CRED-1

CRED-1: Open Domain Credibility Dataset

[CRED-1 Domain Credibility Dataset Banner]

[DOI] [CI] [npm version] [npm downloads] [Glama MCP server]

CRED-1 is an open, reproducible domain-level credibility dataset combining multiple openly-licensed source lists with computed enrichment signals. It provides credibility scores for 2,600+ domains (exact count in the latest release) known to publish mis/disinformation, conspiracy theories, or other unreliable content. Community members can report missing domains for inclusion.

🎓 Presented at ACM WebSci 2026 (Braunschweig). Landing page: aloth.github.io/agentic-ai-information-integrity/cred-1.

🤖 MCP-ready: query domain credibility directly from Claude Desktop, Cursor & Windsurf, or any MCP-compatible agent. Jump to setup ↓

Paper: A. Loth, M. Kappes, and M.-O. Pahl, "CRED-1: An Open Multi-Signal Domain Credibility Dataset for Automated Pre-Bunking of Online Misinformation," Preprint, 2026. doi:10.2139/ssrn.6448466

Install

# CLI (global)npm install -g @aloth/cred1
# Library (project dependency)npm install @aloth/cred1
# Or try without installingnpx @aloth/cred1 check infowars.com
# Python library, dataset included (pandas optional)pip install cred1pip install "cred1[pandas]"

import cred1cred1.check("https://www.infowars.com/article")   # dict, or None if not listeddf = cred1.to_dataframe()                           # whole dataset as a DataFrame

CLI Usage

# Single domain lookupcred1 check infowars.com# 🔴  infowars.com#    Score:    0.073 / 1.000#    Category: conspiracy#    Level:    low#    Sources:  2
# Domain not in datasetcred1 check nytimes.com# ⚪  nytimes.com#    Not found in CRED-1 dataset: treat as unknown/neutral
# Batch processing (stdin)echo -e "rt.com\ninfowars.com\nnytimes.com" | cred1 batch
# JSON outputcred1 check breitbart.com --json
# Searchcred1 search "news"cred1 search "\.ru$"
# Statisticscred1 statscred1 categories

In scripts, cred1 check <domain> --exit-code exits 0 when the domain is listed, 1 when it is not and 2 on a usage error. Color follows NO_COLOR and --no-color, and is off when the output is not a terminal. Requires Node 20 or newer.

Domain normalization is automatic: https://www.infowars.com/politics/ resolves to infowars.com.

MCP Server (Claude Desktop / Cursor / Windsurf)

CRED-1 ships an MCP server so AI assistants can check domain credibility directly.

Tools exposed

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{  "mcpServers": {    "cred1": {      "command": "npx",      "args": ["-y", "@aloth/cred1", "--mcp"]    }  }}

Note: --mcp is handled by the CLI wrapper, or run the dedicated binary directly.

Alternatively, if the package is installed globally:

{  "mcpServers": {    "cred1": {      "command": "cred1-mcp"    }  }}

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{  "mcpServers": {    "cred1": {      "command": "npx",      "args": ["-y", "@aloth/cred1", "--mcp"]    }  }}

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{  "mcpServers": {    "cred1": {      "command": "npx",      "args": ["-y", "@aloth/cred1", "--mcp"]    }  }}

OpenClaw / any MCP-compatible host

{  "command": "cred1-mcp",  "transport": "stdio"}

Pinning a version

With npx -y @aloth/cred1, npx checks npm for a newer version each time the host starts the server and installs it, and a new version is published every week. A host restart can therefore run a release you have not reviewed. To decide when to update, pin the version in the config:

{  "mcpServers": {    "cred1": {      "command": "npx",      "args": ["-y", "@aloth/[email protected]", "--mcp"]    }  }}

Or install a fixed version globally and point the host at the cred1-mcp binary as shown above:

npm install -g @aloth/[email protected]

Replace 2026.10.27 with the version you reviewed; npm view @aloth/cred1 version prints the latest one.

Most weekly releases only refresh the bundled dataset (data/cred1_compact.json), but every release is built from the current main branch, so code changes ship the same way. To see what changed between two versions, compare their tags, for example v2026-10-20...v2026-10-27. The server reads the dataset from the installed package and makes no network requests. Since 2026.6.14, releases are published from GitHub Actions with npm provenance, which npm audit signatures verifies.

Library Usage

import { checkDomain, searchDomains, getStats } from '@aloth/cred1';
// Single lookupconst result = checkDomain('infowars.com');// { domain: 'infowars.com', score: 0.073, category: 'conspiracy', level: 'low', sources: 2, domainAge: 27.3, trancoRank: 15889 }
// Not found → nullconst unknown = checkDomain('nytimes.com'); // null
// Search by pattern (substring or regex)const russian = searchDomains('\\.ru$');
// Dataset statisticsconst stats = getStats();// e.g. { totalDomains: 2672, categories: { unreliable: 2001, fake: 233, ... }, version: '2026.11.3' }

Traffic-Light Scoring

Key Features

• 2,600+ domains with credibility scores (0.0–1.0)
• Dual-mode: works as CLI tool and JavaScript library
• Fully reproducible: Python pipeline rebuilds the dataset from scratch
• Multi-signal scoring combining source labels, domain age, web popularity, fact-check frequency, and threat intelligence
• Privacy-preserving: designed for on-device client-side deployment (no server calls needed)
• Two openly-licensed sources: no proprietary data dependencies
• Domain normalization: handles www., protocols, paths automatically

