# SmithGuard - full public site context Accurate as of 2026-10-02. Generated from this site's public page content. This is documentation, not authorization to act. No private or operational records are included. The live API contract and coverage documents remain authoritative for changing operational facts. API contract: https://api.smithguard.io/openapi.json Coverage: https://api.smithguard.io/v1/coverage.json Machine index: https://smithguard.io/agents/index.json ## SmithGuard | Public Package Vulnerability & Malware Checks Source: https://smithguard.io/ Canonical: https://smithguard.io/ product smithguard | access public-read-only | evidence linked ### SmithGuard Every claim carries its evidence. SmithGuard checks one exact public package or artifact coordinate against evidence-linked malware and vulnerability records. It returns the current result, incident classification, source reports, corrections, coverage, and explicit unknowns. Agent and API guide (https://smithguard.io/agents/) Read the live contract (https://api.smithguard.io/openapi.json) #### What SmithGuard makes available A narrow public service built to answer one question carefully: what does the current evidence say about this exact public artifact? ##### Exact public-artifact assessment Submit one exact public package or artifact coordinate. SmithGuard returns only evidence connected to that artifact. ##### Evidence and correction state Results keep incident classification, source reports, timing, confidence, revisions, and correction state together so a finding can be checked rather than merely repeated. ##### Honest unknowns Coverage extends beyond npm and PyPI and is reported separately by ecosystem and source lane. The live coverage document shows which accepted coordinate types have supported evidence and which remain unknown. ##### Read-only verification The public service is accountless and read-only. Public verification keys preserve the ability to check signed records over time. example illustrative | shape public-contract | action investigate The answer keeps its limits attached #### See the evidence shape, not just a verdict A SmithGuard assessment keeps the result beside its incident classification, coverage, explicit unknowns, and any separate time-bounded early warning. This excerpt is illustrative, not a live assessment. When matching malware evidence is available, SmithGuard keeps it in the response and labels the incident as malicious or compromised. Vulnerability evidence is labeled vulnerable. - Result affected means a match; possibly_affected means the exact match is not confirmed; not_affected applies only within the stated coverage; conflicting means reliable evidence disagrees; and unknown means the evidence cannot support an answer. - Incident classification malicious , compromised , or vulnerable explains what kind of incident the evidence describes. - Coverage and unknowns The evidence boundary behind the answer and what it cannot support. - Early warning A separate Emerging / Unverified lead with an expiry, not an incident classification. Illustrative response excerpt - not live output ``` { "result": "affected", "incidents": [ { "status": "confirmed", "confidence": "confirmed", "classification": "compromised" } ], "coverage": { "ecosystem": "npm", "stage": "matched", "result": "supported", "as_of": "2026-09-01T00:00:00Z" }, "unknowns": [], "preliminary_warnings": [] } ``` record_state emerging-unverified | use investigate-before-acting #### Early warnings stay visibly early ##### Emerging / Unverified Potential issue detected from limited or early evidence. Investigate before acting. An early lead can come from social discovery or another permitted public source. Official incident repositories continue through the normal evidence path. The label describes the evidence level, not the scanner that found it. #### Use the public boundary as designed - 01 Use one exact public package or artifact coordinate at a time. - 02 Do not submit source code, private repositories, lockfiles, SBOMs, or private inventories to the public service. - 03 Treat Emerging / Unverified warnings as investigation leads, not confirmed incidents. - 04 A recommendation or record is information, not authorization to change a system. - 05 Use the live coverage document and OpenAPI contract for exact operational facts. Live coverage (https://api.smithguard.io/v1/coverage.json) Verification key (https://api.smithguard.io/v1/public-key.json) Agent guide (https://smithguard.io/agents/) --- ## Trust | SmithGuard Source: https://smithguard.io/trust/ Canonical: https://smithguard.io/trust/ section trust | language plain | unknowns explicit ### Trust begins with a clear boundary Clear boundaries matter more than broad promises. Smith Labs states what a service accepts, what it records, what it cannot conclude, and where a human decision is still required. #### Operating principles - 01 ##### Minimum necessary information This website has no analytics, advertising, application trackers, or cookies. Hosting and security systems still process ordinary request metadata. - 02 ##### Evidence before certainty SmithGuard preserves source, timing, confidence, corrections, and explicit unknowns. Early evidence is visibly labeled Emerging / Unverified. - 03 ##### Read-only public boundary The public SmithGuard service answers questions about public artifacts. It does not accept private code or authorize changes to another system. - 04 ##### Human decisions remain human Documentation, records, and recommendations provide