cad-agent.Supply-chain and resource report
What cad-agent depends on, vendors and links to, checked on 2026-11-01 at revision 3c0a609b205b (online checks). Findings: 1 critical, 15 medium, 37 low, 12 info. Generated by tools/resource_audit.py; how to read it and what blocks a merge are in the cad-supply-chain skill and on the supply-chain page.
Limits. A clean report is not proof of safety: what each check can and cannot see
- A clean report is not proof of safety: advisory databases (OSV, the npm registry) only know what has been reported.
- Licences come from licence files and registry metadata (GitHub, PyPI, npm), matched by keyword; they are not a legal review.
- Link checks see status codes and redirects, not content: a parked or replaced page that answers 200 passes. Domain expiry is not checked.
- GitHub links are checked at repository level; a missing file or anchor inside a live repository is not seen.
- Python versions are checked at the newest release and the lowest release our range allows, not at every version in between.
- Transitive Python dependencies are checked at the versions deps.dev resolves for our newest direct releases; an existing environment may hold other versions, and --installed checks only the installed versions of our direct dependencies.
- Libraries bundled inside a vendored file (DOMPurify and KaTeX inside mermaid.min.js) are checked at the versions its receipt records; whether the bundling library reaches the affected code is not assessed.
- Repository settings (secret scanning, Dependabot) are read only with an admin token; the weekly workflow cannot see them.
- Offline mode checks only what the checkout shows (pins, hashes, licence files, lockfile, link schemes, install advice).
Findings
Critical (1)
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| critical | webkit:mermaid |
dompurify 3.4.12, bundled inside a vendored file, has 5 known advisories | GHSA-cg2g-xh64-v4q7 (critical, fixed in 3.4.17): DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes; GHSA-mrv2-3pqr-j5jr (high, fixed in 3.4.17): DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached sub | dompurify comes inside another library's file: take the first release of that library that bundles dompurify >=3.4.17, and say in the receipt whether the affected code is reachable. |
Medium (15)
15 medium: 4 repo-moved, 2 install-from-registry, 2 link-not-https, 2 repo-archived, 1 advisory, 1 install-pipe-to-shell …
Table 15 rows: Severity, Subject, Finding, Evidence, …
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| medium | pypi:pillow |
our range allows pillow 10.0.0, which has 53 known advisories | GHSA-332p-7hrc-92wf (critical, fixed in 13.0.0): Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO; GHSA-3f63-hfp8-52jq (critical, fixed in 10.2.0): Arbitrary Code Execution in Pillow; GHSA-5x8w-8jj5-q52h (critical, fixed in 13.0.0): Pillow: Heap buffer overflow in FlashPix | Raise the floor to >=13.0.0 in pyproject.toml. |
| medium | doc:research/landscape.md |
research/landscape.md installs a plugin from a marketplace | research/landscape.md:82: 'claude plugin marketplace add earthtojake/text-to-cad#latest' | Standing rule: never install skills or plugins from registries. Vendor a pinned commit (tools/vendor_sync.py) or point at a reviewed release by commit, and say so. |
| medium | doc:research/landscape.md |
