{
  "schemaVersion": 1,
  "package": "@orusagent/mcp-guard",
  "version": "0.1.0-beta.2",
  "npm": "https://www.npmjs.com/package/@orusagent/mcp-guard/v/0.1.0-beta.2",
  "archiveSha256": "a58b0bde4acd8d3f01e6e47f7ca3b6095c577ecb643b43d8e47b2edf742dc31b",
  "npmIntegrity": "sha512-s2QrgwKmQ6Auz3g/bwkcknu6OWgu7MFzPA5LsevKKZVLbG4FdUwz4iMCwAoycDdaJKsdXi+cfGgacH0PSux5zA==",
  "archiveBytes": 22732,
  "checkedAt": "2026-10-02T12:48:01.978Z",
  "timing": "before-publication",
  "eyebrow": {
    "version": "0.5.6",
    "tag": "https://github.com/alexverify/eyebrow/releases/tag/v0.5.6",
    "releaseArchiveSha256": {
      "eyebrow_0.5.6_darwin_amd64.tar.gz": "157b402243988704dc5d7b0417ea0db59554d0e48f52eaa31dba7a3fc2196c63",
      "eyebrow_0.5.6_darwin_arm64.tar.gz": "aed9244ac395a513e6393e50ddaf77b39e2f6de9b16f05acd7073af43ffc3a00",
      "eyebrow_0.5.6_linux_amd64.tar.gz": "3ea5adb5b432751d7ced1a172ce8f09df6e7503081c8ce12c5879e71003d08df",
      "eyebrow_0.5.6_linux_arm64.tar.gz": "57573006a0a1c63e8be167bcf03f8f1960def90a2095eccced03b135999fdd52"
    },
    "command": "eyebrow check package --json --fail-on high",
    "offline": "eyebrow check reads the folder only: it writes nothing, makes no network call and executes nothing.",
    "binarySha256": "c5686ba24e3a179e5af07e7c514098649a18acfd85cb739df85c981e2d27343e"
  },
  "result": {
    "verdict": "pass",
    "failOn": "high",
    "contentHash": "sha256-3500c8dd5fe026fbcdc209099586435bfaf79c51cd4122d796f829abb5f27786",
    "contentHashCovers": "The package/ folder extracted from the npm archive. An installed copy that nests node_modules/i18next hashes differently; its verdict and findings are the same.",
    "findings": [
      {
        "ruleId": "EXEC-PRIMITIVE",
        "severity": "medium",
        "file": "dist/claude.js",
        "line": 1,
        "reason": "Imports execFile to run the official Claude CLI that registers, verifies and removes the orus-guarded entry. Arguments are fixed; no key is passed."
      },
      {
        "ruleId": "EXEC-PRIMITIVE",
        "severity": "medium",
        "file": "dist/launcher.js",
        "line": 1,
        "reason": "Imports spawn and execFile to read the pinned Eyebrow version and start eyebrow mcp-shim with an allowlisted environment."
      }
    ]
  },
  "dependencies": [
    {
      "name": "i18next",
      "version": "26.4.2",
      "verdict": "pass",
      "contentHash": "sha256-661045836881ab5c78689aaf68eb56f409bacd7b895fbbc281684d3209fbffcd",
      "findings": 0,
      "integrity": "sha512-RX+R0VLg13IbvRuJSxnqykUFS9vQZTl8wYpWPCIUDWVrSGjsQywB5Y+pjzrkboxGAuYfJZVH1InFTdgBdxq6ug=="
    }
  ],
  "files": [
    {
      "path": "dist/binary.js",
      "bytes": 1293,
      "sha256": "78b4249dc52eddfe96231c20c47261c4e48429e3957a1e781b5b8fa1df4f916a"
    },
    {
      "path": "dist/bridge.js",
      "bytes": 8899,
      "sha256": "15257b0f30be8f42759e60f3f5d905d9ee0a36bb57c28969870bf93d49b44754"
    },
    {
      "path": "dist/check.js",
      "bytes": 1233,
      "sha256": "0f25321c7f8dfb3fb5649e38044cc1f042683515095763018bee9c7f917b6114"
    },
    {
      "path": "dist/claude.js",
      "bytes": 4546,
      "sha256": "b3fda2341028fe21bda6166c50b425b21945816a1905f6b352d82dc180730a62"
    },
    {
      "path": "dist/cli.js",
      "bytes": 5135,
      "sha256": "7de4e3c2333e4466f2e372019d9cb41a94965142100bd9604dffafbf87d15263"
    },
    {
      "path": "dist/errors.js",
      "bytes": 455,
      "sha256": "ca383801f708fdc708798227cea6b85f9de37eb155f8e7fddd6b0d91884e507d"
    },
    {
      "path": "dist/launcher.js",
      "bytes": 3092,
      "sha256": "aa6a7a0892b549069e7059db2b0141700ceff1682a0583e2d70ee5645eb07e00"
    },
    {
      "path": "dist/messages.js",
      "bytes": 8749,
      "sha256": "a31c1577fb19e9b2b2763255da202a9253e425c92ee066bc7b3d1d1a87ce988b"
    },
    {
      "path": "dist/profile.js",
      "bytes": 2246,
      "sha256": "841523503b333f85798fe42444bdfb24eca35220ed1f63c96bc3047586e2ff25"
    },
    {
      "path": "dist/storage.js",
      "bytes": 7896,
      "sha256": "dc441bc89bd89cb8378ad7682fd002fe2ce8f1080e7fd443c01232ae3cd0eae0"
    },
    {
      "path": "dist/transport.js",
      "bytes": 5786,
      "sha256": "2b10bb08fc418119a257cc345454c49943bcba40954c351fd84ad7d37aedaab2"
    },
    {
      "path": "LICENSE",
      "bytes": 1061,
      "sha256": "f29ceba9348437e3e392be0a835b3eadfd30bbb2b70eea6e4df45c66a6d9228a"
    },
    {
      "path": "package.json",
      "bytes": 1377,
      "sha256": "588b4e95573e5582e39e8f29b43a43bd73e7c858ab1781f668a1508fbf4a4de4"
    },
    {
      "path": "policies/eyebrow-binaries.json",
      "bytes": 876,
      "sha256": "d1b382fe41f76dddda5dae6c9da9f89f68dcaadda5ec0fc393aa63ee7cf6f4a3"
    },
    {
      "path": "policies/research-draft.json",
      "bytes": 1177,
      "sha256": "f26abac41ac8bcd7376ffbc6890910377680759c6c409de4014251a990b214e4"
    },
    {
      "path": "README.md",
      "bytes": 4562,
      "sha256": "ef1b06f70fa8f07abc0123bf4cdccecbb1c53e406f2eee4b3123ef0783976d8b"
    },
    {
      "path": "README.zh-CN.md",
      "bytes": 7116,
      "sha256": "4f28c97a63f282aa395a36729dc15c9a093276e277093e326d97549e3f431f24"
    }
  ],
  "reproduce": [
    "npm pack @orusagent/mcp-guard@0.1.0-beta.2",
    "shasum -a 256 orusagent-mcp-guard-0.1.0-beta.2.tgz",
    "tar -xzf orusagent-mcp-guard-0.1.0-beta.2.tgz",
    "eyebrow check package --json"
  ],
  "attribution": "Recorded by Orus by running the open-source Eyebrow CLI. Anyone can repeat it. Not an Eyebrow badge, signature or attestation.",
  "registryVerifiedAt": "2026-10-02T13:59:53.744Z",
  "registryArchiveMatches": true
}