Skip to main content
ClawQL
SecurityVerifiable

Security status

This page shows raw, independently checkable supply-chain evidence — scan pass/fail history (including caught failures), SBOM artifact links, and signature verification commands. It is fed by CI exports and an append-only publish job, not hand-edited summaries. Spec: security-status-page-spec.md.

← Security overview · SECURITY.md (disclosure)

Latest release

Version
v8.0.0
SBOM (Syft)
CycloneDX JSON via CI artifact sbom-cyclonedx-repository on each green supply-chain run — download from the linked CI run artifacts.
Verify signature
cosign verify ghcr.io/danielsmithdevelopment/clawql-mcp@sha256:<digest> \
  --certificate-identity-regexp 'https://github\.com/danielsmithdevelopment/ClawQL/.*' \
  --certificate-oidc-issuer-regexp 'https://token\.actions\.githubusercontent\.com.*'

Scan history

Last 0 published main-branch CI supply-chain runs. Failed rows are never removed — a fail-then-fix pair is evidence the gate blocked a merge.

No runs published yet. The scheduled security-status-publish workflow will append records after CI exports land on main.

History updated: 2026-09-01T00:00:00.000Z

Independent verification

Third-party, vendor-neutral security benchmarks (for example MCPSEC-style formal properties) will be linked here when ClawQL completes a reproducible external evaluation — same independent-evidence principle as Harvey LAB and ExtractBench.