{
  "$schema": "https://verifymcp.io/schemas/changelog.json",
  "server": "dev-cite42-mcp",
  "component": "cite42-mcp",
  "generated_at": "2026-10-09T23:59:13.728Z",
  "tracking_since": "2026-07-27",
  "counts": {
    "critical": 0,
    "security": 28,
    "functional": 0,
    "cosmetic": 0
  },
  "events": [
    {
      "id": "chg_01a11764-c185-7e62-839a-b96b2a882b1a",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_failed",
      "to_code": "stability.sandbox_pending",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "version_superseded"
      },
      "occurred_on": "2026-10-07",
      "occurred_at": "2026-10-07 17:23:55.141229+00",
      "observed_since": "2026-10-04",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a11764-c185-7e62-839a-b96b2a882b1a"
    },
    {
      "id": "chg_01a11764-c0b2-7cdc-9dba-2119743d1972",
      "kind": "check.reason",
      "family": "tool-safety-injection",
      "subject_kind": "check",
      "subject": "tool-safety-injection",
      "subject_child": "",
      "from_code": "toolsafety.sandbox_failed",
      "to_code": "toolsafety.sandbox_pending",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "version_superseded"
      },
      "occurred_on": "2026-10-07",
      "occurred_at": "2026-10-07 17:23:55.141229+00",
      "observed_since": "2026-10-04",
      "source": "scan",
      "summary": "Tool safety (Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a11764-c0b2-7cdc-9dba-2119743d1972"
    },
    {
      "id": "chg_01a11764-c052-7272-b651-25c8dcbc94fc",
      "kind": "check.verdict",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.none",
      "to_code": "cve.transitive",
      "from_value": "pass",
      "to_value": "fail",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "path": "@mastra/mcp > @modelcontextprotocol/client",
        "refs": "[\"CVE-2026-104850\"]",
        "seen": "242",
        "package": "@modelcontextprotocol/client",
        "version": "2.0.0",
        "assessed": "243",
        "resolved": "242",
        "severity": "high",
        "transitive": "2",
        "vulnerable": "[{\"name\":\"@modelcontextprotocol/client\",\"version\":\"2.0.0\",\"depth\":2,\"path\":[\"@mastra/mcp\",\"@modelcontextprotocol/client\"],\"refs\":[\"CVE-2026-104850\"]},{\"name\":\"sprintf-js\",\"version\":\"1.0.3\",\"depth\":5,\"path\":[\"@mastra/core\",\"gray-matter\",\"js-yaml\",\"argparse\",\"sprintf-js\"],\"refs\":[\"CVE-2026-97058\"]}]",
        "no_fix_refs": "[\"CVE-2026-97058\"]",
        "tree_source": "registry",
        "tree_status": "resolved"
      },
      "occurred_on": "2026-10-07",
      "occurred_at": "2026-10-07 17:23:55.141229+00",
      "observed_since": "2026-10-04",
      "source": "scan",
      "summary": "Known CVEs (pass → fail)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a11764-c052-7272-b651-25c8dcbc94fc"
    },
    {
      "id": "chg_01a11764-be02-7271-accc-aca6c87eab22",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-104850",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.transitive",
      "from_value": null,
      "to_value": "high",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-104850",
        "severity": "high"
      },
      "occurred_on": "2026-10-07",
      "occurred_at": "2026-10-07 17:23:55.141229+00",
      "observed_since": "2026-10-04",
      "source": "scan",
      "summary": "CVE-2026-104850 affects this package (high)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a11764-be02-7271-accc-aca6c87eab22"
    },
    {
      "id": "chg_01a0ec0e-f239-7e87-b61b-504dba2c1bac",
      "kind": "check.reverified",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.inconclusive",
      "to_code": "cve.none",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "seen": "242",
        "assessed": "243",
        "resolved": "242",
        "tree_source": "registry",
        "tree_status": "resolved"
      },
      "occurred_on": "2026-09-29",
      "occurred_at": "2026-09-29 07:26:37.086537+00",
      "observed_since": "2026-09-28",
      "source": "scan",
      "summary": "Known CVEs (unverified → pass)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a0ec0e-f239-7e87-b61b-504dba2c1bac"
    },
    {
      "id": "chg_01a0e9d1-be35-7ed3-8b4f-2db7e45a44cd",
      "kind": "check.unverifiable",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.none",
