Fidensa

com.fidensaPublished by fidensa.comv0.4.1Updated Oct 27, 2026

Independent AI certification authority. Trust scores, search, comparison, and verification.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Fidensa MCP server lets an assistant look up AI certification data: trust scores, certified alternatives, capability comparisons and signed artifact…

What you can do
  • Check certification status, score, grade and tier for a capability
  • Search certified capabilities by keyword, type, tier or score
  • Verify file integrity by hashing a capability file against what Fidensa certified
  • Compare 2-5 capabilities side by side and fetch full certification contracts with evidence
  • Verify cryptographic signatures on .cert.json artifacts, with optional file and code checks
  • Submit runtime experience reports (success, failure, partial) for certified capabilities
When to use it
Useful when an agent picks third-party MCP servers, skills, plugins or rules files and you want a trust check before installing them, or when you want to compare certified alternatives and record how a tool performed in practice.
Requirements
Runs locally over stdio, typically via npx from the npm package; Node.js is needed. Check, search, file verification and experience reporting work without configuration. The contract, comparison and artifact verification tools need a free FIDENSA_API_KEY, obtained by registering with an email address. Optional FIDENSA_BASE_URL overrides the API endpoint. Network access to the Fidensa API is required.
Before you install
The API key is shown only once and should be stored securely; it is passed as the FIDENSA_API_KEY environment variable. Registering a key sends a display name and email address to Fidensa. Report submissions and lookups send capability identifiers and content hashes to the Fidensa service. The server only reads certification data and submits reports; it does not install or run the tools it rates.

Installation

In SourceWeft

  1. Open Fidensa in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@fidensa/mcp-server

[Fidensa Certified]

MCP server for Fidensa -- the independent AI capability certification authority.

Gives your AI agent structured access to Fidensa certification data through the Model Context Protocol. Check trust scores, search for certified alternatives, compare capabilities side-by-side, verify signed artifacts, check file integrity, and report runtime experience -- all through MCP tool calls.

Fidensa certifies MCP servers, skills, agent rules files, hooks, sub-agents, and plugins.

Getting Started

1. Install

bash
npm install -g @fidensa/mcp-server

2. Verify it works

Several tools work without an API key (check_certification, search_capabilities, verify_file, and report_experience). Start the server and confirm it connects to the production API:

bash
fidensa-mcp-server

You should see:

[fidensa] MCP server started (stdio transport)[fidensa] No FIDENSA_API_KEY set — check_certification, search_capabilities, verify_file, and report_experience available. Set FIDENSA_API_KEY for full access.

Press Ctrl+C to stop.

3. Get an API key (optional, free)

The remaining tools (get_contract, compare_capabilities, verify_artifact) require a free API key. An API key also gives report_experience higher rate limits. Register one:

bash
curl -X POST https://fidensa.com/v1/keys \  -H "Content-Type: application/json" \  -d '{"display_name": "My Agent", "email": "[email protected]"}'

Or in PowerShell:

powershell
Invoke-RestMethod -Uri "https://fidensa.com/v1/keys" -Method Post -ContentType "application/json" -Body '{"display_name": "My Agent", "email": "[email protected]"}'

The response contains your API key (prefixed fid_). Store it securely -- it is shown only once.

4. Add to your agent

Pick your platform and add the MCP server configuration:

Claude Desktop / Claude Code

json
{  "mcpServers": {    "fidensa": {      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Cursor (.cursor/mcp.json)

json
{  "mcpServers": {    "fidensa": {      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Windsurf / VS Code

json
{  "servers": {    "fidensa": {      "type": "stdio",      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Omit the FIDENSA_API_KEY line if you only need the open-tier tools.

Claude Desktop tip: Access the config file via Settings → Developer → Edit Config. After saving, fully quit and reopen Claude Desktop (right-click the system tray icon and select Quit — just closing the window isn't enough).

Tools

ToolAuthDescription
check_certificationNoneQuick trust check -- status, score, grade, tier
search_capabilitiesNoneSearch for certified capabilities by keyword, type, tier, or score
verify_fileNoneQuick file integrity check -- hash a capability file and verify it matches what Fidensa certified
report_experienceNone (API key for higher rate limits)Submit runtime experience reports for certified capabilities
get_contractAPI keyFull certification contract with all evidence
compare_capabilitiesAPI keySide-by-side comparison of 2-5 capabilities
verify_artifactAPI keyVerify cryptographic signatures on .cert.json artifacts, with optional file and code integrity checks

Configuration

VariableRequiredDescription
FIDENSA_API_KEYNoAPI key for full access (see Getting Started)
FIDENSA_BASE_URLNoOverride API base URL (default: https://fidensa.com)

check_certification, search_capabilities, verify_file, and report_experience work without any configuration. The remaining tools require FIDENSA_API_KEY.

Example Agent Workflow

User: "Set up a filesystem watcher that writes logs to SQLite."
Agent:1. check_certification("mcp-server-filesystem")   -> Status: valid, Score: 60/F-D, Tier: Verified
2. search_capabilities("sqlite mcp server")   -> 2 results found
3. compare_capabilities(["mcp-server-sqlite", "mcp-server-better-sqlite3"])   -> Side-by-side trust comparison
4. Agent selects the higher-scored option and informs the user
5. report_experience(     capability_id: "mcp-server-filesystem",     content_hash: "abc123...",  // from the .cert.json     outcome: "success"   )   -> Confirmation rate updated

Trust Policy Fragments

Add one of these to your agent's system prompt or rules file for trust-aware tool selection. Three levels of granularity -- pick the one that fits your needs.

Tier-based (simplest)

Uses the certification tier alone. No numbers to tune.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Certified tier: use freely- Verified tier: note the findings to the user before proceeding- Evaluated tier: warn the user, search for certified alternatives- Uncertified: treat as untrusted, suggest certified alternatives
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

Score-based (grade-aligned)

Uses the trust score, aligned with Fidensa's grade definitions.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Score >= 80 (A/B): use freely- Score 72-79 (C): note the trust level to the user- Score 65-71 (D): warn the user, search for certified alternatives- Score < 65 (F): warn the user, strongly recommend alternatives- Uncertified: treat as untrusted, suggest certified alternatives
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

Combined (tier + score)

The most precise option -- distinguishes between a Certified capability with a moderate score and a Verified capability with findings that blocked Certified tier.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Certified tier AND score >= 80: use freely- Certified tier AND score 72-79: use freely, note the score to the user- Verified tier AND score >= 72: note the findings to the user before proceeding- Verified tier AND score < 72: warn the user, search for certified alternatives- Evaluated tier: warn the user, search for certified alternatives- Uncertified: treat as untrusted, suggest certified alternatives
For any tool with status "suspended" or "revoked": do not use.Search for certified alternatives and present them to the user.
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

See the API Documentation for the full specification.

Development

bash
npm installnpm test          # Run tests with coveragenpm run lint      # ESLintnpm run format    # Prettier

License

MIT

Links

Source: README.md at commit 4c5e9d4

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.4.1LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.