@kryptosai/mcp-observatory 1.28.2 → 1.29.0

package/docs/metrics-dashboard.md

@@ -13,7 +13,7 @@ The layout follows an App Store Connect-style breakdown:
 - Usage
 - Reliability
 
-The Strategy section turns raw telemetry into operator decisions: command funnel, clone/download-to-CI conversion, version adoption, account/domain drilldown, CI/local source mix, and release-spike context.
+The Strategy section turns raw telemetry into operator decisions: command funnel, receipt-to-risk-graph conversion, clone/download-to-CI conversion, version adoption, account/domain drilldown, CI/local source mix, and release-spike context.
 
 Daily rows are shown newest to oldest so the most recent project activity is always at the top.
 
@@ -45,6 +45,22 @@ The collector stores each source independently. If one source fails, the dashboa
 
 GitHub traffic APIs have a limited visible window, so the collector stores snapshots locally going forward. npm daily buckets can lag; the dashboard labels npm data as complete public days rather than assuming current-day zero.
 
+## Growth Command Center
+
+The dashboard tracks the Wiz-style evidence funnel:
+
+- latest-version adoption
+- stale-version sessions
+- receipt sessions
+- risk-graph sessions
+- attack-sim sessions
+- setup-ci/SARIF sessions
+- external CI sessions
+- paid-intent commands
+- sanitized account/domain signals
+
+`risk-graph` telemetry stores command-level aggregates such as invocation, output format, input count, node count, highest graph risk, and whether graph output was generated. It does not collect raw artifacts, file contents, secrets, private URLs, command output, hostnames, or unapproved customer names.
+
 ## Credentials
 
 GitHub collection uses either:

package/docs/private-mcp-fleet-risk-graph.md

@@ -0,0 +1,69 @@
+# Private MCP Fleet Risk Graph
+
+Public MCP receipts prove the method. A private MCP fleet risk graph turns the method into a buyer-ready operating picture.
+
+## Offer
+
+**Private MCP Dependency Safety Report + CI Gate + Attack Simulation Evidence Pack**
+
+What the buyer gets:
+
+- private MCP dependency inventory across repos, agents, gateways, and automation projects
+- MCP risk graph grouped by filesystem, browser, command execution, infrastructure/cloud, memory, data/API, and identity/auth boundaries
+- safe-mode attack simulation evidence for selected dependencies
+- receipt pack with rerun commands, artifact hashes, verdicts, and recommended actions
+- CI/SARIF rollout plan with owner-ready pull request guidance
+- top risky MCP dependencies and remediation backlog
+- procurement/security appendix that explains scope, safe-mode guarantees, limitations, and evidence custody
+
+## Safe-Mode Scope
+
+The pilot does not run destructive attacks, exfiltrate secrets, contact external callback infrastructure, mutate production systems, or require customer credentials in public artifacts.
+
+Evidence is generated from safe startup commands, metadata, schemas, tool descriptions, allowed fixture modes, run artifacts, safe attack-readiness simulation, drift comparison, SARIF, and maintainer-provided context.
+
+## Pricing Anchors
+
+| Package | Starting point | Best for |
+| --- | ---: | --- |
+| Narrow readiness review | `$2,500+` | One team, one repo, or one high-priority MCP dependency. |
+| Attack simulation evidence pack | `$15,000+` | Security teams that need safe attack-readiness proof and owner-ready remediation. |
+| Private fleet risk graph pilot | `$50,000+` | Organizations adopting MCP across multiple agents, repos, teams, or gateways. |
+
+## Pilot Timeline
+
+| Phase | Output |
+| --- | --- |
+| Day 0-1 | Scope, safe startup commands, target inventory, evidence handling rules. |
+| Day 2-4 | Run artifacts, receipts, attack-sim evidence, SARIF, initial risk graph. |
+| Day 5-7 | Owner-ready remediation list, CI rollout plan, executive verdict, procurement appendix. |
+| Optional ongoing | Weekly drift review, CI gate tuning, hosted retention, alerting, and SIEM export roadmap. |
+
+## Sample Deliverable
+
+See the [sanitized sample private fleet risk graph](./sample-private-fleet-risk-graph.md).
+
+## Proprietary Layer
+
+The public CLI, receipts, attack simulator, and risk graph format stay open because they create trust and distribution. These commercial surfaces should stay private unless a customer agreement says otherwise:
+
+- raw telemetry, private account signals, emails, hostnames, and lead intelligence
+- private fleet inventory and buyer-specific risk interpretation
+- commercial scoring weights and prioritization models
+- hosted review workflow, retention, alerting, SIEM export, and incident timelines
+- customer-specific reports, remediation ownership, and procurement packets
+
+## Request A Pilot
+
+Run:
+
+```bash
+npx @kryptosai/mcp-observatory cloud
+```
+
+Or send the buyer this short ask:
+
+```text
+We can map your private MCP fleet into a risk graph, generate safe attack-simulation evidence, and ship CI/SARIF gates without running destructive probes or collecting secrets. The first pilot produces an executive verdict, dependency graph, receipt pack, SARIF evidence, and owner-ready remediation list.
+```
+

