Included code (libraries, packages, frameworks and services) is verified with the same techniques as locally written code so that there is assurance it is at least as secure, and the software's components are watched continuously against known-vulnerability databases, with action taken when a vulnerability is published. Where strong guarantees about a component are lacking, it is tested as much as the producer's own code.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.