io.github.piiiico由 GitHub 账号 piiiico 发布v1.36.0更新于 Oct 24, 2026
Supply chain risk scoring for npm, PyPI, Cargo, and Go. 9 tools. Behavioral signals.
发布方自己的服务：Proof Holdings
对 npm、PyPI、Cargo、Go 包及 GitHub 仓库进行行为型供应链风险评分，并可审计项目依赖。
Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。
把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。
阅读 https://sourceweft.com/mcp/io.github.piiiico%2Fproof-of-commitment/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。把它添加到你客户端的 mcpServers 配置中。
{
"mcpServers": {
"commit-supply-chain-risk-scoring": {
"type": "http",
"url": "https://poc-backend.amdal-dev.workers.dev/mcp"
}
}
}[Commitment Score] [npm downloads] [Mentioned in Awesome MCP Servers]
Stars lie. Behavioral signals don't.
An MCP server and web tool that scores npm packages, PyPI packages, Rust crates, Go modules, and GitHub repos on behavioral commitment — signals that are harder to fake than stars, READMEs, or download counts.
npm audit flags none of these. They're not vulnerabilities — they're attack-surface concentration. One stolen npm token, one phished maintainer, and a single push reaches the whole ecosystem (axios, March 30 2026 — happened).
26 of the 91 npm packages with >10M weekly downloads have a single npm publisher. Together they account for over 3 billion downloads per week. npm audit doesn't surface this. Stars don't either.
Four packages in a typical Node.js project are CRITICAL right now:
They won't appear in your package.json either — but these are in almost every project:
Behavioral signals surface this. Stars and READMEs don't.
No login required. Add to any MCP-compatible AI tool and start querying supply chain risk.
Claude Desktop
Open ~/Library/Application Support/Claude/claude_desktop_config.json on macOS (config file reference) or %APPDATA%\Claude\claude_desktop_config.json on Windows, then add:
Restart Claude Desktop. A tool icon appears in the chat input — ask it to audit your package.json.
Cursor
Open ~/.cursor/mcp.json (Cursor MCP docs) and add:
Smithery (once indexed)
Terminal (zero install):
--fail-on=<level> turns the CLI into a one-line CI gate. No GitHub Action required.
Levels:
Defaults: critical in CI (when CI=true is set, which every major CI runner does) and for --json output. Interactive (TTY, non-CI) keeps the v1.7 default of exit 0 — running locally won't break your shell habits.
The dedicated piiiico/commit-action@v1 is still the right choice when you want PR comments and step summaries; --fail-on is for minimal pipelines that just need a yes/no answer.
--sarif outputs SARIF 2.1.0 — the standard format for static analysis results. Upload it to GitHub Code Scanning and Commit findings appear in the Security tab alongside CodeQL and Snyk.
CRITICAL and HIGH packages show as alerts in the repo's Security tab. Compromised packages (in the Commit incident registry) get a separate alert. --fail-on still controls the exit code independently — use --fail-on=critical to also block the PR.
Web demo (no install): getcommit.dev/audit — paste your packages, see risk scores in seconds.
poc hook installs a supply chain gate for Cursor (beforeShellExecution), Claude Code (PreToolUse), and Windsurf (pre_run_command) in one command. The same hook script intercepts package installs from any agent, auto-detects which client called it, and blocks CRITICAL packages before they run.
The hook writes .cursor/hooks.json, .claude/settings.json, and .windsurf/hooks.json (project) or the equivalents under ~/ (with --global). When Cursor, Claude Code, or Windsurf runs npm install axios, pip install litellm, cargo add serde, or go get github.com/gin-gonic/gin, the hook calls the Commit API and either blocks, warns, or allows — in under 500ms.
What gets intercepted:
Why this matters: Supply chain attacks now happen in minutes. The Shai-Hulud worm (May 2026) compromised 637 packages in 39 minutes and specifically targeted AI coding assistants — planting persistence hooks in .claude/settings.json and .vscode/tasks.json. When your AI assistant installs a dependency, it bypasses the human review that used to be the last line of defense. poc hook puts a gate back in — same gate, whether Cursor, Claude Code, or Windsurf is driving.
Default behavior: CRITICAL packages (sole npm publisher + >10M downloads/week — the exact LiteLLM/axios attack profile) are blocked. HIGH packages trigger an "ask user" prompt (Cursor/Claude Code) or are blocked with a message (Windsurf). Set COMMIT_HOOK_SEVERITY_BLOCK=HIGH to block both.
With an API key: poc login sk_commit_… before running poc hook — the key is embedded in the hook config and lifts the rate limit.