      "to_code": "cve.inconclusive",
      "from_value": "pass",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "reason": "root_version_missing"
      },
      "occurred_on": "2026-09-28",
      "occurred_at": "2026-09-28 21:00:25.242839+00",
      "observed_since": "2026-09-27",
      "source": "scan",
      "summary": "Known CVEs (pass → unverified)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a0e9d1-be35-7ed3-8b4f-2db7e45a44cd"
    },
    {
      "id": "chg_01a09472-69f8-7a5c-ae65-20e311743c55",
      "kind": "check.reverified",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_inconclusive",
      "to_code": "supplychain.malware_clean",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-09-12",
      "occurred_at": "2026-09-12 07:08:41.270893+00",
      "observed_since": "2026-09-11",
      "source": "scan",
      "summary": "Malware scan (unverified → pass)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a09472-69f8-7a5c-ae65-20e311743c55"
    },
    {
      "id": "chg_01a09472-69f9-775c-8347-60749a62a66a",
      "kind": "check.reverified",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.inconclusive",
      "to_code": "cve.none",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "seen": "236",
        "assessed": "237",
        "resolved": "236",
        "tree_source": "registry",
        "tree_status": "resolved"
      },
      "occurred_on": "2026-09-12",
      "occurred_at": "2026-09-12 07:08:41.270893+00",
      "observed_since": "2026-09-11",
      "source": "scan",
      "summary": "Known CVEs (unverified → pass)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a09472-69f9-775c-8347-60749a62a66a"
    },
    {
      "id": "chg_01a09020-01c3-7aac-9fa1-9127414edc02",
      "kind": "check.unverifiable",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.none",
      "to_code": "cve.inconclusive",
      "from_value": "pass",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "reason": "root_version_missing"
      },
      "occurred_on": "2026-09-11",
      "occurred_at": "2026-09-11 11:00:11.504055+00",
      "observed_since": "2026-09-10",
      "source": "scan",
      "summary": "Known CVEs (pass → unverified)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a09020-01c3-7aac-9fa1-9127414edc02"
    },
    {
      "id": "chg_01a09020-01c1-7882-9a89-1145e41ce060",
      "kind": "check.unverifiable",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_clean",
      "to_code": "supplychain.malware_inconclusive",
      "from_value": "pass",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "reason": "vendor_no_verdict"
      },
      "occurred_on": "2026-09-11",
      "occurred_at": "2026-09-11 11:00:11.504055+00",
      "observed_since": "2026-09-10",
      "source": "scan",
      "summary": "Malware scan (pass → unverified)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a09020-01c1-7882-9a89-1145e41ce060"
    },
    {
      "id": "chg_01a06b3d-643b-7b7b-8779-94f26e5ad3b9",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_pending",
      "to_code": "stability.sandbox_failed",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "needs_declared_env",
        "status": "unreachable"
      },
      "occurred_on": "2026-09-04",
      "occurred_at": "2026-09-04 07:06:20.477992+00",
      "observed_since": "2026-09-03",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no schema to compare.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a06b3d-643b-7b7b-8779-94f26e5ad3b9"
    },
    {
      "id": "chg_01a06b3d-643d-70c9-89f4-4b71ad556564",
      "kind": "check.reason",
      "family": "tool-safety-injection",
      "subject_kind": "check",
      "subject": "tool-safety-injection",
      "subject_child": "",
      "from_code": "toolsafety.sandbox_pending",
      "to_code": "toolsafety.sandbox_failed",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "needs_declared_env",
        "status": "unreachable"
      },
      "occurred_on": "2026-09-04",
      "occurred_at": "2026-09-04 07:06:20.477992+00",
      "observed_since": "2026-09-03",
      "source": "scan",
      "summary": "Tool safety (Tool safety not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no tool text to scan.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a06b3d-643d-70c9-89f4-4b71ad556564"
    },
    {