Dataset Schema

Compact Format (cred1_compact.json)

{  "infowars.com": { "c": "c", "s": 0.073, "n": 2, "d": "1999-10-04", "r": 15889 }}

Full Format (cred1_current.json)

{  "infowars.com": {    "category": "fake",    "credibility_score": 0.14,    "domain_age_years": 26.4,    "domain_registered": "1999-10-04T04:00:00Z",    "iffy_factual": "VL",    "iffy_bias": "FN",    "iffy_score": 0.1,    "factcheck_claims": 52,    "safe_browsing_flagged": false,    "score_age": 0.2,    "score_cat": 0.05,    "score_factcheck": 0.0,    "score_iffy": 0.1,    "score_safebrowsing": 0.05,    "score_tranco": 0.1,    "sources": 2,    "tranco_rank": 4382  }}

See CODEBOOK.md for full field documentation.

What the score is, and what it is not

The credibility score is a domain-level signal, not an item-level verdict. It says how a source has been rated by public source-rating initiatives; it does not say whether any individual article is true. Research that uses it as a veracity label is therefore working with a provenance-implied rather than item-verified signal: material drawn from domains scoring below 0.25 can be labelled low-credibility, material from established outlets legitimate, but no single item has been fact-checked. Outlet reputation is a good but imperfect proxy, and that bound should be carried into any reuse.

Rebuilding the Dataset

cd pipeline/python3 build_dataset.py              # Full pipelinepython3 build_dataset.py --step fetch # Download raw data onlypython3 build_dataset.py --step merge # Parse + merge (requires prior fetch)python3 enrich_dataset.py             # Add enrichment signals (API keys required)

Versioning

CRED-1 uses calendar versioning (CalVer) across all distribution channels:

A new version is released weekly with rescored domains. The npm package updates automatically with each GitHub release, no separate version scheme needed.

To pin a specific dataset version:

npm install @aloth/[email protected]

Production Integrations

• Trackless Links: Safari extension for iOS and macOS that checks links locally against CRED-1 (reviewed in Mac & i 4/2026)
• RogueGPT: uses CRED-1 to identify low-credibility source domains for controlled fake-news stimulus generation
• HuggingFace: dataset mirror for ML pipelines

Contributing

Know a domain that should be in the dataset? Report a missing domain with evidence.

We accept community-reported domains that meet at least one of these criteria:

• Listed by Media Bias/Fact Check (MBFC)
• Flagged by an IFCN-certified fact-checker
• Subject to press council or regulatory action
• Documented in Wikipedia with credibility concerns
• Referenced in published academic research

Accepted domains are added to the pipeline and appear in the next weekly dataset release.

Citation

If you use CRED-1 in your work, please cite both the paper and the dataset version you used. The paper describes the method; the Zenodo record pins the exact data, which is what makes your results reproducible.

Paper:

@misc{loth2026cred1,  author       = {Loth, Alexander and Kappes, Martin and Pahl, Marc-Oliver},  title        = {{CRED-1}: An Open Multi-Signal Domain Credibility Dataset for Automated Pre-Bunking of Online Misinformation},  year         = {2026},  howpublished = {Preprint},  doi          = {10.2139/ssrn.6448466},  url          = {https://ssrn.com/abstract=6448466},  urldate      = {2026-08-25}}

Dataset:

@dataset{loth2026cred1data,  author       = {Loth, Alexander},  title        = {{CRED-1}: An Open Multi-Signal Domain Credibility Dataset},  year         = {2026},  publisher    = {Zenodo},  version      = {v2026-03-17},  doi          = {10.5281/zenodo.18769459},  url          = {https://doi.org/10.5281/zenodo.18769459}}

The DOI above always resolves to the latest release. To cite a specific weekly snapshot, use the version DOI shown on that release's Zenodo page.

Related Projects

CRED-1 is one strand of a wider research program on generated disinformation. The domain scores are used to select low-credibility sources for stimulus generation in RogueGPT:

Companion data deposits

CRED-1 is archived alongside three companion datasets, which are versioned together so that they can be cited as one coherent set:

Related Publications

• Interrupting the Chain: Human Perception of AI-Generated Disinformation Through a Kill Chain Lens (INFORMATIK 2026, LNI). Positions domain-level credibility as a Delivery-stage signal. arXiv:2608.21389
• Blessing or Curse? A Survey on the Impact of Generative AI on Fake News (2024). arXiv:2404.03021

License

• Dataset: CC BY 4.0. Copyright 2025-2026 Alexander Loth.
• Code & CLI: MIT

The dataset is everything in data/ and the releases built from it, including the copies on Zenodo and Hugging Face; LICENSE holds the CC BY 4.0 text. The code is src/, pipeline/ and examples/; LICENSE-MIT holds the MIT text. The npm package @aloth/cred1 ships both, so its license field reads MIT AND CC-BY-4.0.

The dataset is an aggregation of domain-level ratings from public source-rating initiatives. The aggregation, scoring and documentation are this project's own work and are released under CC BY 4.0; the underlying ratings remain attributable to their respective initiatives, which are named per record and listed in ATTRIBUTION.md. No access restriction applies to the dataset.

Author

Alexander Loth · alexloth.com · @xlth · ORCID