research/landscape.md installs a plugin from a marketplace | research/landscape.md:83: 'claude plugin install text-to-cad@earthtojake' | Standing rule: never install skills or plugins from registries. Vendor a pinned commit (tools/vendor_sync.py) or point at a reviewed release by commit, and say so. |
| medium | doc:research/landscape.md |
research/landscape.md pipes a download into a shell | research/landscape.md:161: 'curl | sh' | If this is advice, replace it with a pinned, checksummed download or a package manager; if it only describes how a project installs, say that it is a risk. |
| medium | url:https://dl.openfoam.com/source/latest/openfoam-docker |
https://dl.openfoam.com/source/latest/openfoam-docker is gone (HTTP 404) |
research/simulation-tools.md:77 | Replace it with a live source (or an archive.org copy, marked as such), or remove it. |
| medium | url:http://www.dhondt.de/ |
www.dhondt.de is linked over plain HTTP |
research/fea-and-process-tools.md:24 | Link the https:// address; if the site has none, say so next to the link. |
| medium | url:http://www.dhondt.de/ccx_2.23.pdf |
www.dhondt.de is linked over plain HTTP |
research/fea-and-process-tools.md:24 | Link the https:// address; if the site has none, say so next to the link. |
| medium | url:https://dev.opencascade.org/ |
dev.opencascade.org now redirects to occt3d.com | https://dev.opencascade.org/ -> https://occt3d.com/open-cascade-technology/index.html (README.md:183) |
Check the new site belongs to the same owner and is what we meant; link it directly, or drop the link. |
| medium | npm:fsevents |
fsevents runs an install script (only on darwin) | node_modules/fsevents 2.3.2: hasInstallScript, optional | Read the script; in CI prefer npm ci --ignore-scripts where the package works without it. |
| medium | url:https://github.com/google/feabench |
google/feabench is archived (read-only, no fixes) | last push 2025-05-07 | Show it as "unmaintained" (status or note) instead of removing it; plan a replacement if we use its code. |
| medium | url:https://github.com/microsoft/CADFusion |
microsoft/CADFusion is archived (read-only, no fixes) | last push 2026-07-02 | Show it as "unmaintained" (status or note) instead of removing it; plan a replacement if we use its code. |
| medium | url:https://github.com/American-Embedded/kistack |
American-Embedded/kistack moved to BackplaneWorks/kistack | https://github.com/American-Embedded/kistack redirects to https://github.com/BackplaneWorks/kistack |
Update the link to the new name (the old name can be registered by someone else); check the new owner is who you expect. |
| medium | url:https://github.com/anyoptimization/pymoo |
anyoptimization/pymoo moved to the-dual-space/pymoo | https://github.com/anyoptimization/pymoo redirects to https://github.com/the-dual-space/pymoo |
Update the link to the new name (the old name can be registered by someone else); check the new owner is who you expect. |
| medium | url:https://github.com/facebook/Ax |
facebook/Ax moved to meta/Ax | https://github.com/facebook/Ax redirects to https://github.com/meta/Ax |
Update the link to the new name (the old name can be registered by someone else); check the new owner is who you expect. |
| medium | url:https://github.com/i2cjak/Backplane |
i2cjak/Backplane moved to BackplaneWorks/Backplane | https://github.com/i2cjak/Backplane redirects to https://github.com/BackplaneWorks/Backplane |
Update the link to the new name (the old name can be registered by someone else); check the new owner is who you expect. |
Low (37)
