--- title: "agency-orchestrator trust report" type: "trust-report" slug: "jnmetacode-agency-orchestrator" canonical_url: "https://www.graphcanon.com/tools/jnmetacode-agency-orchestrator/trust" computed_at: "2026-07-15T11:18:56.296Z" maintenance_label: "Very active" security_status: "findings" --- # agency-orchestrator trust report _Sourced [trust signals](/glossary/trust-and-signals/trust-signal) from public GitHub metadata and external security intelligence providers. Not a security guarantee._ ## Maintenance - Label: Very active (96% recency signal) - Days since last push: 0 - Last release: 2026-07-08T07:18:26Z - Releases (90d): 11 - Methodology: github_public_v1 ## Provenance - GitHub repo id: 1188191061 - Not a fork - Owner type: User - Computed at: 2026-07-15T11:18:56.296Z - Methodology: github_public_v1 ## Security intelligence - **OSV dependency advisories**: Published findings - Last query: 2026-07-15T11:18:58.458156+00:00 - Evidence: https://osv.dev/ - **deps.dev advisories**: Not queried - Evidence: https://deps.dev/ - **OpenSSF Scorecard**: Not queried - Evidence: https://api.securityscorecards.dev/projects/github.com/jnMetaCode/agency-orchestrator - Note: Weekly public scans omit some checks at scale. ### Findings - **low**: GHSA-92pp-h63x-v22m (@hono/node-server@1.19.11 · package-lock.json · osv@v1) - **low**: GHSA-q3j6-qgpj-74h6 (fast-uri@3.1.0 · package-lock.json · osv@v1) - **low**: GHSA-v39h-62p7-jpjc (fast-uri@3.1.0 · package-lock.json · osv@v1) - **low**: GHSA-26pp-8wgv-hjvm (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-2gcr-mfcq-wcc3 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-3hrh-pfw6-9m5x (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-458j-xx4x-4375 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-69xw-7hcm-h432 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-88fw-hqm2-52qc (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-9vqf-7f2p-gf9v (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-f577-qrjj-4474 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-hm8q-7f3q-5f36 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-j6c9-x7qj-28xf (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-p77w-8qqv-26rm (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-qp7p-654g-cw7p (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-r5rp-j6wh-rvv4 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-rv63-4mwf-qqc2 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-wgpf-jwqj-8h8p (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-wmmm-f939-6g9c (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-wwfh-h76j-fc44 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-xf4j-xp2r-rqqx (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-xpcf-pg52-r92g (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-xrhx-7g5j-rcj5 (hono@4.12.9 · package-lock.json · osv@v1) - **low**: GHSA-v2v4-37r5-5v8g (ip-address@10.1.0 · package-lock.json · osv@v1) - **low**: GHSA-h67p-54hq-rp68 (js-yaml@4.1.1 · package-lock.json · osv@v1) - **low**: GHSA-27v5-c462-wpq7 (path-to-regexp@8.3.0 · package-lock.json · osv@v1) - **low**: GHSA-j3q9-mxjg-w52f (path-to-regexp@8.3.0 · package-lock.json · osv@v1) - **low**: GHSA-q8mj-m7cp-5q26 (qs@6.15.0 · package-lock.json · osv@v1) ## Method and caveats These are heuristics from public GitHub data and external security intelligence providers, sourced and dated. "No published findings from this source" is not a guarantee of safety. See the full methodology: [/trust-methodology](/trust-methodology.md). ## Common questions ### Is agency-orchestrator maintained? GraphCanon rates agency-orchestrator "Very active" (96% maintenance signal from public GitHub metadata, computed today). Last push was 0 days ago. 11 GitHub releases in the last 90 days. This is a recency heuristic, not a guarantee the project will stay maintained. ### Is agency-orchestrator safe to use? Last scanned today (deps profile). Status: 28 low - 28 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify agency-orchestrator as safe - review maintenance, provenance, and scan findings on this page before adopting. ### Is agency-orchestrator a fork? No. agency-orchestrator is not flagged as a fork in GitHub metadata at the time of the last refresh. ### Does agency-orchestrator have known security vulnerabilities? Last scanned today (deps profile). Status: 28 low - 28 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. ### How often is the agency-orchestrator trust report updated? Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed today (methodology github_public_v1). ### What does GraphCanon never claim about agency-orchestrator? We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for agency-orchestrator. Signals are sourced heuristics with explicit limits - see [trust methodology](/trust-methodology). ### How does GraphCanon assess trust for agency-orchestrator? Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read [trust methodology](/trust-methodology) for full scope and limits. --- **Machine-readable endpoints** - JSON: [`/api/graphcanon/tools/jnmetacode-agency-orchestrator/trust`](/api/graphcanon/tools/jnmetacode-agency-orchestrator/trust) - LLM index: [/llms.txt](/llms.txt) - Full corpus: [/llms-full.txt](/llms-full.txt) _GraphCanon - The knowledge graph for AI development. https://www.graphcanon.com/_