Build artifact-backed MCP Safety Index

[KryptosAI]

Summary

• adds a reproducible MCP Safety Index generator and target manifest
• publishes Safety Methodology plus 13 artifact-backed public server evaluations
• refreshes public proof, post draft, paid pilot offer, and README Action guidance for the Safety Methodology release
• bumps package version to 0.24.0 and pins init-ci default workflows to v0.24.0
• extends artifact validation and privacy tests to cover Safety Index evidence

Validation

• npm run lint
• npm run typecheck
• npm run build
• npm test
• npm run smoke
• npm run validate:artifacts
• npm audit --json
• npm --prefix api audit --json
• npm pack --dry-run
• npm pack --dry-run --json private-path check

Notes

• Dependabot PR chore(deps): bump actions/checkout from 6 to 7 #113 was merged into main and this branch includes it.
• Dependabot PR chore(deps-dev): bump the dev-tooling group across 1 directory with 5 updates #114 was updated against main; GitHub verify was still in progress when this PR was opened.
• Safety Index v1 evaluates 13 public targets: 10 Ready for CI, 1 Needs review before production, 2 Unsafe default posture.

[github-actions]

🔭 MCP Observatory — All clear ✅

All checks passed. No security issues, no schema quality warnings.

Safety verdict

Blocked — One or more checks can break agent dependence and should be fixed before production use.
Top risks: startup: server failed to start

📊 Summary

Gate: fail · 0 tools · 0 prompts · 0 resources

Next action

Run the target command manually, compare stderr with the diagnosis below, and only raise timeoutMs if startup is genuinely slow.
Add CI: npx @kryptosai/mcp-observatory init-ci --all --command "npx -y "

---

_{🔭 MCP Observatory — test your MCP servers for breaking changes · ⭐ Star}

[github-actions]

🎉 This PR is included in version 0.24.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