37 low: 21 repo-stale, 3 advisory, 3 install-unpinned, 2 catalogue-no-licence, 2 dependabot-ecosystem, 2 py-no-floor …
Table 37 rows: Severity, Subject, Finding, Evidence, …
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| low | pypi:markdown |
our range allows markdown 3.5, which has 1 known advisory | GHSA-5wmx-573v-2qwq (medium, fixed in 3.8.1): Python-Markdown has an Uncaught Exception | Raise the floor to >=3.8.1 in pyproject.toml. |
| low | pypi:vtk |
our range allows vtk 9.2.2, which has 3 known advisories | PYSEC-2025-224 (medium, fixed in 9.5.1): Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionW; PYSEC-2025-225 (medium, fixed in 9.5.1): Kitware VTK (Visualization Toolkit) through 9.5.0 contai | Raise the floor to >=9.5.1 in pyproject.toml. |
| low | webkit:mermaid |
katex 0.16.47, bundled inside a vendored file, has 1 known advisory | GHSA-238p-pmpm-9mq7 (low, fixed in 0.18.2): KaTeX: Existing prototype pollution can bypass trust restrictions | katex comes inside another library's file: take the first release of that library that bundles katex >=0.18.2, and say in the receipt whether the affected code is reachable. |
| low | url:https://cadarena.dev/ |
no licence recorded for CAD Arena | research/landscape.json benchmarks; research/landscape.md:194 | Record the licence (or "none": ideas only). |
| low | url:https://github.com/Kamel773/CAD_Code_Generation |
no licence recorded for CADPrompt/CADCodeVerify | research/landscape.json benchmarks | Record the licence (or "none": ideas only). |
| low | repo:dependabot-npm |
Dependabot does not watch npm (package.json) | .github/dependabot.yml ecosystems: github-actions | Add a weekly npm entry targeting dev (owner decision: it opens PRs). |
| low | repo:dependabot-pip |
Dependabot does not watch pip (pyproject.toml) | .github/dependabot.yml ecosystems: github-actions | Add a weekly pip entry targeting dev (owner decision: it opens PRs). |
| low | doc:docs/web-diagrams.md |
docs/web-diagrams.md runs playwright without a version | docs/web-diagrams.md:59: 'npx playwright install chromium' | Pin it (playwright==X or playwright@X), so a later release cannot change what runs. |
| low | doc:research/landscape.md |
research/landscape.md runs cadgen without a version | research/landscape.md:96: 'uvx cadgen telemetry off' | Pin it (cadgen==X or cadgen@X), so a later release cannot change what runs. |
| low | doc:research/landscape.md |
research/landscape.md runs kicad-mcp-pro without a version | research/landscape.md:132: 'uvx kicad-mcp-pro' | Pin it (kicad-mcp-pro==X or kicad-mcp-pro@X), so a later release cannot change what runs. |
| low | url:https://github.com/Kamel773/CAD_Code_Generation |
Kamel773/CAD_Code_Generation has no licence GitHub can detect | https://github.com/Kamel773/CAD_Code_Generation |
Without a licence it is all rights reserved: ideas only, never copied code. |
| low | pypi:numpy |
numpy has no lower version bound in cad, required | pyproject.toml: cad: numpy, required: numpy | Set a floor at a release without known advisories (and the oldest one you are willing to support), so an install with old pins cannot pick something worse. |
| low | pypi:pyyaml |
pyyaml has no lower version bound in required | pyproject.toml: required: pyyaml | Set a floor at a release without known advisories (and the oldest one you are willing to support), so an install with old pins cannot pick something worse. |
| low | url:https://github.com/AutodeskAILab/JoinABLe |
