[kory-io]

Enrol projects/nestweaver

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

To sign the CLA, post a comment on this pull request that contains only this line: I have read the CLA Document and I hereby sign the CLA

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

Context (optional): if you believe it is not obvious why your project qualifies for our inclusion criteria, you may write a brief note here to explain why you feel it does.

NestWeaver (MIT) is a Rust codebase-intelligence tool. It builds a knowledge graph over source repositories and Markdown vaults and serves it to AI coding agents through an MCP server (stdio and HTTP), a gRPC server, a CLI and a local web UI. It is distributed through npm and GitHub releases (12.x).

Its security-relevant surface is broad and is mostly fed untrusted input:

• It parses arbitrary third-party repositories with around 30 tree-sitter grammars and custom parsers.
• It parses YAML frontmatter and Markdown.
• It takes tool arguments from AI agents, which can be steered by prompt injection.
• In server mode it accepts webhooks and clones remote git URLs, with SSRF guards.
• It links a C++ graph database (LadybugDB) through FFI.

Notes on this submission:

• The Dockerfile and threat model are added to the NestWeaver repository by chore(security): add oss scanner build and threat model Kehl-io/nestweaver#506. Until that merges, main will not have .oss-scanner/.
• .github/SECURITY.md names primary_contact as the security contact.
• tools/check has not been run end to end yet. The image is about 31 GB and did not fit in my local Docker VM's disk. The Dockerfile itself builds with docker build on linux/arm64, and its in-image unit tests run. I'll update this PR once tools/check nestweaver has run on a larger machine.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/nestweaver

Repository: Kehl-io/nestweaver at main · opened by kory-io

	Check	Result
⚠️	Repository	under 6 months old (created 4 months ago, last push today)
⚠️	Stars / forks	no watchers: little sign that others use it (11 stars · 10 forks · 0 watching)
⚠️	Outside participants	none: the last 50 issues and pull requests were all opened by the project's own people or by bots
ℹ️	Criticality score	0.40 on the OpenSSF scale of 0 to 1 signals created_since 4, updated_since 0, contributor_count 5, org_count 1, commit_frequency 64.8, recent_releases_count 100, closed_issues_count 344, updated_issues_count 345, comment_frequency 0.3, dependents_count 27
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI or the top 10,000 on npm or the top 1,000 on crates.io
✅	License	MIT
✅	Opened by an active maintainer	merged 100 of the last 100 pull requests; 100+ commits in the last 12 months; #1 contributor
✅	Contact in SECURITY.md	kory@kehl.io is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
✅	.oss-scanner/ in the repository	present (Dockerfile, Dockerfile.dockerignore, threat_model.md); Dockerfile at .oss-scanner/Dockerfile
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
⚠️	Checklist	1 of 8 not ticked: 'tools/check <name>' builds the project, and its tests run in the shell that fol…

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[kory-io]

I have read the CLA Document and I hereby sign the CLA