The CLI tells you what's risky today. A free API key unlocks monitoring — score recomputation across the packages you depend on, with alerts when one degrades (publisher drops, release stalls, score falls ≥10 points).
Get a free API key → (no card, 30 seconds · 200 audits/day included)
Add supply chain auditing to any CI pipeline in 30 seconds — auto-detects packages from package.json or requirements.txt, posts results as a PR comment, writes to GitHub Step Summary, and optionally fails on CRITICAL packages.
Use the dedicated action at piiiico/commit-action:
When comment-on-pr: true (default), the action automatically posts the audit table as a comment on the pull request — and updates the same comment on re-run, so you don't get comment spam. Reviewers see the risk table without leaving the PR.
Inputs:
Outputs: has-critical, critical-count, audit-summary (markdown table, also written to Step Summary).
Free vs Pro: Without an API key, packages are audited one at a time (with delays to respect rate limits). With a Pro API key, all packages are audited in a single batch request — faster and with higher monthly limits.
Example PR comment / Step Summary output:
Add a Commit Trust badge to any npm package you maintain or depend on:
Examples:
Grades: 🟢 OK (75+) · 🟠 WARNING (40–74) · 🔴 CRITICAL (<40 or sole npm publisher with 10M+ weekly downloads)
Badges are cached 1 hour. No API key needed.
Also supports PyPI, Cargo, Go modules, and the full ecosystem-specific format:
No API key. No install.
Anonymous: 15 requests/IP/UTC day across both /mcp and /api/audit. Free key (no card, 30s signup at https://getcommit.dev/get-started): 200/day. Higher tiers at https://getcommit.dev/pricing.
Each package is scored 0–100 across:
Both axios (8.1/10 Scorecard) and chalk (3.6/10 Scorecard) score CRITICAL on behavioral signals. They measure different attack surfaces — Scorecard catches process gaps, behavioral signals catch publisher concentration.
Risk flags:
CRITICAL — single npm publisher + >10M weekly downloads (exact LiteLLM/axios attack profile)HIGH — package <1yr old + rapid adoptionWARN — no release in 12+ monthsThe LiteLLM attack (March 2026) and axios attack (March 30, 2026) followed the same pattern: stolen credentials → malicious package pushed → 97M+ machines exposed. Both packages flag CRITICAL by these metrics today, on the single-account condition the attackers used. The scores were computed after the attacks: a retrodiction, not a prediction.
Declarative signals (stars, README quality, CI badges) don't capture this risk. Behavioral commitment does.
Planned, not promised. The project is early-stage — contributions welcome on any of these.
See open issues for things you can help with today.
Supply chain auditing is the first tool. The underlying primitive is a commitment graph — behavioral signals that replace content-based trust across any domain.
When content is free to fake (reviews, stars, READMEs), commitment becomes the signal. A publisher who has shipped 847 releases over 12 years is a different kind of commitment than one who published once in 2023.
The same logic applies to websites, businesses, and AI agents. Two card networks have independently named this gap: Mastercard Verifiable Intent §9.2 explicitly lists behavioral trust as "not covered." Visa TAP identifies agents without answering whether to trust them.
Proof of Commitment is the trust layer they're pointing at.
Deploy:
Publish is triggered automatically when a tag v* is pushed, or manually via GitHub Actions workflow_dispatch.
Before npm publish runs, the CI workflow executes scripts/funnel-smoke.sh — a local-mock pre-publish check that exercises four key funnel paths:
Any path failure blocks the release. The gate runs a local Python mock server so it's deterministic in CI and doesn't depend on production rate-limit state.
Optional CI secret: Set COMMIT_TEST_API_KEY in GitHub repo secrets to use a real API key for Path A. Falls back to a mock key that the local server accepts unconditionally.
Run locally:
来源：README.md，提交 fc6c712
Query verified behavioral commitment data for a domain. Returns aggregated signals: unique verified visitors, repeat visit rate, and average time spent. These prove real human engagement — harder to fake than reviews or content.
domain必填Search for a Norwegian business and get its commitment profile from public data (Brønnøysund Register Centre). Returns real commitment signals: longevity, financial health, employee count, and overall commitment score (0-100). Data source: Norwegian government registers — free, verified, unfakeable.
query必填Look up a specific Norwegian business by organization number (9 digits) and get its commitment profile. Returns temporal, financial, and operational commitment signals from Brønnøysund Register Centre.