no push to AutodeskAILab/JoinABLe for over a year | last push 2022-04-22 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/ElmerCSC/elmerfem-docker |
no push to ElmerCSC/elmerfem-docker for over a year | last push 2021-03-09 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/Gary-code/CADReview |
no push to Gary-code/CADReview for over a year | last push 2025-08-08 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/Kamel773/CAD_Code_Generation |
no push to Kamel773/CAD_Code_Generation for over a year | last push 2025-02-28 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/Mechanical-Python/SnapFit_Calculator |
no push to Mechanical-Python/SnapFit_Calculator for over a year | last push 2022-03-16 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/SadilKhan/Text2CAD |
no push to SadilKhan/Text2CAD for over a year | last push 2025-05-15 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/anniedoris/CAD-Coder |
no push to anniedoris/CAD-Coder for over a year | last push 2025-07-17 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/artofscience/flexures |
no push to artofscience/flexures for over a year | last push 2023-11-06 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/buxtronix/living-hinge |
no push to buxtronix/living-hinge for over a year | last push 2024-05-31 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/calculix/beso |
no push to calculix/beso for over a year | last push 2025-04-03 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/dimitrismallis/CAD-Assistant |
no push to dimitrismallis/CAD-Assistant for over a year | last push 2025-10-30 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/dl4to/dl4to |
no push to dl4to/dl4to for over a year | last push 2024-11-19 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/kovacsv/occt-import-js |
no push to kovacsv/occt-import-js for over a year | last push 2024-12-03 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/lamaalrajih/kicad-mcp |
no push to lamaalrajih/kicad-mcp for over a year | last push 2025-10-17 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/missionlab/fenitop |
no push to missionlab/fenitop for over a year | last push 2024-11-01 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/nohkumado/openscad_snapfit |
no push to nohkumado/openscad_snapfit for over a year | last push 2021-11-01 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/secnot/rectpack |
no push to secnot/rectpack for over a year | last push 2021-11-24 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/sgsellan/swept-volumes |
no push to sgsellan/swept-volumes for over a year | last push 2024-07-18 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/skyneticist/flexure-hinge-calculator |
no push to skyneticist/flexure-hinge-calculator for over a year | last push 2025-06-08 | Check it is still maintained; if not, show it as "unmaintained". |
| low | url:https://github.com/tamasmeszaros/libnest2d |
no push to tamasmeszaros/libnest2d for over a year | last push 2024-05-03 | Check it is still maintained; if not, show it as "unmaintained". |
| low | webkit:occt-import-js |
no push to kovacsv/occt-import-js for over a year | last push 2024-12-03 | Check it is still maintained; if not, show it as "unmaintained". |
| low | vendor:kicad-mcp-pro |
3 upstream files of kicad-mcp-pro are neither vendored nor excluded | .mcp.json, .vscode/extensions.json, .vscode/mcp.example.json (3 of them ignored by a .gitignore, so never committed) | Add them to the manifest exclude list with a reason (or commit them), so the record says what was left out. |
