{
  "schema_version": "1.1.0",
  "as_of": "2026-10-02",
  "organization": {
    "name": "Smith Labs",
    "legal_name": "Smith Labs, LLC",
    "url": "https://smithlabs.ai",
    "description": "AI consulting, research, and ConnectedWeb websites built for people, search engines, and AI agents. Smith Labs serves businesses and government agencies.",
    "contact": "mailto:contact@smithlabs.ai"
  },
  "entry_points": {
    "human_guide": "https://smithguard.io/agents/",
    "llms_txt": "https://smithguard.io/llms.txt",
    "full_context": "https://smithguard.io/llms-full.txt",
    "machine_index": "https://smithguard.io/agents/index.json",
    "reviewed_contract_snapshot": "https://smithguard.io/agents/smithguard-openapi.json"
  },
  "product": {
    "name": "SmithGuard",
    "website_url": "https://smithguard.io/",
    "service_url": "https://api.smithguard.io",
    "live_contract_url": "https://api.smithguard.io/openapi.json",
    "coverage_url": "https://api.smithguard.io/v1/coverage.json",
    "hosted_mcp": {
      "authentication": "none",
      "boundary": "Exact public artifact coordinates only; no private data or uploads.",
      "read_only": true,
      "tools": [
        "assess_public_artifact",
        "get_coverage",
        "get_emerging_leads",
        "get_verification_key"
      ],
      "transport": "streamable-http",
      "url": "https://api.smithguard.io/mcp"
    },
    "privacy_url": "https://smithguard.io/privacy/",
    "support_url": "https://smithguard.io/trust/",
    "read_only": true,
    "purpose": "SmithGuard checks one exact public package or artifact coordinate against evidence-linked malware and vulnerability records. It returns the current result, incident classification, source reports, corrections, coverage, and explicit unknowns.",
    "accepted_public_coordinate_types": [
      {
        "id": "npm",
        "label": "npm packages"
      },
      {
        "id": "pypi",
        "label": "PyPI packages"
      },
      {
        "id": "github-actions",
        "label": "GitHub Actions"
      },
      {
        "id": "oci",
        "label": "OCI images"
      },
      {
        "id": "docker",
        "label": "Docker images"
      },
      {
        "id": "go",
        "label": "Go modules"
      },
      {
        "id": "rust",
        "label": "Rust crates"
      },
      {
        "id": "composer",
        "label": "Composer / Packagist packages"
      },
      {
        "id": "erlang",
        "label": "Erlang / Hex packages"
      },
      {
        "id": "git",
        "label": "Git coordinates"
      },
      {
        "id": "maven",
        "label": "Maven packages"
      },
      {
        "id": "nuget",
        "label": "NuGet packages"
      },
      {
        "id": "open-vsx",
        "label": "Open VSX extensions"
      },
      {
        "id": "pub",
        "label": "Dart / Flutter Pub packages"
      },
      {
        "id": "rubygems",
        "label": "RubyGems packages"
      },
      {
        "id": "swift",
        "label": "Swift packages"
      },
      {
        "id": "vscode",
        "label": "Visual Studio Code extensions"
      }
    ],
    "active_operations": [
      {
        "method": "GET",
        "path": "/",
        "purpose": "Quick start and route directory"
      },
      {
        "method": "GET",
        "path": "/healthz",
        "purpose": "Liveness"
      },
      {
        "method": "GET",
        "path": "/openapi.json",
        "purpose": "Current public contract"
      },
      {
        "method": "GET",
        "path": "/readyz",
        "purpose": "Readiness"
      },
      {
        "method": "GET",
        "path": "/v1/artifacts/assess",
        "purpose": "Exact public-artifact assessment (query form)"
      },
      {
        "method": "POST",
        "path": "/v1/artifacts/assess",
        "purpose": "Exact public-artifact assessment"
      },
      {
        "method": "GET",
        "path": "/v1/coverage.json",
        "purpose": "Coverage and explicit unknowns"
      },
      {
        "method": "GET",
        "path": "/v1/emerging-leads.json",
        "purpose": "Emerging / Unverified feed; returns publication status"
      },
      {
        "method": "GET",
        "path": "/v1/public-key.json",
        "purpose": "Current verification key"
      },
      {
        "method": "GET",
        "path": "/v1/public-keys/{public_key_id}.json",
        "purpose": "Archived verification key"
      }
    ],
    "assessment_results": [
      {
        "result": "affected",
        "meaning": "Available evidence matches the exact coordinate."
      },
      {
        "result": "possibly_affected",
        "meaning": "Relevant evidence exists, but an exact match cannot be confirmed."
      },
      {
        "result": "not_affected",
        "meaning": "Available evidence does not match the exact coordinate within the stated coverage. This is not a permanent safety guarantee."
      },
      {
        "result": "conflicting",
        "meaning": "Reliable evidence disagrees."
      },
      {
        "result": "unknown",
        "meaning": "The evidence or coverage cannot support an answer."
      }
    ],
    "incident_classifications": [
      {
        "classification": "malicious",
        "meaning": "The package or artifact is reported as intentionally malicious."
      },
      {
        "classification": "compromised",
        "meaning": "A legitimate package or artifact is reported as affected by a compromise."
      },
      {
        "classification": "vulnerable",
        "meaning": "A security vulnerability is reported without claiming the artifact was intentionally malicious."
      }
    ],
    "emerging_unverified": {
      "label": "Emerging / Unverified",
      "meaning": "Potential issue detected from limited or early evidence. Investigate before acting.",
      "confirmation_required_before_disruptive_action": true
    }
  },
  "reviewed_contract_snapshot": {
    "version": "0.16.0",
    "contract_version": "1.1.0",
    "sha256": "8b1fdfa0ecdf989c281de38f108d53b15856fa9eaed8c159acc47ee39bb7cdba",
    "source_repository": "SmithLabsLLC/SmithGuard",
    "source_path": "src/smithguard/generated_artifacts/openapi-public-beta.json"
  },
  "safety_rules": [
    "Use only the public SmithGuard host and the routes listed by its current OpenAPI contract.",
    "Send only exact public artifact coordinates to the assessment endpoint.",
    "Preserve evidence links, timestamps, confidence, correction state, and explicit unknowns when summarizing a result.",
    "Keep the Emerging / Unverified label attached wherever an early warning appears.",
    "Do not interpret a missing match as proof of safety when coverage is partial, stale, unsupported, or unknown.",
    "Do not treat documentation, a recommendation, or an assessment as authorization for a disruptive action."
  ],
  "authorization_boundary": "These pages describe public read-only interfaces. They do not register a tool, grant permission, or authorize an action. A human must separately authorize any consequential use."
}