{
    "_about": "Figures for the 'Since the snapshot' part of /reports/2026-11, read from the live site on 2026-11-15. Read-only: Eloquent queries in `php artisan tinker`, `mcp:issues-new --days=10`, and the summary.json + registry-rows.csv of the scheduled `report:security` re-run in storage/app/security-reports/2026-11-12 (same code as the snapshot run; the 2026-11-15 run had not finished). Nothing here names an entry, a publisher or a repo. Our own server (config trustedmcp.own_servers) is left out of every graded-listing count.",
    "as_of": "2026-11-15",
    "rerun": {
        "snapshot": "2026-11-12",
        "finished_at": "2026-11-11T20:02:30+00:00",
        "github_queries": 616,
        "active": 60597,
        "uncheckable": 39372,
        "uncheckable_split": {
            "remote_only": 36395,
            "oci_mcpb": 2309,
            "no_type": 668
        },
        "checkable": 21220,
        "vulnerable": 9,
        "vulnerable_same_as_snapshot": 9,
        "no_source": 21289,
        "repos": 30762,
        "repos_reachable": 26767,
        "repos_unreachable": 3995,
        "entries_repo_unreachable": 4890,
        "stale": 2071,
        "no_policy": 18142,
        "plaintext": 0,
        "plaintext_base": 40963,
        "nvd_from": "2026-07-15",
        "nvd_to": "2026-11-12",
        "cve_published": 340,
        "cve_unmatched": 275
    },
    "registry_today": {
        "_query": "RegistryServer::where('status','active'); split by package type the way report:security does: npm, PyPI, NuGet or cargo package with a version = checkable; else remote only / oci or mcpb / nothing listed. no_source = no repo URL.",
        "active": 62678,
        "deleted": 205,
        "deprecated": 1018,
        "uncheckable": 40964,
        "remote_only": 37930,
        "oci_mcpb": 2358,
        "no_type": 676,
        "checkable": 21709,
        "tag_only": 5,
        "no_source": 22362
    },
    "advisories_since": {
        "_query": "ServerIssue::counted()->where('published_at','>=','2026-11-05'), grouped by severity, source, registry_server_id; advisoryGroups() for distinct advisories; graded = the registry entry is linked to a published listing.",
        "published_from": "2026-11-05",
        "last_scan": "2026-11-14",
        "records": 32,
        "distinct": 31,
        "nvd": 30,
        "osv": 2,
        "severity": {
            "critical": 1,
            "high": 11,
            "medium": 18,
            "low": 2
        },
        "matched_records": 14,
        "matched_entries": 3,
        "unmatched_records": 18,
        "on_graded_listings": 0,
        "osv_on_listed_version": 0
    },
    "graded_today": {
        "_query": "Server::published()->notOwn(): grade counts, per-check score bands, known_cves > 0. Missed points = full marks minus points, summed per check.",
        "listings": 207,
        "grades": {
            "A": 72,
            "B": 70,
            "C": 56,
            "D": 9
        },
        "full_marks": {
            "auth": 57,
            "maintenance": 67,
            "cves": 196,
            "transport": 134
        },
        "missed_points": {
            "auth": 2542,
            "maintenance": 1480,
            "cves": 160,
            "transport": 804
        },
        "no_auth": 35,
        "no_auth_grades": {
            "C": 27,
            "D": 8
        },
        "activity": {
            "active": 169,
            "moderate": 32,
            "stale": 6
        },
        "single_maintainer_active": 90,
        "with_cves": 7,
        "with_cves_grades": {
            "B": 2,
            "C": 2,
            "D": 3
        },
        "lose_cve_points": 11,
        "linked_to_registry": 75
    }
}