{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-11T02:58:52.935Z","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli","markdownUrl":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli.md","server":{"slug":"muralnick-sugo","name":"io.github.Muralnick/sugo","registryName":"io.github.Muralnick/sugo","description":"Local, offline conversion of PDFs, Office files and screenshots into compact Markdown.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"sugo-cli","type":"pypi","identifier":"sugo-cli","withdrawn":false,"url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli","version":"0.1.4","transport":"stdio","scoredAt":"2026-11-10T07:48:23.487Z"},"score":{"total":50,"tier":"low","status":"scored","weekDelta":null,"history":[{"date":"2026-11-10","total":50},{"date":"2026-11-09","total":35},{"date":"2026-11-08","total":0},{"date":"2026-11-07","total":0}]},"categories":[{"name":"Supply Chain Security","score":99,"verdict":"partial","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","Runs uv_build at install time, a recognised build step with no custom scripting around it.","6 of 47 dependencies flagged as unhealthy."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.allowlisted","args":{"tool":"uv_build","hooks":"build_backend"}},{"code":"dephealth.assessed","args":{"deps":"47","unhealthy":"6"}}]},{"name":"Provenance & Transparency","score":100,"verdict":"pass","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to Muralnick/sugo).","Clear OSI-approved license (AGPL-3.0-or-later).","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"Muralnick/sugo"}},{"code":"license.osi","args":{"spdx":"AGPL-3.0-or-later"}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":0,"verdict":"unverified","reasons":["Schema quality not yet verified: our sandbox could not run this package, so we have no schema to assess."],"codes":[{"code":"schema.sandbox_failed","args":{"reason":"not_attempted","status":"unreachable"}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability not yet verified: our sandbox could not run this package, so we have no schema to compare."],"codes":[{"code":"stability.sandbox_failed","args":{"reason":"not_attempted","status":"unreachable"}}]},{"name":"Tool Coverage","score":0,"verdict":"unverified","reasons":["Tool coverage not yet verified: our sandbox could not run this package, so we have no tool definitions to assess."],"codes":[{"code":"toolquality.sandbox_failed","args":{"reason":"not_attempted","status":"unreachable"}}]},{"name":"Tool Safety","score":0,"verdict":"unverified","reasons":["Tool safety not yet verified: our sandbox could not run this package, so we have no tool text to scan."],"codes":[{"code":"toolsafety.sandbox_failed","args":{"reason":"not_attempted","status":"unreachable"}}]},{"name":"Capabilities","score":0,"verdict":"unverified","reasons":["Protocol version not yet verified: our sandbox could not run this package, so we never saw its MCP handshake."],"codes":[{"code":"cap.sandbox_failed","args":{"reason":"not_attempted","status":"unreachable"}}]}],"inconclusive":["Schema quality not yet verified: our sandbox could not run this package, so we have no schema to assess.","Stability not yet verified: our sandbox could not run this package, so we have no schema to compare.","Tool coverage not yet verified: our sandbox could not run this package, so we have no tool definitions to assess.","Tool safety not yet verified: our sandbox could not run this package, so we have no tool text to scan.","Protocol version not yet verified: our sandbox could not run this package, so we never saw its MCP handshake."],"malware":[],"components":[{"slug":"sugo-cli","type":"pypi","identifier":"sugo-cli","withdrawn":false,"score":50,"current":true,"url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli","markdownUrl":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli.md"}],"facts":[{"label":"Registry","value":"pypi"},{"label":"Package","value":"sugo-cli"},{"label":"Version","value":"0.1.4"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-10T07:48:23.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[{"hook":"build_backend","tier":"allowlisted"}],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":47,"partial":false,"deprecated":null,"stale":4,"noRepo":2}},"mismatches":[],"changelog":{"trackingSince":"2026-11-07","recent":[{"id":"chg_01a1c46d-f758-7b5a-a3e6-fe93c9a0885b","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-10","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c46d-f758-7b5a-a3e6-fe93c9a0885b"},{"id":"chg_01a1c46d-f75b-7294-b934-1a12efef6e48","kind":"score.total_changed","summary":"Trust score (35 → 50)","materiality":"functional","direction":"improvement","scoreDelta":15,"occurredOn":"2026-11-10","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c46d-f75b-7294-b934-1a12efef6e48"},{"id":"chg_01a1c21d-36c2-78e1-b5cc-6b0926d797de","kind":"advisory.resolved","summary":"CVE-2026-112393 no longer affects this package","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c2-78e1-b5cc-6b0926d797de"},{"id":"chg_01a1c21d-36c4-72ab-bc31-38821355873e","kind":"advisory.resolved","summary":"CVE-2026-96639 no longer affects this package","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c4-72ab-bc31-38821355873e"},{"id":"chg_01a1c21d-36c6-74ec-ad15-41daed291933","kind":"advisory.resolved","summary":"CVE-2026-112398 no longer affects this package","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c6-74ec-ad15-41daed291933"},{"id":"chg_01a1c21d-36c6-7bac-a268-2fc86d0e7f70","kind":"advisory.resolved","summary":"CVE-2026-112900 no longer affects this package","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c6-7bac-a268-2fc86d0e7f70"},{"id":"chg_01a1c21d-36c7-739e-a570-1b4ce3952f25","kind":"check.verdict","summary":"Known CVEs (fail → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c7-739e-a570-1b4ce3952f25"},{"id":"chg_01a1c21d-36c7-7897-8edf-a26513ab78d5","kind":"advisory.resolved","summary":"CVE-2026-112403 no longer affects this package","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c7-7897-8edf-a26513ab78d5"},{"id":"chg_01a1c21d-36c7-7d9d-af6c-ca531da464aa","kind":"package.version_changed","summary":"Package version (0.1.2 → 0.1.4)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c7-7d9d-af6c-ca531da464aa"},{"id":"chg_01a1c21d-36c8-7394-bad0-5ce95a616e7a","kind":"score.total_changed","summary":"Trust score (0 → 35)","materiality":"functional","direction":"improvement","scoreDelta":35,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c8-7394-bad0-5ce95a616e7a"},{"id":"chg_01a1c21d-36c8-78c9-bfd3-6e0980616ca0","kind":"score.status_changed","summary":"Score status (failed → scored)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1c21d-36c8-78c9-bfd3-6e0980616ca0"},{"id":"chg_01a1bff2-5bfe-7d98-9eb5-011777274bfb","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-11-09","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1bff2-5bfe-7d98-9eb5-011777274bfb"},{"id":"chg_01a1ba02-018b-76e4-9cb7-7db02fe850f4","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-11-08","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1ba02-018b-76e4-9cb7-7db02fe850f4"},{"id":"chg_01a1b6aa-9870-7932-8649-76ebc297966d","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-07","url":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli#chg-chg_01a1b6aa-9870-7932-8649-76ebc297966d"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli/changelog.json"},"links":{"html":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli","markdown":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli.md","changelogJson":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli/changelog.json","changelogRss":"https://verifymcp.io/servers/muralnick-sugo/sugo-cli.xml","external":[{"label":"PyPI project","href":"https://pypi.org/project/sugo-cli/"},{"label":"Socket report","href":"https://socket.dev/pypi/package/sugo-cli"},{"label":"Repository","href":"https://github.com/Muralnick/sugo"}]}}