{
  "repository": "awslabs/mcp",
  "ref": "5fa8de718b308c40770f1c8eb6542677f2df15c9",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "bandit",
      "method": "static_analysis",
      "commands": [
        "bandit -r --severity-level medium --confidence-level medium -f html -o bandit-report-$EXPR.html -c pyproject.toml ."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[6] (Security check - Bandit)"
        }
      ],
      "upstream": "https://github.com/PyCQA/bandit",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.steps[3] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "gitleaks",
      "method": "static_analysis",
      "commands": [
        "pre-commit hook gitleaks"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.gitleaks"
        },
        {
          "path": ".gitleaks.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/gitleaks/gitleaks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pyright",
      "method": "static_analysis",
      "commands": [
        "pyright --stats",
        "pyright"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pyright"
        },
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[14] (Run pyright)"
        },
        {
          "path": "src/ecs-mcp-server/pyrightconfig.json",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/pyright",
      "docs": "https://microsoft.github.io/pyright/#/command-line",
      "exit_codes": {
        "0": "no errors",
        "1": "errors reported",
        "2": "fatal error",
        "3": "config file could not be read or parsed",
        "4": "illegal command-line parameters"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [
        "pre-commit hook ruff-check",
        "ruff check ."
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-check"
        },
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[16] (Run ruff check)"
        },
        {
          "path": ".ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/awslabs/dynamodb_mcp_server/repo_generation_tool/languages/python/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/tests/repo_generation_tool/fixtures/expected_outputs/python/deals/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/tests/repo_generation_tool/fixtures/expected_outputs/python/ecommerce/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/tests/repo_generation_tool/fixtures/expected_outputs/python/elearning/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/tests/repo_generation_tool/fixtures/expected_outputs/python/food_delivery/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/tests/repo_generation_tool/fixtures/expected_outputs/python/gaming_leaderboard/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/tests/repo_generation_tool/fixtures/expected_outputs/python/package_delivery/ruff.toml",
          "locator": "config file"
        },
        {
          "path": "src/dynamodb-mcp-server/tests/repo_generation_tool/fixtures/expected_outputs/python/saas/ruff.toml",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "semgrep",
      "method": "static_analysis",
      "commands": [
        "semgrep scan --config auto --sarif-output semgrep.sarif.json --no-error --dryrun --verbose"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/semgrep.yml",
          "locator": "jobs.semgrep.steps[3]"
        }
      ],
      "upstream": "https://github.com/semgrep/semgrep",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "docusaurus/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "docusaurus/package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "analyze (include: 2)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/codeql.yml",
          "locator": "jobs.analyze.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest --cov --cov-branch --cov-report=term-missing",
        "pytest --cov --cov-branch --cov-report=term-missing --cov-report=xml:$EXPR-coverage.xml --junitxml=$EXPR-junit.xml -o junit-family=legacy"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pytest"
        },
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[11] (Run tests)"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pre-commit-hooks",
      "method": "formatting",
      "commands": [
        "pre-commit hook check-added-large-files",
        "pre-commit hook check-ast",
        "pre-commit hook check-case-conflict",
        "pre-commit hook check-executables-have-shebangs",
        "pre-commit hook check-json"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-added-large-files"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-ast"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-case-conflict"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-executables-have-shebangs"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-json"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-merge-conflict"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-toml"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-yaml"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.debug-statements"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.detect-private-key"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.end-of-file-fixer"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "ruff-format",
      "method": "formatting",
      "commands": [
        "pre-commit hook ruff-format",
        "ruff format ."
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-format"
        },
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[15] (Run ruff format)"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/formatter/#exit-codes",
      "exit_codes": {
        "0": "already formatted",
        "1": "files would be reformatted (--check)",
        "2": "error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "dependency-review",
      "method": "supply_chain",
      "commands": [
        "uses actions/dependency-review-action"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/dependency-review-action.yml",
          "locator": "jobs.dependency-review.steps[1] (Dependency Review)"
        }
      ],
      "upstream": "https://github.com/actions/dependency-review-action",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash -c 'for x in \"$@\""
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pytest"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "detect-secrets scan --baseline .secrets.baseline"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/scanners.yml",
          "locator": "jobs.secrets-scanner.steps[3] (detect-secrets)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "do (cd `dirname $x`"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pytest"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "do if test -f $f"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[4] (Install Graphviz)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pytest"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook check-builtin-literals"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-builtin-literals"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook check-illegal-windows-names"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-illegal-windows-names"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook check-shebang-scripts-are-executable"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-shebang-scripts-are-executable"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook check-symlinks"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-symlinks"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook check-vcs-permalinks"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-vcs-permalinks"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook check-xml"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-xml"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook destroyed-symlinks"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.destroyed-symlinks"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook detect-aws-credentials"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.detect-aws-credentials"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook detect-secrets"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.detect-secrets"
        }
      ],
      "upstream": "https://github.com/Yelp/detect-secrets",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook forbid-new-submodules"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.forbid-new-submodules"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook forbid-submodules"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.forbid-submodules"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook no-commit-to-branch"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.no-commit-to-branch"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook pretty-format-json"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pretty-format-json"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pwd"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/pre-commit.yml",
          "locator": "jobs.pre-commit.steps[5]"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pytest"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/verify_package_name.py src/$EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[10] (Verify package name consistency)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/verify_tool_names.py src/$EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/python.yml",
          "locator": "jobs.build.steps[10] (Verify package name consistency)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "syft scan $EXPR/image.tar -o json > $EXPR/syft-results.json"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/trivy.yml",
          "locator": "jobs.build.steps[6] (Generate Container Software Bill of Materials and Vulnerabilities)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}