Trust & quality

Delivery gates

Every change runs these locally and in CI on every push and pull request; they gate merges.

• npm run typecheckTypes — tsc --noEmit, strict mode
• npm run lintLint — eslint, zero errors permitted
• npm testTests — 397 unit + integration tests
• npm run buildBuild — tsc build
• npm run test:e2eGenerated project actually builds — a project built from every component runs a real npm install + next build

Kept up to date

• Daily freshness CI rebuilds every component and the full combination and runs `npm outdated` (component-freshness.yml).
• search_components returns a live `freshness` field (status / checkedAt / outdatedDependencies) so an agent can skip a component whose last build failed.
• check_component_updates reports when a newer, re-validated version of what you pinned is available.
• Dependabot opens grouped dependency + GitHub-Actions update PRs weekly.

Provenance

All catalog components cite three source types — docs, github-releases, github-examples — each a real URL with a verifiedAt date (and a commit SHA for examples), enforced by schema + test. Source of truth is https://github.com/botkelp/components. You can open the cited source and diff the generated code against the official pattern.

Security posture

• npm audit runs daily and on every push; high/critical fail the build. Current state: 0 vulnerabilities.
• verify_scaffold runs untrusted, caller-supplied builds on an isolated GitHub Actions runner with no secrets and no repo token (permissions: {}), with a path-traversal guard and a hard timeout.
• Every user-scoped table has row-level security with auth.uid() policies, enforced by a test that fails the build if a policy is dropped.
• x402 (USDC) payments are verified against the facilitator before a tool runs and settled only after it succeeds.
• API keys are hashed at rest; raw keys are shown once, never stored or logged. Rate limiting and an explicit CORS allowlist on the HTTP host.

Validate the code we generate — with third-party tools

The scaffold BotKelp returns is ordinary source with exact version pins, a strict tsconfig, an ESLint config, and a real build. Point any standard third-party tool at it — you do not have to trust us.

The project's own guardrails

npm install
npx tsc --noEmit
npm run lint
npm run build

Independent scanners (all third-party)

npm audit --audit-level=moderate
npx osv-scanner --lockfile=package-lock.json
npx @socketsecurity/cli scan create .
npx snyk test
trivy fs .
npm outdated

BotKelp's own validation (any MCP client)

• verify_scaffold — real npm install + build on an isolated runner; returns OK / WAIT / FAIL with the compiler error
• search_components — freshness + sources fields to refuse a stale component
• check_component_updates — newer re-validated versions of what you use