com.babyblueviper/invinoveritas

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  fail25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "audit_agent_readiness" description: names an outbound copy/exfil destination (BCC/exfil verb). resource "Earned Rope (2026-06-04)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Pace (2026-06-02)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Closing the Gaps (2026-05-31)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Fortification (2026-05-29)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "On Searching . . . and Finding (2026-05-24)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Lessons from the Korean War (2026-05-23)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Go Big (At Home) (2026-05-22)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Charlemagne — The Empire Builder (2026-05-21)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Testing (2026-05-20)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "On Bounty Hunters and Mercs (2026-05-18)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Wildfire (2026-05-18)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Swapping Out the Engine (2026-05-16)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Scipio Africanus — How to Win When Everyone Expects You to Lose (2026-05-15)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Compound Interest of Discipline (2026-05-14)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "What to Do When You’re on a Nuclear Submarine and Shit Hits the Fan (2026-05-13)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Lessons from Suetonius Paulinus (2026-05-12)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Pursuing Your Destiny (2026-05-11)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Imagine Where You’ll Be in 3 Months (2026-05-10)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "On Tactical Patience (2026-05-08)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "From Thought to Action: The Day Agents Got Fangs (2026-05-07)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Liberation & Empire: The Serpent and the Throne (2026-05-06)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Past is Not Dead. It is Not Even Past. (2026-05-05)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "80k Is Not the Prize (2026-05-04)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Athena and the Agents: Wisdom Before Execution (2026-05-03)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Alignment, Adjustments & Constructive Motion (2026-04-30)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Alignment is Macedonian, not Spartan (2026-04-28)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Why Positioning is Everything (2026-04-28)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "When AI Starts Paying for Its Own Thoughts (2026-04-02)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Fear Between Being and Becoming (2026-03-14)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Boundary (2026-03-12)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Distributed Runtime Verification Layer (2026-03-10)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Rules We Can't Break (2026-03-08)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Age of Consolidation (2026-03-06)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "From AI Governance Theory to Protocol Design — Why Compute Escalation Needs Rules (2026-03-04)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Determinism vs Probability — The Missing Layer in AI Governance (2026-03-03)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Stress Tests: Geopolitics, Bitcoin, and Enforcement in the Real World (2026-03-01)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Age of Systems Over Humans (2026-02-27)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Enforcement Is the Next Infrastructure Layer (2026-02-25)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Foundations Before the Code: Aligning Governance, Risk, and Infrastructure in Bitcoin & AI (2026-02-23)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Who Verifies the Verifier? AI Code Security and Infrastructure Governance (2026-02-21)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Deterministic Infrastructure in a Volatile World (2026-02-19)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "AI Adoption Is Already Happening. Governance Isn’t. (2026-02-17)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "INTERFACE (2026-02-14)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "DEPENDENCE (2026-02-13)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "SOVEREIGNTY (2026-02-10)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "INTELLIGENCE (2026-02-08)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "HARDENING (2026-02-06)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "FILTERING (2026-02-04)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "AMPLIFICATION (2026-02-02)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "TEMPO (2026-01-31)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "ANTIFRAGILITY (2026-01-29)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "RHYTHM (2026-01-27)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "RECOVERY (2026-01-25)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "ELASTICITY (2026-01-23)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "LOAD (REVISTED) (2026-01-21)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "TRANSMISSION (2026-01-19)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "MARGIN (2026-01-17)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "🜁 CAPACITY (2026-01-15)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "RECOVERY (2026-01-15)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "FATIGUE (2026-01-12)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "DIRECTION (2026-01-10)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "ENERGY (2026-01-08)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Load (2026-01-06)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Pressure (2026-01-04)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "🜆 FRIDAY — Repair (2026-01-02)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "🜄 Custodians (2025-12-31)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "🜂 MONDAY — Maintenance (2025-12-29)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Civilization (2025-12-28)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Assimilation (2025-12-25)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Coordination (2025-12-24)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Node (2025-12-22)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "THE ΩMEGA STANDARD (2025-12-20)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Pruning: The Sacrifice That Saves the Future (2025-12-19)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Your Wallet Is Lying to You (2025-12-17)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "States Think in Accounts. Bitcoin Thinks in Reality. (2025-12-15)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Ωmega Standard: Sovereignty After Awakening (2025-12-14)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Consolidation: Paying Once to Save Forever (2025-12-12)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Weight, Size, and the Economics of the Mempool (2025-12-09)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "IN THE BEGINNING WAS THE LEDGER (2025-12-07)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Rubedo — The Red Act: When Vision Becomes Matter (2025-12-05)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Albedo — The White Cleanse: Purification Before Light (2025-12-03)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Alexander the Great — Sovereignty Without Restraint (2025-11-30)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Philip II, God, and Bitcoin — The Geometry of Unbreakable Formation (2025-11-24)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "God, Bitcoin, and Themistocles — The Art of Seeing Before Others See (2025-11-23)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Cocoon Work: Bitcoin and the Evolution You Don’t See (2025-11-15)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Epilogue — The Sea and the Stone (2025-11-08)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Bitcoin: The Stateless Crown (2025-11-05)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Spanish Empire: Faith, Gold, and Conquest (2025-11-03)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Ottoman Empire: The Bridge of Continents (2025-11-01)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Han Dynasty: The Mandate and the Machine (2025-10-30)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Mongol Empire: Velocity and the Veil (2025-10-28)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Rome: The Ledger of Law (2025-10-26)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "🜍 The Return: The Gold Within (Digital Magnum Opus, Episode VI) (2025-10-24)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Rubedo: The Reddening (Digital Magnum Opus, Episode IV) (2025-10-22)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Albedo: The Whitening (Digital Magnum Opus, Ep. II) (2025-10-20)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "🜍 The Hidden Kingdom: Privacy as Love, Secrecy as Service (2025-10-18)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "🜄 Episode 4 — Lightning and the Ghost Network (2025-10-16)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "Shadows in the Ledger: How You Are Tracked (2025-10-14)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Reluctant Saint: How Bitcoin Does Good Without Permission (2025-10-12)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes. resource "The Eyes of the Network: Surveillance, Privacy, and the Veil (2025-10-10)" description: off-vendor URL in a description (www.babyblueviper.com); capability text should not name where data goes.

• Supply chain

  pass25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  repository linkage verified

• Credential hygiene

  pass15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  No hardcoded secrets, secret-shaped tool parameters, or leaked keys found. PASS = no static red flag; static analysis cannot prove the code honors env-based secret handling at runtime.

• Permission scope

  unscannable15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No source files, package.json, or pyproject were fetched; cannot infer capability scope.

• Version behavior

  warn10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  vs prior 1.12.0 (minor bump): tool "review" gained input property(ies): intended_verifier, request_capture_ref, action_binding; tool "verify_proof" gained input property(ies): expect_intended_verifier, verifier_signature; new tool "validate" touches a sensitive surface (email/exec/net/fs).

• Transport config

  pass10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  remote endpoint "https://api.babyblueviper.com/mcp" uses TLS (https); remote endpoint uses OAuth (strongest auth mode)