{"id":14159,"user_id":54687,"name":"attest-mcp","description":"The attestation service timestamps a file's SHA-256 fingerprint, signs it (HMAC), and can produce a signed PDF certificate plus an OpenTimestamps proof anchored in Bitcoin. This server exposes that service as MCP tools, so an agent can attest and verify works on your behalf without a browser.","homepage_url":"https://attestazione.spaziogenesi.org/en","repo_url":"https://github.com/SPAZIO-GENESI/attest-mcp","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","sites_https_justification":"GitHub (repo/downloads) and npm (package) both HTTPS-only by default; all in-app URLs (attestazione.spaziogenesi.org) are HTTPS.","description_good_status":"Met","description_good_justification":"README opens with a one-line description: an attestation client — SHA-256 fingerprint, timestamp, HMAC signature, optional certificate, via CLI or MCP.","interact_status":"Met","interact_justification":"README: npm install instructions, GitHub Issues linked for feedback, \"Contributing\" section explaining how to submit changes.","contribution_status":"Met","contribution_justification":"https://github.com/SPAZIO-GENESI/attest-mcp#contributing — pull requests, keep them focused, npm test must pass.","contribution_requirements_status":"Met","contribution_requirements_justification":"https://github.com/SPAZIO-GENESI/attest-mcp#contributing — PRs must be focused (one change per PR) and pass npm test before merge.","license_location_status":"Met","license_location_justification":"https://github.com/SPAZIO-GENESI/attest-mcp/blob/main/LICENSE","floss_license_status":"Met","floss_license_justification":"MIT license — https://github.com/SPAZIO-GENESI/attest-mcp/blob/main/LICENSE","floss_license_osi_status":"Met","floss_license_osi_justification":"MIT is OSI-approved: https://opensource.org/licenses/MIT","documentation_basics_status":"Met","documentation_basics_justification":"https://github.com/SPAZIO-GENESI/attest-mcp#readme — installation, all CLI commands and flags documented.","documentation_interface_status":"Met","documentation_interface_justification":"README documents every CLI command/flag and every MCP tool exposed (input/output), plus the server.json tool schemas: https://github.com/SPAZIO-GENESI/attest-mcp/blob/main/server.json","repo_public_status":"Met","repo_public_justification":"https://github.com/SPAZIO-GENESI/attest-mcp — public git repository.","repo_track_status":"Met","repo_track_justification":"Full git history with author and timestamp per commit: https://github.com/SPAZIO-GENESI/attest-mcp/commits/main","repo_interim_status":"Met","repo_interim_justification":"Commit history shows individual changes between releases, not just tagged release commits: https://github.com/SPAZIO-GENESI/attest-mcp/commits/main","repo_distributed_status":"Met","repo_distributed_justification":"git, hosted on GitHub.","version_unique_status":"Met","version_unique_justification":"package.json \"version\" field, unique per release (e.g. 0.4.2): https://github.com/SPAZIO-GENESI/attest-mcp/blob/main/package.json","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"Each release is tagged in git: v0.4.0, v0.4.1, v0.4.2 (https://github.com/SPAZIO-GENESI/attest-mcp/tags).","release_notes_status":"Met","release_notes_justification":"https://github.com/SPAZIO-GENESI/attest-mcp/releases — each release has a human-written summary of what changed (not raw git log).","release_notes_vulns_status":"N/A","release_notes_vulns_justification":"No publicly known CVE has ever applied to this project's own code — only to third-party transitive dependencies, which are out of scope for this criterion.","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"GitHub Issues: https://github.com/SPAZIO-GENESI/attest-mcp/issues","report_process_status":"Met","report_process_justification":"https://github.com/SPAZIO-GENESI/attest-mcp/issues","report_responses_status":"Met","report_responses_justification":"No bug reports have been submitted in the 2-12 month window (the project is young), so the requirement is vacuously satisfied — there is nothing unacknowledged.","enhancement_responses_status":"Unmet","enhancement_responses_justification":"Project is young; too few enhancement requests filed in the 2-12 month window to establish a track record either way.","report_archive_status":"Met","report_archive_justification":"GitHub Issues archive, public and searchable: https://github.com/SPAZIO-GENESI/attest-mcp/issues?q=is%3Aissue","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://github.com/SPAZIO-GENESI/attest-mcp/blob/main/SECURITY.md — points to the full policy at https://attestazione.spaziogenesi.org/sicurezza/","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://github.com/SPAZIO-GENESI/attest-mcp/blob/main/SECURITY.md — links to https://attestazione.spaziogenesi.org/sicurezza/, which lists a private reporting channel (email it@spaziogenesi.org).","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"No vulnerability report has ever been received, so there is nothing to measure the response time against — vacuously satisfied. The stated commitment is 14 days per the disclosure policy.","build_status":"Met","build_justification":"npm install rebuilds all dependencies from package-lock.json; the CLI/MCP server run directly from source, no compile step needed for normal use.","build_common_tools_status":"Met","build_common_tools_justification":"Standard npm/Node.js tooling — no custom or unusual build system.","build_floss_tools_status":"Met","build_floss_tools_justification":"Node.js, npm, and Bun (for the optional standalone binaries) are all FLOSS.","test_status":"Met","test_justification":"node --test test/hash.test.js test/cli.test.js — 11 passing tests, MIT licensed same as the project. Documented as \"npm test\" and run automatically in .github/workflows/ci.yml.","test_invocation_status":"Met","test_invocation_justification":"npm test — the standard invocation for a Node.js package.","test_most_status":"Unmet","test_most_justification":"Core hashing and CLI flag-parsing logic is covered, but no coverage-measurement tool is configured yet, so \"most branches\" can't be demonstrated quantitatively.","test_policy_status":"Met","test_policy_justification":"README \"Contributing\" section states the policy explicitly; npm run lint and npm test both run in CI on every push/PR.","tests_are_added_status":"Met","tests_are_added_justification":"The most recent major change (P54 hardening) kept all 11 tests green throughout; the CI job \"packaged-bins\" was