Name: Ghidra BizHawk
Author: getanirao

Ghidra BizHawk MCP

Unified Ghidra + BizHawk MCP server for static analysis, P-code emulation, and retro ROM triage.

Grade A Local · stdio No auth needed 46 tools v1.1.0

No reviews yet by getaniraoPyPI 416 Runs on your machine, nothing hosted

93/100

trust score

downloads a day

local

runs on your machine

downloads in 30d

What it does

Unified Ghidra + BizHawk MCP server for static analysis, P-code emulation, and retro ROM triage.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --env 'GHIDRA_INSTALL_DIR=${GHIDRA_INSTALL_DIR}' --transport stdio ghidra-bizhawk-mcp '--' uvx ghidra-bizhawk-mcp

# 2 — ask your agent for something these tools do
#   ghidra_analyze, ghidra_sessions, ghidra_session_close and 43 more

It needs GHIDRA_INSTALL_DIR: this reads it from your environment, so export it first.

Ghidra BizHawk costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

getanirao2 servers

2 categories

All 2 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Ghidra BizHawk as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need uv (docs.astral.sh/uv): uvx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads GHIDRA_INSTALL_DIR (Absolute path to the Ghidra installation directory) from your environment each time it starts the server, so the value stays out of its config: export it in your shell profile (macOS, Linux), or run setx GHIDRA_INSTALL_DIR … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user --env 'GHIDRA_INSTALL_DIR=${GHIDRA_INSTALL_DIR}' --transport stdio ghidra-bizhawk-mcp '--' uvx ghidra-bizhawk-mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

It reaches a system of yours, so it needs settings only you can give it: GHIDRA_INSTALL_DIR — Absolute path to the Ghidra installation directory. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

46 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Import and analyze a binary into a named Ghidra session. Creates or replaces a session. Returns session_id, platform info, and function count. Call this first before any other Ghidra analysis tool.

Parameter	Type	Required	Notes
binary_path	string	yes	Absolute path to the binary file to analyze. Supports ELF, PE, Mach-O, and raw binaries.
session_id	string	no	Optional session tracking ID. Auto-generated if omitted. Use to reuse a session across multiple tool calls.

List all active Ghidra session workspaces with their session IDs, binary paths, and load timestamps. Useful before calling ghidra.session_close or ghidra.diff.

Parameter	Type	Required	Notes
session_id	string	no	Optional session ID to filter by. Returns only the matching session if provided.

Close and remove a Ghidra session workspace, freeing project resources. Cannot be undone. Use ghidra.sessions first to find active session IDs.

Parameter	Type	Required	Notes
session_id	string	yes	Session ID to close. Get active sessions from ghidra.sessions.

Decompile a function by name or hex address. Returns decompiled C code. Use after session.analyze has loaded a binary.

Parameter	Type	Required	Notes
function_name	string	yes	Function name (e.g. 'main', 'FUN_08000100') or hex address (e.g. '0x08000100')
session_id	string	no	Session ID (defaults to most recently active session)

Decompile a function with line range, token budget, and optional summarization to prevent context-window exhaustion on large functions. Use for functions over 50 lines.

Parameter	Type	Required	Notes
function_name	string	yes	Function name or hex address to decompile
line_start	integer	no	1-indexed start line for paginated output
line_end	integer	no	1-indexed end line (exclusive) for paginated output
max_tokens	integer	no	Truncate output to approximately N tokens to stay within context budget
summarize	boolean	no	Set to true to strip boilerplate local variable declarations and collapse blank lines
session_id	string	no	Session ID (defaults to most recently active session)

List all data types defined in the loaded program, including structures, enums, and typedefs. Useful for understanding the program's type landscape before creating new types.

Parameter	Type	Required	Notes
session_id	string	no	Session ID (defaults to most recently active session)

Get cross-references to and from a given address. Shows what references the address and what the address references. Useful for understanding how data or code is used across the binary.

Parameter	Type	Required	Notes
address	string	yes	Target address (e.g. '0x401000') to find cross-references for
max_results	integer	no	Maximum number of reference results to return (default 100)
session_id	string	no	Session ID (defaults to most recently active session)

Get the call graph for a function — shows which functions it calls (callees) and which functions call it (callers). Use after ghidra.decompile to understand function relationships.