| low | webkit:fonts |
5 vendored files in fonts have no recorded hash | fonts/OFL-Inter.txt, fonts/OFL-JetBrainsMono.txt, fonts/fonts.css, fonts/inter.woff2, fonts/jetbrains-mono.woff2 | Record their SHA-256 and source (as mermaid/SOURCE.json does), so a silent change is caught. |
| low | webkit:three |
5 vendored files in three have no recorded hash | three/addons/controls/OrbitControls.js, three/addons/geometries/RoundedBoxGeometry.js, three/addons/loaders/STLLoader.js, three/addons/utils/BufferGeometryUtils.js, three/three.module.min.js | Record their SHA-256 and source (as mermaid/SOURCE.json does), so a silent change is caught. |
Info (12)
12 info: 11 link-unverified, 1 py-no-floor
| Severity | Subject | Finding | Evidence | Action |
|---|---|---|---|---|
| info | url:https://develop.openfoam.com/Development/openfoam |
develop.openfoam.com did not answer | The read operation timed out (upstreams/registry.yaml) | Check by hand; run again later. |
| info | url:https://help.solidworks.com/2022/English/SolidWorks/sldworks/c_K_Factor.htm |
help.solidworks.com answered HTTP 403 | research/process-profiles.md:729 | Many sites refuse scripts; check by hand. |
| info | url:https://hull-repository.worktribe.com/output/4511720/interlayer-bonding-has-bulk-material-strength-in-extrusion-additive-manufacturing-new-understanding-of-anisotropy |
hull-repository.worktribe.com answered HTTP 403 | research/compliant-mechanisms.md:292 | Many sites refuse scripts; check by hand. |
| info | url:https://openelab.io/products/seeed-studio-recomputer-mini-j501-heatsink |
openelab.io answered HTTP 429 | research/simulation-tools.md:198 | Many sites refuse scripts; check by hand. |
| info | url:https://www.autodesk.com/products/fusion-360/blog/fusion-compute-mcp/ |
www.autodesk.com answered HTTP 403 |
research/agent-toolkits-2026-10.md:49 | Many sites refuse scripts; check by hand. |
| info | url:https://www.elegoo.com/blogs/3d-printer-user-guide/mastering-hollowing-and-adding-holes-in-elegoo-satellite |
www.elegoo.com answered HTTP 429 |
research/process-profiles.md:704 | Many sites refuse scripts; check by hand. |
| info | url:https://www.iso.org/standard/67289.html |
www.iso.org answered HTTP 403 |
research/process-profiles.md:733 | Many sites refuse scripts; check by hand. |
| info | url:https://www.iso.org/standard/7748.html |
www.iso.org answered HTTP 403 |
research/process-profiles.md:730 | Many sites refuse scripts; check by hand. |
| info | url:https://www.mouser.com/pdfDocs/Jetson_AGX_Orin_Series_TDG-10943-001_v11.pdf |
www.mouser.com did not answer |
The read operation timed out (research/simulation-tools.md:189) | Check by hand; run again later. |
| info | url:https://www.plasticstoday.com/plastics-processing/can-this-part-be-saved-part-3-living-hinges |
www.plasticstoday.com answered HTTP 403 |
research/compliant-mechanisms.md:335 | Many sites refuse scripts; check by hand. |
| info | url:https://xometry.pro/en/articles/fdm-design-tips/ |
xometry.pro answered HTTP 403 | research/process-profiles.md:670 | Many sites refuse scripts; check by hand. |
| info | pypi:pytest |
pytest has no lower version bound in dev | pyproject.toml: dev: pytest | Set a floor at a release without known advisories (and the oldest one you are willing to support), so an install with old pins cannot pick something worse. |
What we depend on
22 Python packages (75 more pulled in), 22 npm packages, 6 vendored projects, 6 web kit folders, 418 links, 13 skills and agents
