Source Audit of lexmount/moli at d56bbd7: the README’s Lexbench figures describe Moli 0.1.1 in a 1.1.7 tree, and its efficiency map joins two runs the benchmark keeps apart.

Source Audit of getagentseal/codeburn at 3684f1d: the README says the hard cap stops the session; Claude Code hooks offer continue:false for that, the guard sends a per-tool deny.

Source Audit of openocta/openocta at 0c7dac2: the LICENSE file went GPL-3.0, Apache-2.0, then GPL-3.0 again on 16 Sep 2026, while both READMEs still say Apache-2.0.

Source Audit of agent-infra/sandbox: its quick starts and compose file drop Docker’s seccomp filter, shipped API contracts declare zero auth, and the runtime is a prebuilt image.

Source Audit of deer-flow/llm-space 4.19.0: the telemetry contract holds in code, but provider API keys land in a models.json written without the 0600 mode the plugin store uses.

Source Audit of oomol-lab/open-connector: the security policy’s do-not-report list names the defaults its quickstart ships, and anonymous proxy calls outrank scoped tokens.

Source Audit of CoplayDev/unity-mcp: the script built to stop stale release notes ships a –check mode no workflow runs, and its two files sit four releases behind.

Source Audit of NVlabs/SoL-Pi: a per-mechanism capability gate permits losses that accumulate until the assembled harness retains roughly 94% of Pi’s EdgeBench average.

A pinned-commit read of TradingAgents and LibreChat: what adopting open source actually transfers, what it never removes, and why these two are not substitutes.