Everything in the atlas

Not for production: the README states local and development instances only, and the server refuses a HAC URL whose host is not private unless `HAC_ALLOW_REMOTE=true` overrides that guard. Masking applies to `config_get` only, so `logs_tail` and `monitoring_info` output, thread dumps included, is unmasked and may carry sensitive data, and whatever a tool returns goes to the MCP client and its model. Certificate checks are disabled whenever `HAC_INSECURE_TLS=true` is set, which the README names as typical for local HAC.

Not for a project below the 2211-jdk21.1 baseline: older releases and the JSP Accelerator are covered only as explicitly marked legacy material, so a JSP storefront or a pre-JDK-21 platform is outside what the guides are written against. Knowledge with reach only through one script — it can tell an agent what to write and, apart from `query-items.sh`, cannot let it read what a given system contains.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

A team that does not keep one long-lived branch per environment has no environment branches for it to compare feature branches against. What it reports is the merge state of branches in Git, so it says nothing about whether a merged change has been built or deployed to the environment.

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

It reads TypeScript exports only; a project written in plain JavaScript has no exported functions for it to extract. A call to the function name in a test file counts as tested, and a call through property access such as `.foo(` does not.