v0.5.1

HoneyBadger 0.5.1

Security scanner for skills, tools, and MCP servers used by AI assistant runtimes.

HoneyBadger don't care. HoneyBadger checks anyway.

Install

# Go install
go install github.com/famclaw/honeybadger/cmd/honeybadger@v0.5.1

# Docker
docker pull ghcr.io/famclaw/honeybadger:0.5.1

# Binary (Linux amd64)
curl -fsSL https://github.com/famclaw/honeybadger/releases/download/v0.5.1/honeybadger-linux-amd64 -o honeybadger
chmod +x honeybadger

Verify

# Verify checksum signature (cosign signs SHA256SUMS, not individual binaries)
cosign verify-blob SHA256SUMS \
  --bundle SHA256SUMS.bundle \
  --certificate-identity-regexp ".*famclaw/honeybadger.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# Verify binary integrity via checksums
sha256sum --check SHA256SUMS

# Docker image
cosign verify ghcr.io/famclaw/honeybadger:0.5.1 \
  --certificate-identity-regexp ".*famclaw/honeybadger.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

# GitHub attestation
gh attestation verify honeybadger-linux-amd64 --repo famclaw/honeybadger

Changelog

Bug Fixes

• 2fdd21d: fix: eliminate self-check false positives (file-role classification) (#49) (@depohmel)

---

Full changelog: v0.5.0...v0.5.1

Supply chain security: All binaries are signed with Sigstore cosign (keyless), attested with GitHub build provenance, and include SPDX SBOMs. Container images are signed and pushed to GHCR.