package/docs/receipt-graph.md

@@ -1,35 +1,107 @@
-# MCP Receipt Graph
+# MCP Risk Graph
 
-Agent trust should be a receipt graph, not a follower graph.
+Agent trust should be a risk graph, not a follower graph.
 
-A social graph says who is popular. A receipt graph says what was verified, what could not happen during the run, which artifact can be rerun, and what changed since the last trusted state.
+A follower graph says who is popular. An MCP risk graph says which agent toolchains were evaluated, what capability boundary each server exposes, what receipts support the verdict, which evidence can be rerun, where CI/SARIF should be added, and what changed since the last trusted state.
 
-Use this page as the first public map from MCP servers to reproducible evidence. It is intentionally small: a receipt graph should start with high-quality, rerunnable receipts before it tries to become a giant directory.
+MCP Observatory maps the risk graph of agent toolchains before agents depend on them.
 
-## Receipt Graph Fields
+## Generate A Graph
+
+Use `risk-graph` to merge run artifacts, receipt artifacts, or a Safety Index artifact directory into JSON, Markdown, and HTML outputs:
+
+```bash
+npx @kryptosai/mcp-observatory risk-graph --input docs/safety-index/artifacts --json mcp-risk-graph.json --output mcp-risk-graph.md --html mcp-risk-graph.html
+```
+
+Supported inputs:
+
+- one JSON run artifact
+- one JSON receipt
+- an audit report JSON with an embedded `artifact`
+- a directory containing any mix of supported artifacts
+- repeated `--input` paths
+
+The JSON output is intended for agents and tooling. The Markdown output is intended for GitHub and docs. The HTML output is intended for demos, buyer review, and internal security conversations.
+
+## Graph Fields
 
