blocked, or could not be evaluated. |
+| Recommended action | `allow`, `gate`, `rerun`, `quarantine`, or `escalate`. |
+| Risk level | Graph-level severity derived from receipts, attack-sim evidence, findings, and action receipts. |
+| Evidence refs | Source artifact paths and SHA-256 hashes. |
+| CI command | The exact `setup-ci --all --sarif` command maintainers can run. |
+
+## Seed Public Map
+
+The seed graph is intentionally evidence-based, not a dunk list. A public entry means MCP Observatory has a safe, reproducible command and an artifact path. It is not an official certification and should not be treated as a production approval.
+
+### Browser Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [BrowserMCP](https://github.com/BrowserMCP/mcp) | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | `attack-sim npx -y @browsermcp/mcp` | `setup-ci --all --command "npx -y @browsermcp/mcp" --sarif` | Browser automation should have clear CI evidence before agents depend on it. |
+| [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | `attack-sim npx -y @playwright/mcp` | `setup-ci --all --command "npx -y @playwright/mcp" --sarif` | High-capability browser boundary; safe evidence is useful for downstream adopters. |
+| [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | `attack-sim npx -y puppeteer-mcp-server` | `setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif` | Public package, no production credentials, no destructive tool invocation. |
+
+### Command Execution And Infrastructure Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | `attack-sim npx -y @opentofu/opentofu-mcp-server` | `setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif` | Infrastructure tools deserve explicit permission-boundary evidence before production use. |
+| [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | [attack-sim](./safety-index/artifacts/kubernetes-server.attack.md) / [SARIF](./safety-index/artifacts/kubernetes-server.attack.sarif) | `setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif` | Kubernetes and cluster mutation boundaries should be reviewed with no kubeconfig or cluster calls in public evidence. |
+
+### Memory Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [Official memory server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | `attack-sim npx -y @modelcontextprotocol/server-memory` | `setup-ci --all --command "npx -y @modelcontextprotocol/server-memory" --sarif` | Memory tools need clear evidence around persistence, recall, and schema drift. |
+
+### Data/API And General Tooling Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [Context7](https://github.com/upstash/context7) | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | `attack-sim npx -y @upstash/context7-mcp` | `setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif` | Documentation/data access servers are good candidates for portable receipts and maintainer CI. |
+| [Official everything server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | `attack-sim npx -y @modelcontextprotocol/server-everything` | Public reference baseline; CI-ready. | Baseline server for validating Observatory behavior and receipt output. |
+| [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | `attack-sim npx -y @modelcontextprotocol/server-sequential-thinking` | Public reference baseline; CI-ready. | Low-destructive baseline useful for receipt and graph examples. |
+
+## Maintainer Conversation Templates
+
+Use these when opening or replying to maintainer conversations. Keep them short, specific, and easy to rerun.
+
+### Safe Receipt Generated
+
+```text
+We generated a safe MCP Observatory receipt for this server using a public startup command. It does not use secrets, production data, external callbacks, or destructive tool calls.
+
+Receipt/report: <artifact link>
+Reproduce: npx @kryptosai/mcp-observatory receipt <safe startup command> --profile nsa-mcp --format markdown --output receipt.md
+CI/SARIF: npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --schedule weekly
+
+If there is a safer startup mode or fixture command you prefer, tell us and we can rerun the receipt.
+```
+
+### CI/SARIF Follow-Up
+
+```text
+This server now has reproducible MCP receipt evidence. The next useful maintainer step is a weekly CI/SARIF gate:
+
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --schedule weekly
+
+That gives downstream users a GitHub-native signal when tool schemas, descriptions, or attack-readiness findings drift.
+```
+
+### Claim Or Update Receipt
+
+```text
+Maintainers can claim/update this receipt by providing the preferred safe startup command, expected capability boundary, and any fixture mode that avoids credentials or production systems.
+
+We will keep the public entry evidence-based and mark limitations directly in the receipt instead of treating this as a ranking dunk.
+```
 
 ## How To Add A Node
 
@@ -40,15 +112,30 @@ Use this page as the first public map from MCP servers to reproducible evidence.
 ```bash
 npx @kryptosai/mcp-observatory test <safe startup command> --json run-artifact.json --markdown run-report.md
 npx @kryptosai/mcp-observatory attack-sim <safe startup command> --json attack-artifact.json --output attack-report.md --sarif attack-results.sarif
-npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif
+npx @kryptosai/mcp-observatory receipt <safe startup command> --profile nsa-mcp --format json --output receipt.json
+npx @kryptosai/mcp-observatory risk-graph --input . --json mcp-risk-graph.json --output mcp-risk-graph.md --html mcp-risk-graph.html
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --schedule weekly
 ```
 
 4. Attach sanitized artifacts or open a focused PR.
 
-## Agent-Native Ask
+## Commercial Boundary
 
-```text
-Name one MCP server your agent depends on. I will help turn it into a reproducible receipt: safe startup command, run artifact, attack-sim evidence, SARIF, and a CI gate maintainers can review.
-```
+The public graph should maximize trust and adoption. The private graph should maximize buyer value.
+
+Public:
+
+- target name and safe startup command
+- receipt, run artifact, SARIF, Markdown/HTML reports
+- capability boundary and recommended action
+- maintainer note and rerun command
+
+Private:
+
+- raw telemetry, emails, hostnames, and account identifiers
+- exact commercial scoring weights
+- private fleet inventory
+- buyer-specific remediation notes
+- hosted retention, alerts, SIEM export, and incident timeline workflows
 
-For the public intake loop, see [Drop an MCP server, get a receipt](./drop-server-get-receipt.md) or comment on [the live GitHub thread](https://github.com/KryptosAI/mcp-observatory/issues/146).
+See [Open Core And Commercial Boundary](./commercial-boundary.md) and [Private MCP Fleet Risk Graph](./private-mcp-fleet-risk-graph.md).