mo
docs: enterprise documentation suite — compliance mappings (CRA, ISO 27001, IEC 62443), threat model, data flow, audit & deployment guides, SBOM, use cases, security.txt
5c5b617 Software Bill of Materials (SBOM)
Client-side component inventory for the mona-agent device daemon.
Runtime dependencies
| Component | Version | Purpose | License |
|---|---|---|---|
| Node.js (runtime) | ≥ 20 | JavaScript runtime | MIT |
| ws | ^8.18 | WebSocket client (optional relay) | MIT |
The client has exactly one npm dependency (ws); everything else —
cloud client, engine protocol, SSE handling, tool registry, TUI — is
implemented in this repository with Node built-ins.
Build & toolchain
| Component | Purpose |
|---|---|
| node:test | Test runner (34+ tests, no external test deps) |
| npm workspaces | Monorepo layout (packages/engine, packages/protocol, apps/desktop) |
Server-side (operated by the platform)
The cloud side is a PHP application on standard shared hosting (LiteSpeed, MySQL/MariaDB, PHP 8.x) plus the Sngine framework for accounts and payments. Provider SDKs are not used; LLM calls are plain HTTPS REST. Server components are the operator's responsibility and are documented for audits in this folder.
Generating a full SBOM
npm ls --all --json > sbom-npm.json
Combine with the Git tag manifest (git tag, CHANGELOG.md) for a complete
release inventory.
Vulnerability monitoring
npm auditon the single dependency per release- GitHub Security advisories for the repository
- SECURITY.md reporting path for external findings