      "id": "chg_01a067c9-0e5e-7299-9f65-c2a3c863e771",
      "kind": "check.reason",
      "family": "tool-safety-injection",
      "subject_kind": "check",
      "subject": "tool-safety-injection",
      "subject_child": "",
      "from_code": "toolsafety.sandbox_failed",
      "to_code": "toolsafety.sandbox_pending",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "version_superseded"
      },
      "occurred_on": "2026-09-03",
      "occurred_at": "2026-09-03 15:00:24.582287+00",
      "observed_since": "2026-09-02",
      "source": "scan",
      "summary": "Tool safety (Tool safety not yet verified: we do not have a sandbox capture of the tool definitions this version of the package serves yet.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a067c9-0e5e-7299-9f65-c2a3c863e771"
    },
    {
      "id": "chg_01a067c9-0e5f-74a7-8510-df3ae644786f",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_failed",
      "to_code": "stability.sandbox_pending",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "version_superseded"
      },
      "occurred_on": "2026-09-03",
      "occurred_at": "2026-09-03 15:00:24.582287+00",
      "observed_since": "2026-09-02",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a067c9-0e5f-74a7-8510-df3ae644786f"
    },
    {
      "id": "chg_01a06616-bbf4-72c3-9d29-d763a98f04f8",
      "kind": "advisory.resolved",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-8769",
      "subject_child": "",
      "from_code": "cve.no_fix_available",
      "to_code": "cve.none",
      "from_value": null,
      "to_value": null,
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-8769"
      },
      "occurred_on": "2026-09-03",
      "occurred_at": "2026-09-03 07:06:00.867994+00",
      "observed_since": "2026-09-02",
      "source": "scan",
      "summary": "CVE-2026-8769 no longer affects this package",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a06616-bbf4-72c3-9d29-d763a98f04f8"
    },
    {
      "id": "chg_01a06616-bbf8-7caa-8147-85d849835411",
      "kind": "check.verdict",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.no_fix_available",
      "to_code": "cve.none",
      "from_value": "partial",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "seen": "236",
        "assessed": "237",
        "resolved": "236",
        "tree_source": "registry",
        "tree_status": "resolved"
      },
      "occurred_on": "2026-09-03",
      "occurred_at": "2026-09-03 07:06:00.867994+00",
      "observed_since": "2026-09-02",
      "source": "scan",
      "summary": "Known CVEs (partial → pass)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a06616-bbf8-7caa-8147-85d849835411"
    },
    {
      "id": "chg_01a03297-a83f-7141-994f-31af25cc0d34",
      "kind": "check.reverified",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.inconclusive",
      "to_code": "cve.no_fix_available",
      "from_value": "unverified",
      "to_value": "partial",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "refs": "[\"CVE-2026-8769\"]",
        "seen": "237",
        "package": "@ai-sdk/provider-utils",
        "assessed": "238",
        "resolved": "237",
        "transitive": "1",
        "vulnerable": "[{\"name\":\"@ai-sdk/provider-utils\",\"version\":\"3.0.30\",\"depth\":2,\"path\":[\"@mastra/core\",\"@ai-sdk/provider-utils-v5\"],\"refs\":[\"CVE-2026-8769\"]}]",
        "no_fix_refs": "[\"CVE-2026-8769\"]",
        "tree_source": "registry",
        "tree_status": "resolved"
      },
      "occurred_on": "2026-08-24",
      "occurred_at": "2026-08-24 07:06:34.807082+00",
      "observed_since": "2026-08-23",
      "source": "scan",
      "summary": "Known CVEs (unverified → partial)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a03297-a83f-7141-994f-31af25cc0d34"
    },
    {
      "id": "chg_01a02eb4-e230-78b1-a847-801017c1b227",
      "kind": "check.unverifiable",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.no_fix_available",
      "to_code": "cve.inconclusive",
      "from_value": "partial",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "reason": "root_version_missing"
      },
      "occurred_on": "2026-08-23",
      "occurred_at": "2026-08-23 13:00:00.884388+00",
      "observed_since": "2026-08-22",
      "source": "scan",
      "summary": "Known CVEs (partial → unverified)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_01a02eb4-e230-78b1-a847-801017c1b227"