Parameter	Type	Required	Notes
function_name	string	yes	Function name or hex address to get the call graph for
max_depth	integer	no	Recursion depth for the call graph (default 3, max 10)
session_id	string	no	Session ID (defaults to most recently active session)

Composite tool that bulk-decompiles all entry points in one call — program entry, exports, main, _start, etc. Use early in analysis to get an overview of the binary's surface area.

Parameter	Type	Required	Notes
session_id	string	no	Session ID (defaults to most recently active session)

Produce a Markdown summary of the active workspace — functions, entry points, custom symbols, recovered structures, renamed functions, and comment count. Replaces a GUI CodeBrowser window. Call at the end of a session to get a human-readable overview.

Parameter	Type	Required	Notes
session_id	string	no	Session ID (defaults to most recently active session)

Rename a function or label at a given address. Changes are stored in the Ghidra project database. Use to replace auto-generated names like FUN_* with meaningful identifiers.

Parameter	Type	Required	Notes
address	string	yes	Address of the symbol to rename (e.g. '0x08000100')
new_name	string	yes	New name for the symbol (alphanumeric + underscores only)
session_id	string	no	Session ID (defaults to most recently active session)

Attach a comment to a code unit at a given address. Supports comment types: plate, pre, post, eol, repeatable. Use to document reverse-engineering findings inline.

Parameter	Type	Required	Notes
address	string	yes	Address to attach the comment to (e.g. '0x08000100')
text	string	yes	Comment text content
comment_type	string	no	Type of comment: 'plate' (boxed header), 'pre' (before code), 'post' (after code), 'eol' (end of line), 'repeatable' (appears at all references)
session_id	string	no	Session ID (defaults to most recently active session)

Create a custom structured data type from a JSON member layout. Each member specifies offset (optional), field name, and type string. Use to model protocol headers, packet formats, and data structures.

Parameter	Type	Required	Notes
name	string	yes	Name for the new struct type (e.g. 'PacketHeader')
members	array	yes	Array of member field definitions forming the struct layout
session_id	string	no	Session ID (defaults to most recently active session)

Change a local variable or function parameter's type annotation in the decompiled view. Use to replace generic types like undefined4* with meaningful types like MyStruct* for cleaner decompilation.

Parameter	Type	Required	Notes
address	string	yes	Address inside the function containing the variable to retype
variable_name	string	yes	Name of the local variable or parameter to retype
new_type	string	yes	New type string (e.g. 'MyStruct*', 'int', 'char[256]')
session_id	string	no	Session ID (defaults to most recently active session)

Disassemble N raw instructions at an address. Returns mnemonic, operands, hex bytes, and length for each instruction. Use for precise lower-level inspection when decompiled C is insufficient.

Parameter	Type	Required	Notes
address	string	yes	Starting address for disassembly (e.g. '0x08000100')
instruction_count	integer	no	Number of instructions to disassemble (default 10, max 100)
session_id	string	no	Session ID (defaults to most recently active session)

Search the entire loaded binary for a hex byte pattern. Returns matching addresses with context bytes and any string labels at the hit. Use to locate known constants, magic bytes, or patch locations.

Parameter	Type	Required	Notes
pattern	string	yes	Hex byte pattern to search for (e.g. '09 08 00 01' with spaces, or 'F86D0003' without)
max_results	integer	no	Maximum number of matches to return (default 50)
session_id	string	no	Session ID (defaults to most recently active session)

Return a raw hex + ASCII dump for a byte range, equivalent to Ghidra's Listing panel. Complements ghidra.disassemble for inspecting data regions, strings, and padding.

Parameter	Type	Required	Notes
start_address	string	yes	Starting address for the hex dump (e.g. '0x08000100')
byte_count	integer	no	Total number of bytes to dump (default 64, max 4096)
columns	integer	no	Bytes per row in the hex dump (default 16)
session_id	string	no	Session ID (defaults to most recently active session)

Compare two loaded sessions by function name and body size. Returns functions unique to each side and functions that changed between versions. Use for patch diffing and version comparison.

Parameter	Type	Required	Notes
session_a	string	yes	First session ID (the 'old' binary)
session_b	string	yes	Second session ID (the 'new' binary)

Headlessly execute a slice of instructions using Ghidra's P-code emulator. Seed initial register values and track value propagation across execution steps. No debugger, GDB stub, or network needed. Works on any Ghidra-supported architecture (ARM, x86, MIPS, etc.)

