Privacy, security and limits

Runs locally with no network by default; not independently assessed.

The claims line is the whole claim. Nothing here goes beyond it.

What the tool does

It runs locally and makes no network calls by default. It uses only the Python standard library. A test in the repository blocks network access and runs the tool. Only refresh_data.py, run by the data workflows, opens network connections.

Confidential inventories

Run real inventories only through the local script, or through an AI agent in --counts-only mode.
In --counts-only mode the tool prints only counts, item IDs, the checked-on date and the kev_current flag. The full report goes to a file.
An agent can still read that file, and nothing technical stops it. Tell the agent not to, and keep the output folder out of its reach.
No model should read the full report.
The default keeps no run history. Keeping evidence is your choice.

Item IDs

An item ID is a 12-character hash of publisher, name and version, with no secret in it. It keeps names out of counts and findings. But anyone who holds a guess can hash it and confirm that the item is in the estate. Treat item IDs with the same care as the inventory, and do not post them where the inventory would not go.

The optional desktop-chat server

The server (swlc_mcp.py) enforces counts-only in its code: it returns only fixed labels and numbers, with no item IDs. It was tested by hand once, on one Mac, in both apps (2026-11-01). It does not stop the counts and the path from going to the chat app's provider, other tools in the same app from reading files, or the full report (written next to the CSV) from reaching a synced folder. What is and is not tested, and what it does not protect, is in docs/mcp-setup.md.

Supply chain

The tool checks a SHA-256 manifest every time it loads its data. This catches a damaged data folder. It does not prove who made the files.
Each data release made while the repository is public carries a GitHub artifact attestation. Check it online before use. The tool never checks attestations offline.
Only main can publish a data release. Data releases are never changed or re-tagged. A fix is a new, higher release.
Every GitHub Action is pinned to a commit SHA.

Check a data release online

gh attestation verify data.zip --repo evemcgivern/software-lifecycle --signer-workflow evemcgivern/software-lifecycle/.github/workflows/kev-daily.yml --source-ref refs/heads/main

Details are in SECURITY.md.

What it does not claim

It has not been independently assessed or audited.
Its end-of-life and KEV data are snapshots and can be out of date.
A clean result does not prove that software is safe or supported.
A support-records file and the reports made with it hold your record references. Treat them as confidential.

How it can be wrong

Coverage is partial. The tool covers only products endoflife.date lists. The rate on a real estate is unknown. Not found: a hit rate on a real estate. The benchmark figures are in the README.
Names must match strictly. A name with extra words after the product name often lands in "couldn't match". That is safer than a wrong guess.
A product whose version is a build number may map to the wrong cycle or none. Check the cycle shown in the report.
The profiles for Flexera, ServiceNow and Rapid7 are Unverified until run on a real export.
Data is a snapshot and can be out of date.
The tool was tested on macOS and Linux. Windows is not a supported platform yet.

Status and support

This is an experiment with a review date of 2027-01-31; on that date the maintainer decides whether to keep it, archive it, or fold it into another project. It is maintained as time allows, best effort, no SLA, not independently assessed. There is no promised response time. Only the latest release and the latest data release are supported.

Report a problem

Security: use private vulnerability reporting. Open the repository's Security tab and choose Report a vulnerability. Do not open a public issue and do not include real inventory data. See SECURITY.md.
A mistake in the docs, or a column problem with an export: use the issue forms on GitHub, with names and headers only.

Federal context

CISA's current binding directive for US federal civilian agencies, BOD 26-04, superseded BOD 22-01 (source: CISA, BOD 26-04). It is a reference only. It binds federal civilian agencies only. This tool does not implement it or its deadlines.

For a standards crosswalk, see docs/themes.md. Not found: independent assessment, audit report, SLA.