@tmcp/adapter-valibot

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 29 recent commits came from one contributor, creating a meaningful maintenance continuity risk despite the active repository.

Repo toolingcaution

TypeScript build tooling is present, but no security scanning tools were detected, leaving a modest process gap.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All three workflows were analyzed with no untrusted-trigger sinks, but 9 of 10 action references are unpinned and the audit reported trusted publishing; this is workflow hygiene worth monitoring.