Fidensa

com.fidensa由 fidensa.com 发布v0.4.1更新于 Oct 27, 2026

Independent AI certification authority. Trust scores, search, comparison, and verification.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

Fidensa MCP 服务器让助手查询 AI 认证数据：信任评分、已认证替代方案、能力对比和签名产物验证。

可以做什么
  • 查询某项能力的认证状态、评分、等级与层级
  • 按关键词、类型、层级或评分搜索已认证能力
  • 对能力文件做哈希校验，核对是否与 Fidensa 认证内容一致
  • 并排比较 2 至 5 项能力，并获取含全部证据的完整认证合约
  • 验证 .cert.json 产物的加密签名，可选做文件与代码完整性检查
  • 提交已认证能力的运行时体验报告（成功、失败、部分成功）
适用场景
适合在智能体挑选第三方 MCP 服务器、技能、插件或规则文件时，安装前先做信任核查；也适合比较已认证的替代方案，并记录某工具的实际使用表现。
运行要求
以 stdio 方式在本机运行，通常通过 npm 包用 npx 启动，需要 Node.js。查询、搜索、文件校验和体验报告无需任何配置。合约、对比和产物验证工具需要免费的 FIDENSA_API_KEY，需用邮箱注册获取。可选 FIDENSA_BASE_URL 覆盖 API 地址。需要能访问 Fidensa 的 API。
安装前请注意
API 密钥只显示一次，应妥善保存，通过 FIDENSA_API_KEY 环境变量传入。注册密钥会把显示名称和邮箱地址发送给 Fidensa。提交报告和查询会把能力标识与内容哈希发送到 Fidensa 服务。该服务器只读取认证数据并提交报告，不会安装或运行它所评级的工具。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Fidensa，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

@fidensa/mcp-server

[Fidensa Certified]

MCP server for Fidensa -- the independent AI capability certification authority.

Gives your AI agent structured access to Fidensa certification data through the Model Context Protocol. Check trust scores, search for certified alternatives, compare capabilities side-by-side, verify signed artifacts, check file integrity, and report runtime experience -- all through MCP tool calls.

Fidensa certifies MCP servers, skills, agent rules files, hooks, sub-agents, and plugins.

Getting Started

1. Install

bash
npm install -g @fidensa/mcp-server

2. Verify it works

Several tools work without an API key (check_certification, search_capabilities, verify_file, and report_experience). Start the server and confirm it connects to the production API:

bash
fidensa-mcp-server

You should see:

[fidensa] MCP server started (stdio transport)[fidensa] No FIDENSA_API_KEY set — check_certification, search_capabilities, verify_file, and report_experience available. Set FIDENSA_API_KEY for full access.

Press Ctrl+C to stop.

3. Get an API key (optional, free)

The remaining tools (get_contract, compare_capabilities, verify_artifact) require a free API key. An API key also gives report_experience higher rate limits. Register one:

bash
curl -X POST https://fidensa.com/v1/keys \  -H "Content-Type: application/json" \  -d '{"display_name": "My Agent", "email": "[email protected]"}'

Or in PowerShell:

powershell
Invoke-RestMethod -Uri "https://fidensa.com/v1/keys" -Method Post -ContentType "application/json" -Body '{"display_name": "My Agent", "email": "[email protected]"}'

The response contains your API key (prefixed fid_). Store it securely -- it is shown only once.

4. Add to your agent

Pick your platform and add the MCP server configuration:

Claude Desktop / Claude Code

json
{  "mcpServers": {    "fidensa": {      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Cursor (.cursor/mcp.json)

json
{  "mcpServers": {    "fidensa": {      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Windsurf / VS Code

json
{  "servers": {    "fidensa": {      "type": "stdio",      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Omit the FIDENSA_API_KEY line if you only need the open-tier tools.

Claude Desktop tip: Access the config file via Settings → Developer → Edit Config. After saving, fully quit and reopen Claude Desktop (right-click the system tray icon and select Quit — just closing the window isn't enough).

Tools

ToolAuthDescription
check_certificationNoneQuick trust check -- status, score, grade, tier
search_capabilitiesNoneSearch for certified capabilities by keyword, type, tier, or score
verify_fileNoneQuick file integrity check -- hash a capability file and verify it matches what Fidensa certified
report_experienceNone (API key for higher rate limits)Submit runtime experience reports for certified capabilities
get_contractAPI keyFull certification contract with all evidence
compare_capabilitiesAPI keySide-by-side comparison of 2-5 capabilities
verify_artifactAPI keyVerify cryptographic signatures on .cert.json artifacts, with optional file and code integrity checks

Configuration

VariableRequiredDescription
FIDENSA_API_KEYNoAPI key for full access (see Getting Started)
FIDENSA_BASE_URLNoOverride API base URL (default: https://fidensa.com)

check_certification, search_capabilities, verify_file, and report_experience work without any configuration. The remaining tools require FIDENSA_API_KEY.

Example Agent Workflow

User: "Set up a filesystem watcher that writes logs to SQLite."
Agent:1. check_certification("mcp-server-filesystem")   -> Status: valid, Score: 60/F-D, Tier: Verified
2. search_capabilities("sqlite mcp server")   -> 2 results found
3. compare_capabilities(["mcp-server-sqlite", "mcp-server-better-sqlite3"])   -> Side-by-side trust comparison
4. Agent selects the higher-scored option and informs the user
5. report_experience(     capability_id: "mcp-server-filesystem",     content_hash: "abc123...",  // from the .cert.json     outcome: "success"   )   -> Confirmation rate updated

Trust Policy Fragments

Add one of these to your agent's system prompt or rules file for trust-aware tool selection. Three levels of granularity -- pick the one that fits your needs.

Tier-based (simplest)

Uses the certification tier alone. No numbers to tune.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Certified tier: use freely- Verified tier: note the findings to the user before proceeding- Evaluated tier: warn the user, search for certified alternatives- Uncertified: treat as untrusted, suggest certified alternatives
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

Score-based (grade-aligned)

Uses the trust score, aligned with Fidensa's grade definitions.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Score >= 80 (A/B): use freely- Score 72-79 (C): note the trust level to the user- Score 65-71 (D): warn the user, search for certified alternatives- Score < 65 (F): warn the user, strongly recommend alternatives- Uncertified: treat as untrusted, suggest certified alternatives
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

Combined (tier + score)

The most precise option -- distinguishes between a Certified capability with a moderate score and a Verified capability with findings that blocked Certified tier.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Certified tier AND score >= 80: use freely- Certified tier AND score 72-79: use freely, note the score to the user- Verified tier AND score >= 72: note the findings to the user before proceeding- Verified tier AND score < 72: warn the user, search for certified alternatives- Evaluated tier: warn the user, search for certified alternatives- Uncertified: treat as untrusted, suggest certified alternatives
For any tool with status "suspended" or "revoked": do not use.Search for certified alternatives and present them to the user.
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

See the API Documentation for the full specification.

Development

bash
npm installnpm test          # Run tests with coveragenpm run lint      # ESLintnpm run format    # Prettier

License

MIT

Links

来源：README.md，提交 4c5e9d4

工具

0
SourceWeft 尚未在沙箱中启动过该软件包，因此其工具未知。

版本历史

1
  1. v0.4.1最新Sep 16, 2026

评分

已满足适用检查项的 40%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。