{
  "format_version": "0.2.0",
  "report_id": "2ed4eeab-f8fc-4db0-a77a-74a906e6db37",
  "generated_at": "2026-08-13T00:17:31.651Z",
  "subject": {
    "server_name": "@crewhaus/mcp-host",
    "publisher_claim": "@crewhaus",
    "artifact": {
      "ecosystem": "npm",
      "package": "@crewhaus/mcp-host",
      "version": "0.5.3",
      "sha256": "db118a21d519d297a4e674c3d5e49c24cca965f218e2d397059ba0155d0df585",
      "download_url": "https://registry.npmjs.org/@crewhaus/mcp-host/-/mcp-host-0.5.3.tgz",
      "registry_metadata_url": "https://registry.npmjs.org/%40crewhaus%2Fmcp-host/0.5.3",
      "acquired_at": "2026-08-13T00:17:31.651Z",
      "registry_metadata_sha256": "1a63f1092248c1293d852fe461871e63da123fcb34b09aa3aebc068f74a05c55",
      "integrity_claim": "sha512-edKaob3pdLwGj0/3poXPJ5+i0YDK7nusH9eCjGb/uH3wS4f2cMLaphaQUuxzVTcKxdXkiF7jtJ7Q+ooA1UWfuA==",
      "integrity_verified": true
    }
  },
  "analysis": {
    "engine": {
      "name": "sentinel",
      "version": "0.2.0",
      "build_sha256": "76ecfa3e5785d89b34d6618b32c84c01f0e40666b3541871cc874aba61200160"
    },
    "protocol_profile": {
      "id": "mcp-2026-07-28",
      "specification_revision": "2026-07-28",
      "local_retrieval_date": "2026-08-01",
      "discovery_status": "not_run"
    },
    "authorization_profiles": [
      {
        "id": "none",
        "credential_present": false,
        "description": "No credentials were supplied."
      }
    ],
    "rule_pack": {
      "version": "0.1.0",
      "sha256": "302d85219dda34199bd2402fcc94ba34233152fe996a128e0b332ac3efef24b3"
    },
    "semantic_analysis": []
  },
  "observations": [
    {
      "id": "observation:package-metadata",
      "kind": "artifact_metadata",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "1c9bf882e56a483aed249c5dc26ab28ad65553f8085aa9c105299e7b9e889725",
          "artifact_path": "package/package.json",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "name": "@crewhaus/mcp-host",
        "version": "0.5.3",
        "description": "MCP client manager: stdio + SSE transports, exp-backoff reconnect, server registry, built on @modelcontextprotocol/sdk",
        "main": "dist/index.js",
        "scripts": {
          "test": "bun test src"
        }
      }
    },
    {
      "id": "observation:file-inventory",
      "kind": "file",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "db118a21d519d297a4e674c3d5e49c24cca965f218e2d397059ba0155d0df585",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "entry_count": 13,
        "regular_file_bytes": 53955,
        "entries": [
          {
            "path": "package/dist/backoff.d.ts",
            "type": "file",
            "size": 400,
            "sha256": "a945dd0ed9c016cd85bc375572e5edc8c86cca0df38c862b6c73bcc392718cbc"
          },
          {
            "path": "package/dist/backoff.js",
            "type": "file",
            "size": 892,
            "sha256": "676e349c9f0cd1087f4f34a35b800e02741a8799fffba63c3679b5cb0aab3c98"
          },
          {
            "path": "package/dist/client.d.ts",
            "type": "file",
            "size": 7269,
            "sha256": "d3dc1c73e387bfb649927c734c49a34319987bde42653a571bbb13b95c31169a"
          },
          {
            "path": "package/dist/client.js",
            "type": "file",
            "size": 21131,
            "sha256": "5b5b674d96ba9ede265558f2d708f61c1ef6a3acbcceabdf6ae0098e8365de28"
          },
          {
            "path": "package/dist/host.d.ts",
            "type": "file",
            "size": 1605,
            "sha256": "7e6738210ace26fe83314ed7e8a5e7fd214743e0b2dcb46f6212114e6e34fbb7"
          },
          {
            "path": "package/dist/host.js",
            "type": "file",
            "size": 2043,
            "sha256": "2f7f989a15695a2896e3ea0b201c217c2ebbd65ec1f4bee1470d201415e702a7"
          },
          {
            "path": "package/dist/index.d.ts",
            "type": "file",
            "size": 2225,
            "sha256": "75c14403b89211e9a1948c595f04ff12bb57bdb3d3b1f7a56fbe4c3aefd79050"
          },
          {
            "path": "package/dist/index.js",
            "type": "file",
            "size": 1657,
            "sha256": "2435cae031429c452c4857e9803c1206dcc853c396328b9314d359ece6636b17"
          },
          {
            "path": "package/dist/resolve.d.ts",
