{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-05T17:24:16.236Z","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang","markdownUrl":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang.md","server":{"slug":"wsattazahn-caveat-lang","name":"io.github.WSattazahn/caveat-lang","registryName":"io.github.WSattazahn/caveat-lang","description":"Authoring bridge for Caveat: validate, check and test programs; explain decisions; find dependents.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"caveat-lang","type":"npm","identifier":"caveat-lang","withdrawn":false,"url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang","version":"1.4.1","transport":"stdio","scoredAt":"2026-11-05T10:56:08.254Z"},"score":{"total":93,"tier":"high trust","status":"scored","weekDelta":3,"history":[{"date":"2026-11-05","total":93},{"date":"2026-11-04","total":93},{"date":"2026-11-03","total":92},{"date":"2026-11-02","total":92},{"date":"2026-11-01","total":91},{"date":"2026-10-31","total":91},{"date":"2026-10-30","total":90},{"date":"2026-10-29","total":90},{"date":"2026-10-28","total":90},{"date":"2026-10-27","total":63},{"date":"2026-10-26","total":74},{"date":"2026-10-25","total":88},{"date":"2026-10-24","total":72},{"date":"2026-10-23","total":87},{"date":"2026-10-22","total":86},{"date":"2026-10-21","total":86},{"date":"2026-10-20","total":70},{"date":"2026-10-19","total":70},{"date":"2026-10-18","total":84},{"date":"2026-10-17","total":69},{"date":"2026-10-16","total":83},{"date":"2026-10-15","total":68},{"date":"2026-10-14","total":49},{"date":"2026-10-13","total":49},{"date":"2026-10-12","total":49}]},"categories":[{"name":"Supply Chain Security","score":100,"verdict":"pass","reasons":["No malware found by supply-chain analysis.","No known CVEs affecting this package version or its production dependencies.","No install/post-install scripts declared.","No production dependencies, so there is no dependency health to assess."],"codes":[{"code":"supplychain.malware_clean","args":{}},{"code":"cve.none","args":{}},{"code":"installscript.none","args":{}},{"code":"dephealth.no_dependencies","args":{"deps":"0","unhealthy":"0"}}]},{"name":"Provenance & Transparency","score":100,"verdict":"pass","reasons":["Source repository is publicly reachable at the declared URL.","Cryptographically verified build provenance (signed, bound to WSattazahn/caveat-lang).","Clear OSI-approved license (MIT).","Actively maintained (last published 9 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.verified","args":{"repo":"WSattazahn/caveat-lang"}},{"code":"license.osi","args":{"spdx":"MIT"}},{"code":"maintenance.recent","args":{"age_days":"9"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":60,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 1876 tokens (~375/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"375","items":"5","tools":"5","tokens":"1876","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":100,"verdict":"pass","reasons":["No destabilizing schema changes in the last 30 days."],"codes":[{"code":"stability.stable","args":{}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 5 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 6 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"5"}},{"code":"toolsafety.manipulation_clean","args":{"units":"6","judged":"6"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a current MCP spec version (2026-07-28)."],"codes":[{"code":"protocol.current","args":{"version":"2026-07-28"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"caveat-lang","type":"npm","identifier":"caveat-lang","withdrawn":false,"score":93,"current":true,"url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang","markdownUrl":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang.md"}],"facts":[{"label":"Registry","value":"npm"},{"label":"Package","value":"caveat-lang"},{"label":"Version","value":"1.4.1"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"caveat_validate","title":null,"description":"Load inline source with the installed runtime and list its declarations. Start here to find load errors; use caveat_check for authoring diagnostics and caveat_test to verify expected behavior. No events are dispatched. report (caveat-validate/0.1) contains program, loads, events, reading_streams, decision_series and displayed bindings, or a load error. exitCode: 0 loaded; 2 load failure. Returns the same JSON in structuredContent and text: {schema:\"caveat-authoring/0.1\",operation,sourceSha256,runtime,exitCode,report}. Read exitCode even when isError is false. Bridge failures instead set isError:true with {schema:\"caveat-authoring-error/0.1\",error:{kind,message}}.","inputs":[{"name":"source","type":"string","required":true,"description":"Complete inline Caveat program text, available as the virtual file inline.cav. No file path or URL lookup. At most 1 MiB of UTF-8 source; each call uses a fresh runtime."