Python dependencies
| Extra | Direct | With transitive (deps.dev, newest releases) |
|---|---|---|
| required | 2 | 2 |
| cad | 6 | 45 |
| robot | 1 | 10 |
| sim | 10 | 41 |
| site | 1 | 1 |
| fea | 5 | 23 |
| explore | 1 | 11 |
| dev | 1 | 5 |
75 transitive packages (at the versions deps.dev resolves) were also checked against OSV; findings on them name the direct dependency they come through.
Table 22 rows: Package, Extras, Range, Newest, …
| Package | Extras | Range | Newest | Released | Licence | Lowest allowed | Advisories (newest / lowest) |
|---|---|---|---|---|---|---|---|
cadquery |
cad | >=2.4 | 2.8.0 | 2026-06-21 | Apache Public License 2.0 | 2.4.0 | 0 / 0 |
gmsh |
fea | >=4.11 | 4.15.2 | 2026-03-24 | GPLv2+ | 4.11.0 | 0 / 0 |
imageio |
sim | >=2.30 | 2.38.1 | 2026-10-08 | BSD-2-Clause | 2.30.0 | 0 / 0 |
imageio-ffmpeg |
sim | >=0.5 | 0.7.0 | 2026-10-28 | BSD-2-Clause | 0.5.0 | 0 / 0 |
manifold3d |
sim | >=2.4 | 3.5.4 | 2026-09-25 | Apache Software License | 2.4.5 | 0 / 0 |
markdown |
site | >=3.5 | 3.11.2 | 2026-10-19 | BSD-3-Clause | 3.5 | 0 / 1 |
matplotlib |
cad, fea, sim | >=3.7 | 3.11.2 | 2026-09-11 | Python Software Foundation License | 3.7.0 | 0 / 0 |
mujoco |
robot | >=3 | 3.17.0 | 2026-10-22 | Apache-2.0 | 3.0.0 | 0 / 0 |
numpy |
cad, required | any | 2.5.4 | 2026-10-10 | BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 | 0 / 0 | |
optuna |
explore | >=3.4 | 5.0.0 | 2026-09-07 | MIT License | 3.4.0 | 0 / 0 |
pillow |
cad, sim | >=10.0 | 13.0.0 | 2026-10-16 | MIT-CMU | 10.0.0 | 0 / 53 |
pyamg |
fea | >=5 | 5.4.1 | 2026-10-30 | MIT License | 5.0.0 | 0 / 0 |
pymoto |
sim | >=2.0 | 2.0.1 | 2026-05-07 | MIT | 2.0.0 | 0 / 0 |
pypardiso |
fea | >=0.4 | 0.4.7 | 2025-11-02 | BSD-3-Clause | 0.4.0 | 0 / 0 |
pytest |
dev | any | 9.2.0 | 2026-10-27 | MIT | 0 / 0 | |
pyvista |
sim | >=0.44 | 0.49.2 | 2026-10-28 | MIT | 0.44.0 | 0 / 0 |
pyyaml |
required | any | 6.0.3 | 2025-09-25 | MIT | 0 / 0 | |
rtree |
sim | >=1.0 | 1.4.1 | 2025-08-13 | MIT | 1.0.0 | 0 / 0 |
scikit-fem |
fea | >=9 | 12.0.2 | 2026-06-05 | BSD License | 9.0.0 | 0 / 0 |
scipy |
sim | >=1.10 | 1.18.1 | 2026-08-21 | BSD License | 1.10.0 | 0 / 0 |
trimesh |
cad, sim | >=4.0 | 5.2.0 | 2026-10-24 | MIT License | 4.0.0 | 0 / 0 |
vtk |
cad | >=9.2 | 9.7.1 | 2026-09-28 | BSD | 9.2.2 | 0 / 3 |
npm (site build and browser tests)
4 direct, 22 packages in the lockfile including transitive.
Table 22 rows: Package, Version, Direct, Dev, …
| Package | Version | Direct | Dev | Licence | Install script | Advisories |
|---|---|---|---|---|---|---|
@playwright/test |
1.56.1 | yes | yes | Apache-2.0 | 0 | |
dayjs |
1.11.23 | yes | MIT | 0 | ||
dom-serializer |
3.1.1 | yes | MIT | 0 | ||
domelementtype |
3.0.0 | yes | BSD-2-Clause | 0 | ||
domhandler |
6.0.1 | yes | BSD-2-Clause | 0 | ||
domutils |
4.0.2 | yes | BSD-2-Clause | 0 | ||
entities |
8.1.0 | yes | BSD-2-Clause | 0 | ||
escape-string-regexp |
4.0.0 | yes | MIT | 0 | ||
fsevents |
2.3.2 | yes | MIT | yes | 0 | |
htmlparser2 |
12.0.0 | yes | MIT | 0 | ||
is-plain-object |
5.1.0 | yes | MIT | 0 | ||
launder |
1.7.2 | yes | MIT | 0 | ||
marked |
16.4.1 | yes | yes | MIT | 0 | |
nanoid |
3.3.20 | yes | MIT | 0 | ||
parse-srcset |
1.0.2 | yes | MIT | 0 | ||
picocolors |
1.1.1 | yes | ISC | 0 | ||
playwright |
1.56.1 | yes | Apache-2.0 | 0 | ||
playwright-core |
1.56.1 | yes | Apache-2.0 | 0 | ||
postcss |
8.5.32 | yes | MIT | 0 | ||
sanitize-html |
2.18.1 | yes | yes | MIT | 0 | |