            "type": "file",
            "size": 5311,
            "sha256": "84cf67485722ed027a895f1adc634d3938bb9dd8070990ebc3ef78c7440449dd"
          },
          {
            "path": "package/dist/resolve.js",
            "type": "file",
            "size": 8196,
            "sha256": "e19bd4d5184689a9eebe100d4496239aa27ea51981be3ff48b458905c09c5183"
          },
          {
            "path": "package/dist/types.d.ts",
            "type": "file",
            "size": 1830,
            "sha256": "da372293a3d92fa25d742d75fed7d49b16d5841b8d0d5b53a3cc15ee3a90e8f7"
          },
          {
            "path": "package/dist/types.js",
            "type": "file",
            "size": 232,
            "sha256": "4943ba39f0f457c79d72ac4373db6f6e2a83c00349e00c4a60544b9630e1b422"
          },
          {
            "path": "package/package.json",
            "type": "file",
            "size": 1164,
            "sha256": "1c9bf882e56a483aed249c5dc26ab28ad65553f8085aa9c105299e7b9e889725"
          }
        ]
      }
    },
    {
      "id": "observation:registry-metadata",
      "kind": "artifact_metadata",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "1a63f1092248c1293d852fe461871e63da123fcb34b09aa3aebc068f74a05c55",
          "capture_kind": "registry_metadata"
        }
      ],
      "data": {
        "metadata_url": "https://registry.npmjs.org/%40crewhaus%2Fmcp-host/0.5.3",
        "requested_package": "@crewhaus/mcp-host",
        "requested_version": "0.5.3",
        "tarball_url": "https://registry.npmjs.org/@crewhaus/mcp-host/-/mcp-host-0.5.3.tgz",
        "integrity_claim": "sha512-edKaob3pdLwGj0/3poXPJ5+i0YDK7nusH9eCjGb/uH3wS4f2cMLaphaQUuxzVTcKxdXkiF7jtJ7Q+ooA1UWfuA==",
        "integrity_verified": true
      }
    },
    {
      "id": "observation:runtime-dependencies",
      "kind": "dependency",
      "coverage": "declared",
      "evidence": [
        {
          "sha256": "1c9bf882e56a483aed249c5dc26ab28ad65553f8085aa9c105299e7b9e889725",
          "artifact_path": "package/package.json",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "dependencies": {
          "@crewhaus/errors": "0.5.3",
          "@crewhaus/logging": "0.5.3",
          "@crewhaus/trace-event-bus": "0.5.3",
          "@modelcontextprotocol/sdk": "^1.29.0",
          "zod": "^3.23.8"
        }
      }
    },
    {
      "id": "observation:network-api-87c1d22a3ee8f47d",
      "kind": "code_indicator",
      "coverage": "inferred",
      "evidence": [
        {
          "sha256": "5b5b674d96ba9ede265558f2d708f61c1ef6a3acbcceabdf6ae0098e8365de28",
          "artifact_path": "package/dist/client.js",
          "capture_kind": "artifact_file",
          "byte_range": [
            17658,
            17664
          ]
        }
      ],
      "data": {
        "indicator": "network-api",
        "description": "Source references a network API."
      }
    },
    {
      "id": "observation:static-tool-inventory",
      "kind": "protocol_inventory",
      "coverage": "inferred",
      "evidence": [
        {
          "sha256": "db118a21d519d297a4e674c3d5e49c24cca965f218e2d397059ba0155d0df585",
          "capture_kind": "artifact_file"
        }
      ],
      "data": {
        "extraction": "static_source_analysis",
        "complete": false,
        "incompleteness": [
          "no_recognized_registration_pattern"
        ],
        "scanned_files": [
          "package/dist/backoff.js",
          "package/dist/client.js",
          "package/dist/host.js",
          "package/dist/index.js",
          "package/dist/resolve.js",
          "package/dist/types.js"
        ],
        "tools": []
      }
    }
  ],
  "findings": [],
  "limitations": [
    {
      "code": "protocol_discovery_not_run",
      "summary": "M1 performs static artifact inspection only; no MCP protocol session was opened."
    },
    {
      "code": "tool_calls_not_performed",
      "summary": "No tools were invoked."
    },
    {
      "code": "semantic_analysis_not_run",
      "summary": "No semantic model analysis was run."
    },
    {
      "code": "static_tool_extraction_incomplete",
      "summary": "The declared tool surface could not be fully resolved from source (no_recognized_registration_pattern). Treat the inventory as a lower bound, not a complete list."
    }
  ]
}