Fidensa

com.fidensa由 fidensa.com 發布v0.4.1更新於 Oct 27, 2026

Independent AI certification authority. Trust scores, search, comparison, and verification.

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

Fidensa MCP 伺服器讓助理查詢 AI 認證資料：信任評分、已認證替代方案、能力比較與簽章產物驗證。

可以做什麼
  • 查詢某項能力的認證狀態、評分、等級與層級
  • 依關鍵字、類型、層級或評分搜尋已認證能力
  • 對能力檔案做雜湊比對，確認是否與 Fidensa 認證內容一致
  • 並排比較 2 至 5 項能力，並取得含完整證據的認證合約
  • 驗證 .cert.json 產物的加密簽章，可選擇加做檔案與程式碼完整性檢查
  • 提交已認證能力的執行期體驗回報（成功、失敗、部分成功）
適用情境
適合在代理挑選第三方 MCP 伺服器、技能、外掛或規則檔時，安裝前先做信任查核；也適合比較已認證的替代方案，並記錄某項工具的實際使用表現。
執行需求
以 stdio 方式在本機執行，通常透過 npm 套件以 npx 啟動，需要 Node.js。查詢、搜尋、檔案驗證與體驗回報不需任何設定。合約、比較與產物驗證工具需要免費的 FIDENSA_API_KEY，須以電子郵件註冊取得。可選 FIDENSA_BASE_URL 覆寫 API 位址。需要能連線至 Fidensa 的 API。
安裝前請注意
API 金鑰只顯示一次，應妥善保存，並透過 FIDENSA_API_KEY 環境變數傳入。註冊金鑰會把顯示名稱與電子郵件傳送給 Fidensa。提交回報與查詢會把能力識別碼與內容雜湊傳送到 Fidensa 服務。此伺服器只讀取認證資料並提交回報，不會安裝或執行它所評比的工具。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Fidensa，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

@fidensa/mcp-server

[Fidensa Certified]

MCP server for Fidensa -- the independent AI capability certification authority.

Gives your AI agent structured access to Fidensa certification data through the Model Context Protocol. Check trust scores, search for certified alternatives, compare capabilities side-by-side, verify signed artifacts, check file integrity, and report runtime experience -- all through MCP tool calls.

Fidensa certifies MCP servers, skills, agent rules files, hooks, sub-agents, and plugins.

Getting Started

1. Install

bash
npm install -g @fidensa/mcp-server

2. Verify it works

Several tools work without an API key (check_certification, search_capabilities, verify_file, and report_experience). Start the server and confirm it connects to the production API:

bash
fidensa-mcp-server

You should see:

[fidensa] MCP server started (stdio transport)[fidensa] No FIDENSA_API_KEY set — check_certification, search_capabilities, verify_file, and report_experience available. Set FIDENSA_API_KEY for full access.

Press Ctrl+C to stop.

3. Get an API key (optional, free)

The remaining tools (get_contract, compare_capabilities, verify_artifact) require a free API key. An API key also gives report_experience higher rate limits. Register one:

bash
curl -X POST https://fidensa.com/v1/keys \  -H "Content-Type: application/json" \  -d '{"display_name": "My Agent", "email": "[email protected]"}'

Or in PowerShell:

powershell
Invoke-RestMethod -Uri "https://fidensa.com/v1/keys" -Method Post -ContentType "application/json" -Body '{"display_name": "My Agent", "email": "[email protected]"}'

The response contains your API key (prefixed fid_). Store it securely -- it is shown only once.

4. Add to your agent

Pick your platform and add the MCP server configuration:

Claude Desktop / Claude Code

json
{  "mcpServers": {    "fidensa": {      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Cursor (.cursor/mcp.json)

json
{  "mcpServers": {    "fidensa": {      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Windsurf / VS Code

json
{  "servers": {    "fidensa": {      "type": "stdio",      "command": "npx",      "args": ["@fidensa/mcp-server"],      "env": {        "FIDENSA_API_KEY": "fid_your_key_here"      }    }  }}

Omit the FIDENSA_API_KEY line if you only need the open-tier tools.

