Skip to content

feat: add source_url to framework_sources #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chaksaray merged 1 commit into from
Sep 9, 2026
+32 −0
Merged

feat: add source_url to framework_sources #266

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions docs/terms-relationships.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,3 +74,14 @@ OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that
prompted the field, where two independent projects assigned the same MCP
category number to genuinely unrelated categories because each read the
spec at a different point while it was still moving.
`framework_sources.*.source_url` was added afterward, once an unrelated
project facing the same #52 gap converged on the same shape:
BerkantACUN/guardmcp PR #3 ("Pin the OWASP spec commit the mapping was
drafted against") pins its SARIF taxonomy to the OWASP MCP Top 10 with a
`specCommit`/`specSource` pair -- not a comment posted in #52 itself, a
separate repo's independent fix for the versioning gap #52 describes --
and its `specCommit` happens to be the exact same commit sha AVE's own
`owasp_mcp` backfill pinned, `165fe0f78ef104459237b4a8e0f6e78db9b02391`.
`source_url` mirrors `specSource`: the resolved tree URL at `commit`, so
a reader can check the mapping without reconstructing it from repo and
sha by hand. Optional even when `commit` is present.
11 changes: 11 additions & 0 deletions docs/terms.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,17 @@ OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that
prompted the field, where two independent projects assigned the same MCP
category number to genuinely unrelated categories because each read the
spec at a different point while it was still moving.
`framework_sources.*.source_url` was added afterward, once an unrelated
project facing the same #52 gap converged on the same shape:
BerkantACUN/guardmcp PR #3 ("Pin the OWASP spec commit the mapping was
drafted against") pins its SARIF taxonomy to the OWASP MCP Top 10 with a
`specCommit`/`specSource` pair -- not a comment posted in #52 itself, a
separate repo's independent fix for the versioning gap #52 describes --
and its `specCommit` happens to be the exact same commit sha AVE's own
`owasp_mcp` backfill pinned, `165fe0f78ef104459237b4a8e0f6e78db9b02391`.
`source_url` mirrors `specSource`: the resolved tree URL at `commit`, so
a reader can check the mapping without reconstructing it from repo and
sha by hand. Optional even when `commit` is present.

<!-- GENERATED FROM schema/ave-record-1.1.0.schema.json, DO NOT HAND-EDIT BELOW THIS LINE -->

Expand Down
5 changes: 5 additions & 0 deletions schema/ave-record-1.1.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -615,6 +615,11 @@
"pattern": "^[0-9a-f]{40}$",
"description": "Full 40-character commit sha pinning the tree this mapping was read against, where the referenced framework has git history to pin. Same convention as crosswalk endpoint commit pinning: full, not abbreviated."
},
"source_url": {
"type": "string",
"format": "uri",
"description": "The resolved tree URL at commit, where a reader can go check the mapping directly without reconstructing it from commit and repo. Optional even when commit is present. Matches the specCommit/specSource pairing independently designed by BerkantACUN/guardmcp (PR #3, 'Pin the OWASP spec commit the mapping was drafted against') for the same OWASP MCP Top 10 versioning gap OWASP/www-project-mcp-top-10#52 raised and this field exists to close -- guardmcp's PR pins the identical commit sha AVE's own owasp_mcp backfill used (165fe0f78ef104459237b4a8e0f6e78db9b02391), independent convergence on the same fix from two unrelated projects reading the same gap."
},
"read_date": {
"type": "string",
"format": "date",
Expand Down
5 changes: 5 additions & 0 deletions schema/ave-record.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -615,6 +615,11 @@
"pattern": "^[0-9a-f]{40}$",
"description": "Full 40-character commit sha pinning the tree this mapping was read against, where the referenced framework has git history to pin. Same convention as crosswalk endpoint commit pinning: full, not abbreviated."
},
"source_url": {
"type": "string",
"format": "uri",
"description": "The resolved tree URL at commit, where a reader can go check the mapping directly without reconstructing it from commit and repo. Optional even when commit is present. Matches the specCommit/specSource pairing independently designed by BerkantACUN/guardmcp (PR #3, 'Pin the OWASP spec commit the mapping was drafted against') for the same OWASP MCP Top 10 versioning gap OWASP/www-project-mcp-top-10#52 raised and this field exists to close -- guardmcp's PR pins the identical commit sha AVE's own owasp_mcp backfill used (165fe0f78ef104459237b4a8e0f6e78db9b02391), independent convergence on the same fix from two unrelated projects reading the same gap."
},
"read_date": {
"type": "string",
"format": "date",
Expand Down
Loading