VAREXIS-INDEX
Evidence Packs
Choose a complete pack for a tool-access, procurement or source-review question. Each brings related published answers, source versions and limitations together in one result.
The complete published pack, sources, comparison and limitations are free to read and save locally. Pay for server-saved retrieval of the selected version. Single Request saves the whole pack; Evidence Receipt adds an unsigned delivery receipt. Payment adds no evidence or independent assurance.
Single Request: £5. Evidence Receipt: £19. Prices exclude applicable VAT, confirmed at checkout. Compare prices and entitlements.
Repository and browser Tool-Trust Evidence Pack
Compare repository and browser permissions before connecting an agent to authenticated tools.
2 included evidence records · Version 1.0.0. Documentation reviewed: 2026-10-11. Source checks are not independent tests of current tool behaviour.
Included questions
- How can an agent review repository access without enabling GitHub MCP writes?
- Does an isolated Playwright MCP browser session prevent privileged web actions or data disclosure?
What you save: All included answers, source bindings, comparison, hashes and limitations in one version-bound JSON result. £5 Single Request; £19 Evidence Receipt also adds an unsigned delivery receipt. Plus applicable VAT. Eligible subscribers use one query for the whole pack.
Read the scope and limits
GitHub MCP and Playwright MCP expose different authority boundaries. GitHub documents read-only mode separately from credential scope. Playwright session isolation does not make authenticated browser actions read-only. This pack compares the two published documentation reviews, including read/write capability, authentication, data movement, unknowns and refusal conditions. The reviews are dated 11 October 2026; neither your deployment nor current tool behaviour has been independently tested.
The records report when sources were checked. A separate source capture timestamp and an independently tested runtime version are not established.
Agent Tool Permissions & Data Handling — Notion + Slack
Review workspace access and where content can go before connecting Notion or Slack.
2 included evidence records · Version 1.0.0. Documentation reviewed: 2026-10-11. Source checks are not independent tests of current tool behaviour.
Included questions
- Can an agent assume Notion content stays inside Notion when using its MCP connector?
- What should an agent check before searching private Slack content without posting messages?
What you save: All included answers, source bindings, comparison, hashes and limitations in one version-bound JSON result. £5 Single Request; £19 Evidence Receipt also adds an unsigned delivery receipt. Plus applicable VAT. Eligible subscribers use one query for the whole pack.
Read the scope and limits
Compare Notion and Slack connector access before retrieving workspace content. This pack keeps their documented authentication, read/write permissions and data-sharing boundaries together, with unresolved client and workspace questions. Notion content may leave Notion through the connected client; Slack search and posting permissions are distinct. These are the existing 11 October 2026 documentation reviews, not tests of your configuration or current tool behaviour.
Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.
Evidence Boundary Pack — Audit & Export Coverage
Check what a supplier's audit or export claim actually covers before using it in procurement.
3 included evidence records · Version 1.0.0. Documentation reviewed: 2026-10-14. Source checks are not independent tests of current tool behaviour.
Included questions
- Does a GitHub audit export establish a complete history of repository activity?
- Does a Slack workspace export contain private channels, direct messages and the files themselves?
- Does enabling Cloudflare Logpush provide a complete searchable archive of past activity?
What you save: All included answers, source bindings, comparison, hashes and limitations in one version-bound JSON result. £5 Single Request; £19 Evidence Receipt also adds an unsigned delivery receipt. Plus applicable VAT. Eligible subscribers use one query for the whole pack.
Read the scope and limits
Review what an activity-history claim can establish before using it in a technical review or procurement discussion. This pack compares the existing GitHub audit, Slack export and Cloudflare Logpush documentation reviews dated 14 October 2026. It preserves event and conversation scope, required buyer evidence, retention and delivery gaps, and conditions for withholding broader conclusions. Missing records do not establish that nothing happened; no buyer export or deployment has been inspected.
Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.
Next.js: three dated advisory source assertions
Keep three selected Next.js affected/fixed source assertions and their separately dated enrichment together.
3 included evidence records · Version 1.0.0. Source projection reviewed: 2026-10-13. Source snapshot: 2026-10-08; enrichment dates are retained per member.
Included questions
- What does GHSA-g77x-44xx-532m record about npm/next in the 2026-10-08 snapshot?
- What does GHSA-c59h-r6p8-q9wc record about npm/next in the 2026-10-08 snapshot?
- What does GHSA-39w2-rjm5-chcv record about npm/next in the 2026-10-08 snapshot?
What you save: All included answers, source bindings, comparison, hashes and limitations in one version-bound JSON result. £5 Single Request; £19 Evidence Receipt also adds an unsigned delivery receipt. Plus applicable VAT. Eligible subscribers use one query for the whole pack.
Read the scope and limits
These three dated Next.js advisory projections preserve the selected affected/fixed source assertions and their separately dated enrichment. This selection is not complete coverage or an assessment of an installed deployment.
Individual capture, publication, modification and enrichment dates are retained per member; these are not current deployment assessments.
