@mushi-mushi/mcp
MCP server exposing Mushi Mushi reports to coding agents
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): @sentry/node is an established error-monitoring SDK consistent with this MCP server's observability use case. | ai | |
| provenance | missing-githead | AI (provenance): Package publishes with SLSA provenance attestation via GitHub Actions; gitHead absence is acceptable given strong CI/CD attestation. | ai | |
| typosquat | typosquat.levenshtein:yup | AI (typosquat): Scoped package @mushi-mushi/mcp; Levenshtein match to 'yup' is coincidental, not impersonation. | ai |
Versions (showing 9 of 9)
| Version | Deps | Published |
|---|---|---|
| 0.19.0 | 4 / 6 | |
| 0.18.4 | 4 / 6 | |
| 0.18.3 | 4 / 6 | |
| 0.18.2 | 4 / 6 | |
| 0.10.0 | 3 / 6 | |
| 0.9.0 | 3 / 6 | |
| 0.3.7 | 3 / 6 | |
| 0.2.0 | 3 / 6 | |
| 0.1.0 | 3 / 5 |
v0.19.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v0.18.4
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
v0.18.3
2 findings[Reject — re-review on republish] (prior reject: AI (provenance): gitHead was present in prior versions; absence confirms changed publish environment.) This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.18.2
2 findings[Reject — re-review on republish] (prior reject: AI (provenance): gitHead was present in prior versions; absence confirms changed publish environment.) This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.