# ossf_scorecard_trend_analyzer

As a CTO, analyze OSSF Scorecard trends for your top 10-50 dependencies to identify security regressions or deteriorating project health. Input GitHub repository names (owner/repo), get structured trend data including score deltas, check failures, and risk flags. Uses OSSF Scorecard API and GitHub Archive for historical context. Ideal for proactive dependency management and risk assessment.

Agent View of the PolicyLayer registry record for `ossf_scorecard_trend_analyzer`. HTML page: https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ossf-scorecard-trend-analyzer

## Facts

- Tool: `ossf_scorecard_trend_analyzer`
- Server: Mcp Knowledge (`https://mcp.gapup.io`) — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge.md
- Homepage: https://github.com/getgapup/gapup-mcp
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server auth posture: open
- Server rate-limited: no
- Parameters: 4 (1 required)
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `async` | boolean | no | If true, returns a job_id immediately (<200ms) instead of waiting for the result. Poll the result with job_result(job_id). Use for slow tools to avoid client ti |
| `lookbackDays` | number | no | Number of days to analyze trends for |
| `repositories` | array | yes | List of GitHub repositories in owner/repo format |
| `minScoreThreshold` | number | no | Minimum acceptable score to flag as risky |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "ossf_scorecard_trend_analyzer",
    "arguments": {
      "repositories": []
    }
  }
}
```

## Why ossf_scorecard_trend_analyzer is rated Low

This tool queries existing security scorecard data and historical metrics from public APIs (OSSF Scorecard, GitHub Archive) to help assess dependency risk. It is purely informational—it reads and analyzes data without side effects.

From the tool's own definition: "Tool description explicitly states 'analyze OSSF Scorecard trends' and 'get structured trend data' — retrieval and analysis operations. It 'uses OSSF Scorecard API and GitHub Archive for historical context' to fetch and present security metrics."

## Use case

AI agents call ossf_scorecard_trend_analyzer to retrieve information from Mcp Knowledge without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Mcp Knowledge:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "ossf_scorecard_trend_analyzer": {}
  }
}
```

## Other tools on Mcp Knowledge (270)

- `adversarial_input_stress_tester` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/adversarial-input-stress-tester.md
- `competitor_pricing_scrape` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/competitor-pricing-scrape.md
- `dora_operational_resilience_stress_tes` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/dora-operational-resilience-stress-tes.md
- `financial_model_3statement` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/financial-model-3statement.md
- `gl_reconciler` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/gl-reconciler.md
- `lgpd_data_subject_rights_automator` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/lgpd-data-subject-rights-automator.md
- `monte_carlo_portfolio` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/monte-carlo-portfolio.md
- `workflow_orchestrator` — Execute — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/workflow-orchestrator.md
- `ma_arbitrage_hunter` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ma-arbitrage-hunter.md
- `repo_rate_arbitrage_scanner` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/repo-rate-arbitrage-scanner.md
- `tax_optimization` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/tax-optimization.md
- `treasury_optimizer` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/treasury-optimizer.md
- `usdc_x402_payments_intel` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/usdc-x402-payments-intel.md
- `working_capital_fx_hedge_optimizer` — Financial — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/working-capital-fx-hedge-optimizer.md
- `pricing_in_deal` — Other — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/pricing-in-deal.md
- `term_sheet_negotiation` — Other — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/term-sheet-negotiation.md
- `abm_architect` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/abm-architect.md
- `abm_lookalike_account_finder` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/abm-lookalike-account-finder.md
- `account_expansion_mapper` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/account-expansion-mapper.md
- `affiliate_fraud_clickstream_detector` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/affiliate-fraud-clickstream-detector.md
- `africa_trade_barrier_breaker` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-barrier-breaker.md
- `africa_trade_finance_esg_rater` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-finance-esg-rater.md
- `africa_trade_preference_arbitrage` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-preference-arbitrage.md
- `africa_trade_preference_optimizer` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/africa-trade-preference-optimizer.md
- `agoa_eba_intelligence` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/agoa-eba-intelligence.md
- `ai_act_sandbox_regulatory_sandbox` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-act-sandbox-regulatory-sandbox.md
- `ai_act_training_data_audit` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-act-training-data-audit.md
- `ai_governance_full_report_async` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-full-report-async.md
- `ai_governance_full_report_result` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-full-report-result.md
- `ai_governance_pilot` — Read — https://policylayer.com/tools/io-github-getgapup-mcp-knowledge/ai-governance-pilot.md
- …and 240 more: https://policylayer.com/tools/io-github-getgapup-mcp-knowledge.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-github-getgapup-mcp-knowledge · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-github-getgapup-mcp-knowledge