    },
    {
      "id": "chg_019fff15-ec6b-7900-9a66-332e58a40fea",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_pending",
      "to_code": "stability.sandbox_failed",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "needs_declared_env",
        "status": "unreachable"
      },
      "occurred_on": "2026-08-14",
      "occurred_at": "2026-08-14 07:04:14.587775+00",
      "observed_since": "2026-08-13",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: this server's registry entry declares environment variables (an API key or similar), and its server did not start in our sandbox, so we have no schema to compare.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fff15-ec6b-7900-9a66-332e58a40fea"
    },
    {
      "id": "chg_019ffcb6-20f6-7df6-bf14-edb187c1e4cc",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_failed",
      "to_code": "stability.sandbox_pending",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "reason": "version_superseded"
      },
      "occurred_on": "2026-08-13",
      "occurred_at": "2026-08-13 20:00:22.240108+00",
      "observed_since": "2026-08-12",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019ffcb6-20f6-7df6-bf14-edb187c1e4cc"
    },
    {
      "id": "chg_019fc4e5-f7f0-7ec3-96a5-fae9ab734e87",
      "kind": "check.reverified",
      "family": "install-scripts",
      "subject_kind": "check",
      "subject": "install-scripts",
      "subject_child": "",
      "from_code": "installscript.inconclusive",
      "to_code": "installscript.none",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "tier": "none"
      },
      "occurred_on": "2026-08-02",
      "occurred_at": "2026-08-02 23:53:53.370734+00",
      "observed_since": "2026-08-01",
      "source": "scan",
      "summary": "Install scripts (unverified → pass)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fc4e5-f7f0-7ec3-96a5-fae9ab734e87"
    },
    {
      "id": "chg_019fc4e5-f7f1-74c6-a1cc-284a1a157424",
      "kind": "check.reverified",
      "family": "vulnerabilities",
      "subject_kind": "check",
      "subject": "vulnerabilities",
      "subject_child": "",
      "from_code": "cve.inconclusive",
      "to_code": "cve.no_fix_available",
      "from_value": "unverified",
      "to_value": "partial",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {
        "refs": "[\"CVE-2026-8769\"]",
        "seen": "237",
        "package": "@ai-sdk/provider-utils",
        "assessed": "231",
        "resolved": "230",
        "transitive": "1",
        "unresolved": "7",
        "vulnerable": "[{\"name\":\"@ai-sdk/provider-utils\",\"version\":\"3.0.30\",\"depth\":2,\"path\":[\"@mastra/core\",\"@ai-sdk/provider-utils-v5\"],\"refs\":[\"CVE-2026-8769\"]}]",
        "no_fix_refs": "[\"CVE-2026-8769\"]",
        "tree_source": "registry",
        "tree_status": "partial"
      },
      "occurred_on": "2026-08-02",
      "occurred_at": "2026-08-02 23:53:53.370734+00",
      "observed_since": "2026-08-01",
      "source": "scan",
      "summary": "Known CVEs (unverified → partial)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fc4e5-f7f1-74c6-a1cc-284a1a157424"
    },
    {
      "id": "chg_019fc4e5-f7f0-79db-afdc-0bf163920c81",
      "kind": "advisory.identified",
      "family": "vulnerabilities",
      "subject_kind": "advisory",
      "subject": "CVE-2026-8769",
      "subject_child": "",
      "from_code": null,
      "to_code": "cve.no_fix_available",
      "from_value": null,
      "to_value": null,
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {
        "id": "CVE-2026-8769",
        "severity": ""
      },
      "occurred_on": "2026-08-02",
      "occurred_at": "2026-08-02 23:53:53.370734+00",
      "observed_since": "2026-08-01",
      "source": "scan",
      "summary": "CVE-2026-8769 affects this package",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fc4e5-f7f0-79db-afdc-0bf163920c81"
    },
    {
      "id": "chg_019fc4e5-f7ef-7b7d-a32b-e9a502ca10c8",
      "kind": "check.reverified",
      "family": "build-provenance",
      "subject_kind": "check",
      "subject": "build-provenance",
      "subject_child": "",
      "from_code": "provenance.inconclusive",
      "to_code": "provenance.none",
      "from_value": "unverified",
