v0.1.0

publishedstablecli-upload

What the registry recorded: This version's findings are within the auto-publish threshold, so the gate published it.

Security report

1 finding

mediumhigh confidenceS9/new-egress-content

New egress destination in package content: osv.dev

AGENT.md:5

You are a dependency-vulnerability analyst. You audit the dependencies of a codebase against OSV.dev, then read the codebase itself to judge, for each found vul

Findings are shown in full, including any a reviewer dismissed and why. Scanning reduces risk; it does not prove this version safe.

Capabilities

data: codemcp servers: 1

Declared capabilities are a contract from the author: what this release says it needs, and what scanning and policy check against. The registry cannot enforce them while your QuickAgent runs.

Provenance

Archive digest: sha256:7302202a7c2a4b6dc98ac377d2d5591ff95fb04f124956ced5dffeb308aaa5ba
Report digest: sha256:482477abe68bd447dae2fc97b6e5d3e7f3dd96a7e4023aedce6e7d0aaced9509
Attestation: signed (DSSE)
Signing key: -_Ea_eEb6AVt8DSP

agentry verify blaktron/vuln-reachability-audit@0.1.0

Check the key id against the registry's published set at /.well-known/agentry/signing-keys.json. A signature proves who built this release, not that its contents are safe.

Manifest

The manifest as the registry validated and stored it, in canonical JSON.

{
  "name": "vuln-reachability-audit",
  "tags": [
    "vulnerabilities",
    "cve",
    "osv",
    "reachability",
    "dependency-audit",
    "html-report"
  ],
  "guide": {
    "task": "e.g. Audit this repo's dependencies and tell me which CVEs are actually reachable from our code.",
    "files": "Add the project's dependency manifests and lockfiles (package.json, package-lock.json, requirements.txt, pyproject.toml, go.mod, go.sum, Cargo.toml, Cargo.lock, pom.xml, Gemfile.lock, composer.lock) and the source files you want reachability assessed on.",
    "prepare": [
      "The codebase files: dependency manifests and lockfiles (package-lock.json, go.sum, Cargo.lock, uv.lock, ...) plus the source code you want reachability judged on.",
      "For monorepos, include every workspace's manifest and lockfile.",
      "If the codebase is large, add at least the files that import the dependencies you care about.",
      "For a GitHub repo, note the repository URL in the intake; the files still have to be added."
    ],
    "overview": "Audits the dependencies of the codebase you add as files against OSV.dev, then reads the source to judge whether each found vulnerability is reachable from your code. Returns reports/vuln-reachability.html: a self-contained HTML report, worst first, with reachability verdicts, path:line evidence, and fix suggestions."
  },
  "modes": [
    "autonomous"
  ],
  "intake": [
    {
      "id": "repository_url",
      "prompt": "GitHub repository URL of the codebase (leave blank for a local disk scan)"
    }
  ],
  "license": "MIT",
  "publish": {
    "include": [
      "agent.yaml",
      "AGENT.md",
      "README.md",
      "LICENSE"
    ]
  },
  "summary": "Audits a codebase's dependencies against OSV.dev, traces reachability in the code, and returns an HTML report with fix suggestions.",
  "version": "0.1.0",
  "namespace": "blaktron",
  "entrypoints": {
    "instruction": "AGENT.md"
  },
  "capabilities": {
    "exec": "none",
    "network": {
      "egress": "none"
    },
    "dataAccess": [
      "code"
    ],
    "filesystem": {
      "read": "none",
      "write": "none"
    },
    "mcpServers": [
      {
        "npm": "@cyanheads/osv-advisory-mcp-server",
        "tools": [
          "osv_query_batch",
          "osv_get_vulnerability",
          "osv_list_ecosystems"
        ],
        "egress": [
          "api.osv.dev"
        ],
        "version": "0.1.15"
      }
    ]
  },
  "schemaVersion": "2"
}