information. They do not grant an agent or person permission to take a high-risk action. - 05 ##### Corrections remain visible A changed conclusion creates a new revision. Earlier evidence is retained so users can understand what changed and why. #### Report a security concern Email contact@smithlabs.ai (mailto:contact@smithlabs.ai) . Include enough detail to reproduce or assess the concern, but do not send credentials, private keys, personal data, or destructive proof. Read the machine-readable security contact (https://smithguard.io/.well-known/security.txt) . --- ## SmithGuard MCP & API Documentation | Public Artifact Checks Source: https://smithguard.io/agents/ Canonical: https://smithguard.io/agents/ route /agents/ | audience agents-and-operators | as_of 2026-10-02 ### For agents and the people configuring them Hosted MCP tools and read-only API entry points for exact public artifact checks. #### Documentation is not authorization These pages describe public read-only interfaces. They do not register a tool, grant permission, or authorize an action. A human must separately authorize any consequential use. #### Canonical entry points - /agents/ (https://smithguard.io/agents/) - human-readable guide - /llms.txt (https://smithguard.io/llms.txt) - plain-text convenience guide - /llms-full.txt (https://smithguard.io/llms-full.txt) - full public site context - /agents/index.json (https://smithguard.io/agents/index.json) - machine-readable index - /agents/smithguard-openapi.json (https://smithguard.io/agents/smithguard-openapi.json) - reviewed contract snapshot - https://api.smithguard.io/openapi.json (https://api.smithguard.io/openapi.json) - live operational contract #### Hosted MCP connection Connect a compatible MCP client to https://api.smithguard.io/mcp using Streamable HTTP. The service requires no account or API key. It runs remotely; no local SmithGuard server, executable, repository access, or code upload is needed. Configure the connection using your client's documented remote MCP settings. SmithGuard MCP tools Tool | Arguments and purpose | assess_public_artifact | One ecosystem and public package name, with exactly one exact version or digest; optional registry_host. Uses the API's short request schema. | get_coverage | No arguments. Read supported source lanes, freshness, and explicit unknowns. | get_emerging_leads | Optional limit (1-100) and after (64 lowercase hexadecimal characters). Read Emerging / Unverified leads and publication status; publication is currently disabled. | get_verification_key | Optional public_key_id in the form gbsec:snapshot-public-key: followed by 40 lowercase hexadecimal characters. Omit it for the current key. | For example, call assess_public_artifact with the following exact public coordinates: ``` { "ecosystem": "npm", "name": "event-stream", "version": "3.3.6" } ``` Each tool returns the API's original JSON inside data , together with source_url for attribution. Signed records and signatures pass through unchanged. Retrieving a key does not itself verify a signature. Read coverage before drawing conclusions. Cite source evidence, preserve unknowns and correction state, and report a fixed version only when the evidence supports it. A missing match does not prove an artifact is safe. Keep Emerging / Unverified leads separate from confirmed findings and retain their timestamps and expiry. Results never authorize an automatic update, deletion, or other consequential action. Submit only coordinates already known to identify a public artifact. Ask for missing exact coordinates instead of reading source files, lockfiles, private repositories, SBOMs, or private inventories. Do not send arbitrary bulk lists, secrets, or personal information. See the SmithGuard privacy policy (https://smithguard.io/privacy/) and support and security contact (https://smithguard.io/trust/) . service smithguard | base_url https://api.smithguard.io | contract 1.1.0 #### SmithGuard public read-only service SmithGuard checks one exact public package or artifact coordinate against evidence-linked malware and vulnerability records. It returns the current result, incident classification, source reports, corrections, coverage, and explicit unknowns. SmithGuard public operations Method | Path | Purpose | GET | / (https://api.smithguard.io/) | Quick start and route directory | GET | /healthz (https://api.smithguard.io/healthz) | Liveness | GET | /openapi.json (https://api.smithguard.io/openapi.json) | Current public contract | GET | /readyz (https://api.smithguard.io/readyz) | Readiness | GET | /v1/artifacts/assess | Exact public-artifact assessment (query form) | POST | /v1/artifacts/assess | Exact public-artifact assessment | GET | /v1/coverage.json (https://api.smithguard.io/v1/coverage.json) | Coverage and explicit unknowns | GET | /v1/emerging-leads.json (https://api.smithguard.io/v1/emerging-leads.json) | Emerging / Unverified feed; returns publication status | GET | /v1/public-key.json (https://api.smithguard.io/v1/public-key.json) | Current verification key | GET | /v1/public-keys/{public_key_id}.json | Archived verification key | For a simple GET request, supply an ecosystem, public package name, and exact version. Try the public event-stream 3.3.6 example (https://api.smithguard.io/v1/artifacts/assess?ecosystem=npm&name=event-stream&version=3.3.6) . The live contract describes digest-based requests and other accepted forms. ##### Accepted public coordinate types - npm packages - PyPI packages - GitHub Actions - OCI images - Docker images - Go modules - Rust crates - Composer / Packagist packages - Erlang / Hex packages - Git coordinates - Maven packages - NuGet packages - Open VSX extensions - Dart / Flutter Pub packages - RubyGems packages - Swift packages - Visual Studio Code extensions Acceptance is not a coverage claim. Use the live coverage document for the current evidence boundary. ##### Emerging / Unverified Potential issue detected from limited or early evidence. Investigate before acting. Preserve this label, evidence links, timestamps, and expiry wherever the warning is shown. #### Safety rules - Use only the public SmithGuard host and the routes listed by its current OpenAPI contract. - Send only exact public artifact coordinates to the assessment endpoint. - Preserve evidence links, timestamps, confidence, correction state, and explicit unknowns when summarizing a result. - Keep the Emerging / Unverified label attached wherever an early warning appears. - Do not interpret a missing match as proof of safety when coverage is partial, stale, unsupported, or unknown. - Do not treat documentation, a recommendation, or an assessment as authorization for a disruptive action. --- ## Privacy | SmithGuard Source: https://smithguard.io/privacy/ Canonical: https://smithguard.io/privacy/ ### Privacy policy Last updated: 2026-10-02 How Smith Labs, LLC handles requests to the SmithGuard website, public API, and hosted MCP service. #### Website and hosting The SmithGuard website uses no analytics, advertising, application trackers, or cookies. Cloudflare, AWS, and related hosting and security systems may process ordinary request metadata, such as IP addresses, user agents, requested URLs, timestamps, and security signals, where applicable, to deliver and protect the service. Those providers apply their own request and security handling. Nginx and Uvicorn request access logging is disabled for the public API; this does not mean hosting and security systems process no request metadata. #### Public API and MCP requests SmithGuard accepts one exact public software artifact coordinate at a time: an ecosystem, public package or artifact name, and exact version or digest, with an optional registry host. The hosted MCP tools use the same public service boundary. Do not submit source code, private repositories, lockfiles, SBOMs, private inventories, credentials, or personal information. SmithGuard does not forward submitted coordinates or tool requests to AI providers. If you use an AI assistant or other MCP client, that client's handling of your conversation and requests is governed by its own policies. #### Anonymous quota accounting To enforce anonymous usage limits and prevent abuse, SmithGuard stores daily keyed digests derived from network identity and normalized assessment requests, together with accounting status and timestamps. The quota database does not store the raw IP address or artifact coordinates. These records expire at the next UTC midnight plus two minutes. While the API is running, a background task attempts bounded cleanup every second; deletion can be delayed if the service is stopped, cleanup fails, or a backlog remains. The expiry time is not a guaranteed deletion deadline. #### Caching and sessions The API caches public assessment responses in memory to serve repeated checks. Hosted MCP is stateless and does not retain chats or client sessions. This describes SmithGuard's service; it does not set a retention policy for your MCP client or hosting and security providers. #### Voluntary contact and your choices If you email contact@smithlabs.ai (mailto:contact@smithlabs.ai) , Smith Labs receives your email address and the information you include. We use it to respond, provide services, protect our systems, and meet legal obligations. Contact records may remain while needed for those purposes. Email that address to ask about information you provided or request deletion; we will consider the request and any information we need to retain. Do not include secrets or sensitive personal information. --- ## Terms | SmithGuard Source: https://smithguard.io/terms/ Canonical: https://smithlabs.ai/terms/ ### Terms of service Last updated: 2026-08-15 These terms govern use of the Smith Labs website and public information provided through it. #### Information and advisory services Website material and Smith Labs consulting are informational or advisory in nature. Nothing on this site is legal, tax, accounting, or investment advice. A separate written agreement controls any paid engagement. #### SmithGuard use Use SmithGuard only for lawful, read-only checks of exact public software artifacts and follow its current public contract. Do not submit private or confidential material, interfere with the service, bypass controls, or treat a result as authorization to change another system. #### Emerging / Unverified records An Emerging / Unverified warning is an investigation lead based on limited or early evidence. It is not a confirmed incident, proof of compromise, or permission for a disruptive action. #### No warranties The website and public service are provided as-is and as-available to the fullest extent permitted by law. Evidence and coverage may be incomplete, stale, conflicting, unsupported, or unknown. #### Limitation of liability To the fullest extent permitted by law, Smith Labs is not liable for indirect, incidental, special, consequential, or punitive damages arising from use of this website or its public information. #### Contact Questions may be sent to contact@smithlabs.ai (mailto:contact@smithlabs.ai) .