Code-Scanner Trust — SonarQube, Snyk & Semgrep
Check scanner permissions and the evidence needed before accepting a clean report or claimed fix.
6 included evidence records · Version 1.0.0. Documentation reviewed: 2026-10-14, 2026-10-16. Source checks are not independent tests of current tool behaviour.
Included questions
- Does connecting SonarQube MCP automatically restrict an agent to reading findings?
- Does a SonarQube token used by a scanner have only analysis permissions?
- Can a Snyk dependency scan execute project tooling, even when the task is only a security review?
- Does a Snyk ignore rule establish that a vulnerability was fixed?
- Does installing Semgrep MCP prove every agent code change was scanned?
- Does an empty Semgrep findings list prove every relevant file was scanned?
What you save: All included answers, source bindings, comparison, hashes and limitations in one version-bound JSON result. £5 Single Request; £19 Evidence Receipt also adds an unsigned delivery receipt. Plus applicable VAT. Eligible subscribers use one query for the whole pack.
Read the scope and limits
Review access before connecting a scanner and interpret what its findings establish. Six dated documentation reviews compare SonarQube server filters and token scope, Snyk folder execution and ignore policies, and Semgrep invocation and scan exclusions. They preserve the evidence still needed before accepting a clean report or a claimed fix. They do not test your repository, credentials or deployment.
Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.
Telemetry Redaction — Coverage, Exceptions & Data Flow
Review where sensitive data can remain or leave a pipeline despite a redaction claim.
5 included evidence records · Version 1.0.0. Documentation reviewed: 2026-10-16. Source checks are not independent tests of current tool behaviour.
Included questions
- Does configuring the OpenTelemetry redaction processor prove every sensitive attribute is masked?
- Can a Vector remap error send the original sensitive event downstream?
- Does a successful ingest pipeline prove the redact processor changed the document?
- Does a clean Presidio result prove a document contains no sensitive information?
- Does Datadog sensitive-data scanning prove raw content never leaves our environment?
What you save: All included answers, source bindings, comparison, hashes and limitations in one version-bound JSON result. £5 Single Request; £19 Evidence Receipt also adds an unsigned delivery receipt. Plus applicable VAT. Eligible subscribers use one query for the whole pack.
Read the scope and limits
Review where sensitive data can remain or leave a pipeline despite a redaction claim. Five dated documentation reviews cover OpenTelemetry exceptions, Vector error paths, Elastic licence skips, Presidio detection limits and Datadog scanning location. They keep configuration evidence and unresolved coverage questions with the source versions. They do not establish complete removal, regulatory compliance or permission to disclose data.
Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.
GitHub Release Acceptance — Approval, Execution & Artifact Identity
Check whether approval and execution evidence is bound to the exact artifact being accepted.
5 included evidence records · Version 1.0.0. Documentation reviewed: 2026-10-16. Source checks are not independent tests of current tool behaviour.
Included questions
- Does a CODEOWNERS file prove the right owner must approve every change?
- Does a passing required GitHub check prove its test job actually ran?
- Does a valid GitHub OIDC token prove an approved reusable deployment workflow ran?
- Does reusing an artifact name mean a later download contains the same approved build?
- Does any valid Cosign signature establish the supplier artifact we intended to accept?
What you save: All included answers, source bindings, comparison, hashes and limitations in one version-bound JSON result. £5 Single Request; £19 Evidence Receipt also adds an unsigned delivery receipt. Plus applicable VAT. Eligible subscribers use one query for the whole pack.
Read the scope and limits
Review whether approval and execution evidence is bound to the artifact being accepted. Five dated documentation reviews connect GitHub code-owner enforcement, skipped checks, reusable-workflow OIDC identity and artifact replacement with Cosign signer and digest verification. They preserve the buyer evidence still required for the exact revision and artifact. They do not approve a release, verify your configuration or certify software safety.
Existing dated review and upstream hash metadata are preserved. No new source bytes were acquired for this compilation; separate capture timestamps and independently tested runtime versions are not established.
One pack, one saved result
Documentation reviews or selected dated advisory source assertions, not independent tool tests, fresh investigation, current safety verdicts, certification or deployment approval. Keep your private access key. Saved results are version-bound, not continually refreshed; no permanent-retention promise is made.
Eligible active subscribers retrieve a whole pack using one query without another checkout. Developer/API includes 100 new queries per paid monthly period; Research is subject to operational rate limits. Monthly plans renew until cancelled. Research is £29/month; Developer/API is £149/month, plus applicable VAT. Retrieve a saved result or use your subscription.
Hosted Stripe checkout and compatible authorised MPP/Stripe SPT purchasing use the existing paths. Compatible MPP/Stripe SPT agents require owner spending authority for the exact VAT-inclusive quote and any provider authentication. Not every agent or wallet is supported.
Use the original purchasing path and key; MPP retries retain the original credential. Never repurchase to recover uncertain payment. Existing subscribers and saved-result owners retrieve before buying again.
Agent purchasing contract · Live REST contract · Checkout and recovery terms
Public MCP stays free and read-only. Connect an agent · Evidence Packs listing (JSON)
