广告合作
MCP.so
登录

Proof Of Commitment MCP Server

@piiiico

代码仓库主页文档

基本信息

分类

其他

许可证

MIT

作者

piiiico

关于 Proof Of Commitment MCP Server

Supply chain security risk scorer for npm, PyPI, Cargo, and Go — behavioral signals that can't be faked

Proof Of Commitment MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "proof-of-commitment": {
      "command": "npx",
      "args": [
        "-y",
        "@smithery/cli",
        "install",
        "proof-of-commitment",
        "--client",
        "claude"
      ]
    }
  }
}

Proof Of Commitment MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

点击上方按钮,在临时沙箱中运行此服务器并实时获取工具列表。

概览

What is proof-of-commitment?

proof-of-commitment is an MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on behavioral commitment — signals like publisher concentration, age, and provenance that are harder to fake than stars or download counts. It helps developers and AI agents identify supply chain risk, especially single-publisher packages with large reach.

How to use proof-of-commitment?

Add the server to any MCP-compatible AI tool using the URL https://poc-backend.amdal-dev.workers.dev/mcp via a streamable-http transport. Use the CLI with npx proof-of-commitment (zero‑arg auto‑detect in a project directory, or explicit package names and --file flags). For CI, use --fail-on=critical or the dedicated GitHub Action piiiico/commit-action@v1. Install IDE hooks with poc hook to block critical packages before install.

Key features of proof-of-commitment

  • Detects publish‑access concentration risk (single NPM publisher >10M weekly downloads)
  • Supports npm, PyPI, Rust crates, Go modules, and GitHub repos
  • CLI with zero‑arg auto‑detect and lock‑file scanning (package‑lock, yarn.lock, go.sum, etc.)
  • CI integration with --fail-on=critical and GitHub Action (PR comments, step summary)
  • SARIF output for GitHub Code Scanning (Security tab)
  • IDE hooks for Cursor, Claude Code, and Windsurf to block critical packages
  • Monitoring plan with weekly/daily alerts and package score degradation detection

Use cases of proof-of-commitment

  • Auditing a project’s package.json or lockfile for supply chain risk before merging
  • Adding a CI gate that blocks pull requests when critical packages are detected
  • Preventing AI coding assistants from installing high‑risk dependencies via IDE hooks
  • Monitoring third‑party packages for publisher changes or score drops over time

常见问题

1

How does proof-of-commitment differ from npm audit?

npm audit flags known vulnerabilities, but not publish‑access concentration. proof-of-commitment surfaces attack‑surface risk — e.g., a single publisher with >10M weekly downloads — which `npm audit` does not detect.

2

Do I need to log in to use proof-of-commitment?

No login is required for the MCP server or CLI. A free API key is available to unlock monitoring (package watch, alerts) and higher rate limits.

3

What ecosystems does proof-of-commitment support?

It supports npm (Node.js), PyPI (Python), Rust crates, Go modules, and GitHub repositories.

4

What does a CRITICAL score mean?

A CRITICAL score indicates a package with a sole npm publisher and more than 10 million weekly downloads — a profile matching the axios token theft attack in March 2026.

5

How is data fetched in the MCP server?

The server uses a streamable‑HTTP backend (`https://poc-backend.amdal-dev.workers.dev/mcp`) that queries the same API used by the CLI and web demo. No local data storage is required.

评论

其他 分类下的更多 MCP 服务器

Yuppsy

Yuppsy MCP: build and publish real estate websites from your AI assistant. Yuppsy lets your AI assistant create live websites for real estate agents and individual property listings. You don't need a designer or any code

Figs, Relationship Expert

Figs O'Sullivan, LMFT

Couples therapist Figs O'Sullivan (LMFT, 17 years, endorsed by Sue Johnson, creator of EFT) inside your AI. Ask relationship questions answered from his clinical writing, name the pattern in a fight, get a three-step rep

Activepieces

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

23.2K

Klarix Intelligence Engine

Klarix

B2B competitive intelligence, live sales battlecards, 5-axis ICP prospect fit scoring, and tech stack teardowns over MCP and REST with cited public-web evidence.

Soar Flight Booking MCP

Soar Flight Booking MCP is a remote MCP server available at https://mcp.soar.flights.

广告合作