v1.0.1: shipcheck treatment — SECURITY.md, logo, hint field

- Add SECURITY.md with attack surface analysis and reporting policy
- Add hint field to ValidationIssue (Tier 1 error shape compliance)
- Add hints to key validation issues (MISSING_ID, MISSING_PATH, EMPTY_KEYWORDS)
- Expand README security section with threat model table
- Add logo, fix broken image reference
- Include SECURITY.md and logo.png in npm package

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mcp-tool-shop

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.0.1 — 2026-03-06
+
+- Add `hint` field to `ValidationIssue` (Tier 1 error shape compliance)
+- Add hints to key validation issues (MISSING_ID, MISSING_PATH, EMPTY_KEYWORDS)
+- Add SECURITY.md with threat model
+- Expand README security section with threat model table
+- Add logo
+- Include SECURITY.md and logo.png in npm package
+
 ## 1.0.0 — 2026-03-06
 
 Initial release.

README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="https://raw.githubusercontent.com/mcp-tool-shop-org/brand/main/logos/ai-loadout/readme.png" width="400" alt="ai-loadout">
+  <img src="logo.png" width="400" alt="ai-loadout">
 </p>
 
 <p align="center">
@@ -176,6 +176,17 @@ import type {
 
 This package is a pure data library. It does not access the filesystem, make network requests, or collect telemetry. All I/O is the consumer's responsibility.
 
+### Threat Model
+
+| Threat | Mitigation |
+|--------|------------|
+| Malformed frontmatter input | `parseFrontmatter()` returns `null` on invalid input — no exceptions, no eval |
+| Prototype pollution | Hand-rolled parser uses plain object literals, no `JSON.parse` of untrusted nested structures |
+| Index with bad data | `validateIndex()` catches structural issues before they propagate |
+| Regex DoS | No user-supplied regex — patterns are matched as plain string lookups |
+
+See [SECURITY.md](SECURITY.md) for the full security policy.
+
 ---
 
 Built by [MCP Tool Shop](https://mcp-tool-shop.github.io/)

SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Attack Surface
+
+`@mcptoolshop/ai-loadout` is a **pure data library**. It has:
+
+- **No filesystem access** — does not read or write files
+- **No network access** — makes no HTTP requests, opens no sockets
+- **No code execution** — no `eval`, `Function()`, or dynamic imports
+- **No telemetry** — collects and transmits nothing
+- **No native dependencies** — pure TypeScript, zero production deps
+
+All I/O is the consumer's responsibility. This package only transforms data structures in memory.
+
+## Input Validation
+
+The `parseFrontmatter()` function processes untrusted text input. It uses simple string splitting — no YAML parser, no regex-based evaluation, no prototype pollution vectors.
+
+The `validateIndex()` function checks structural integrity of index objects. It does not execute or interpret any field values.
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 1.x     | Yes       |
+
+## Reporting a Vulnerability
+
+If you discover a security issue, please email **64996768+mcp-tool-shop@users.noreply.github.com** with:
+
+- Description of the vulnerability
+- Steps to reproduce
+- Impact assessment
+
+We will respond within 7 days and aim to release a fix within 14 days for confirmed issues.

logo.png

@@ -1,6 +1,6 @@
 {
   "name": "@mcptoolshop/ai-loadout",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Context-aware knowledge router for AI agents. Dispatch table, frontmatter spec, keyword matcher, token estimator.",
   "type": "module",
   "main": "dist/index.js",
@@ -21,7 +21,9 @@
     "dist",
     "README.md",
     "CHANGELOG.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md",
+    "logo.png"
   ],
   "keywords": [
     "ai",

package.json

@@ -65,6 +65,7 @@ export interface ValidationIssue {
   severity: IssueSeverity;
   code: string;
   message: string;
+  hint?: string;
   entryId?: string;
 }
 

src/types.ts

@@ -60,6 +60,7 @@ export function validateIndex(index: LoadoutIndex): ValidationIssue[] {
         severity: "error",
         code: "MISSING_ID",
         message: "Entry is missing an id field",
+        hint: "Every entry needs a unique kebab-case id",
       });
       continue;
     }
@@ -91,6 +92,7 @@ export function validateIndex(index: LoadoutIndex): ValidationIssue[] {
         severity: "error",
         code: "MISSING_PATH",
         message: `Entry "${entry.id}" has no path`,
+        hint: "Set path to the relative file location (e.g. .claude/rules/my-rule.md)",
         entryId: entry.id,
       });
     }
@@ -128,6 +130,7 @@ export function validateIndex(index: LoadoutIndex): ValidationIssue[] {
         severity: "error",
         code: "EMPTY_KEYWORDS",
         message: `Domain entry "${entry.id}" has no keywords — cannot be routed`,
+        hint: "Add keywords to frontmatter so the matcher can find this entry",
         entryId: entry.id,
       });
     }