Parameter	Type	Required	Notes
start_address	string	yes	Starting address for emulation (e.g. '0x1000')
instruction_count	integer	no	Number of instructions to step through (default 10)
initial_registers	object	no	Register seed values as a JSON object, e.g. {"r0": 5, "r1": 1095216660}. Omit to use Ghidra's default initial state.
track_registers	array	no	Subset of register names to log at each step (default: all seeded registers + PC). Example: ["r0", "r1", "pc"]
session_id	string	no	Session ID (defaults to most recently active session)

Execute an instruction slice with automatic taint tracking. Specify a taint register; the tool reports every step where its value is modified or propagates to other registers. Use to trace data flows through cryptographic routines or input processing.

Parameter	Type	Required	Notes
start_address	string	yes	Starting address for emulation (e.g. '0x1000')
instruction_count	integer	no	Number of instructions to step through (default 10)
initial_registers	object	no	Register seed values, e.g. {"r0": 5, "r1": 0x41424344}
taint_register	string	no	Register name to track for data lineage and propagation (default 'r0')
session_id	string	no	Session ID (defaults to most recently active session)

Execute instructions until a break condition is met or the instruction count expires. Supports equality (R0==0), inequality (R1>0xFF), not-equal (R2!=R3), and PC address (PC==0x1234). Stops before or after the matching instruction. Ideal for finding copy-loop bounds, null-pointer paths, or…

Parameter	Type	Required	Notes
start_address	string	yes	Starting address for emulation (e.g. '0x1000')
instruction_count	integer	no	Maximum instructions to execute before timeout (default 50)
initial_registers	object	no	Register seed values for initial emulator state
break_condition	string	no	Break condition string. Supported: R0==0, R1>0xFF, R2!=R3, PC==0x1234. Example: 'R0==0' stops when register r0 becomes zero.
session_id	string	no	Session ID (defaults to most recently active session)

Generate a behavior-based structural hash for a function that survives compiler shuffling and optimization changes across binary versions. Use with ghidra.apply_signatures for cross-version function matching.

Parameter	Type	Required	Notes
func_name	string	yes	Function name or address to fingerprint (e.g. 'main' or '0x08000100')
session_id	string	no	Session ID (defaults to most recently active session)

Export a complete {structural_hash -> function_name} signature map for every function in the current binary. Save the output JSON to reuse across binary versions. Call before closing a session to preserve naming for future diffing.

Parameter	Type	Required	Notes
session_id	string	no	Session ID (defaults to most recently active session)

Scan the current binary, match every function by structural fingerprint against a previously exported signature map, and rename matches automatically. Use after loading a new binary version to restore meaningful names.

Parameter	Type	Required	Notes
signature_json_map	object	yes	Signature map JSON object from a previous ghidra.export_signatures call. Format: {hash: function_name}
session_id	string	no	Session ID (defaults to most recently active session)

Fingerprint all functions and stash the signature map server-side under a lineage_group_id label (e.g. 'my_firmware_v1'). No JSON file management needed — stored in ~/.ghidra_bizhawk_mcp/signatures/.

Parameter	Type	Required	Notes
lineage_group_id	string	yes	Arbitrary group name for this binary family (e.g. 'my_firmware_v1', 'router_fw_3.x')
session_id	string	no	Session ID (defaults to most recently active session)

Load a previously stashed signature map by lineage_group_id and auto-rename every matching function in the current session. Use with ghidra.stash_save for persistent cross-version function name recovery.

Parameter	Type	Required	Notes
lineage_group_id	string	yes	Group name that was used during ghidra.stash_save (e.g. 'my_firmware_v1')
session_id	string	no	Session ID (defaults to most recently active session)

Zero-input auto-stash: hashes the loaded binary's first 4 KB and saves a signature map under that hash. No group ID or user input needed. Just analyze and call.

Parameter	Type	Required	Notes
session_id	string	no	Session ID (defaults to most recently active session)

Zero-input auto-restore: hashes the loaded binary, looks up a previously stashed map by content hash, and renames matching functions automatically. Pair with ghidra.stash_auto_save for fully automatic cross-version name recovery.

Parameter	Type	Required	Notes
session_id	string	no	Session ID (defaults to most recently active session)

List all stashed signature groups currently in the local server cache (~/.ghidra_bizhawk_mcp/signatures/). Use before ghidra.stash_restore to see available lineage_group_ids.

Parameter	Type	Required	Notes
lineage_group_id	string	no	Optional lineage group ID to filter by. Returns details for a specific group if provided.

