@squawk/mcp
Model Context Protocol server exposing squawk's aviation libraries as tools for LLM clients
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| typosquat | typosquat.levenshtein:yup | AI (typosquat): @squawk/mcp is a scoped aviation MCP server with no resemblance to 'yup'; the levenshtein match is a false positive for this package. | ai | |
| phantom-deps | phantom-dep:@squawk/types | AI (phantom-deps): @squawk/types is a sibling type-only package in a TypeScript monorepo; not directly imported but used transitively for type definitions — stable pattern for this package. | ai |
Versions (showing 23 of 23)
| Version | Deps | Published |
|---|---|---|
| 0.9.0 | 21 / 2 | |
| 0.8.13 | 22 / 1 | |
| 0.8.12 | 22 / 1 | |
| 0.8.11 | 22 / 1 | |
| 0.8.10 | 22 / 1 | |
| 0.8.9 | 22 / 1 | |
| 0.8.8 | 22 / 1 | |
| 0.8.7 | 22 / 1 | |
| 0.8.6 | 22 / 1 | |
| 0.8.5 | 22 / 1 | |
| 0.8.4 | 22 / 1 | |
| 0.8.3 | 22 / 1 | |
| 0.8.2 | 22 / 1 | |
| 0.8.1 | 22 / 1 | |
| 0.8.0 | 22 / 1 | |
| 0.7.0 | 22 / 1 | |
| 0.6.0 | 22 / 1 | |
| 0.5.0 | 22 / 1 | |
| 0.4.1 | 22 / 1 | |
| 0.4.0 | 22 / 1 | |
| 0.3.0 | 22 / 1 | |
| 0.2.1 | 22 / 1 | |
| 0.2.0 | 22 / 1 |
v0.9.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.13
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.12
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.11
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.8.7
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.6
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.4
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.8.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.8.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.7.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.6.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.5.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.1
1 findingPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.