source-map-js |
1.2.2 | yes | BSD-3-Clause | 0 | ||
yaml |
2.9.1 | yes | yes | ISC | 0 |
Vendored code (vendor/)
| Project | Pinned | Imported | Licence (manifest / file) | Files | Skills | Upstream | Behind | Scorecard | Drift |
|---|---|---|---|---|---|---|---|---|---|
| agentcad | 52af472ddade |
2026-10-24 | Apache-2.0 / Apache-2.0 | 234 | 0 | ok | 15 | 0 changed, 0 added, 0 missing (234 compared) | |
| bd_warehouse | e6ae6e7bae74 |
2026-10-24 | Apache-2.0 / Apache-2.0 | 123 | 0 | ok | 2 | 0 changed, 0 added, 0 missing (123 compared) | |
| build123d-mcp | 59b256121886 |
2026-10-24 | Apache-2.0 / Apache-2.0 | 175 | 4 | ok | 0 | 0 changed, 0 added, 0 missing (175 compared) | |
| kicad-happy | 2fd9aa0fe2d6 |
2026-10-24 | MIT / MIT | 213 | 11 | ok | 0 | 0 changed, 0 added, 0 missing (213 compared) | |
kicad-mcp-pro (https://github.com/oaslananka/kicad-mcp-pro) |
f03b478f597d |
2026-10-24 | MIT / MIT | 2088 | 30 | ok | 98 | 8.7 | 0 changed, 0 added, 3 missing (2088 compared) |
| text-to-cad | 2f793659fb7b |
2026-10-24 | MIT / MIT | 1864 | 13 | ok | 19 | 0 changed, 0 added, 0 missing (1864 compared) |
Web kit (src/cadagent/webkit/vendor/)
| Folder | Packages | Bundled inside | Files | Hashed | Matches its npm package | Newest | Advisories |
|---|---|---|---|---|---|---|---|
file-parsers |
[email protected], [email protected] | 5 | 5 | fflate: 2 of 2 | fflate 0.8.3, three 0.187.0 | 0 | |
fonts |
5 | 0 | 0 | ||||
linkedom |
[email protected] | 2 | 2 | linkedom 0.18.15 | 0 | ||
mermaid |
[email protected] | [email protected], [email protected] | 3 | 2 | mermaid: 2 of 2 | dompurify 3.4.17, katex 0.19.1, mermaid 12.2.0 | 6 |
occt-import-js |
[email protected] | 31 | 31 | occt-import-js 0.0.23 | 0 | ||
three |
[email protected] | 5 | 0 | three 0.187.0 | 0 |
Links we send people to
73 catalogue links (catalog.json, upstreams/registry.yaml, research/landscape.json) and 345 more in published pages; 42 have findings above.
Skills and agents
Table 13 rows: Item, Kind, Source, Version
| Item | Kind | Source | Version |
|---|---|---|---|
cad-pr-reviewer |
agent | this repository | 3c0a609b205b |
cad-resume |
agent | this repository | 3c0a609b205b |
cad-motion-validation |
skill | this repository | 3c0a609b205b |
cad-pr-review |
skill | this repository | 3c0a609b205b |
cad-remote-runs |
skill | this repository | 3c0a609b205b |
cad-supply-chain |
skill | this repository | 3c0a609b205b |
cad-work-tracking |
skill | this repository | 3c0a609b205b |
design-process |
skill | this repository | 3c0a609b205b |
mcmaster-parts |
skill | this repository | 3c0a609b205b |
build123d-mcp |
4 vendored skills | https://github.com/pzfreo/build123d-mcp | 59b256121886 |
kicad-happy |
11 vendored skills | https://github.com/aklofas/kicad-happy | 2fd9aa0fe2d6 |
kicad-mcp-pro |
30 vendored skills | https://github.com/oaslananka/kicad-mcp-pro | f03b478f597d |
text-to-cad |
13 vendored skills | https://github.com/earthtojake/text-to-cad | 2f793659fb7b |
Sources
8 sources, with how each was reached
- deps.dev: api.deps.dev v3 dependency graphs (newest releases)
- github: GitHub REST API (gh)
- npm-audit: npm audit --package-lock-only
- npm-registry: registry.npmjs.org (abbreviated metadata)
- offline: pyproject.toml, package.json, package-lock.json, vendor/manifest.json, kit hash records, THIRD_PARTY_NOTICES.md, upstreams/registry.yaml, research/landscape.json, published Markdown
- osv: osv.dev querybatch and vulns
- pypi: pypi.org JSON API
- scorecard: api.securityscorecards.dev