
The open store index for AI agents: merchants list real stock, agents find local food and stores.
Connects MCP servers, packages, security checks, and release gates in one repo.
Observability, tracking, and root-cause for Security Wave scans and findings.
Pre-flight checks for open-source contributions: is this GitHub issue actually landable?
Vetting for MCP servers and skills: capabilities, configs, mismatches, typosquats, probe parity.
Condense a CI log to its failure sections and root-cause lines, with original line anchors.
Token budget auditor for agent context: per-file estimates, top offenders, exclusion advice.
Pre-publish npm pack auditor: shipped files, size, secret-pattern leaks, missing fields.
Base-vs-head test result differ: named tests added, removed, and changed, never raw counts.
Check .env.example against actual env usage in code: missing, stale, and undocumented vars.
Validate AGENTS.md and CLAUDE.md against repo reality: paths, scripts, and commands checked.
Probe a URL and name the bot wall: vendor, verdict, and evidence. CLI plus stdio MCP server.
Track stale claims and parked fixes so open-source work does not silently die.
GitHub Actions supply-chain hardener: audit workflows for unpinned actions and build a SHA pin plan.
Base-vs-head CI differ: which PR failures are introduced, pre-existing, external, or fixed.
Least-privilege auditor for GitHub Actions workflows: permissions, triggers, secrets.
Audit any MCP server: handshake, schemas, descriptions, error handling, scored.
Pre-install verdicts for npm packages: GO, RISKY, FAKE, or MISSING. Built for humans and AI agents.
An E2E encrypted mailbox for AI agents: claim an address, send and receive sealed messages.
Release verification: git tag, release, npm, MCP Registry, and GHCR must agree, or NO-GO.
Red-first repro verifier: a fix counts only when the repro fails on the base and passes on the fix.