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":218},{"name":"caveat_check","title":null,"description":"Load a single-file program and report authoring diagnostics, such as repeated rules or a missing reopening path. Use after editing source; choose caveat_validate for a declaration summary and caveat_test for behavior assertions. A clean check does not prove behavior; bundles are unsupported. report (caveat-check/0.1) contains loads, strict, diagnostics and suppressed diagnostics, with code, location, message and suggestion, or a load error. exitCode: 0 completed without a strict failure; 1 strict with unsuppressed diagnostics; 2 load failure or bundle. Returns the same JSON in structuredContent and text: {schema:\"caveat-authoring/0.1\",operation,sourceSha256,runtime,exitCode,report}. Read exitCode even when isError is false. Bridge failures instead set isError:true with {schema:\"caveat-authoring-error/0.1\",error:{kind,message}}.","inputs":[{"name":"source","type":"string","required":true,"description":"Complete inline Caveat program text, available as the virtual file inline.cav. No file path or URL lookup. At most 1 MiB of UTF-8 source; each call uses a fresh runtime."},{"name":"strict","type":"boolean","required":false,"description":"Optional, defaults to false. When true, any unsuppressed diagnostic makes exitCode 1 instead of 0; suppressed diagnostics do not count. Does not change program behavior. Load failures and unsupported…"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":300},{"name":"caveat_test","title":null,"description":"Run scenario assertions and runtime invariant checks against inline source, with a fresh session per scenario. Use to verify expected event outcomes and snapshot values; caveat_validate only checks loading, caveat_check reports diagnostics, and caveat_explain inspects history without assertions. report (caveat-scenario-report/0.1) includes files, per-scenario results/failures, check diagnostics and passed/failed totals. exitCode: 0 all passed; 1 scenario failure; 2 invalid scenario document (report has valid:false and error) or blocking authoring diagnostics. Every source reference must be inline.cav. Returns the same JSON in structuredContent and text: {schema:\"caveat-authoring/0.1\",operation,sourceSha256,runtime,exitCode,report}. Read exitCode even when isError is false. Bridge failures instead set isError:true with {schema:\"caveat-authoring-error/0.1\",error:{kind,message}}.","inputs":[{"name":"scenarios","type":"object","required":true,"description":"Scenario document object, not JSON text. Example: {\"schema\":\"caveat-scenarios/0.1\",\"source\":\"inline.cav\",\"scenarios\":[{\"id\":\"initial\",\"title\":\"Initial sequence\",\"steps\":[{\"expect\":{\"/sequence\":0}}]}]…"},{"name":"source","type":"string","required":true,"description":"Complete inline Caveat program text, available as the virtual file inline.cav. No file path or URL lookup. At most 1 MiB of UTF-8 source; each call uses a fresh runtime."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":511},{"name":"caveat_explain","title":null,"description":"Replay optional events and explain the resulting decisions, evidence and displayed values. Use to answer why a decision was made; choose caveat_dependents to trace one evidence or caveat name forward, and caveat_test for assertions. report (caveat-explain/0.1) includes sequence, event outcomes, decisions with grounds and revision history, evidence with caveats, displayed values and available archive history. exitCode: 0 replay completed (may include rejected events); 1 fatal event with last good state; 2 source load failure (report has loads:false and error). Returns the same JSON