Examines raw file magic header signatures to detect retro console architectures (NES, SNES, GBA, NDS, Switch, PSX, Genesis, SMS, Dreamcast), headlessly maps correct Ghidra language loaders, hooks multi-session project bindings, and applies automated signature caching overlays. Single-call entry…

Parameter	Type	Required	Notes
rom_path	string	yes	Absolute system path to the targeted emulator ROM image or raw memory partition block dump
session_id	string	no	Optional session tracking token for parallel multi-binary session context

Check connectivity to BizHawk by pinging the bridge.lua script running inside EmuHawk. Use first before any other bizhawk.* tool to verify the emulator is responsive.

Parameter	Type	Required	Notes
timeout	integer	no	Connection timeout in seconds (default 5). Increase for slow or remote emulator instances.

Get ROM name, ROM hash, current framecount, available memory domains, and capabilities from the connected BizHawk instance.

Parameter	Type	Required	Notes
detail	string	no	Detail level: 'summary' for key info, 'full' for all available metadata including memory domains.

List available memory domains for the currently loaded emulation core (e.g. WRAM, RAM, EWRAM, VRAM, System Bus). Use before bizhawk.read to determine valid domain names.

Parameter	Type	Required	Notes
domain	string	no	Optional domain name to get details for a specific memory domain (e.g. 'WRAM', 'VRAM'). Returns all domains if omitted.

Read bytes from BizHawk emulated memory at a given address. Returns an array of byte values. Use bizhawk.memory_domains first to discover valid domain names for the loaded game.

Parameter	Type	Required	Notes
address	integer	yes	Starting memory address (decimal or hex format, e.g. 0x02000000)
size	integer	no	Number of bytes to read (default 4, max 4096)
domain	string	no	Memory domain name (e.g. WRAM, RAM, EWRAM, VRAM, System Bus). Use bizhawk.memory_domains to discover available names.

Write bytes to BizHawk emulated memory at a given address. Use to patch game state, inject values, or modify emulated hardware registers in real time.

Parameter	Type	Required	Notes
address	integer	yes	Starting memory address to write to (decimal or hex)
data	array	yes	Array of byte values to write (max 4096 bytes). Example: [0x00, 0xFF, 0xAB]
domain	string	no	Optional memory domain (e.g. WRAM, RAM). Defaults to system bus.

Set joypad button state for a player. Accepts an object like {A: true, B: true, Up: true, Start: true, Select: true}. State persists until changed or cleared. Use bizhawk_tap_buttons for a single atomic press/hold/release sequence.

Parameter	Type	Required	Notes
buttons	object	yes	Button states as {ButtonName: true/false}. Valid names: A, B, Up, Down, Left, Right, Start, Select, L, R, X, Y (console-dependent). Example: {A: true, Start: true}
player	integer	no	Player number (1-based). Player 1 is the default.

Read the current joypad state for a player. Returns the active button table as reported by BizHawk, which is useful for verifying that input was applied correctly.

Parameter	Type	Required	Notes
player	integer	no	Player number (1-based). Player 1 is the default.

Advance the emulator by N frames. Use to step through execution frame by frame. If you need to apply input and release it atomically, prefer bizhawk_tap_buttons.

Parameter	Type	Required	Notes
count	integer	no	Number of frames to advance (default 1). Use higher values to fast-forward through known sequences.

Atomically press a set of buttons for a fixed number of frames, then release them. Use for timed inputs such as a one-frame tap or a short hold.

Parameter	Type	Required	Notes
buttons	object	yes	Button states as {ButtonName: true/false}. Valid names: A, B, Up, Down, Left, Right, Start, Select, L, R, X, Y (console-dependent). Example: {A: true, Start: true}
frames	integer	no	Number of frames to hold the buttons before releasing them.
player	integer	no	Player number (1-based). Player 1 is the default.

Pause BizHawk emulation. Use before reading memory or inspecting state to prevent the emulated system from changing values between operations.

Parameter	Type	Required	Notes
reason	string	no	Optional reason for pausing (e.g. 'reading memory', 'inspecting state'). Logged for debugging.

Unpause BizHawk emulation after a previous pause call. The emulated system resumes normal execution.

Parameter	Type	Required	Notes
reason	string	no	Optional reason for unpausing (e.g. 'resuming after memory read'). Logged for debugging.

Reset the loaded emulation core (reboot the emulated console). All emulated memory and CPU state is lost. Use to restart a game or boot a different ROM path.