 | Field | Meaning |
 | --- | --- |
-| Server | Public MCP server, package, or repo. |
-| Receipt | JSON/Markdown evidence generated by MCP Observatory. |
-| Attack evidence | Safe `attack-sim` command, report, or SARIF. |
-| CI/SARIF path | Whether the next step is a maintainer CI gate, Code Scanning, or both. |
-| Capability envelope | What the run was allowed to access. |
-| Last verified | Timestamp of the latest public Safety Index refresh. |
-
-## Seed Graph
-
-| Server | Receipt | Attack evidence | CI/SARIF path | Capability envelope | Last verified |
-| --- | --- | --- | --- | --- | --- |
-| [Official everything server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | `attack-sim npx -y @modelcontextprotocol/server-everything` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
-| [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | `attack-sim npx -y @modelcontextprotocol/server-sequential-thinking` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
-| [Official memory server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | `attack-sim npx -y @modelcontextprotocol/server-memory` | Public reference baseline; CI-ready. | Public package, no secrets, no production data. | 2026-07-06 |
-| [Context7](https://github.com/upstash/context7) | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | `attack-sim npx -y @upstash/context7-mcp` | Maintainer CI conversation candidate. | Public package, no secrets, no production data. | 2026-07-06 |
-| [BrowserMCP](https://github.com/BrowserMCP/mcp) | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | `attack-sim npx -y @browsermcp/mcp` | Browser boundary candidate for CI/SARIF. | Public package, no secrets, no production credentials. | 2026-07-06 |
-| [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | `attack-sim npx -y @playwright/mcp` | High-capability browser boundary; Code Scanning useful. | Public package, no secrets, no production credentials. | 2026-07-06 |
-| [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | `attack-sim npx -y puppeteer-mcp-server` | Browser boundary candidate for review before production. | Public package, no secrets, no production credentials. | 2026-07-06 |
-| [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | `attack-sim npx -y @opentofu/opentofu-mcp-server` | Infrastructure tool surface; CI/SARIF recommended. | Public package, no secrets, no production infrastructure. | 2026-07-06 |
-| [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | [attack-sim](./safety-index/artifacts/kubernetes-server.attack.md) / [SARIF](./safety-index/artifacts/kubernetes-server.attack.sarif) | Kubernetes command and cluster mutation boundary; CI/SARIF recommended before agent dependency. | Public package, no secrets, no kubeconfig, no cluster tool invocation. | 2026-07-06 |
+| Server | Public MCP server, package, repo, or private fleet dependency. |
+| Capability boundary | Filesystem, browser, command execution, infrastructure/cloud, memory, data/API, identity/auth, or unknown. |
+| Receipt state | Whether the current evidence is ready for CI, needs review, blocked, or could not be evaluated. |
+| Recommended action | `allow`, `gate`, `rerun`, `quarantine`, or `escalate`. |
+| Risk level | Graph-level severity derived from receipts, attack-sim evidence, findings, and action receipts. |
+| Evidence refs | Source artifact paths and SHA-256 hashes. |
+| CI command | The exact `setup-ci --all --sarif` command maintainers can run. |
+
+## Seed Public Map
+
+The seed graph is intentionally evidence-based, not a dunk list. A public entry means MCP Observatory has a safe, reproducible command and an artifact path. It is not an official certification and should not be treated as a production approval.
+
+### Browser Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [BrowserMCP](https://github.com/BrowserMCP/mcp) | [JSON](./safety-index/artifacts/browsermcp-server.json) / [report](./safety-index/artifacts/browsermcp-server.md) | `attack-sim npx -y @browsermcp/mcp` | `setup-ci --all --command "npx -y @browsermcp/mcp" --sarif` | Browser automation should have clear CI evidence before agents depend on it. |
+| [Microsoft Playwright MCP](https://github.com/microsoft/playwright-mcp) | [JSON](./safety-index/artifacts/playwright-mcp-server.json) / [report](./safety-index/artifacts/playwright-mcp-server.md) | `attack-sim npx -y @playwright/mcp` | `setup-ci --all --command "npx -y @playwright/mcp" --sarif` | High-capability browser boundary; safe evidence is useful for downstream adopters. |
+| [Puppeteer MCP server](https://www.npmjs.com/package/puppeteer-mcp-server) | [JSON](./safety-index/artifacts/puppeteer-server.json) / [report](./safety-index/artifacts/puppeteer-server.md) | `attack-sim npx -y puppeteer-mcp-server` | `setup-ci --all --command "npx -y puppeteer-mcp-server" --sarif` | Public package, no production credentials, no destructive tool invocation. |
+
+### Command Execution And Infrastructure Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [OpenTofu MCP server](https://github.com/opentofu/opentofu-mcp-server) | [JSON](./safety-index/artifacts/opentofu-server.json) / [report](./safety-index/artifacts/opentofu-server.md) | `attack-sim npx -y @opentofu/opentofu-mcp-server` | `setup-ci --all --command "npx -y @opentofu/opentofu-mcp-server" --sarif` | Infrastructure tools deserve explicit permission-boundary evidence before production use. |
+| [Flux159 Kubernetes MCP server](https://github.com/Flux159/mcp-server-kubernetes) | [JSON](./safety-index/artifacts/kubernetes-server.json) / [report](./safety-index/artifacts/kubernetes-server.md) | [attack-sim](./safety-index/artifacts/kubernetes-server.attack.md) / [SARIF](./safety-index/artifacts/kubernetes-server.attack.sarif) | `setup-ci --all --command "npx -y mcp-server-kubernetes" --sarif` | Kubernetes and cluster mutation boundaries should be reviewed with no kubeconfig or cluster calls in public evidence. |
+
+### Memory Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [Official memory server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/memory-server.json) / [report](./safety-index/artifacts/memory-server.md) | `attack-sim npx -y @modelcontextprotocol/server-memory` | `setup-ci --all --command "npx -y @modelcontextprotocol/server-memory" --sarif` | Memory tools need clear evidence around persistence, recall, and schema drift. |
+
+### Data/API And General Tooling Boundary
+
+| Server | Receipt | Attack evidence | CI/SARIF path | Maintainer note |
+| --- | --- | --- | --- | --- |
+| [Context7](https://github.com/upstash/context7) | [JSON](./safety-index/artifacts/context7-server.json) / [report](./safety-index/artifacts/context7-server.md) | `attack-sim npx -y @upstash/context7-mcp` | `setup-ci --all --command "npx -y @upstash/context7-mcp" --sarif` | Documentation/data access servers are good candidates for portable receipts and maintainer CI. |
+| [Official everything server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/everything-server.json) / [report](./safety-index/artifacts/everything-server.md) | `attack-sim npx -y @modelcontextprotocol/server-everything` | Public reference baseline; CI-ready. | Baseline server for validating Observatory behavior and receipt output. |
+| [Official sequential thinking server](https://github.com/modelcontextprotocol/servers) | [JSON](./safety-index/artifacts/sequential-thinking-server.json) / [report](./safety-index/artifacts/sequential-thinking-server.md) | `attack-sim npx -y @modelcontextprotocol/server-sequential-thinking` | Public reference baseline; CI-ready. | Low-destructive baseline useful for receipt and graph examples. |
+
+## Maintainer Conversation Templates
+
+Use these when opening or replying to maintainer conversations. Keep them short, specific, and easy to rerun.
+
+### Safe Receipt Generated
+
+```text
+We generated a safe MCP Observatory receipt for this server using a public startup command. It does not use secrets, production data, external callbacks, or destructive tool calls.
+
+Receipt/report: <artifact link>
+Reproduce: npx @kryptosai/mcp-observatory receipt <safe startup command> --profile nsa-mcp --format markdown --output receipt.md
+CI/SARIF: npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --schedule weekly
+
+If there is a safer startup mode or fixture command you prefer, tell us and we can rerun the receipt.
+```
+
+### CI/SARIF Follow-Up
+
+```text
+This server now has reproducible MCP receipt evidence. The next useful maintainer step is a weekly CI/SARIF gate:
+
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --schedule weekly
+
+That gives downstream users a GitHub-native signal when tool schemas, descriptions, or attack-readiness findings drift.
+```
+
+### Claim Or Update Receipt
+
+```text
+Maintainers can claim/update this receipt by providing the preferred safe startup command, expected capability boundary, and any fixture mode that avoids credentials or production systems.
+
+We will keep the public entry evidence-based and mark limitations directly in the receipt instead of treating this as a ranking dunk.
+```
 