orgNumber必填Get a behavioral commitment profile for any public GitHub repository. Returns real signals that prove genuine investment: how long the project has existed, recent commit frequency, contributor community size, release cadence, and social proof. These are behavioral commitments — harder to fake than README claims or marketing copy. Useful for: vetting open-source dependencies, evaluating AI tools/frameworks, assessing vendor reliability, due diligence on any GitHub project. Examples: "vercel/next.js", "facebook/react", "https://github.com/piiiico/proof-of-commitment"
repo必填Get a behavioral commitment profile for any npm package. Returns real signals that prove genuine investment: package age, download volume and trend (growing/stable/declining), release consistency, npm publisher count, GitHub contributor count, and linked GitHub activity. Also returns publisherLifecycle — cross-referencing current maintainers against per-version publish history to flag dormant publishers who still hold npm scope access. The Mastra incident (June 2026) exploited exactly this: a contributor dormant since 2024 with never-revoked scope access. Why behavioral signals matter: download counts, stars, and READMEs can be gamed. Download *trend* consistency and publisher depth over years are harder to fake. Supply chain attacks often target packages with low publisher depth (few people with npm publish access). Useful for: vetting dependencies before installation, due diligence on open-source packages, identifying abandonware, checking if a package is actively maintained. Examples: "langchain", "@anthropic-ai/sdk", "express", "litellm"
package必填Get a behavioral commitment profile for any PyPI (Python) package. Returns real signals: package age, download volume and trend, release consistency, publisher/owner count, and linked GitHub activity. Supply chain attacks target Python packages — LiteLLM (97M downloads/mo) was compromised via stolen PyPI token in March 2026. Behavioral signals reveal what star counts hide. Useful for: vetting Python dependencies, identifying abandonware, supply chain risk due diligence. Examples: "langchain", "litellm", "openai", "anthropic", "requests", "fastapi", "pydantic"
package必填Get a behavioral commitment profile for any Rust crate on crates.io. Returns real signals: crate age, download volume (estimated weekly from 90-day totals), version count, publish cadence, owner count (users with publish access), team owners, and linked GitHub activity. Supply chain risks apply to Cargo too — crate owners with publish access are the attack surface. A single owner on a high-download crate is the same risk pattern as npm. Useful for: vetting Rust dependencies before adding to Cargo.toml, identifying abandonware, supply chain risk assessment. Examples: "serde", "tokio", "reqwest", "clap", "rand"
crate必填Get a behavioral commitment profile for any Go module on proxy.golang.org. Takes a full module path (e.g., "github.com/gin-gonic/gin", "golang.org/x/net", "k8s.io/client-go", "gopkg.in/yaml.v3") and returns real signals: module age, version count, publish cadence, GitHub contributors (the closest equivalent to "publishers" since Go has no centralized publisher concept — git push access is the publish equivalent), GitHub stars, OpenSSF Scorecard score. The Go ecosystem has no centralized download counter, so this profile is GitHub-primary — the linked source repository's activity, contributor count, and Scorecard carry more weight than for npm/PyPI/Cargo. Stars are used as the popularity proxy. Useful for: vetting Go dependencies before adding to go.mod, identifying abandonware, supply chain risk assessment. Examples: "github.com/gin-gonic/gin", "golang.org/x/crypto", "github.com/spf13/cobra", "k8s.io/api"
module必填Batch-score multiple npm, PyPI, Cargo, or Go packages for supply chain risk. Takes a list of package names and returns a risk table sorted by commitment score (lowest = highest risk first). Risk flags: - CRITICAL: single publisher + >10M weekly downloads (publish-access concentration risk) - HIGH: new package (<1yr) + high downloads (unproven, rapid adoption = supply chain risk) - WARN: no release in 12+ months (potential abandonware) - WARN: dormant publishers with current scope access — contributors who stopped publishing but retain npm tokens (Mastra-incident vector, June 2026) Perfect for auditing a full package.json, requirements.txt, Cargo.toml, or go.mod — paste your dependency list and get a prioritized risk report. For Go: pass full module paths (e.g., "github.com/gin-gonic/gin", "golang.org/x/net") and set ecosystem="golang". The "maintainers" column shows GitHub contributor count since Go has no centralized publisher concept. Examples: score all deps in a project, compare two similar packages, identify abandonware before it becomes a CVE.
packages必填ecosystemAudit the supply chain risk of a GitHub repository's dependencies. Fetches the repo's package.json and/or requirements.txt from GitHub and runs behavioral commitment scoring on every dependency. This is the fastest way to audit a project — just provide the GitHub URL or owner/repo slug, and get a full risk table in seconds. Risk flags: - CRITICAL: single publisher/maintainer/owner + >10M weekly downloads (publish-access concentration risk) - HIGH: sole publisher/maintainer + >1M/wk downloads, OR new package (<1yr) with high adoption - WARN: no release in 12+ months (potential abandonware) Examples: - "vercel/next.js" — audit Next.js dependencies - "https://github.com/langchain-ai/langchainjs" — audit LangChain JS - "facebook/react" — audit React's dependency tree - "anthropics/anthropic-sdk-python" — audit Anthropic Python SDK Use this when someone asks "is my project at risk?" or "audit this repo's dependencies".