      "to_value": "fail",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-08-02",
      "occurred_at": "2026-08-02 23:53:53.370734+00",
      "observed_since": "2026-08-01",
      "source": "scan",
      "summary": "Provenance (unverified → fail)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fc4e5-f7ef-7b7d-a32b-e9a502ca10c8"
    },
    {
      "id": "chg_019fc327-c204-7dc9-b72d-6e8f65764e32",
      "kind": "check.unverifiable",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_clean",
      "to_code": "supplychain.malware_inconclusive",
      "from_value": "pass",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-08-02",
      "occurred_at": "2026-08-02 15:46:30.508999+00",
      "observed_since": "2026-08-01",
      "source": "scan",
      "summary": "Malware scan (pass → unverified)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fc327-c204-7dc9-b72d-6e8f65764e32"
    },
    {
      "id": "chg_019fbe32-6fea-7e4c-9712-f204a3062af4",
      "kind": "check.reason",
      "family": "stability",
      "subject_kind": "check",
      "subject": "stability",
      "subject_child": "",
      "from_code": "stability.sandbox_pending",
      "to_code": "stability.sandbox_failed",
      "from_value": "unverified",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "neutral",
      "score_delta": null,
      "detail": {
        "status": "failed"
      },
      "occurred_on": "2026-08-01",
      "occurred_at": "2026-08-01 16:40:04.317499+00",
      "observed_since": "2026-07-31",
      "source": "scan",
      "summary": "Stability (Stability not yet verified: our sandbox run of this package did not complete, so we have no schema to compare.)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fbe32-6fea-7e4c-9712-f204a3062af4"
    },
    {
      "id": "chg_019fbe32-6fea-7394-9105-cf3c440b2508",
      "kind": "check.reverified",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_inconclusive",
      "to_code": "supplychain.malware_clean",
      "from_value": "unverified",
      "to_value": "pass",
      "materiality": "security",
      "direction": "improvement",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-08-01",
      "occurred_at": "2026-08-01 16:40:04.317499+00",
      "observed_since": "2026-07-31",
      "source": "scan",
      "summary": "Malware scan (unverified → pass)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fbe32-6fea-7394-9105-cf3c440b2508"
    },
    {
      "id": "chg_019fb6ce-eceb-7357-958b-420ad29fb45e",
      "kind": "check.unverifiable",
      "family": "supplychain-malware",
      "subject_kind": "check",
      "subject": "supplychain-malware",
      "subject_child": "",
      "from_code": "supplychain.malware_clean",
      "to_code": "supplychain.malware_inconclusive",
      "from_value": "pass",
      "to_value": "unverified",
      "materiality": "security",
      "direction": "regression",
      "score_delta": null,
      "detail": {},
      "occurred_on": "2026-07-31",
      "occurred_at": "2026-07-31 06:14:02.188913+00",
      "observed_since": "2026-07-29",
      "source": "scan",
      "summary": "Malware scan (pass → unverified)",
      "link": "https://verifymcp.io/servers/dev-cite42-mcp/cite42-mcp#chg-chg_019fb6ce-eceb-7357-958b-420ad29fb45e"
    }
  ],
  "days": [
    {
      "date": "2026-10-07",
      "total": 31,
      "delta": -2,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 8
    },
    {
      "date": "2026-09-30",
      "total": 33,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-09-29",
      "total": 33,
      "delta": 10,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 2
    },
    {
      "date": "2026-09-28",
      "total": 23,
      "delta": -10,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 5
    },
    {
      "date": "2026-09-25",
      "total": 33,
      "delta": 0,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 1
    },
    {
      "date": "2026-09-12",
      "total": 33,
      "delta": 25,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 3
    },
    {
      "date": "2026-09-11",
      "total": 8,
      "delta": -25,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 4
    },
    {
      "date": "2026-09-04",
      "total": 0,
      "delta": null,
      "tracked": true,
      "explained": true,
      "beyond_event_horizon": false,
      "attribution": null,
      "event_count": 5
    }
  ]
}