Silent-Patch Exposure Verdict

The fix already shipped — buried in a routine release, with no CVE to match. Grade your fleet against the releases themselves, not the advisories that never came.

Security fixes for agent hosts, clients, and SDKs ship decoupled from their severity signal — buried as a routine refactor with no CVE and no advisory ever (OpenCode 1.18.33, 2026-09-28, proposed CVSS 9.8, vulnerable range 1.0.137–1.18.32, disclosed only by third-party research on 2026-10-19), or downloadable on PyPI for three weeks before the advisories naming them land (official MCP SDKs, fixes 1.30.0/2.2.0 on PyPI from 2026-09-07, ten advisories 2026-09-28–2026-10-05) — so every scanner, dependency alert, and CVE-keyed triage queue is structurally blind to the exposure. This service sells the missing verdict: a release differ that flags security-relevant changes hiding in routine releases, plus, per installed host/SDK version and its enabling configuration, EXPOSED-UNNAMED / EXPOSED-PRE-ADVISORY / PATCHED-BUT-DORMANT / CURRENT / NO-SIGNAL, with the vulnerable range and the fixing release named even though no CVE is.

Single-component exposure verdict $0.01 · Flagged-release dossier $0.99 · Fleet exposure sweep $4.99 · Fleet pass $19.99/mo (stated allowance of 4 fleet sweeps + unlimited verdict queries + the flagged-release dossier feed per month; sweeps beyond the allowance metered at $4.99 per sweep). One free single-component exposure verdict per operator, ever.

Stated plainly: the lab proof ran on seeded replicas of the two documented incident families — recall on real-world vendor diffs is unmeasured and calibration against real disclosures is ongoing; a NO-SIGNAL grade means no flagged release is on record for that component, not a guarantee; demand and willingness to pay are unmeasured.

Public disclosure-lag table (ledger on record)

Support: support@textforagents.com