Parameter	Type	Required	Notes
hard	boolean	no	If true, perform a hard reset (reload ROM). If false (default), perform a soft reset.

Save a PNG screenshot of the current emulator display to a file path. Useful for capturing in-game state, error screens, or UI elements during automated testing.

Parameter	Type	Required	Notes
path	string	yes	Absolute file path to save the PNG screenshot (e.g. 'C:/temp/shot.png' or '/tmp/shot.png')

Save the current emulator state to a file. The savestate captures all CPU registers, memory, and hardware state for later reload. Use with bizhawk.load_state for checkpoint-based testing workflows.

Parameter	Type	Required	Notes
path	string	yes	Absolute file path for the savestate (e.g. 'C:/temp/state.bin')

Load emulator state from a previously saved savestate file. Restores all CPU registers, memory, and hardware state exactly. Use with bizhawk.save_state for reproducible testing.

Parameter	Type	Required	Notes
path	string	yes	Absolute file path of the savestate to load (e.g. 'C:/temp/state.bin')

Launch the BizHawk emulator process and establish the Lua bridge connection. Optionally specify a ROM path to load. Call this first before any other bizhawk.* tool if the emulator is not already running.

Parameter	Type	Required	Notes
rom_path	string	no	Optional absolute path to a ROM file to load on startup

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under Apache-2.0
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Ghidra BizHawk or to call it, at any volume.

ATrust score 93 / 100

Release 1.1.0 · scanned 17 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings2 threat · 0 capability

Capabilityhigh

Coveragesource

Verificationrepo

Surface digestd75af5ccfc8dae05f9da5563c79bae9f8a2326a61fa7c12526344fb8fbac91c0

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	repo	publisher verification (public source) — no provenance, but the source is public and inspectable	−1
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (46 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
ghidra_analyze	state-write	state-write: declares readOnlyHint: false
ghidra_sessions	no tags
ghidra_session_close	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
ghidra_decompile	no tags
ghidra_decompile_paginated	no tags
ghidra_data_types	no tags
ghidra_cross_references	no tags
ghidra_call_graph	no tags
ghidra_decompile_entrypoints	no tags
ghidra_report	no tags
ghidra_rename	state-write	state-write: declares readOnlyHint: false
ghidra_comment	state-write	state-write: declares readOnlyHint: false
ghidra_create_struct	state-write	state-write: declares readOnlyHint: false
ghidra_retype	state-write	state-write: declares readOnlyHint: false
ghidra_disassemble	no tags
ghidra_search	no tags
ghidra_listing	sensitive-source	sensitive-source: keyword "dump"
ghidra_diff	no tags
ghidra_emulate	no tags
ghidra_emulate_taint	no tags
ghidra_emulate_breakpoints	no tags
ghidra_fingerprint	no tags
ghidra_export_signatures	no tags
ghidra_apply_signatures	state-write	state-write: declares readOnlyHint: false
ghidra_stash_save	state-write	state-write: declares readOnlyHint: false
ghidra_stash_restore	state-write	state-write: declares readOnlyHint: false
ghidra_stash_auto_save	state-write	state-write: declares readOnlyHint: false
ghidra_stash_auto_restore	state-write	state-write: declares readOnlyHint: false
ghidra_stash_list	no tags
ghidra_triage	state-write	state-write: declares readOnlyHint: false
bizhawk_connect	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
bizhawk_info	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
bizhawk_memory_domains	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
bizhawk_read	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
bizhawk_write	state-write	state-write: declares readOnlyHint: false
bizhawk_buttons	state-write	state-write: declares readOnlyHint: false
bizhawk_input_state	untrusted-input	untrusted-input: declares openWorldHint: true (interacts with entities outside the server)
bizhawk_frame	state-write	state-write: declares readOnlyHint: false
bizhawk_tap_buttons	state-write	state-write: declares readOnlyHint: false
bizhawk_pause	state-write	state-write: declares readOnlyHint: false
bizhawk_unpause	state-write	state-write: declares readOnlyHint: false
bizhawk_reset	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
bizhawk_screenshot	state-write	state-write: declares readOnlyHint: false
bizhawk_save_state	state-write	state-write: declares readOnlyHint: false
bizhawk_load_state	state-write	state-write: declares readOnlyHint: false
bizhawk_launch	state-write	state-write: declares readOnlyHint: false

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digestd75af5ccfc8dae05

Scanned2026-10-17

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.