in structuredContent and text: {schema:\"caveat-authoring/0.1\",operation,sourceSha256,runtime,exitCode,report}. Read exitCode even when isError is false. Bridge failures instead set isError:true with {schema:\"caveat-authoring-error/0.1\",error:{kind,message}}.","inputs":[{"name":"events","type":"array","required":false,"description":"Events replayed in array order from a fresh session. Omitted or [] inspects the initial state; previous calls supply no history. Rejections are recorded and replay continues; a fatal event stops repl…"},{"name":"source","type":"string","required":true,"description":"Complete inline Caveat program text, available as the virtual file inline.cav. No file path or URL lookup. At most 1 MiB of UTF-8 source; each call uses a fresh runtime."}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":320},{"name":"caveat_dependents","title":null,"description":"Replay optional events and find what rests on one named evidence item, reading stream or caveat. Use for impact inspection; caveat_explain instead explains all decisions and their reasons. Subjects are causes only: evidence, a reading stream or a caveat. Claims and decisions are never subjects, because a claim causes nothing and the grounds of a decision are evidence, not claims; both appear in the report as what the subject reaches. To trace from a claim, query the evidence that supports or opposes it (report.claims lists those relations). report (caveat-dependents/0.1) includes subject, kind, sequence, event outcomes, claims, decisions, changes, values, displayed values and withdrawal records; dependency entries distinguish grounds from possible influence through lineage. exitCode: 0 replay completed (may include rejected events); 1 fatal event with last good state; 2 load failure or unknown subject, with report.error. Returns the same JSON in structuredContent and text: {schema:\"caveat-authoring/0.1\",operation,sourceSha256,runtime,exitCode,report}. Read exitCode even when isError is false. Bridge failures instead set isError:true with {schema:\"caveat-authoring-error/0.1\",error:{kind,message}}.","inputs":[{"name":"events","type":"array","required":false,"description":"Events replayed in array order from a fresh session. Omitted or [] inspects the initial state; previous calls supply no history. Rejections are recorded and replay continues; a fatal event stops repl…"},{"name":"source","type":"string","required":true,"description":"Complete inline Caveat program text, available as the virtual file inline.cav. No file path or URL lookup. At most 1 MiB of UTF-8 source; each call uses a fresh runtime."},{"name":"subject","type":"string","required":true,"description":"Exact case-sensitive evidence name, reading stream name, caveat name, or evidence occurrence ID after replay. Evidence records supplied observations; a reading stream is a named history of samples; a…"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":502}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T10:56:08.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"verified","label":"Verified","reason":"verified","reasonLabel":"Verified","discovery":"attestation_endpoint","discoveryLabel":"Registry attestation endpoint","sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":{"nodes":0,"partial":false,"deprecated":null,"stale":null,"noRepo":null}},"mismatches":[],"changelog":{"trackingSince":"2026-10-12","recent":[{"id":"chg_01a1a62c-f7b3-70c2-96e3-3f04e72bdaa0","kind":"check.verdict","summary":"Stability (0.97 → pass)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a1a62c-f7b3-70c2-96e3-3f04e72bdaa0"},{"id":"chg_01a1a62c-f7b3-7efc-afd8-fcc024769fb3","kind":"score.total_changed","summary":"Trust score (92 → 93)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a1a62c-f7b3-7efc-afd8-fcc024769fb3"},{"id":"chg_01a19bdd-3ee6-74a0-932a-1f24c7eabca0","kind":"score.total_changed","summary":"Trust score (91 → 92)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a19bdd-3ee6-74a0-932a-1f24c7eabca0"},{"id":"chg_01a19190-535b-741d-a97e-7c036e2add71","kind":"score.total_changed","summary":"Trust score (90 → 91)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-31","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a19190-535b-741d-a97e-7c036e2add71"},{"id":"chg_01a1821d-4f13-731a-bcc4-a293df2e69d0","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a1821d-4f13-731a-bcc4-a293df2e69d0"},{"id":"chg_01a1821d-4f15-7219-9a96-afc506d4a9f7","kind":"check.reverified","summary":"Known CVEs (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a1821d-4f15-7219-9a96-afc506d4a9f7"},{"id":"chg_01a1821d-4f16-77d1-83ca-811f0ef16a0e","kind":"check.reverified","summary":"Dependency health (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a1821d-4f16-77d1-83ca-811f0ef16a0e"},{"id":"chg_01a1821d-4f19-700a-bbe2-8f209e1fc88a","kind":"package.version_changed","summary":"Package version (0.1.0-rc.19 → 1.4.