proof-of-commitment
About
Cryptographic proof-of-commitment protocol for MCP. Make verifiable commitments before posting/acting, preventing post-hoc narrative changes.
Details
- Transport
- SSE
- License
- MIT
Explore
- Detects publish‑access concentration risk (single NPM publisher >10M weekly downloads)
- Supports npm, PyPI, Rust crates, Go modules, and GitHub repos
- CLI with zero‑arg auto‑detect and lock‑file scanning (package‑lock, yarn.lock, go.sum, etc.)
- CI integration with --fail-on=critical and GitHub Action (PR comments, step summary)
- SARIF output for GitHub Code Scanning (Security tab)
- IDE hooks for Cursor, Claude Code, and Windsurf to block critical packages
- Monitoring plan with weekly/daily alerts and package score degradation detection
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
proof-of-commitmentCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.
Claude Desktop
Open ~/Library/Application Support/Claude/claude_desktop_config.json on macOS (config file reference) or %APPDATA%\Claude\claude_desktop_config.json on Windows, then add:
{
"mcpServers": {
"commit": {
"type": "streamable-http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}
Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your package.json.
Cursor
Open ~/.cursor/mcp.json (Cursor MCP docs) and add:
{
"mcpServers": {
"commit": {
"type": "streamable-http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}
Smithery (once indexed)
npx -y @smithery/cli install proof-of-commitment --client claude
---
poc hook
audit_dependencies
Batch risk audit for up to 20 npm/PyPI/Cargo/Go packages
audit_github_repo
Fetch a repo's package.json/requirements.txt and audit every dep
audit_dependency_tree
Map an npm package's full dependency tree (incl. transitive CRITICAL deps)
lookup_npm_package
Single npm package behavioral profile
lookup_pypi_package
Single PyPI package behavioral profile
lookup_cargo_crate
Single Rust crate behavioral profile (crates.io)
lookup_go_module
Single Go module behavioral profile (proxy.golang.org + GitHub)
lookup_github_repo
GitHub repo commitment score (longevity, commit frequency, contributor depth)
lookup_business
Norwegian business register — operating years, employees, financials
lookup_business_by_org
Same, by org number
query_commitment
Browser extension behavioral data (unique verified visitors, repeat rate)
get_api_key
Create a free API key in-chat — no browser needed, key returned instantly
npx proof-of-commitment --file package-lock.json --json | jq '.criticalCount'
``
| Tool | Description |
|------|-------------|
| audit_dependencies | Batch risk audit for up to 20 npm/PyPI/Cargo/Go packages |audit_github_repo
| | Fetch a repo's package.json/requirements.txt and audit every dep |audit_dependency_tree
| | Map an npm package's full dependency tree (incl. transitive CRITICAL deps) |lookup_npm_package
| | Single npm package behavioral profile |lookup_pypi_package
| | Single PyPI package behavioral profile |lookup_cargo_crate
| | Single Rust crate behavioral profile (crates.io) |lookup_go_module
| | Single Go module behavioral profile (proxy.golang.org + GitHub) |lookup_github_repo
| | GitHub repo commitment score (longevity, commit frequency, contributor depth) |lookup_business
| | Norwegian business register — operating years, employees, financials |lookup_business_by_org
| | Same, by org number |query_commitment
| | Browser extension behavioral data (unique verified visitors, repeat rate) |get_api_key
| | Create a free API key in-chat — no browser needed, key returned instantly |
Anonymous: 15 requests/IP/UTC day across both /mcp and /api/audit`. Free key (no card, 30s signup at https://getcommit.dev/get-started): 200/day. Higher tiers at https://getcommit.dev/pricing.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"proof-of-commitment": {
"proof-of-commitment": {
"command": "npx",
"args": [
"-y",
"@smithery/cli",
"install",
"proof-of-commitment",
"--client",
"claude"
]
}
}
}
}McpServers
{
"proof-of-commitment": {
"command": "npx",
"args": [
"-y",
"@smithery/cli",
"install",
"proof-of-commitment",
"--client",
"claude"
]
}
}
> Stars lie. Behavioral signals don't.
An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on behavioral commitment — signals that are harder to fake than stars, READMEs, or download counts.
$ npx proof-of-commitment axios zod chalk lodash minimatch
Scoring 5 npm packages... done in 3.0s
Package Risk Score Publishers Downloads Age Provenance
chalk 🔴 CRITICAL 72 1 432.9M/wk 14.6y —
minimatch 🔴 CRITICAL 78 1 634.1M/wk 14.9y —
lodash 🔴 CRITICAL 80 1 158.9M/wk 14.1y —
zod 🔴 CRITICAL 83 1 161.2M/wk 6.3y 🔐 verified
axios 🔴 CRITICAL 88 1 115.7M/wk 11.8y 🔐 verified
⚠ COMPROMISED — axios token theft (2026-03-30)
⚠ 5 CRITICAL packages found.
CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk)
npm audit flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).
The supply chain problem
26 of the 91 npm packages with >10M weekly downloads have a single npm publisher. Together they account for over 3 billion downloads per week. npm audit doesn't surface this. Stars don't either.
Four packages in a typical Node.js project are CRITICAL right now:
- chalk — 432M downloads/week, 1 npm publisher
- zod — 185M downloads/week, 1 npm publisher (30+ GitHub contributors)
- lodash — 156M downloads/week, 1 npm publisher
- axios — 113M downloads/week, 1 npm publisher (attacked March 30, 2026)
They won't appear in your package.json either — but these are in almost every project:
- minimatch — 625M downloads/week, 1 npm publisher
- glob — 366M downloads/week, 1 npm publisher
- cross-spawn — 215M downloads/week, 1 npm publisher
Behavioral signals surface this. Stars and READMEs don't.
Quick install (MCP)
No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.
Claude Desktop
Open ~/Library/Application Support/Claude/claude_desktop_config.json on macOS (config file reference) or %APPDATA%\Claude\claude_desktop_config.json on Windows, then add:
{
"mcpServers": {
"commit": {
"type": "streamable-http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}
Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your package.json.
Cursor
Open ~/.cursor/mcp.json (Cursor MCP docs) and add:
{
"mcpServers": {
"commit": {
"type": "streamable-http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}
Smithery (once indexed)
npx -y @smithery/cli install proof-of-commitment --client claude
---
Try it now
Terminal (zero install):
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