Claude Desktop tip: Access the config file via Settings → Developer → Edit Config. After saving, fully quit and reopen Claude Desktop (right-click the system tray icon and select Quit — just closing the window isn't enough).

Tools

ToolAuthDescription
check_certificationNoneQuick trust check -- status, score, grade, tier
search_capabilitiesNoneSearch for certified capabilities by keyword, type, tier, or score
verify_fileNoneQuick file integrity check -- hash a capability file and verify it matches what Fidensa certified
report_experienceNone (API key for higher rate limits)Submit runtime experience reports for certified capabilities
get_contractAPI keyFull certification contract with all evidence
compare_capabilitiesAPI keySide-by-side comparison of 2-5 capabilities
verify_artifactAPI keyVerify cryptographic signatures on .cert.json artifacts, with optional file and code integrity checks

Configuration

VariableRequiredDescription
FIDENSA_API_KEYNoAPI key for full access (see Getting Started)
FIDENSA_BASE_URLNoOverride API base URL (default: https://fidensa.com)

check_certification, search_capabilities, verify_file, and report_experience work without any configuration. The remaining tools require FIDENSA_API_KEY.

Example Agent Workflow

User: "Set up a filesystem watcher that writes logs to SQLite."
Agent:1. check_certification("mcp-server-filesystem")   -> Status: valid, Score: 60/F-D, Tier: Verified
2. search_capabilities("sqlite mcp server")   -> 2 results found
3. compare_capabilities(["mcp-server-sqlite", "mcp-server-better-sqlite3"])   -> Side-by-side trust comparison
4. Agent selects the higher-scored option and informs the user
5. report_experience(     capability_id: "mcp-server-filesystem",     content_hash: "abc123...",  // from the .cert.json     outcome: "success"   )   -> Confirmation rate updated

Trust Policy Fragments

Add one of these to your agent's system prompt or rules file for trust-aware tool selection. Three levels of granularity -- pick the one that fits your needs.

Tier-based (simplest)

Uses the certification tier alone. No numbers to tune.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Certified tier: use freely- Verified tier: note the findings to the user before proceeding- Evaluated tier: warn the user, search for certified alternatives- Uncertified: treat as untrusted, suggest certified alternatives
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

Score-based (grade-aligned)

Uses the trust score, aligned with Fidensa's grade definitions.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Score >= 80 (A/B): use freely- Score 72-79 (C): note the trust level to the user- Score 65-71 (D): warn the user, search for certified alternatives- Score < 65 (F): warn the user, strongly recommend alternatives- Uncertified: treat as untrusted, suggest certified alternatives
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

Combined (tier + score)

The most precise option -- distinguishes between a Certified capability with a moderate score and a Verified capability with findings that blocked Certified tier.

Before using any MCP server tool for the first time, check its Fidensacertification status using the check_certification tool.
- Certified tier AND score >= 80: use freely- Certified tier AND score 72-79: use freely, note the score to the user- Verified tier AND score >= 72: note the findings to the user before proceeding- Verified tier AND score < 72: warn the user, search for certified alternatives- Evaluated tier: warn the user, search for certified alternatives- Uncertified: treat as untrusted, suggest certified alternatives
For any tool with status "suspended" or "revoked": do not use.Search for certified alternatives and present them to the user.
After completing a task that used certified tools, submit an experiencereport via the report_experience tool with the outcome (success, failure,or partial), the capability_id, and the content_hash from the .cert.json.

See the API Documentation for the full specification.

Development

bash
npm installnpm test          # Run tests with coveragenpm run lint      # ESLintnpm run format    # Prettier

License

MIT

Links

來源：README.md，提交 4c5e9d4

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.4.1最新Sep 16, 2026

評分

已滿足適用檢查項的 40%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分

    請在儲存庫或註冊中心條目中宣告授權條款。