{
  "slug": "io-github-arc-mcp-arc-1",
  "name": "ARC-1",
  "auditedAt": "2026-10-24T00:12:12Z",
  "version": "1.9.0",
  "ecosystem": "npm",
  "package": "arc-1",
  "disclaimer": "Automated smoke test, not a security guarantee.",
  "complete": true,
  "checks": {
    "versionPin": {
      "status": "pass",
      "detail": "Pinned npm arc-1@1.9.0",
      "version": "1.9.0"
    },
    "vulnerabilities": {
      "status": "warn",
      "detail": "Medium advisories were returned. No critical or high advisories were returned.",
      "critical": 0,
      "high": 0,
      "medium": 1,
      "low": 0,
      "packagesScanned": 80
    },
    "license": {
      "status": "pass",
      "detail": "MIT",
      "spdx": "MIT"
    },
    "installScripts": {
      "status": "warn",
      "detail": "Install-time scripts: prepare",
      "scripts": [
        "prepare"
      ]
    },
    "secrets": {
      "status": "pass",
      "detail": "No credential patterns in the published artifact.",
      "findings": []
    },
    "packageSize": {
      "status": "pass",
      "detail": "1516855 bytes",
      "bytes": 1516855
    },
    "activity": {
      "status": "pass",
      "detail": "Active 0 days ago.",
      "ageDays": 0
    },
    "sandbox": {
      "status": "pass",
      "detail": "MCP handshake completed. 9 tools listed.",
      "starts": true,
      "handshake": true,
      "timeToReadyMs": 2418,
      "tools": [
        {
          "name": "SAPRead",
          "description": "Read SAP ABAP source, metadata and syntax results. For source purpose, explanations, specs, reviews or pre-change context, prefer SAPContext first. DDIC metadata: omit format (default text); structured is CLAS-only for ordinary reads. TABLE"
        },
        {
          "name": "SAPSearch",
          "description": "Search for ABAP objects, exact object-directory entries, or source code. Modes:\n1. Object search (default): name pattern with wildcards (*); returns type, name, package, description, ADT URI.\n2. TADIR lookup (searchType=\"tadir_lookup\"): exa"
        },
        {
          "name": "SAPNavigate",
          "description": "Navigate code: definitions, references, completion, hierarchy. references: where-used objects by default; detail=positions/snippets adds bounded native usages; objectType filters results (e.g. CLAS/OC, PROG/P); type+name replaces uri. hiera"
        },
        {
          "name": "SAPLint",
          "description": "Run local abaplint rules on ABAP/CDS source (auto-selects cloud or on-prem rules by system type). Actions:\n- \"lint\": check source (errors+warnings) for ABAP (PROG/CLAS/INTF/FUNC) and CDS (DDLS).\n- \"lint_and_fix\": lint + auto-fix fixable iss"
        },
        {
          "name": "SAPDiagnose",
          "description": "ABAP diagnostics:\n- \"syntax\": check objects[] (CLAS/INTF/PROG/DDLS; version active/inactive). Single: prefer SAPRead SYNTAX.\n- \"unittest\": harmless ABAP Unit for CLAS/PROG/FUGR or DEVC (exact; includeSubpackages recurses).\n- \"unittest_ci\": "
        },
        {
          "name": "SAPContext",
          "description": "Primary tool for understanding ABAP/CDS objects before specs, reviews, explanations, or changes \u2014 use instead of SAPRead when the user asks what an object does. Returns intent first (the object KTD when available) then compressed dependency"
        },
        {
          "name": "SAPManage",
          "description": "Probe and report SAP system capabilities. Use BEFORE operations that depend on optional features (abapGit, RAP/CDS, AMDP, HANA, UI5/Fiori, CTS transports, FLP). Also handles package (DEVC) lifecycle.\n\nActions:\n- \"features\": cached feature s"
        },
        {
          "name": "SAPTransport",
          "description": "Manage CTS transport requests (SE09/SE10). Actions: list (current user, modifiable), get (tasks + objects), create (always a Workbench (K) request \u2014 the package/target sets target & layer, not the request category; optional explicit target)"
        },
        {
          "name": "SAPGit",
          "description": "Git reads and gated abapGit workflows. gCTS mutations are quarantined. abapGit mutations need write/Git gates and allowedPackages ROOT/** or *; clone/pull evidence is unverified. external_info is gated HTTPS SAP egress."
        }
      ],
      "toolCount": 9,
      "resourceCount": null,
      "promptCount": null,
      "stderrExcerpt": ": Object cache enabled {\"mode\":\"auto\",\"sources\":0,\"legacyDepGraphs\":0}\n[2026-10-24T00:12:37.145Z] INFO: Skipped startup auth preflight: SAP_URL is not configured.\n[2026-10-24T00:12:37.148Z] INFO: ARC-1 MCP server running on stdio\n[2026-10-24T00:12:37.150Z] WARN: ADT discovery unavailable (Invalid URL) \u2014 continuing without proactive MIME negotiation\n[2026-10-24T00:12:37.150Z] WARN: Authorization probe: object search access is not confirmed \u2014 Network error \u2014 cannot reach the search endpoint.\n[2026-10-24T00:12:37.150Z] INFO: Authorization probe: transport access is not available \u2014 Network error \u2014 cannot reach the transport endpoint.\n[2026-10-24T00:12:37.159Z] INFO: schema nullable optionals auto mode clientInfo {\"clientName\":\"addonaudit\",\"clientVersion\":\"0\",\"resolvedNullableOptionals\":false}\n",
      "requiresCredentials": false,
      "network": "disabled",
      "networkAttemptedWhileOffline": false,
      "outboundHosts": []
    }
  },
  "tier": "tested",
  "tierReason": "Sandbox handshake completed, with warnings: medium known vulnerabilities; install scripts present.",
  "logExcerpt": ": Object cache enabled {\"mode\":\"auto\",\"sources\":0,\"legacyDepGraphs\":0}\n[2026-10-24T00:12:37.145Z] INFO: Skipped startup auth preflight: SAP_URL is not configured.\n[2026-10-24T00:12:37.148Z] INFO: ARC-1 MCP server running on stdio\n[2026-10-24T00:12:37.150Z] WARN: ADT discovery unavailable (Invalid URL) \u2014 continuing without proactive MIME negotiation\n[2026-10-24T00:12:37.150Z] WARN: Authorization probe: object search access is not confirmed \u2014 Network error \u2014 cannot reach the search endpoint.\n[2026-10-24T00:12:37.150Z] INFO: Authorization probe: transport access is not available \u2014 Network error \u2014 cannot reach the transport endpoint.\n[2026-10-24T00:12:37.159Z] INFO: schema nullable optionals auto mode clientInfo {\"clientName\":\"addonaudit\",\"clientVersion\":\"0\",\"resolvedNullableOptionals\":false}\n"
}