brevio-core 0.9.1

brevio-core 0.9.1

Exported from harness commit 8f5bd18f06ea788102231a12b642ae0e0b7cf32a of 2026-11-07.

This tree was produced by the harness exporter and checked for leaks before it was written. To reproduce it, check out that commit and run the exporter.

Rules

No rule was added, changed or retired since the last release.

Notes:

• R2.8 No unsafe code or HTML sinks: no eval or new Function on strings; dangerouslySetInnerHTML only with sanitised HTML: New ID for the eval, new Function and dangerouslySetInnerHTML findings, which builds before 0.6.0 reported as R2.5 (the SSRF and timeout guard, which brevio-core scan does not check); name R2.8 in an ignore comment or brevio-core.toml for them.
• R6.3 Deterministic condition waits: never use waitForTimeout/sleep in tests: Now preview: it reports a sleep in a test but never fails a scan (see its rule page).

Verify

• Release commit: a2ec1956981871b2adc91d3060f620bb16ec6e98
• brevio-core.pyz SHA-256: fb246081c8701277bda36cc2013592840b9237d6966b55bbd4b6444cdfbb2338
• brevio_core-0.9.1-py3-none-any.whl SHA-256: 2b8abca4a41cf6b766fcb5dad5d7f9048ad42cfe480e0e394816484a90a28a57
• brevio_core-0.9.1.tar.gz SHA-256: 911893bd6a60d4abe991d3103ab7466f41f4d74dd7dda7089a42451a19e28093
• brevio-core.cdx.json: the SBOM (no runtime dependency)

gh attestation verify brevio-core.pyz --repo Brevio-Ventures/brevio-core
python3 brevio-core.pyz scan

The package is on PyPI as brevio-core==0.9.1, with the attestations of trusted publishing.

What's Changed

• brevio-core 0.9.1 by @rmb in #8
• docs(0.9.1): progressive depth 5-track documentation hub and dual-audience contracts by @rmb in #10

Full Changelog: v0.9.0...v0.9.1

brevio-core 0.9.0

brevio-core 0.9.0

Exported from harness commit fa5108166ebe11df8319643993ce7ce398d47821 of 2026-11-07.

This tree was produced by the harness exporter and checked for leaks before it was written. To reproduce it, check out that commit and run the exporter.

Rules

No rule was added, changed or retired since the last release.

Notes:

• R2.8 No unsafe code or HTML sinks: no eval or new Function on strings; dangerouslySetInnerHTML only with sanitised HTML: New ID for the eval, new Function and dangerouslySetInnerHTML findings, which builds before 0.6.0 reported as R2.5 (the SSRF and timeout guard, which brevio-core scan does not check); name R2.8 in an ignore comment or brevio-core.toml for them.
• R6.3 Deterministic condition waits: never use waitForTimeout/sleep in tests: Now preview: it reports a sleep in a test but never fails a scan (see its rule page).

Verify

• Release commit: 9e1850c10022d999e718ce7044345d81f9e2c244
• brevio-core.pyz SHA-256: 6a8ad77d6096621b091d9d727920a65616d5e720de954dc009ce955a881b4d97
• brevio_core-0.9.0-py3-none-any.whl SHA-256: 2c2f9fdb8ede9e0b7e1433ddabee1dd6ef3cc64028b89d2f847915f020e08de5
• brevio_core-0.9.0.tar.gz SHA-256: 1b2c1de6f351225fa4e578a99e5e9442d65ad3b58241834f4c4ec6c30e085bda
• brevio-core.cdx.json: the SBOM (no runtime dependency)

gh attestation verify brevio-core.pyz --repo Brevio-Ventures/brevio-core
python3 brevio-core.pyz scan

The package is on PyPI as brevio-core==0.9.0, with the attestations of trusted publishing.

What's Changed

• brevio-core 0.9.0 by @rmb in #7

Full Changelog: v0.8.1...v0.9.0

brevio-core v0.8.1 — Agent Safety Scorecard, MCP TDQS & 16 Scanned Rules

Highlights in brevio-core v0.8.1 — Viral Agent Safety Scorecard, MCP TDQS & Flight Checks

🏆 brevio-core score — Agent Safety Scorecard (0–100, Grade A+ to F)

• brevio-core score [paths ...] [--diff] [--min] [--format {text,markdown,json}] [--badge] [--roast]: Deterministic 0-100 Agent Safety Score and letter grade (A+ through F) across Security, Correctness, Reliability, and Maintainability pillars.
• Embeddable Shield & SVG Scorecard: Output ready-to-paste Markdown badges (--badge) and rich dark-glassmorphic SVG Scorecards (https://brevio.pro/api/tools/scorecard.svg).
• GitHub Action Job Summary ($GITHUB_STEP_SUMMARY): Brevio-Ventures/brevio-core@v0 automatically renders an interactive Agent Safety Scorecard table, shield badge, and direct deep links into the Agent Guard Playground (https://brevio.pro/tools/agent-guard-playground) on every pull request.

🔌 MCP Server Quality & Directory Compatibility (TDQS 95+)

• MCP Tool Annotations: All 3 MCP tools (brevio_scan, brevio_gate_check, brevio_gain) now emit full MCP spec annotations (title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint) and comprehensive property descriptions.
• Container & Registry Ready: Includes root Dockerfile, smithery.yaml, glama.json, and server.json (io.github.Brevio-Ventures/brevio-core on the Official MCP Registry).

🛡️ 16 High-Signal Scanned Rules & Pre-Flight Gates

• 16 Scanned Rules (R4–R26): Zero-token deterministic detection for eval/exec sinks (R4.1), unsafe deserialization (R4.4), SQL string interpolation (R4.6), command injection (R4.8), hardcoded secrets (R4.10), weak hashes (R4.13), SSRF (R4.15), merge conflict markers (R6.2), empty catch blocks (R7.1), @ts-ignore / unguarded as any (R9.2), debug print remnants (R13.1), tests without assertions (R16.1), missing alt attributes (R18.1), non-interactive clickable divs (R18.5), phantom packages (R24.1), and symlink escapes (R26.2).
• Pre-Commit Flight Checks (brevio-core gate check): Catch hallucinated imports, secret leaks, .env staging, and bloated diffs before commit.
• Cross-Tool Memory Sync (brevio-core memory sync): Sync AGENTS.md, CLAUDE.md, .cursor/rules/brevio-core.mdc, .windsurfrules, and .github/copilot-instructions.md with SHA-256 drift verification.

🌐 Interactive Companion Tools (100% Client-Side)

• Public Repo Grader & Roast: https://brevio.pro/scan
• Interactive Rules Encyclopedia & Challenge Mode: https://brevio.pro/tools/rules-encyclopedia
• Agent Guard Playground: https://brevio.pro/tools/agent-guard-playground
• AEO & llms.txt Generator: https://brevio.pro/tools/llms-txt-generator

Quickstart

pip install brevio-core==0.8.1
brevio-core score . --badge
brevio-core init --with hook,mcp

brevio-core v0.8.0 — Agent Safety Scorecards, Action Summaries & MCP TDQS

brevio-core v0.8.0 — Deterministic Agent Safety Scorecards, GitHub Action Summaries & MCP TDQS Annotations

brevio-core catches the mistakes coding agents repeat before they reach pull-request review — with 12 deterministic line- & AST-scanned rules (<15ms, zero LLM calls, stdlib Python) and 123 documented engineering rules.

What's New in v0.8.0

1. brevio-core score CLI (0–100, Grade A+ to F):
   • Compute a deterministic Agent Safety Score across your repository or PR diff (brevio-core score, brevio-core score --diff origin/main, brevio-core score --min 90, brevio-core score --badge, brevio-core score --roast, --format {text,markdown,json}).
   • Outputs copy-pasteable README badge Markdown, dynamic repo scorecard Markdown, signed verification receipt URLs, and per-rule deep links into the browser playground.
2. Rich $GITHUB_STEP_SUMMARY Scorecards in GitHub Actions (Brevio-Ventures/brevio-core@v0.8.0):
   • Automatically appends an Agent Safety Scorecard (0–100, Grade A+ to F), shield badge, 1-click [Test R... in Playground] links, and a collapsible README badge snippet to $GITHUB_STEP_SUMMARY.
3. MCP TDQS Tool Annotations & Directory Manifests (glama.json, smithery.yaml, Dockerfile, server.json):
   • All 7 stdio MCP tools (scan, explain, list_rules, fix, learn, brief, check) now include explicit MCP annotations (title, readOnlyHint, destructiveHint, idempotentHint, openWorldHint) and complete parameter descriptions for Glama TDQS and Smithery indexing.
4. Embeddable Markdown Badges in brevio-core gain & brevio-core init:
   • brevio-core gain now outputs a ready-to-paste Markdown Badge: line right below the signed receipt URL.