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a1821d-4f19-700a-bbe2-8f209e1fc88a"},{"id":"chg_01a1821d-4f19-7b1d-9eb0-1a7b5a8de045","kind":"score.total_changed","summary":"Trust score (63 → 90)","materiality":"functional","direction":"improvement","scoreDelta":27,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a1821d-4f19-7b1d-9eb0-1a7b5a8de045"},{"id":"chg_01a17acc-9b79-7b1a-91bc-61ad10fe0d23","kind":"check.unverifiable","summary":"Known CVEs (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a17acc-9b79-7b1a-91bc-61ad10fe0d23"},{"id":"chg_01a17acc-9b7d-706a-bacb-4a099854cee4","kind":"check.unverifiable","summary":"Dependency health (pass → unverified)","materiality":"functional","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a17acc-9b7d-706a-bacb-4a099854cee4"},{"id":"chg_01a17acc-9b7d-7665-a1b5-a1c12bf79770","kind":"package.version_changed","summary":"Package version (1.4.0 → 1.4.1)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a17acc-9b7d-7665-a1b5-a1c12bf79770"},{"id":"chg_01a17acc-9b7d-7b12-bc78-4ec8062941d6","kind":"score.total_changed","summary":"Trust score (74 → 63)","materiality":"functional","direction":"regression","scoreDelta":-11,"occurredOn":"2026-10-27","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a17acc-9b7d-7b12-bc78-4ec8062941d6"},{"id":"chg_01a17983-a9d7-78cb-be94-bf04c70ba64a","kind":"check.unverifiable","summary":"Malware scan (pass → unverified)","materiality":"security","direction":"regression","scoreDelta":null,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a17983-a9d7-78cb-be94-bf04c70ba64a"},{"id":"chg_01a17983-a9da-793a-956d-afce69b00319","kind":"package.version_changed","summary":"Package version (1.3.0 → 1.4.0)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a17983-a9da-793a-956d-afce69b00319"},{"id":"chg_01a17983-a9da-7eb2-985d-1a7629e00689","kind":"score.total_changed","summary":"Trust score (89 → 74)","materiality":"functional","direction":"regression","scoreDelta":-15,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a17983-a9da-7eb2-985d-1a7629e00689"},{"id":"chg_01a177ce-faf8-7315-9378-d1b383596b0a","kind":"check.verdict","summary":"Security disclosure (fail → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a177ce-faf8-7315-9378-d1b383596b0a"},{"id":"chg_01a177ce-faf9-7394-9f56-5b8dcb591a5d","kind":"score.total_changed","summary":"Trust score (88 → 89)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a177ce-faf9-7394-9f56-5b8dcb591a5d"},{"id":"chg_01a172a6-0798-78e3-b78b-a85e3f38d90b","kind":"check.reverified","summary":"Malware scan (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-25","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a172a6-0798-78e3-b78b-a85e3f38d90b"},{"id":"chg_01a172a6-0799-7db0-993d-a98dc555888a","kind":"score.total_changed","summary":"Trust score (72 → 88)","materiality":"functional","direction":"improvement","scoreDelta":16,"occurredOn":"2026-10-25","url":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang#chg-chg_01a172a6-0799-7db0-993d-a98dc555888a"}],"truncated":true,"feedUrl":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang/changelog.json"},"links":{"html":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang","markdown":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang.md","changelogJson":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang/changelog.json","changelogRss":"https://verifymcp.io/servers/wsattazahn-caveat-lang/caveat-lang.xml","external":[{"label":"npm package","href":"https://www.npmjs.com/package/caveat-lang"},{"label":"Socket report","href":"https://socket.dev/npm/package/caveat-lang"},{"label":"Repository","href":"https://github.com/WSattazahn/caveat-lang"}]}}