{
  "format_version": "0.2.0",
  "report_id": "5e4981fe-0650-4f81-90ad-64d06fdbf9bf",
  "generated_at": "2026-08-14T18:17:10.961Z",
  "subject": {
    "server_name": "@crewhaus/mcp-host",
    "publisher_claim": "@crewhaus",
    "artifact": {
      "ecosystem": "npm",
      "package": "@crewhaus/mcp-host",
      "version": "0.5.6",
      "sha256": "c5252400b6b5bca4a82a19d4485c32cd3c16bb059a2a398800812fd46e8c7355",
      "download_url": "https://registry.npmjs.org/@crewhaus/mcp-host/-/mcp-host-0.5.6.tgz",
      "registry_metadata_url": "https://registry.npmjs.org/%40crewhaus%2Fmcp-host/0.5.6",
      "acquired_at": "2026-08-14T18:17:10.961Z",
      "registry_metadata_sha256": "4c621df20e7b64b095606e21aa4ff819986045d10f8316c4006a4d5c3d064942",
      "integrity_claim": "sha512-ZMn8zZOLn+tjtQf8pBKESh2ktw438bmJiI/O880hOu1ldnkeStX1kmiLp1TPCu75nalWbJaRFQ0OsFiN7+X6QA==",
      "integrity_verified": true
    }
  },
  "analysis": {
    "engine": {
      "name": "sentinel",
      "version": "0.2.0",
      "build_sha256": "76ecfa3e5785d89b34d6618b32c84c01f0e40666b3541871cc874aba61200160"
    },
    "protocol_profile": {
      "id": "mcp-2026-07-28",
      "specification_revision": "2026-07-28",
      "local_retrieval_date": "2026-08-01",
      "discovery_status": "not_run"
    },
    "authorization_profiles": [
      {
        "id": "none",
        "credential_present": false,
        "description": "No credentials were supplied."
      }
    ],
    "rule_pack": {
      "version": "0.1.0",
      "sha256": "302d85219dda34199bd2402fcc94ba34233152fe996a128e0b332ac3efef24b3"
    },
    "semantic_analysis": []
  },
  "observations": [
    {
      "id": "observation:package-metadata",
      "kind": "artifact_metadata",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "ca8ec92983a06cf85d4741c39b069157ee73ef35d7aa69617f4238adc0fb2a2d",
          "artifact_path": "package/package.json",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "name": "@crewhaus/mcp-host",
        "version": "0.5.6",
        "description": "MCP client manager: stdio + SSE transports, exp-backoff reconnect, server registry, built on @modelcontextprotocol/sdk",
        "main": "dist/index.js",
        "scripts": {
          "test": "bun test src"
        }
      }
    },
    {
      "id": "observation:file-inventory",
      "kind": "file",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "c5252400b6b5bca4a82a19d4485c32cd3c16bb059a2a398800812fd46e8c7355",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "entry_count": 13,
        "regular_file_bytes": 64790,
        "entries": [
          {
            "path": "package/dist/backoff.d.ts",
            "type": "file",
            "size": 400,
            "sha256": "a945dd0ed9c016cd85bc375572e5edc8c86cca0df38c862b6c73bcc392718cbc"
          },
          {
            "path": "package/dist/backoff.js",
            "type": "file",
            "size": 892,
            "sha256": "676e349c9f0cd1087f4f34a35b800e02741a8799fffba63c3679b5cb0aab3c98"
          },
          {
            "path": "package/dist/client.d.ts",
            "type": "file",
            "size": 10904,
            "sha256": "ece8b8b11bc275f2a67a84b61bf1818516315428de8eb15e282f9b41087bafea"
          },
          {
            "path": "package/dist/client.js",
            "type": "file",
            "size": 28331,
            "sha256": "df7e77fc34c61d20998992d57cefbfbaea67bfa3c36a951a3c49e68fcd0c7d25"
          },
          {
            "path": "package/dist/host.d.ts",
            "type": "file",
            "size": 1605,
            "sha256": "7e6738210ace26fe83314ed7e8a5e7fd214743e0b2dcb46f6212114e6e34fbb7"
          },
          {
            "path": "package/dist/host.js",
            "type": "file",
            "size": 2043,
            "sha256": "2f7f989a15695a2896e3ea0b201c217c2ebbd65ec1f4bee1470d201415e702a7"
          },
          {
            "path": "package/dist/index.d.ts",
            "type": "file",
            "size": 2225,
            "sha256": "75c14403b89211e9a1948c595f04ff12bb57bdb3d3b1f7a56fbe4c3aefd79050"
          },
          {
            "path": "package/dist/index.js",
            "type": "file",
            "size": 1657,
            "sha256": "2435cae031429c452c4857e9803c1206dcc853c396328b9314d359ece6636b17"
          },
          {
