@danainnovations/cortex-mcp
Connect your AI tools to Asana, GitHub, Microsoft 365, Monday.com, Salesforce, Slack, Vercel & Supabase MCPs via Cortex
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Manual publish by known maintainer, consistent with prior pattern; no behavior concern. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): fflate is a widely-used, legitimate compression library. | ai |
Versions (showing 51 of 137)
| Version | Deps | Published |
|---|---|---|
| 1.0.151 | 3 / 5 | |
| 1.0.149 | 3 / 5 | |
| 1.0.148 | 3 / 5 | |
| 1.0.147 | 3 / 5 | |
| 1.0.146 | 2 / 5 | |
| 1.0.144 | 2 / 5 | |
| 1.0.143 | 2 / 5 | |
| 1.0.142 | 2 / 5 | |
| 1.0.141 | 2 / 5 | |
| 1.0.140 | 2 / 5 | |
| 1.0.139 | 2 / 5 | |
| 1.0.137 | 2 / 5 | |
| 1.0.136 | 2 / 5 | |
| 1.0.135 | 2 / 5 | |
| 1.0.134 | 2 / 5 | |
| 1.0.133 | 2 / 5 | |
| 1.0.132 | 2 / 5 | |
| 1.0.131 | 2 / 5 | |
| 1.0.130 | 2 / 5 | |
| 1.0.129 | 2 / 5 | |
| 1.0.128 | 2 / 5 | |
| 1.0.127 | 2 / 5 | |
| 1.0.126 | 2 / 5 | |
| 1.0.125 | 2 / 5 | |
| 1.0.124 | 2 / 5 | |
| 1.0.123 | 2 / 5 | |
| 1.0.122 | 2 / 5 | |
| 1.0.121 | 2 / 5 | |
| 1.0.120 | 2 / 5 | |
| 1.0.119 | 2 / 5 | |
| 1.0.118 | 2 / 5 | |
| 1.0.117 | 2 / 5 | |
| 1.0.116 | 2 / 5 | |
| 1.0.115 | 2 / 5 | |
| 1.0.114 | 2 / 5 | |
| 1.0.113 | 2 / 5 | |
| 1.0.112 | 2 / 5 | |
| 1.0.111 | 2 / 5 | |
| 1.0.109 | 2 / 5 | |
| 1.0.108 | 2 / 5 | |
| 1.0.106 | 2 / 5 | |
| 1.0.105 | 2 / 5 | |
| 1.0.104 | 2 / 5 | |
| 1.0.103 | 2 / 5 | |
| 1.0.102 | 2 / 5 | |
| 1.0.101 | 2 / 5 | |
| 1.0.100 | 2 / 5 | |
| 1.0.99 | 2 / 5 | |
| 1.0.98 | 2 / 5 | |
| 1.0.97 | 2 / 5 | |
| 1.0.96 | 2 / 5 |
v1.0.151
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (elliotta1130) than the most recent previously approved version (tcpalm-r) on 2026-07-27, but elliotta1130 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.149
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tcpalm-r.
v1.0.148
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tcpalm-r.
v1.0.147
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tcpalm-r.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (tcpalm-r) than the most recent previously approved version (elliotta1130) on 2026-07-08, but tcpalm-r is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.146
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.0.144
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: tcpalm-r.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (tcpalm-r) than the most recent previously approved version (elliotta1130) on 2026-07-01, but tcpalm-r is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.139
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (elliotta1130) than the most recent previously approved version (tcpalm-r) on 2026-04-30, but elliotta1130 is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.136
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (tcpalm-r) than the most recent previously approved version (elliotta1130) on 2026-04-03, but tcpalm-r is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.