 ## How To Add A Node
 
@@ -40,15 +112,30 @@ Use this page as the first public map from MCP servers to reproducible evidence.
 ```bash
 npx @kryptosai/mcp-observatory test <safe startup command> --json run-artifact.json --markdown run-report.md
 npx @kryptosai/mcp-observatory attack-sim <safe startup command> --json attack-artifact.json --output attack-report.md --sarif attack-results.sarif
-npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif
+npx @kryptosai/mcp-observatory receipt <safe startup command> --profile nsa-mcp --format json --output receipt.json
+npx @kryptosai/mcp-observatory risk-graph --input . --json mcp-risk-graph.json --output mcp-risk-graph.md --html mcp-risk-graph.html
+npx @kryptosai/mcp-observatory setup-ci --all --command "<safe startup command>" --sarif --schedule weekly
 ```
 
 4. Attach sanitized artifacts or open a focused PR.
 
-## Agent-Native Ask
+## Commercial Boundary
 
-```text
-Name one MCP server your agent depends on. I will help turn it into a reproducible receipt: safe startup command, run artifact, attack-sim evidence, SARIF, and a CI gate maintainers can review.
-```
+The public graph should maximize trust and adoption. The private graph should maximize buyer value.
+
+Public:
+
+- target name and safe startup command
+- receipt, run artifact, SARIF, Markdown/HTML reports
+- capability boundary and recommended action
+- maintainer note and rerun command
+
+Private:
+
+- raw telemetry, emails, hostnames, and account identifiers
+- exact commercial scoring weights
+- private fleet inventory
+- buyer-specific remediation notes
+- hosted retention, alerts, SIEM export, and incident timeline workflows
 
-For the public intake loop, see [Drop an MCP server, get a receipt](./drop-server-get-receipt.md) or comment on [the live GitHub thread](https://github.com/KryptosAI/mcp-observatory/issues/146).
+See [Open Core And Commercial Boundary](./commercial-boundary.md) and [Private MCP Fleet Risk Graph](./private-mcp-fleet-risk-graph.md).