repo必填Map the full dependency tree of an npm package and identify CRITICAL supply chain risks at every level. Unlike auditing a flat list of packages, this tool traverses the dependency graph — showing not just your direct dependencies but also what your dependencies depend on. Hidden CRITICAL packages (sole publisher + >10M weekly downloads) often lurk 1-2 levels deep. Risk flags: - CRITICAL: single npm publisher + >10M weekly downloads — sole point of failure for a massive attack surface - HIGH: sole publisher + >1M/wk, OR new package (<1yr) with high adoption - WARN: no release in 12+ months (potential abandonware) depth=1 (default): root package + all direct dependencies depth=2: also traverses one more level for any CRITICAL/HIGH direct deps (reveals hidden exposure) Examples: - audit_dependency_tree("express") — see all of Express's deps and their risk scores - audit_dependency_tree("langchain", 2) — reveal transitive CRITICAL deps 2 levels deep - audit_dependency_tree("@anthropic-ai/sdk") — audit Anthropic SDK full tree Use this when someone asks: - "What am I really depending on?" - "Are my dependencies' dependencies safe?" - "Show me the full supply chain risk for package X"
depthpackage必填Create a free Commit API key instantly — no browser required. When you've hit the daily free query limit (or just want faster access), call this tool with your email to get an API key returned directly in the chat. The key lifts the rate limit to 200 audits/day and enables package monitoring (weekly alerts when your dependencies get riskier). After creating the key, configure your MCP client to pass it: Authorization: Bearer sk_commit_<your-key> Example: get_api_key({ email: "[email protected]" }) One key per email. 3 keys per IP per day (anti-abuse).
email必填已满足适用检查项的 100%
该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。
holdings.proof官方发布者
Proof Holdings MCP 服务器让助手发起并管理身份与控制权验证（手机、邮箱、域名、钱包），管理证明令牌与委托，并进行校验。
由 GitHub 账号 kivtxs 发布
让助手阅读 Proof of Work 的规则、检查本机是否已有账户，并创建代理账户以发布、投票和支持带证据的主张。
由 GitHub 账号 frankjie3-create 发布
QuietProof 提供免费发现工具，用于浏览一组确定性、只读的审计服务，这些审计按次以 Base 上的 USDC 通过 x402 付费。
com.scriptmasterlabs
远程 MCP 端点，用于在 XRPL 上以 RLUSD 创建、验证和评分发票，并对结算进行自证。
由 GitHub 账号 ZKStamp 发布
远程 MCP 服务器，把 SHA-256 指纹以屏蔽交易写入 BitcoinZ 区块链，生成带日期的存在性证明时间戳。
$ npx proof-of-commitment axios zod chalk lodash minimatchScoring 5 npm packages... done in 3.0s
Package Risk Score Publishers Downloads Age Provenancechalk 🔴 CRITICAL 72 1 432.9M/wk 14.6y —minimatch 🔴 CRITICAL 78 1 634.1M/wk 14.9y —lodash 🔴 CRITICAL 80 1 158.9M/wk 14.1y —zod 🔴 CRITICAL 83 1 161.2M/wk 6.3y 🔐 verifiedaxios 🔴 CRITICAL 88 1 115.7M/wk 11.8y 🔐 verified ⚠ COMPROMISED — axios token theft (2026-03-30)
⚠ 5 CRITICAL packages found. CRITICAL = sole npm publisher + >10M weekly downloads (publish-access concentration risk){ "mcpServers": { "commit": { "type": "streamable-http", "url": "https://poc-backend.amdal-dev.workers.dev/mcp" } }}{ "mcpServers": { "commit": { "type": "streamable-http", "url": "https://poc-backend.amdal-dev.workers.dev/mcp" } }}npx -y @smithery/cli install proof-of-commitment --client claude# New in v1.8.0: zero-arg auto-detect — cd into any project, run once:npx proof-of-commitment# Picks the highest-coverage manifest in cwd (package-lock.json > yarn.lock ># pnpm-lock.yaml > pnpm-workspace.yaml > package.json; requirements.txt;# Cargo.toml; go.sum > go.mod). When multiple ecosystems are present, the# file with the most recent mtime wins.