Quick Start

uvx brevio-core==0.8.0 scan --diff
uvx brevio-core==0.8.0 score
uvx brevio-core==0.8.0 init --with hook,mcp

Companion Interactive Browser Tools (Zero-Install)

• Public GitHub Repo Agent-Safety Grader & Roast: https://brevio.pro/scan?repo=Brevio-Ventures/brevio-core
• Interactive 123-Rule Encyclopedia & "Spot the Agent Mistake" Challenge: https://brevio.pro/tools/rules-encyclopedia?mode=challenge
• Zero-Network Agent Guard & Diff Playground: https://brevio.pro/tools/agent-guard-playground
• /llms.txt & /skill.md Discovery Generator: https://brevio.pro/tools/llms-txt-generator

brevio-core 0.7.0

brevio-core 0.7.0

Exported from harness commit a77791e6c4ec2c363a8975e49a2425489d448e3d of 2026-11-06.

This tree was produced by the harness exporter and checked for leaks before it was written. To reproduce it, check out that commit and run the exporter.

Verify

• Release commit: 6404e499d9eaff80208933bc53398db76e81a755
• brevio-core.pyz SHA-256: 3fa4367beb143630e71fbc5ed8279646a9c3d32e291b9fbd626820b7a8a14dfd
• brevio_core-0.7.0-py3-none-any.whl SHA-256: 929f772a069f24b6eebea5904793a7f7549994bcae2757fcc0e234716ca81d7c
• brevio_core-0.7.0.tar.gz SHA-256: 878aa4b2f051e7798ccc479df5b2a9a10034bb057b6eea1434c26aca9fe18b4d
• brevio-core.cdx.json: the SBOM (no runtime dependency)

gh attestation verify brevio-core.pyz --repo Brevio-Ventures/brevio-core
python3 brevio-core.pyz scan

The package is on PyPI as brevio-core==0.7.0, with the attestations of trusted publishing.

What's Changed

• brevio-core 0.7.0 by @rmb in #3

Full Changelog: v0.6.0...v0.7.0

brevio-core 0.6.0

brevio-core 0.6.0

Exported from harness commit 91eecc1395f3eb48525b7ee4d16ada7d4ed7d757 of 2026-11-06.

This tree was produced by the harness exporter and checked for leaks before it was written. To reproduce it, check out that commit and run the exporter.

Rules

No rule was added, changed or retired since the last release.

Notes:

• R2.8 No unsafe code or HTML sinks: no eval or new Function on strings; dangerouslySetInnerHTML only with sanitised HTML: New ID for the eval, new Function and dangerouslySetInnerHTML findings, which builds before 0.6.0 reported as R2.5 (the SSRF and timeout guard, which brevio-core scan does not check); name R2.8 in an ignore comment or brevio-core.toml for them.
• R6.3 Deterministic condition waits: never use waitForTimeout/sleep in tests: Now preview: it reports a sleep in a test but never fails a scan (see its rule page).

Verify

• Release commit: 274b4b66de6dfb6ec670090809c72071555334f0
• brevio-core.pyz SHA-256: fbdb0517e4f5b7a8b3cd8fb9a798568b118eae7861dfd8871789741d672c9b8e
• brevio_core-0.6.0-py3-none-any.whl SHA-256: ad846864450b9554c165392444367184246937ea76020bd8db52c42d452a3fec
• brevio_core-0.6.0.tar.gz SHA-256: 6d0ae3b972bd298d55ac9c268d3e55651f1f6bb6f47db6c2c501990fdcfd5745
• brevio-core.cdx.json: the SBOM (no runtime dependency)

gh attestation verify brevio-core.pyz --repo Brevio-Ventures/brevio-core
python3 brevio-core.pyz scan

The package is on PyPI as brevio-core==0.6.0, with the attestations of trusted publishing.

What's Changed

• brevio-core 0.6.0 by @rmb in #2

Full Changelog: v0.1.0...v0.6.0