itself added specifically to catch a bug the unit tests missed (P39).","tests_documented_added_status":"Unmet","tests_documented_added_justification":"Not yet documented in the README's Contributing section — a small gap, plan to add it in a future pass.","warnings_status":"Met","warnings_justification":"An ESLint flat config (eslint.config.js) is now enabled","warnings_fixed_status":"Met","warnings_fixed_justification":"npm run lint reports zero errors and zero warnings.","warnings_strict_status":"N/A","warnings_strict_justification":"Depends on the \"warnings\" criterion above (no linter enabled yet).","know_secure_design_status":"Met","know_secure_design_justification":"The maintainer applies secure-design principles in practice: minimal attack surface (client never handles the HMAC secret), least privilege (fine-grained tokens, no broad credentials), and explicit input validation on all hash/parsing paths.","know_common_errors_status":"Met","know_common_errors_justification":"Demonstrated in practice on 2026-08-19: found and fixed a ReDoS vulnerability (unbounded regex on untrusted input) and 4 transitive dependency vulnerabilities via npm audit, with verified mitigations for each.","crypto_published_status":"Met","crypto_published_justification":"Only SHA-256 (Node.js built-in crypto module) is used — a publicly published, expert-reviewed algorithm.","crypto_call_status":"Met","crypto_call_justification":"Uses Node.js's built-in crypto module (createHash) for SHA-256; no cryptographic algorithm is reimplemented.","crypto_floss_status":"Met","crypto_floss_justification":"Node.js's built-in crypto module (used for SHA-256) is itself FLOSS.","crypto_keylength_status":"N/A","crypto_keylength_justification":"This client does not manage or generate any cryptographic keys itself — the HMAC signing key lives server-side in imgauth, out of scope for this repo.","crypto_working_status":"Met","crypto_working_justification":"Only SHA-256 is used, which is not a broken algorithm.","crypto_pfs_status":"N/A","crypto_pfs_justification":"This client does not implement its own TLS/key-agreement protocol — it relies on the OS/runtime's HTTPS stack for all network connections.","crypto_password_storage_status":"N/A","crypto_password_storage_justification":"This client does not store any user passwords — authentication is via an API key or a device-flow token, no password storage involved.","crypto_random_status":"N/A","crypto_random_justification":"This client does not generate cryptographic keys or nonces — no key material is created client-side.","delivery_mitm_status":"Met","delivery_mitm_justification":"npm registry and GitHub Releases are served exclusively over HTTPS.","delivery_unsigned_status":"Met","delivery_unsigned_justification":"No hash is fetched over plain HTTP; the standalone binaries carry a build-provenance attestation (actions/attest-build-provenance) checkable via \"gh attestation verify\".","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"The 4 transitive vulnerabilities found on 2026-08-19 (hono, @hono/node-server, fast-uri, ip-address) were fixed the same day via npm audit fix.","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"No critical-severity vulnerability has ever been reported for this project, so the requirement is trivially satisfied.","static_analysis_status":"Met","static_analysis_justification":"CodeQL runs on every push/PR to main via .github/workflows/codeql.yml (active since 2026-08-13).","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"CodeQL's default query suite is specifically designed to find common vulnerability patterns (injection, ReDoS, unsafe data flow, etc.).","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"All real CodeQL findings from the 2026-08-19 triage were resolved the same day: 1 fixed (ReDoS), the rest dismissed with a code-verified reason.","static_analysis_often_status":"Met","static_analysis_often_justification":"codeql.yml runs on every push and pull request to main, plus a weekly scheduled run.","dynamic_analysis_status":"Unmet","dynamic_analysis_justification":"No dynamic analysis/fuzzing tool configured — deliberately out of scope for now, decided 2026-08-19 given the project's size and risk profile.","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_unsafe_justification":"Written entirely in JavaScript, a memory-safe language.","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_enable_assertions_justification":"Depends on the \"dynamic_analysis\" criterion above, which is not yet in place.","dynamic_analysis_fixed_status":"Met","dynamic_analysis_fixed_justification":"No dynamic analysis tool is in place yet, so none has surfaced a vulnerability to fix — trivially satisfied.","general_comments":"","created_at":"2026-08-19T20:32:10.721Z","updated_at":"2026-08-20T08:21:35.103Z","crypto_weaknesses_status":"Met","crypto_weaknesses_justification":"SHA-256 has no known weaknesses.","test_continuous_integration_status":"Met","test_continuous_integration_justification":".github/workflows/ci.yml runs the test suite automatically on every push and pull request to main.","cpe":"","discussion_status":"Met","discussion_justification":"GitHub Issues and Pull Requests: https://github.com/SPAZIO-GENESI/attest-mcp/issues — public, searchable, URL-addressable, no proprietary client needed.","no_leaked_credentials_status":"Met","no_leaked_credentials_justification":"No secrets in the repository — credentials (IMGAUTH_API_KEY, OAuth token) live only in environment variables or a local file written by \"sg-attest authorize\", never committed.","english_status":"Met","english_justification":"README and all documentation are in English; issue tracker accepts English reports.","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"?","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":100,"achieved_passing_at":"2026-08-20T08:21:35.101Z","lost_passing_at":null,"implementation_languages":"JavaScript","badge_percentage_1":13,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":9,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":113,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2026-08-20T08:21:35.101Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","maintained_justification":"Active: latest release v0.4.2 (2026-08-15), commits and merged PRs through 2026-08-20.","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","badge_level":"passing","additional_rights":[],"project_entry_attribution":"Please credit maxAlone and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"}