HVTracker MCP

io.github.YugantMPublished by GitHub account YugantMv0.4.0Updated Nov 10, 2026

Pre-connect trust checks for AI agents and MCP servers using HVTracker's public trust registry.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & MonitoringAI & ML

Overview

AI-generated overview

Lets an assistant look up HVTracker's public trust registry to check AI agents, MCP servers, and dependencies before connecting to them.

What you can do
Provides tools that return pre-connect trust verdicts for MCP servers, packages, GitHub repos, and agent names, plus trust profiles for tracked AI agents and frameworks including runtime capabilities and a signed trust credential URL. It can compare two agents side by side, search the registry, bulk-check a whole dependency set from a requirements.txt, package.json, or MCP client config, list categories, show leaderboards by HVTrust score, and return 90-day trust-score history for one agent.
When to use it
Useful when an assistant or developer wants a trust signal before adding an AI agent, MCP server, or package dependency, or when reviewing dependency changes in CI. Also handy for comparing agents or tracking whether a tracked agent's trust score is improving or declining.
Requirements
Can be used as a hosted remote endpoint at or installed locally via the npm package hvtracker-mcp or the PyPI package hvtracker-mcp, both over stdio. No API key or environment variables are declared; network access to hvtracker.net is needed. An optional HVTRACKER_BASE_URL variable is mentioned for testing against a different base URL.
Before you install
Search strings and server or agent identifiers are sent to to fetch public trust data, so anything you query leaves your machine. The README states it does not require an API key and does not write to user systems. Trust verdicts come from a third-party registry; verify methodology and current data on the HVTracker site before relying on them.

Installation

In SourceWeft

  1. Open HVTracker MCP in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.YugantM%2Fhvtracker-mcp/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "hvtracker": {
      "type": "http",
      "url": "https://hvtracker.net/mcp"
    }
  }
}

README

HVTracker MCP

[Smithery] [npm] [PyPI] [License: MIT]

MCP server for checking supply-chain trust before connecting to AI agents, frameworks, or MCP servers.

The hosted remote server is:

json
{  "mcpServers": {    "hvtracker": {      "url": "https://hvtracker.net/mcp"    }  }}

This repository also provides a local stdio package for clients that prefer package-based installation.

Tools

  • verify_mcp_server: pre-connect trust verdict for an MCP server, package, GitHub repo, or agent name.
  • check_agent_trust: trust profile for a tracked AI agent or framework — incl. runtime capabilities (MCP status, providers, plugin surface, provenance drift) and the URL of its Ed25519-signed trust credential.
  • compare_agents: two agents side by side with an evidence-based verdict and the published compare-page link.
  • search_agents: search the HVTracker registry by name, repo, description, or category.
  • scan_stack: bulk pre-connect trust check for a whole dependency set — paste a requirements.txt, package.json, MCP client config, or a plain list and get a trust verdict per item plus a stack summary.
  • list_categories: list the HVTracker categories with agent counts, so you can then pull a category's leaderboard.
  • get_leaderboard: top tracked AI agents and MCP servers ranked by HVTrust score, optionally filtered to one category.
  • get_agent_history: 90-day trust-score, grade, and rank history for one tracked agent — is it improving or declining?

Check your AI dependencies in CI

HVTrust Gate runs the same trust checks in GitHub Actions. With no configuration it reads your requirements.txt, pyproject.toml, package.json and MCP client configs, and comments on pull requests that change them with the HVTrust grade of each AI agent and MCP server you depend on.

yaml
name: HVTruston: [pull_request]permissions:  contents: read  pull-requests: writejobs:  trust:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v7      - uses: YugantM/hvtrust-gate@v1

Local Install

With npm:

bash
npm install -g hvtracker-mcp

With PyPI:

bash
python3 -m pip install hvtracker-mcp

Example MCP client config:

json
{  "mcpServers": {    "hvtracker": {      "command": "hvtracker-mcp"    }  }}

Development

bash
python3 -m pip install -e ".[dev]"python3 -m pytesthvtracker-mcp

Use a different HVTracker base URL while testing:

bash
HVTRACKER_BASE_URL=http://localhost:8080 hvtracker-mcp

Registry Publishing

The official MCP Registry manifest is server.json.

bash
mcp-publisher login githubmcp-publisher publish

In GitHub Actions, run the "Publish MCP Registry" workflow after the npm, PyPI, and GHCR packages for the same version are live.

The server name is:

text
io.github.YugantM/hvtracker-mcp

Claude Desktop Extension

Tagged releases build an .mcpb bundle for Claude Desktop from manifest.json. To build it locally:

bash
npm ci --omit=devnpx @anthropic-ai/[email protected] pack

Privacy

HVTracker MCP sends the user-supplied search string or server identifier to https://hvtracker.net to fetch public trust data. It does not require an API key and does not write to user systems. See the HVTracker site for current data and methodology, and see PRIVACY.md for the repository privacy note.

Source: README.md at commit d1dd8e4

Tools

8

check_agent_trust

Check Agent Trust

Get the HVTracker supply-chain trust profile for a tracked AI agent or framework.

Parametersname_or_reporequired

verify_mcp_server

Verify MCP Server

Pre-connect trust verdict for an MCP server, package, GitHub repo, or agent name before connecting an AI agent to it.

Parametersserverrequired

compare_agents

Compare Agents

Compare two tracked AI agents side by side: trust scores, grades, runtime capabilities, and an evidence-based verdict.

Parametersarequiredbrequired

search_agents

Search Agents

Search tracked AI agents and frameworks by name, repo, description, or category, ranked by trust score.

Parameterslimitquerycategory

scan_stack

Scan Stack

Bulk pre-connect trust check for a whole dependency set — paste a requirements.txt, package.json, MCP client config, or a plain list and get a trust verdict per item plus a stack summary.

Parametersinputrequired

list_categories

List Categories

List the HVTracker categories with agent counts, so you can then pull a category's leaderboard.

Takes no parameters.

get_leaderboard

Get Leaderboard

Top tracked AI agents and MCP servers ranked by HVTrust score, optionally filtered to one category.

Parameterslimitcategory

get_agent_history

Get Agent History

90-day trust-score, grade, and rank history for one tracked agent — is it improving or declining?

Parametersname_or_reporequired

Version history

2
  1. v0.4.0LatestSep 29, 2026
  2. v0.3.0Sep 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts