← Home

@transcend-io/mcp-server-workflows

npm Repository Homepage

Transcend MCP Server — Workflows tools.

18
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

cami-transcendmichaelfarrell76bencmbrookdmattiaelidawson.turechekaldobarrfran-transcendkendra.taylorhtunnicliff

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
phantom-deps phantom-dep:graphql AI (phantom-deps): Used via generated config/codegen, not direct import. ai
phantom-deps phantom-dep:@graphql-typed-document-node/core AI (phantom-deps): Type-only dep used by codegen, not direct import. ai
phantom-deps phantom-dep:zod AI (phantom-deps): Monorepo catalog dependency; resolved at workspace level, not a true phantom. ai
phantom-deps phantom-dep:@modelcontextprotocol/sdk AI (phantom-deps): Monorepo catalog dependency; resolved at workspace level, not a true phantom. ai

Versions (showing 18 of 18)

Version Deps Published
0.4.11 6 / 6
0.4.10 6 / 6
0.4.9 6 / 6
0.4.8 6 / 6
0.4.7 6 / 6
0.4.6 6 / 6
0.4.5 6 / 6
0.4.4 6 / 6
0.4.3 6 / 6
0.4.2 6 / 6
0.4.0 6 / 6
0.3.6 3 / 6
0.3.3 3 / 6
0.3.1 3 / 6
0.3.0 3 / 6
0.2.1 3 / 6
0.2.0 3 / 6
0.1.0 3 / 6

v0.4.11

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.10

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.9

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.8

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.7

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.6

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.5

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.4

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.3

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.2

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.4.0

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.