{
  "specVersion": "0.1",
  "host": {
    "name": "Pipefort",
    "domain": "pipefort.com",
    "description": "CI/CD security posture management. Scans GitHub Actions and GitLab CI pipelines against ~74 deterministic rules covering the OWASP CI/CD Top 10, scores third-party GitHub Actions, and auto-fixes insecure workflows.",
    "url": "https://pipefort.com",
    "documentation": "https://docs.pipefort.com",
    "contact": "https://pipefort.com"
  },
  "entries": [
    {
      "id": "urn:air:pipefort.com:api:public-api",
      "displayName": "Pipefort Public API",
      "description": "Unauthenticated REST API for scanning a public GitHub repository's CI/CD workflows, reading security scores for published GitHub Actions, and hardening a workflow YAML. No credentials required.",
      "type": "application/openapi+json",
      "url": "https://pipefort.com/openapi.json",
      "representativeQueries": [
        "Is this GitHub repository's CI/CD pipeline secure?",
        "Scan a repo's GitHub Actions workflows for OWASP CI/CD Top 10 issues",
        "How safe is the third-party GitHub Action I'm about to use?",
        "Rewrite my workflow file with security hardening applied",
        "Which CI/CD security rules does this repository fail?"
      ]
    },
    {
      "id": "urn:air:pipefort.com:catalog:api-catalog",
      "displayName": "API Catalog",
      "description": "RFC 9727 linkset indexing every machine-readable description of the Pipefort API: OpenAPI spec, human documentation, and the health endpoint.",
      "type": "application/linkset+json",
      "url": "https://pipefort.com/.well-known/api-catalog",
      "representativeQueries": [
        "Where is Pipefort's API documented?",
        "Find the OpenAPI specification for Pipefort",
        "What APIs does pipefort.com expose?"
      ]
    },
    {
      "id": "urn:air:pipefort.com:skills:agent-skills",
      "displayName": "Pipefort Agent Skills",
      "description": "Installable agent skills that teach an autonomous agent how to scan a repository, vet a GitHub Action before adding it to a workflow, and harden a workflow file using the Pipefort public API.",
      "type": "application/json",
      "url": "https://pipefort.com/.well-known/agent-skills/index.json",
      "representativeQueries": [
        "Give me a skill for auditing CI/CD pipeline security",
        "How do I teach my agent to harden GitHub Actions workflows?",
        "Agent skill for checking GitHub Action supply-chain risk"
      ]
    },
    {
      "id": "urn:air:pipefort.com:docs:rule-catalog",
      "displayName": "CI/CD Security Rule Catalog",
      "description": "Human and agent readable documentation for every Pipefort detection rule, mapped to the OWASP CI/CD Top 10, with the attack it prevents and the remediation for each.",
      "type": "text/html",
      "url": "https://docs.pipefort.com/rules/overview",
      "representativeQueries": [
        "What does the Pipefort rule cicd-sec-1 detect?",
        "List CI/CD security rules for GitHub Actions",
        "How do I fix an unpinned GitHub Action?",
        "What is pwn request in GitHub Actions and how do I prevent it?"
      ]
    },
    {
      "id": "urn:air:pipefort.com:data:action-scores",
      "displayName": "GitHub Action Security Scores",
      "description": "Daily-recomputed security grades for published GitHub Actions, with a per-signal breakdown of every deduction and the score history per commit.",
      "type": "application/json",
      "url": "https://pipefort.com/api/public/actions",
      "representativeQueries": [
        "What is the security score of actions/checkout?",
        "Which GitHub Actions are the safest to depend on?",
        "Rank popular GitHub Actions by supply-chain risk",
        "Is this GitHub Action archived or unmaintained?"
      ]
    }
  ]
}