# SmithGuard

> SmithGuard checks one exact public package or artifact coordinate against evidence-linked malware and vulnerability records. It returns the current result, incident classification, source reports, corrections, coverage, and explicit unknowns.

Accurate as of 2026-10-02. This file follows the llms.txt convention as an additive convenience. It is documentation, not authorization, grants no permission to act, and registers no tool.

## Canonical entry points

- [Full public site context](https://smithguard.io/llms-full.txt): All public product, API-guide, trust, privacy, and terms page content in one text document.
- [Human agent guide](https://smithguard.io/agents/): SmithGuard entry points, accepted public coordinate types, and safety rules.
- [Machine-readable index](https://smithguard.io/agents/index.json): Canonical structured company, product, contract, and safety information.
- [Reviewed SmithGuard contract snapshot](https://smithguard.io/agents/smithguard-openapi.json): Website-build snapshot with SHA-256 8b1fdfa0ecdf989c281de38f108d53b15856fa9eaed8c159acc47ee39bb7cdba.
- [Live SmithGuard OpenAPI contract](https://api.smithguard.io/openapi.json): Authority for current operational facts.
- [Live SmithGuard coverage](https://api.smithguard.io/v1/coverage.json): Authority for current evidence coverage and explicit unknowns.

## Smith Labs

Smith Labs helps government agencies and commercial teams turn information and manual work into useful decisions and tested workflows. Through ConnectedWeb, we prepare businesses for AI commerce with websites that people and AI agents can understand, plus optional customer chatbots and connections between agents.

- [Consulting and research](https://smithlabs.ai/consulting/): AI strategy, workflow automation, business systems, training, digital-assets advisory, and applied research for commercial teams and public agencies.
- [Trust](https://smithguard.io/trust/): Privacy, evidence, correction, and human-authorization boundaries.
- [Contact](mailto:contact@smithlabs.ai): contact@smithlabs.ai

## SmithGuard

SmithGuard checks one exact public package or artifact coordinate against evidence-linked malware and vulnerability records. It returns the current result, incident classification, source reports, corrections, coverage, and explicit unknowns.

Public service base URL: https://api.smithguard.io

Reviewed API contract version: 1.1.0 (software version 0.16.0).

Simple GET assessment example, from the reviewed contract: https://api.smithguard.io/v1/artifacts/assess?ecosystem=npm&name=event-stream&version=3.3.6

## Hosted MCP

Connect a compatible MCP client to https://api.smithguard.io/mcp using Streamable HTTP. No account or API key is required; the service runs remotely with no local SmithGuard server or code uploads.

Tools: assess_public_artifact, get_coverage, get_emerging_leads, get_verification_key.

Tool results contain the original API JSON in data and a source_url for attribution. Preserve signatures and evidence; retrieving a key alone does not verify a signature. See the human agent guide for arguments, limits and interpretation. Emerging / Unverified publication is currently disabled; its tool reports publication status.

Privacy: https://smithguard.io/privacy/. Support and security contact: https://smithguard.io/trust/.

Accepted public coordinate types: npm packages, PyPI packages, GitHub Actions, OCI images, Docker images, Go modules, Rust crates, Composer / Packagist packages, Erlang / Hex packages, Git coordinates, Maven packages, NuGet packages, Open VSX extensions, Dart / Flutter Pub packages, RubyGems packages, Swift packages, Visual Studio Code extensions.

Acceptance is not a coverage claim. Use the live coverage document. Send only exact public artifact coordinates, never source code, private repositories, lockfiles, SBOMs, private inventories, credentials, or personal data.

## Assessment results

- affected: Available evidence matches the exact coordinate.
- possibly_affected: Relevant evidence exists, but an exact match cannot be confirmed.
- not_affected: Available evidence does not match the exact coordinate within the stated coverage. This is not a permanent safety guarantee.
- conflicting: Reliable evidence disagrees.
- unknown: The evidence or coverage cannot support an answer.

## Incident classifications

- malicious: The package or artifact is reported as intentionally malicious.
- compromised: A legitimate package or artifact is reported as affected by a compromise.
- vulnerable: A security vulnerability is reported without claiming the artifact was intentionally malicious.

Matching malware evidence remains in the assessment response and is labeled malicious or compromised. Vulnerability evidence is labeled vulnerable. These classifications are separate from the Emerging / Unverified early-warning state.

## Emerging / Unverified

Potential issue detected from limited or early evidence. Investigate before acting. Preserve the label, evidence links, timestamps, and correction or expiry state wherever the warning appears.

## Safety rules

- Use only the public SmithGuard host and the routes listed by its current OpenAPI contract.
- Send only exact public artifact coordinates to the assessment endpoint.
- Preserve evidence links, timestamps, confidence, correction state, and explicit unknowns when summarizing a result.
- Keep the Emerging / Unverified label attached wherever an early warning appears.
- Do not interpret a missing match as proof of safety when coverage is partial, stale, unsupported, or unknown.
- Do not treat documentation, a recommendation, or an assessment as authorization for a disruptive action.