# Explicit package list still works:npx proof-of-commitment axios zod chalk
# Or point at a specific file:npx proof-of-commitment --file package.jsonnpx proof-of-commitment --file package-lock.json # npm (transitive)npx proof-of-commitment --file yarn.lock # yarnnpx proof-of-commitment --file pnpm-lock.yaml # pnpmnpx proof-of-commitment --file pnpm-workspace.yaml # pnpm monoreponpx proof-of-commitment --pypi litellm langchain requestsnpx proof-of-commitment --cargo serde tokio reqwestnpx proof-of-commitment --golang github.com/gin-gonic/gin golang.org/x/netnpx proof-of-commitment --file go.modnpx proof-of-commitment --file go.sum # full transitive Go set
# JSON output for downstream tools:npx proof-of-commitment --file package-lock.json --json | jq '.criticalCount'# .github/workflows/supply-chain.ymlname: Supply Chainon: [pull_request]jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: '20' } - run: npx -y proof-of-commitment --fail-on=critical# .github/workflows/supply-chain.ymlname: Supply Chainon: [pull_request]jobs: audit: runs-on: ubuntu-latest permissions: security-events: write steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: '20' } - run: npx -y proof-of-commitment --file package-lock.json --sarif --fail-on=none > results.sarif - uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: results.sarif category: commit-supply-chain# Install for the current project (writes .cursor/hooks.json + .claude/settings.json + .windsurf/hooks.json):poc hook
# Or protect every project for your user:poc hook --global
# Narrow to one client:poc hook --cursor # only .cursor/hooks.jsonpoc hook --claude-code # only .claude/settings.jsonpoc hook --windsurf # only .windsurf/hooks.json
# Remove (cleans all three):poc hook --uninstallnpm install -g proof-of-commitment # then:poc watch axios --email [email protected] # free key + monitoring in one steppoc watch chalk # add more packages (3 free)poc init # add CI gate to this repo# .github/workflows/supply-chain.ymlname: Supply Chain Auditon: pull_request: paths: ['package.json', 'package-lock.json', 'bun.lock']
jobs: audit: runs-on: ubuntu-latest permissions: pull-requests: write steps: - uses: actions/checkout@v4 - uses: piiiico/commit-action@v1 with: fail-on-critical: true # blocks merges on CRITICAL packages comment-on-pr: true # posts results as a PR comment| Package | Risk | Score | Publishers | Downloads/wk | Age ||---------|-------------|-------|------------|--------------|-------|| chalk | 🔴 CRITICAL | 75 | 1 | 380M | 12.7y || zod | 🔴 CRITICAL | 83 | 1 | 133M | 6.1y || axios | 🔴 CRITICAL | 89 | 1 | 93M | 11.6y |curl https://poc-backend.amdal-dev.workers.dev/api/audit \ -X POST \ -H "Content-Type: application/json" \ -d '{"packages": ["axios", "zod", "chalk", "lodash", "express"]}'{ "count": 5, "results": [ { "name": "chalk", "ecosystem": "npm", "score": 75, "maintainers": 1, "weeklyDownloads": 398397580, "ageYears": 12.7, "trend": "stable", "riskFlags": ["CRITICAL"], "scorecardScore": 3.6, // null if no GitHub repo "hasDangerousWorkflow": false // null if no Scorecard data }, ... ]}# packages you know about:chalk — score 75, 1 publisher, 432M/week ⚑ CRITICALzod — score 83, 1 publisher, 185M/week ⚑ CRITICAL (30+ GitHub contributors)lodash — score 81, 1 publisher, 156M/week ⚑ CRITICALaxios — score 88, 1 publisher, 113M/week ⚑ CRITICAL (attacked Mar 30 2026)express — score 90, 5 publishers, 95M/week
# packages probably not in your package.json, definitely in your lock file:minimatch — score 78, 1 publisher, 625M/week ⚑ CRITICALglob — score 80, 1 publisher, 366M/week ⚑ CRITICALcross-spawn — score 72, 1 publisher, 215M/week ⚑ CRITICAL
# post-attack:litellm — score 74, 1 publisher ⚑ CRITICAL (supply chain attack Mar 2026)
# Rust crates (new in v1.3.0):serde — score 78, 1 owner, 13M/week ⚑ CRITICAL (dtolnay sole owner)tokio — score 89, 2 owners, 10M/weekreqwest — score 85, 1 owner, 8M/week ⚑ HIGHbun installbun run dev:backend # local server with SQLitebun run test:e2e # E2E test with mock World IDbun run deploy # deploys to Cloudflare Workersbash scripts/funnel-smoke.sh