            "path": "package/dist/resolve.d.ts",
            "type": "file",
            "size": 5311,
            "sha256": "84cf67485722ed027a895f1adc634d3938bb9dd8070990ebc3ef78c7440449dd"
          },
          {
            "path": "package/dist/resolve.js",
            "type": "file",
            "size": 8196,
            "sha256": "e19bd4d5184689a9eebe100d4496239aa27ea51981be3ff48b458905c09c5183"
          },
          {
            "path": "package/dist/types.d.ts",
            "type": "file",
            "size": 1830,
            "sha256": "da372293a3d92fa25d742d75fed7d49b16d5841b8d0d5b53a3cc15ee3a90e8f7"
          },
          {
            "path": "package/dist/types.js",
            "type": "file",
            "size": 232,
            "sha256": "4943ba39f0f457c79d72ac4373db6f6e2a83c00349e00c4a60544b9630e1b422"
          },
          {
            "path": "package/package.json",
            "type": "file",
            "size": 1164,
            "sha256": "ca8ec92983a06cf85d4741c39b069157ee73ef35d7aa69617f4238adc0fb2a2d"
          }
        ]
      }
    },
    {
      "id": "observation:registry-metadata",
      "kind": "artifact_metadata",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "4c621df20e7b64b095606e21aa4ff819986045d10f8316c4006a4d5c3d064942",
          "capture_kind": "registry_metadata"
        }
      ],
      "data": {
        "metadata_url": "https://registry.npmjs.org/%40crewhaus%2Fmcp-host/0.5.6",
        "requested_package": "@crewhaus/mcp-host",
        "requested_version": "0.5.6",
        "tarball_url": "https://registry.npmjs.org/@crewhaus/mcp-host/-/mcp-host-0.5.6.tgz",
        "integrity_claim": "sha512-ZMn8zZOLn+tjtQf8pBKESh2ktw438bmJiI/O880hOu1ldnkeStX1kmiLp1TPCu75nalWbJaRFQ0OsFiN7+X6QA==",
        "integrity_verified": true
      }
    },
    {
      "id": "observation:runtime-dependencies",
      "kind": "dependency",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "ca8ec92983a06cf85d4741c39b069157ee73ef35d7aa69617f4238adc0fb2a2d",
          "artifact_path": "package/package.json",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "dependencies": {
          "@crewhaus/errors": "0.5.6",
          "@crewhaus/logging": "0.5.6",
          "@crewhaus/trace-event-bus": "0.5.6",
          "@modelcontextprotocol/sdk": "^1.29.0",
          "zod": "^3.23.8"
        }
      }
    },
    {
      "id": "observation:network-api-d90bec99cedda138",
      "kind": "code_indicator",
      "coverage": "inferred",
      "evidence": [
        {
          "sha256": "df7e77fc34c61d20998992d57cefbfbaea67bfa3c36a951a3c49e68fcd0c7d25",
          "artifact_path": "package/dist/client.js",
          "capture_kind": "artifact_file",
          "byte_range": [
            24832,
            24838
          ]
        }
      ],
      "data": {
        "indicator": "network-api",
        "description": "Source references a network API."
      }
    },
    {
      "id": "observation:static-tool-inventory",
      "kind": "protocol_inventory",
      "coverage": "inferred",
      "evidence": [
        {
          "sha256": "c5252400b6b5bca4a82a19d4485c32cd3c16bb059a2a398800812fd46e8c7355",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "extraction": "static_source_analysis",
        "complete": false,
        "incompleteness": [
          "no_recognized_registration_pattern"
        ],
        "scanned_files": [
          "package/dist/backoff.js",
          "package/dist/client.js",
          "package/dist/host.js",
          "package/dist/index.js",
          "package/dist/resolve.js",
          "package/dist/types.js"
        ],
        "tools": []
      }
    }
  ],
  "findings": [],
  "limitations": [
    {
      "code": "protocol_discovery_not_run",
      "summary": "M1 performs static artifact inspection only; no MCP protocol session was opened."
    },
    {
      "code": "tool_calls_not_performed",
      "summary": "No tools were invoked."
    },
    {
      "code": "semantic_analysis_not_run",
      "summary": "No semantic model analysis was run."
    },
    {
      "code": "static_tool_extraction_incomplete",
      "summary": "The declared tool surface could not be fully resolved from source (no_recognized_registration_pattern). Treat the inventory as a lower bound, not a complete list."
    }
  ]
}