@inkeep/agents-cli
Inkeep CLI tool
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:keytar | AI (phantom-deps): keytar is a declared runtime dependency used via the postinstall script; phantom-dep heuristic is a false positive here. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Runs ensure-keytar.mjs to set up native keytar module; benign and consistent with keytar's documented install flow. | ai | |
| phantom-deps | phantom-dep:ts-morph | AI (phantom-deps): Code transform lib used indirectly; stable false positive for this CLI package. | ai | |
| phantom-deps | phantom-dep:ast-types | AI (phantom-deps): Peer/transitive dep of recast; stable false positive. | ai | |
| phantom-deps | phantom-dep:@babel/types | AI (phantom-deps): Framework-scoped, loaded by convention per analyzer note; stable false positive. | ai | |
| phantom-deps | phantom-dep:@inkeep/agents-manage-ui | AI (phantom-deps): Same org scope; may be loaded dynamically or via CLI dispatch; stable false positive. | ai | |
| phantom-deps | phantom-dep:inquirer-autocomplete-prompt | AI (phantom-deps): Inquirer plugin loaded by convention/registration; stable false positive. | ai | |
| phantom-deps | phantom-dep:@babel/parser | AI (phantom-deps): Framework-scoped, loaded by convention per analyzer note; stable false positive. | ai | |
| phantom-deps | phantom-dep:recast | AI (phantom-deps): AST transform lib likely used indirectly by build tooling; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:ai | AI (phantom-deps): `ai` is explicitly listed in package.json dependencies; phantom-dep is a false positive here. | ai |
Versions (showing 63 of 164)
| Version | Deps | Published |
|---|---|---|
| 0.53.9 | 19 / 7 | |
| 0.53.8 | 19 / 7 | |
| 0.53.7 | 19 / 7 | |
| 0.53.6 | 19 / 7 | |
| 0.53.5 | 19 / 7 | |
| 0.53.4 | 19 / 7 | |
| 0.53.3 | 19 / 7 | |
| 0.53.2 | 19 / 7 | |
| 0.53.1 | 19 / 7 | |
| 0.53.0 | 19 / 7 | |
| 0.52.0 | 22 / 7 | |
| 0.51.0 | 22 / 6 | |
| 0.50.6 | 22 / 6 | |
| 0.50.5 | 22 / 6 | |
| 0.50.4 | 22 / 6 | |
| 0.50.3 | 22 / 6 | |
| 0.50.1 | 22 / 6 | |
| 0.50.0 | 22 / 6 | |
| 0.49.0 | 22 / 6 | |
| 0.48.7 | 22 / 6 | |
| 0.48.6 | 22 / 6 | |
| 0.48.5 | 22 / 6 | |
| 0.48.4 | 22 / 6 | |
| 0.48.3 | 22 / 6 | |
| 0.48.2 | 22 / 6 | |
| 0.48.1 | 22 / 6 | |
| 0.48.0 | 22 / 6 | |
| 0.47.5 | 22 / 6 | |
| 0.47.4 | 22 / 6 | |
| 0.47.3 | 22 / 6 | |
| 0.47.2 | 22 / 6 | |
| 0.47.1 | 22 / 6 | |
| 0.47.0 | 22 / 6 | |
| 0.46.1 | 22 / 6 | |
| 0.46.0 | 22 / 6 | |
| 0.45.3 | 22 / 6 | |
| 0.45.2 | 22 / 6 | |
| 0.45.1 | 22 / 6 | |
| 0.45.0 | 22 / 6 | |
| 0.44.0 | 22 / 6 | |
| 0.43.0 | 22 / 6 | |
| 0.41.2 | 22 / 7 | |
| 0.41.0 | 22 / 7 | |
| 0.40.0 | 22 / 7 | |
| 0.18.1 | 28 / 10 | |
| 0.18.0 | 28 / 10 | |
| 0.17.0 | 28 / 10 | |
| 0.16.3 | 28 / 10 | |
| 0.16.2 | 28 / 10 | |
| 0.16.1 | 28 / 10 | |
| 0.16.0 | 28 / 10 | |
| 0.14.16 | 27 / 10 | |
| 0.6.4 | 27 / 10 | |
| 0.5.0 | 26 / 9 | |
| 0.1.8 | 23 / 7 | |
| 0.1.7 | 23 / 7 | |
| 0.1.6 | 23 / 7 | |
| 0.1.5 | 20 / 6 | |
| 0.1.4 | 20 / 6 | |
| 0.1.3 | 20 / 6 | |
| 0.1.2 | 19 / 6 | |
| 0.1.1 | 19 / 6 | |
| 0.1.0 | 18 / 6 |
v0.53.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.53.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.52.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.51.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.50.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.50.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.50.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.50.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.50.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.50.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.49.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.48.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.47.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.47.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.47.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.47.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.47.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.47.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.46.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.46.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.45.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.45.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.45.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.45.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.44.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.43.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.41.2
2 findingsScript: node scripts/ensure-keytar.mjs || true
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.41.0
2 findingsScript: node scripts/ensure-keytar.mjs || true
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.40.0
2 findingsScript: node scripts/ensure-keytar.mjs || true
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.18.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.18.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.17.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.16.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.14.16
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.6.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.5.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.8
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.6
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.5
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.4
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.3
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.1
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v0.1.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.