
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
@reneturcios/claimcheck
Advanced tools
Track the two ways open-source work silently dies: stale claims and parked fixes
Two quiet ways open-source work dies, tracked before they cost you weeks:
claimcheck scans for both. It is the follow-up to greenlight: greenlight asks "is this issue landable?", claimcheck asks "did everyone who said yes actually show up, and did their work ever ship?"
npm install -g @reneturcios/claimcheck
# or
npx @reneturcios/claimcheck claims owner/repo
Needs Node 20+. Set GITHUB_TOKEN (or GH_TOKEN) for the 5000 req/hr authenticated rate limit; without it you get 60 req/hr. Responses are cached in ~/.cache/claimcheck.
claimcheck claims modelcontextprotocol/python-sdk
Scans open unassigned issues, detects claim comments (explicit claims, work intentions, assignment requests; bots, maintainers, and the issue author are excluded), checks whether a linked PR ever appeared, and ranks the results with the oldest claims first:
Stale claims in modelcontextprotocol/python-sdk: 2 stale of 5 claimed issues (threshold 45d)
[STALE] modelcontextprotocol/python-sdk#3287
Fix: handle empty result sets
https://github.com/modelcontextprotocol/python-sdk/issues/3287
claimant: helpfuldev, 63d ago (want-to-work)
[IN FLIGHT] modelcontextprotocol/python-sdk#3290
...
claimant: shipitdev, 5d ago (explicit-claim)
Flags: --days 45 changes the stale threshold, --json prints machine output.
Claim age buckets
| Bucket | Age | Meaning |
|---|---|---|
| FRESH | <14 days | Claimant probably still active |
| WATCH | 14 to 44 days | Check before duplicating work |
| STALE | 45 to 89 days | Contestable, likely abandoned |
| DEAD | 90+ days | Almost certainly abandoned |
| WORK_IN_FLIGHT | any | A linked PR exists, the work is real |
claimcheck parked CloudCorpRecords/pdfcn
Lists branches on a fork (excluding the default branch), compares each against the upstream default branch, and checks for open PRs from that fork. A branch ahead by 1+ commits with no open PR is PARKED:
Parked branches on CloudCorpRecords/pdfcn (upstream shadcn-labs/pdfcn): 1 parked of 4 branches
[PARKED_STALE] fix-typos
ahead by 5 commit(s), last commit 20d ago
no open PR on upstream
Parked age buckets (from the branch tip commit date)
| Verdict | Age | Meaning |
|---|---|---|
| PARKED_RECENT | <7 days | Probably still being finished |
| PARKED_STALE | 7 to 30 days | Likely forgotten, easy to revive |
| PARKED_DEAD | 30+ days | May need rebasing onto upstream |
Branches with an open PR show as IN_PR, branches even with upstream as EVEN. Neither is parked.
claimcheck issue https://github.com/modelcontextprotocol/python-sdk/issues/3287
Every claimant found in the comments, their age bucket, and whether a linked PR exists.
The same engines as tools, for agents that should check before they comment or code:
{
"mcpServers": {
"claimcheck": {
"command": "npx",
"args": ["-y", "claimcheck", "mcp"],
"env": { "GITHUB_TOKEN": "ghp_your_token_here" }
}
}
}
| Tool | Input | Returns |
|---|---|---|
stale_claims | repo (owner/repo), optional stale_days | Ranked stale claims, oldest first |
parked_branches | fork (owner/repo) | Parked branches with compare data, plus all branches |
issue_claim_status | url (issue URL) | Claimants, age buckets, linked PRs, summary |
Or run the server directly: npx @reneturcios/claimcheck mcp (stdio).
Claim heuristics (clean reimplementation of the patterns proven in greenlight's dogfooding):
A claim with any linked PR is WORK_IN_FLIGHT at any age: the claimant did the work, it just has not landed yet. Only PR-less claims age into STALE and DEAD.
npm install
npm test # 23 offline tests, node:test via tsx
npm run build # tsc to dist/
Engines (src/claims.ts, src/parked.ts) are pure functions over fetched data, fully testable offline against fixtures in test/fixtures/. src/github.ts holds the REST client (issues, comments, PR search, branches, compare, fork info) with file caching.
MIT, Rene Turcios 2026.
This tool is one of four in a lifecycle for open-source contribution work, all published under the @reneturcios npm scope and each available as a CLI and an MCP server (<tool> mcp):
npx @reneturcios/gatefile) extracts a repo's contribution gates into a committed contribution-gates.json.npx @reneturcios/greenlight) pre-flights issues (GO / RISKY / TAKEN / GATED / STALE), consumes gatefile's output in check and scan, then claims, preps, and opens PRs.npx @reneturcios/claimcheck) watches for stale claims and fixes parked on forks.npx @reneturcios/prwatch) triages your open PRs by what needs you right now.FAQs
Track the two ways open-source work silently dies: stale claims and parked fixes
We found that @reneturcios/claimcheck demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.