Hvtracker Mcp

MCP server for checking supply-chain trust before connecting to AI agents, frameworks, or MCP servers.

{ "mcpServers": { "hvtracker": { "url": "https://hvtracker.net/mcp" } } }

This repository also provides a local stdio package for clients that prefer package-based installation.

- verify_mcp_server: pre-connect trust verdict for an MCP server, package, GitHub repo, or agent name.
- check_agent_trust: trust profile for a tracked AI agent or framework — incl. runtime capabilities (MCP status, providers, plugin surface, provenance drift) and the URL of its Ed25519-signed trust credential.
- compare_agents: two agents side by side with an evidence-based verdict and the published compare-page link.
- search_agents: search the HVTracker registry by name, repo, description, or category.
- scan_stack: bulk pre-connect trust check for a whole dependency set — paste a requirements.txt, package.json, MCP client config, or a plain list and get a trust verdict per item plus a stack summary.
- list_categories: list the HVTracker categories with agent counts, so you can then pull a category's leaderboard.
- get_leaderboard: top tracked AI agents and MCP servers ranked by HVTrust score, optionally filtered to one category.
- get_agent_history: 90-day trust-score, grade, and rank history for one tracked agent — is it improving or declining?

{ "mcpServers": { "hvtracker": { "command": "hvtracker-mcp" } } }

python3 -m pip install -e ".[dev]" python3 -m pytest hvtracker-mcp

Use a different HVTracker base URL while testing:

HVTRACKER_BASE_URL=http://localhost:8080 hvtracker-mcp

The official MCP Registry manifest isserver.json.

mcp-publisher login github mcp-publisher publish

In GitHub Actions, run the "Publish MCP Registry" workflow after the npm, PyPI, and GHCR packages for the same version are live.

Tagged releases build an.mcpbbundle for Claude Desktop frommanifest.json. To build it locally:

npm ci --omit=dev npx @anthropic-ai/mcpb@2.1.2 pack

HVTracker MCP sends the user-supplied search string or server identifier tohttps://hvtracker.netto fetch public trust data. It does not require an API key and does not write to user systems. See the HVTracker site for current data and methodology, and seePRIVACY.mdfor the repository privacy note.

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Require a named human's offline-verifiable approval before an AI agent takes an irreversible action — payment release, record change, deploy. Two-person rule, Ed25519 Trust Receipts, IETF-drafted, Apache-2.0.

Six-gate governance for AI agents: PROCEED/PAUSE/HALT decisions with hash-chained audit trails.

EU AI Act compliance scanner for Python AI agents — 10 tools for scanning, analysis, and remediation

EXIF for AI. AKF embeds trust scores, source provenance, and compliance metadata into every file your AI touches — DOCX, PDF, images, code, and 20+ formats. 9 MCP tools: stamp, inspect, trust, audit, scan, embed, extract, detect. Audit against EU AI Act, SOX, HIPAA, NIST in one command.

A pre-action risk gate your AI agent calls before any irreversible action — returns a risk score, named red flags, and a gate: proceed / confirm / human-required.

Security scanner for MCP servers — detects tool poisoning, prompt injection, and 90+ vulnerability patterns

MCP server for security-vetting third-party AI agent extensions before installation — Claude skills, ClawHub plugins, agent tool packs. 41 detection rules; outputs 0-100 risk score + BLOCK/REVIEW/CAUTION/CLEAN.

Paid remote MCP for AI agent safety replay checks, policy gates, eval receipts, control-fix suggestions, and release evidence exports.

Cryptographic action receipts for AI agents. Signs every MCP tool call with Ed25519, hash-chained audit log. 3 lines of code to integrate.

Trust and safety layer for AI agents — scores MCP servers for security risk, capability flags, and prompt injection.